Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Message.eml

Overview

General Information

Sample name:Message.eml
Analysis ID:1591080
MD5:d8c2b3b7019bdf03a6c217ca0ff3b590
SHA1:54f3788d494b70612fd1200f5d5c04bcf375baa7
SHA256:cecdb8beb225d584ee97826cf9b10a8cb4ec1ad5852f8482858d25deab8521e1
Infos:

Detection

HTMLPhisher
Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected BlockedWebSite
AI detected suspicious Javascript
HTML page contains hidden javascript code
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6344 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Message.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6544 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "E7664668-7A47-4471-93C2-574664F9A341" "9752B0B2-E327-40AF-9841-F5F9768C9AB2" "6344" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 2860 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fazbex.acemlna.com%2Flt.php%3Fx%3D3DZy~GDMJnDL65OuzQ5NhOKh1aIji_f3wuY3X5M7JXWZE5z~yUy.0OFz13FziNfujfYxbHHFKXSa&data=05%7C02%7Cbhuey%40carollo.com%7Ca80c66979fc242bd1d2608dd349328b9%7Cf50354a04a5a4fa1b18f8d1efb41b024%7C0%7C0%7C638724528856822158%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=A9KZ4SEWrgSCTOmUbkM40BenkS%2FCpr99TYThOPEp6SI%3D&reserved=0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
      • chrome.exe (PID: 3932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1960,i,15324891518452662747,4272222388325707937,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • cleanup

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
dropped/chromecache_141JoeSecurity_BlockedWebSiteYara detected BlockedWebSiteJoe Security

    HTML

    SourceRuleDescriptionAuthorStrings
    0.0.pages.csvJoeSecurity_BlockedWebSiteYara detected BlockedWebSiteJoe Security

      Sigma Signatures

      Sigma detected: Office Autorun Keys Modification
      Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6344, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

      Suricata Signatures

      ⊘No Suricata rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      Phishing

      barindex
      Yara detected BlockedWebSite
      Source: Yara matchFile source: 0.0.pages.csv, type: HTML
      Source: Yara matchFile source: dropped/chromecache_141, type: DROPPED
      AI detected suspicious Javascript
      Source: 1.1.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://carollo.com/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as implementing a security challenge, the overall behavior is highly suspicious and indicative of a potential attack vector.
      Source: https://carollo.com/HTTP Parser: Base64 decoded: {"alg":"HS256","typ":"JWT"}
      Source: https://carollo.com/HTTP Parser: No favicon
      Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49718 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49739 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.17:49744 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49745 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 2.23.227.215:443 -> 192.168.2.17:49748 version: TLS 1.2
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
      Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.76
      Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.76
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
      Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.76
      Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.76
      Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.76
      Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.76
      Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.76
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: global trafficDNS traffic detected: DNS query: nam10.safelinks.protection.outlook.com
      Source: global trafficDNS traffic detected: DNS query: carollo.com
      Source: global trafficDNS traffic detected: DNS query: www.google.com
      Source: global trafficDNS traffic detected: DNS query: www.carollo.com
      Source: global trafficDNS traffic detected: DNS query: code.jquery.com
      Source: global trafficDNS traffic detected: DNS query: player.vimeo.com
      Source: global trafficDNS traffic detected: DNS query: static.cloudflareinsights.com
      Source: global trafficDNS traffic detected: DNS query: fresnel.vimeocdn.com
      Source: global trafficDNS traffic detected: DNS query: i.vimeocdn.com
      Source: global trafficDNS traffic detected: DNS query: f.vimeocdn.com
      Source: global trafficDNS traffic detected: DNS query: player-telemetry.vimeo.com
      Source: global trafficDNS traffic detected: DNS query: vimeo.com
      Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
      Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
      Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
      Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
      Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
      Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
      Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
      Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
      Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
      Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
      Source: unknownNetwork traffic detected: HTTP traffic on port 49680 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
      Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
      Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
      Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
      Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
      Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
      Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
      Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
      Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
      Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
      Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
      Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
      Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49693 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
      Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
      Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
      Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
      Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49696
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49693
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49691
      Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
      Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
      Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
      Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
      Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49691 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
      Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
      Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49696 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
      Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
      Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
      Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
      Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49718 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49739 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.17:49744 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49745 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 2.23.227.215:443 -> 192.168.2.17:49748 version: TLS 1.2
      Source: classification engineClassification label: mal52.phis.winEML@19/41@36/159
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250114T1116130691-6344.etl
      Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Message.eml"
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "E7664668-7A47-4471-93C2-574664F9A341" "9752B0B2-E327-40AF-9841-F5F9768C9AB2" "6344" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fazbex.acemlna.com%2Flt.php%3Fx%3D3DZy~GDMJnDL65OuzQ5NhOKh1aIji_f3wuY3X5M7JXWZE5z~yUy.0OFz13FziNfujfYxbHHFKXSa&data=05%7C02%7Cbhuey%40carollo.com%7Ca80c66979fc242bd1d2608dd349328b9%7Cf50354a04a5a4fa1b18f8d1efb41b024%7C0%7C0%7C638724528856822158%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=A9KZ4SEWrgSCTOmUbkM40BenkS%2FCpr99TYThOPEp6SI%3D&reserved=0
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1960,i,15324891518452662747,4272222388325707937,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "E7664668-7A47-4471-93C2-574664F9A341" "9752B0B2-E327-40AF-9841-F5F9768C9AB2" "6344" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fazbex.acemlna.com%2Flt.php%3Fx%3D3DZy~GDMJnDL65OuzQ5NhOKh1aIji_f3wuY3X5M7JXWZE5z~yUy.0OFz13FziNfujfYxbHHFKXSa&data=05%7C02%7Cbhuey%40carollo.com%7Ca80c66979fc242bd1d2608dd349328b9%7Cf50354a04a5a4fa1b18f8d1efb41b024%7C0%7C0%7C638724528856822158%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=A9KZ4SEWrgSCTOmUbkM40BenkS%2FCpr99TYThOPEp6SI%3D&reserved=0
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1960,i,15324891518452662747,4272222388325707937,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
      Browser Extensions      		1
      Process Injection      		1
      Masquerading      		OS Credential Dumping1
      Process Discovery      		Remote ServicesData from Local System2
      Encrypted Channel      		Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/Job1
      DLL Side-Loading      		1
      DLL Side-Loading      		1
      Process Injection      		LSASS Memory13
      System Information Discovery      		Remote Desktop ProtocolData from Removable Media1
      Non-Application Layer Protocol      		Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAt1
      Registry Run Keys / Startup Folder      		1
      Registry Run Keys / Startup Folder      		1
      DLL Side-Loading      		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
      Application Layer Protocol      		Automated ExfiltrationData Encrypted for Impact

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      ⊘No Antivirus matches

      Dropped Files

      ⊘No Antivirus matches

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      vimeo.map.fastly.net
      		151.101.64.217
      		truefalse
        		high
        player-telemetry.vimeo.com
        		34.120.202.204
        		truefalse
          		high
          static.cloudflareinsights.com
          		104.16.80.73
          		truefalse
            		high
            code.jquery.com
            		151.101.2.137
            		truefalse
              		high
              fresnel.vimeocdn.com
              		34.120.202.204
              		truefalse
                		high
                nam10.safelinks.eop-tm2.outlook.com
                		104.47.55.28
                		truefalse
                  		unknown
                  carollo.com
                  		172.66.42.241
                  		truetrue
                    		unknown
                    www.google.com
                    		142.250.185.228
                    		truefalse
                      		high
                      www.carollo.com
                      		172.66.42.241
                      		truefalse
                        		unknown
                        vimeo.com
                        		162.159.138.60
                        		truefalse
                          		high
                          nam10.safelinks.protection.outlook.com
                          		unknown
                          		unknownfalse
                            		unknown
                            f.vimeocdn.com
                            		unknown
                            		unknownfalse
                              		high
                              player.vimeo.com
                              		unknown
                              		unknownfalse
                                		high
                                i.vimeocdn.com
                                		unknown
                                		unknownfalse
                                  		high

                                  Contacted URLs

                                  NameMaliciousAntivirus DetectionReputation
                                  https://carollo.com/true
                                    		unknown
                                    https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fazbex.acemlna.com%2Flt.php%3Fx%3D3DZy~GDMJnDL65OuzQ5NhOKh1aIji_f3wuY3X5M7JXWZE5z~yUy.0OFz13FziNfujfYxbHHFKXSa&data=05%7C02%7Cbhuey%40carollo.com%7Ca80c66979fc242bd1d2608dd349328b9%7Cf50354a04a5a4fa1b18f8d1efb41b024%7C0%7C0%7C638724528856822158%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=A9KZ4SEWrgSCTOmUbkM40BenkS%2FCpr99TYThOPEp6SI%3D&reserved=0false
                                      		unknown

                                      World Map of Contacted IPs

                                      • No. of IPs < 25%
                                      • 25% < No. of IPs < 50%
                                      • 50% < No. of IPs < 75%
                                      • 75% < No. of IPs

                                      Public IPs

                                      IPDomainCountryFlagASNASN NameMalicious
                                      142.250.185.228
                                      		www.google.comUnited States
                                      		15169GOOGLEUSfalse
                                      151.101.64.217
                                      		vimeo.map.fastly.netUnited States
                                      		54113FASTLYUSfalse
                                      104.47.55.28
                                      		nam10.safelinks.eop-tm2.outlook.comUnited States
                                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                      52.182.141.63
                                      		unknownUnited States
                                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                      151.101.0.217
                                      		unknownUnited States
                                      		54113FASTLYUSfalse
                                      142.250.185.227
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      162.159.138.60
                                      		vimeo.comUnited States
                                      		13335CLOUDFLARENETUSfalse
                                      104.47.58.28
                                      		unknownUnited States
                                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                      104.16.80.73
                                      		static.cloudflareinsights.comUnited States
                                      		13335CLOUDFLARENETUSfalse
                                      216.58.206.35
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      142.250.184.227
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      172.217.18.10
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      52.113.194.132
                                      		unknownUnited States
                                      		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                      172.66.41.15
                                      		unknownUnited States
                                      		13335CLOUDFLARENETUSfalse
                                      142.250.184.195
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      1.1.1.1
                                      		unknownAustralia
                                      		13335CLOUDFLARENETUSfalse
                                      34.120.202.204
                                      		player-telemetry.vimeo.comUnited States
                                      		15169GOOGLEUSfalse
                                      151.101.192.217
                                      		unknownUnited States
                                      		54113FASTLYUSfalse
                                      172.66.42.241
                                      		carollo.comUnited States
                                      		13335CLOUDFLARENETUStrue
                                      64.233.167.84
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      239.255.255.250
                                      		unknownReserved
                                      		unknownunknownfalse
                                      142.250.185.131
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      162.159.128.61
                                      		unknownUnited States
                                      		13335CLOUDFLARENETUSfalse
                                      184.28.90.27
                                      		unknownUnited States
                                      		16625AKAMAI-ASUSfalse
                                      142.250.184.238
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse

                                      Private

                                      IP
                                      192.168.2.17

                                      General Information

                                      Joe Sandbox version:42.0.0 Malachite
                                      Analysis ID:1591080
                                      Start date and time:2025-01-14 17:15:30 +01:00
                                      Joe Sandbox product:CloudBasic
                                      Overall analysis duration:
                                      Hypervisor based Inspection enabled:false
                                      Report type:full
                                      Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                      Number of analysed new started processes analysed:19
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:0
                                      Technologies:
                                      • EGA enabled
                                      Analysis Mode:stream
                                      Analysis stop reason:Timeout
                                      Sample name:Message.eml
                                      Detection:MAL
                                      Classification:mal52.phis.winEML@19/41@36/159
                                      Cookbook Comments:
                                      • Found application associated with file extension: .eml

                                      Warnings

                                      • Exclude process from analysis (whitelisted): dllhost.exe
                                      • Excluded IPs from analysis (whitelisted): 52.113.194.132, 184.28.90.27, 52.182.141.63, 142.250.185.131, 142.250.184.238, 64.233.167.84, 142.250.184.206, 142.250.185.110
                                      • Excluded domains from analysis (whitelisted): ecs.office.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, clientservices.googleapis.com, s-0005-office.config.skype.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, mobile.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, clients2.google.com, redirector.gvt1.com, s-0005.s-msedge.net, e16604.g.akamaiedge.net, ecs.office.trafficmanager.net, clients.l.google.com, prod.fs.microsoft.com.akadns.net, mobile.events.data.trafficmanager.net, onedscolprdcus01.centralus.cloudapp.azure.com
                                      • Not all processes where analyzed, report is missing behavior information
                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                      • VT rate limit hit for: nam10.safelinks.eop-tm2.outlook.com

                                      Created / dropped Files

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 15:16:26 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                      Category:dropped
                                      Size (bytes):2677
                                      Entropy (8bit):3.9935531344194835
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:E84CD26B00E945825F7C713942FA86D6
                                      SHA1:A9E18EE46311C483BA75C75E8EDCF3F489D90613
                                      SHA-256:87C8900113FF598DCC30645E45AABAB6C32470F26FF632B1EDAC669C42D828BC
                                      SHA-512:D4FC150ED09726CACA5A4F8E0B166603A327AC383A5F7F2DFF7333106E803A26E39144B27DB4D421E80E72AF8A1C959D1A09CD024C1CA244AB068CB3FBC58C29
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L..................F.@.. ...$+.,.....}...f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Z......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Z.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Z.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 15:16:26 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                      Category:dropped
                                      Size (bytes):2679
                                      Entropy (8bit):4.010657594545806
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:BB9E6BD22F9EE26CB0223E78AEC8F5F2
                                      SHA1:55C2360303993908E54BED95C51C9C5108634634
                                      SHA-256:A4038360478C7B12B16AD1C3DEDC287859F213CE60A8A722298CFC38C7CDCB41
                                      SHA-512:51685BE8F8612A69DE5B55CDDE5AC2EC5BCA0495A8818C46EC4654C55B2EA19E76A348E93ABB5A891C98A45284C2633E7A861B4F994C3630603BD55197931062
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L..................F.@.. ...$+.,....z.{..f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Z......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Z.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Z.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                      Category:dropped
                                      Size (bytes):2693
                                      Entropy (8bit):4.018267388419722
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F3E8FE04D2E09738762B1D2C02ABFC22
                                      SHA1:14870A74F3166315FAD7EBCBC49807727AA72192
                                      SHA-256:9BB82D189D0CC6D0EFDFB423C54FD71AC2A6740854EB205EEFFCB1E3CC717016
                                      SHA-512:C87AF6A87F5CCE44B4EFCA9206C2D1A24DE3F538FAFCEDAC0E1ABAAF694666A9E09FB54BCE065B0E80DACA95AF9BF7BCD9E2B0C34075E256BE3F6EFB8B7186F6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Z......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Z.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 15:16:26 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                      Category:dropped
                                      Size (bytes):2681
                                      Entropy (8bit):4.006472369187453
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:EECAE9FC0C6445AED6C5228542026502
                                      SHA1:0FB3BD776D04FA66EC8DD5B860930C7F17731290
                                      SHA-256:1B6A0EEBF200BECEA6AD399A2A8F499CEF71165493A3B7322E8D1E62E94933AD
                                      SHA-512:2232D7E7AA96C13255045039ADF3355F002694FED93BE826B9F6B05C2A312EFBBF8AC99B26996C6064ADB7297CD487954C79E0BB23732AB8CF8883782239E2F0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L..................F.@.. ...$+.,......u..f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Z......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Z.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Z.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 15:16:26 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                      Category:dropped
                                      Size (bytes):2681
                                      Entropy (8bit):3.9978110309008486
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:34B7C2301A50E6B91062342EA1D2FEB6
                                      SHA1:205D20B75F355B8DB18B72E7C7CD647CE2587D4D
                                      SHA-256:EDA6B6FA1D27BF515F50F95E1F5736259A36134CD86F266222BA178B703E01B4
                                      SHA-512:B2793F159945D8604919AEB0D37CECEF01F5888CDC6B444E436B62F001A7C2167EB13BC9833DB6A1AA5478009878D52B3B865195CD4220C1EC78B673167C4D33
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L..................F.@.. ...$+.,........f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Z......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Z.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Z.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 15:16:26 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                      Category:dropped
                                      Size (bytes):2683
                                      Entropy (8bit):4.007649830706113
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:06401E63AE0E9E67CA1AB5BFE59057CE
                                      SHA1:D0CF1C60C721D76AD3423170E913FDE74044E346
                                      SHA-256:B95643A085B291A9E63706A13EE7268660D78843171A65F2A54397C9949AC2D6
                                      SHA-512:EF3ACEE9A14FEC15F86C8B52D5DE964CE04C448D8A6BF7608E3585158D8FE1C11E977AC887338219FA63B1FD12CBBB3F8EACFA234CC8FB2E8E5B98175F005462
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L..................F.@.. ...$+.,......j..f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Z......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Z.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Z.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                      Chrome Cache Entry: 100

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:JPEG image data, baseline, precision 8, 780x435, components 3
                                      Category:dropped
                                      Size (bytes):110559
                                      Entropy (8bit):7.973458193211702
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:DDF61E6E90C5F2B99828BE26CE23CD24
                                      SHA1:8ABBC89BADE360F05FB62DAE17371E0573E21DE0
                                      SHA-256:D20E3D63FB96B4D4FBA6A77140B990FFD5E0DB860FD4D9C0C3D14AEBB9CB0192
                                      SHA-512:500BF0B0A1E0F0EFA6BFAC5FC3F078AC4C060805B41D357B670352CFD7E452A59014ABD0E9BE40F7B643E09F0CE3C12BD5CBD00FEF518CE58D9D3A82E7B43D3D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........................................................! !%%%%%%%%%%........... ... %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%.....b....Adobe.d......................................................................................................!."1A.Qaq.2.#BR....3b..$r..C...%4S.c.......Ds..&T......................!.1AQ.."a2q....#BR.......3br............?..9.l..t.b...r.7.o.~.....F,g%....5b.U...$t.y`..tKqX.9st/ee7P....t*.J&..*H.$MQ....../.x....,y.id.P..ukt>^...9.9...n#.1../r7....4..t5....,....U.....2....:.ybR`.V...........B*o..DU..$#.`..R<.b..-.V....!....N.a[..h...A7.L.;.U3..jb.........\W.]....CH..z..D.-..U..n......5%<..51....:.k.....4:.u\_..E}kQ=....Q..H.. %......e..7..6j..c'TbN0.2...aE.Q.r.^.p*-.H..u...*9<..(e....T0fK...h.e.7..er]....%....QFx....f!..v.F9f.XZ.2.$...*.x.....5..2.I...WS.#....I#k.....s=.bp..M.go3.WF%.....B.n..\m.WA~.M.2....5..O.&...a...Y....#p..;..c....\..m..V+....LJ.EX......$.........r.8."..Q&..x.e;.....L.wTR'..P.L*cxb,.D....7

                                      Chrome Cache Entry: 104

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines (836)
                                      Category:downloaded
                                      Size (bytes):112792
                                      Entropy (8bit):4.998375187746269
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:214CFBC7899A081C3349CB8E0530D355
                                      SHA1:57759E30847B0D411F430EE00E536C687897348E
                                      SHA-256:F03104B9CABE38E28197A8CF2AB7A71DFCBC83F46CA79532BAF033922581D9C1
                                      SHA-512:9E4F1488690917CBA8BBE9B13A4F9DEF4F29C112C80D5EC3B2CD3764E50AADD162AD00CDFDFC65613DC4753301D46DC8A87EEE60F6EE9CE67988EF85B023FADA
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://carollo.com/wp-content/themes/carollo_2020/css/carollo.base.css?ver=07.11.2024
                                      Preview:.clearfix {. clear: both;.}..clearfix::after {. content: ".";. clear: both;. display: block;. height: 0;. visibility: hidden;.}..html {. background-color: #fff;.}..body {. background-color: #fff;. position: relative;. color: #333;. font-family: "Open Sans", sans-serif;. letter-spacing: normal;. margin: 0;. overflow-y: scroll;. z-index: 1;. min-height: 100vh;. box-sizing: border-box;. font-size: 15px;. line-height: 25px;.}..a {. border: 0 none;. font-weight: 700;. color: #003db6;. text-decoration: none;.}.a:hover, a:focus {. text-decoration: underline;.}.a.solutions-link {. display: inline-block;.}..input {. border-radius: 0;.}..div,.section {. display: block;.}..*,.:after,.:before {. box-sizing: inherit;.}..h1,.h2,.h3,.h4,.h5 {. padding: 0;. margin: 0;. font-weight: 600;.}..ul,.ol {. list-style-position: outside;. padding-left: 20px;.}..img.alignright {. float: right;. margin: 0 0 1em 1em;.}..img.alignleft {. float: left;. margin: 0 1em 1em 0;.}..im

                                      Chrome Cache Entry: 106

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:downloaded
                                      Size (bytes):3932
                                      Entropy (8bit):5.202197618496175
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:BBAD95C4A0BE4E5775B7D5B409FBF602
                                      SHA1:FAD598750B15C207DFEF6E1FEA3C072BAEAC2B66
                                      SHA-256:41F78D15AE18C36B84C819D9AF3511C342C180F0ABA8F91DC1CCF4046B56B308
                                      SHA-512:4006994F240E4DAB7134F1B716E51E4FFC0DD495EAF3269165FB0C27D89B2F19063AF17086553B39507199D62DBCD8BA6F07F34770BCAF15C40CF5EF06419631
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://nam10.safelinks.protection.outlook.com/Content/Scripts/safelinksv2.css
                                      Preview:@charset "UTF-8";../* CSS Document */....body{...margin:0px;...padding:0px;..}....div{.. text-align:left;..}....#recommendation_container{...width:100%;..}....#icon img {...margin-left: 40px;...margin-top: 45px;..}....#url {height: 32px;..background-color: #f4f4f4;..margin-left: 40px;..margin-right: 40px;..margin-bottom: 20px;..margin-top: 0px;..font-family: Segoe, "Segoe UI", "DejaVu Sans", "Trebuchet MS", Verdana, "sans-serif";..display: inline-block;..}....#url p {...margin:4px 12px;..}......#close {height: 32px;..background-color: #0078d7;..margin-left: 40px;..margin-right:40px;..margin-top:20px;..padding: 4px 12px 8px 12px;..font-family: Segoe, "Segoe UI", "DejaVu Sans", "Trebuchet MS", Verdana, "sans-serif";..width: auto;..display: inline-block;..color: #fff;..border: 0;...font-size:100%;..}....#text {...margin-left:40px;...margin-right: 40px;...margin-top: 0px;...font-family: Segoe, "Segoe UI", "DejaVu Sans", "Trebuchet MS", Verdana, "sans-serif";..}....#tips {...margin-left:

                                      Chrome Cache Entry: 107

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines (19948), with no line terminators
                                      Category:dropped
                                      Size (bytes):19948
                                      Entropy (8bit):5.261902742187293
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:EC18AF6D41F6F278B6AED3BDABFFA7BC
                                      SHA1:62C9E2CAB76B888829F3C5335E91C320B22329AE
                                      SHA-256:8A18D13015336BC184819A5A768447462202EF3105EC511BF42ED8304A7ED94F
                                      SHA-512:669B0E9A545057ACBDD3B4C8D1D2811EAF4C776F679DA1083E591FF38AE7684467ABACEF5AF3D4AABD9FB7C335692DBCA0DEF63DDAC2CD28D8E14E95680C3511
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:!function(){var e={343:function(e){"use strict";for(var t=[],n=0;n<256;++n)t[n]=(n+256).toString(16).substr(1);e.exports=function(e,n){var r=n||0,i=t;return[i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]]].join("")}},944:function(e){"use strict";var t="undefined"!=typeof crypto&&crypto.getRandomValues&&crypto.getRandomValues.bind(crypto)||"undefined"!=typeof msCrypto&&"function"==typeof window.msCrypto.getRandomValues&&msCrypto.getRandomValues.bind(msCrypto);if(t){var n=new Uint8Array(16);e.exports=function(){return t(n),n}}else{var r=new Array(16);e.exports=function(){for(var e,t=0;t<16;t++)0==(3&t)&&(e=4294967296*Math.random()),r[t]=e>>>((3&t)<<3)&255;return r}}},508:function(e,t,n){"use strict";var r=n(944),i=n(343);e.exports=function(e,t,n){var o=t&&n||0;"string"==typeof e&&(t="binary"===e?new Array(16):null,e=null);var a=(e=e||{}).random||(e.rng||r)();if(

                                      Chrome Cache Entry: 109

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:PNG image data, 186 x 200, 8-bit/color RGBA, non-interlaced
                                      Category:downloaded
                                      Size (bytes):25664
                                      Entropy (8bit):4.972505404550475
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:FF4FEDB556605288FEC259EE6B8D5981
                                      SHA1:BBC525AB65E54999044F14FF8F31CF25EEDB7754
                                      SHA-256:2809B6F62DC341D238F02C33C7347A7BA714F10B6F075BDD39A1CD7C68CE9807
                                      SHA-512:9EAE6F8D1822A1EF91B909B0D6A8826BFB323BD34FA76FBF0A2DCA99B5F580BA09173ECD2068F393979EBAE248BF5FF1FC592C5D43D5EEB33E0EC6DDE93E8349
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://nam10.safelinks.protection.outlook.com/Content/images/cross.png
                                      Preview:.PNG........IHDR............._..;....pHYs...%...%.IR$....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                      Chrome Cache Entry: 110

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:JPEG image data, progressive, precision 8, 2200x790, components 3
                                      Category:downloaded
                                      Size (bytes):331565
                                      Entropy (8bit):7.984071318750268
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:7F5401548ADE3B74F29D9DE78044C184
                                      SHA1:A864CFD2E9223465BD7C213B2019453A08845E1D
                                      SHA-256:2837F711EEC152F3ED54D471A74E770F9A2E1CFCEFB07FD51758A1D0A9EEF880
                                      SHA-512:57388E834FB4ADA465615A9DA413060680E21AE93CDBF0B63FBC1FE248B792DF5A8EB521FA1A112950BA3C5815C8E0D2579EB797F612388D844681C62F56CB2C
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://carollo.com/wp-content/themes/carollo_2020/images/hero-90.jpg
                                      Preview:.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

                                      Chrome Cache Entry: 111

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):1925
                                      Entropy (8bit):4.842999011569697
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:2F397447F1F6F61B70ED423EABB48BE0
                                      SHA1:6C9D604588105F19F194E2C740612A98915B05ED
                                      SHA-256:D13F38B60429EC17E8D437A0DC8BB78CD142DED63201FC50D28EAE16CA970341
                                      SHA-512:C39A4FCF8814F5412BC73AE63A9381DBD67561755A1B59D82039A58289D39A1D304729BDCBB332783702BF4BD3D1227182C2D8BE95FFF19B832C789019AADC41
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<svg width="19px" height="19px" viewBox="0 0 19 19" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. Generator: Sketch 58 (84663) - https://sketch.com -->. <title>footer-linkedin</title>. <desc>Created with Sketch.</desc>. <g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="footer-linkedin" transform="translate(0.000000, -0.323120)" fill="#003CB9" fill-rule="nonzero">. <path d="M4.30013928,2.36072423 C4.30188174,2.92629786 4.06694619,3.46681178 3.65222709,3.85136949 C3.237508,4.2359272 2.68082549,4.4294591 2.11699164,4.38509749 C1.56320564,4.41430223 1.02193703,4.21354343 0.621137581,3.83027896 C0.220338134,3.44701449 -0.00441793464,2.91526218 3.23417508e-16,2.36072423 C-0.00516037235,1.79533753 0.2263658,1.25355718 0.638539979,0.86651557 C1.05071416,0.479473963 1.60597106,0.282445817 2.16991643,0.323119777 C2.72824983,0.289939991 3.2

                                      Chrome Cache Entry: 112

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 82", baseline, precision 8, 1200x670, components 3
                                      Category:downloaded
                                      Size (bytes):173683
                                      Entropy (8bit):7.976216149518799
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:C960A286904FE3DA7CE219F03F143D78
                                      SHA1:7A9262C0DE6C2D4DE7359C7FA85541B0F63B2709
                                      SHA-256:D7F54BF79325FAA4282FD749BCC837C476DAB36975FDBEE847DFE56C259C7A6B
                                      SHA-512:49745A91CE0D7D451D45091EC99D7428AAF8BB7A1B9C1203864CB08DD7062A84765823FB57E75F56FC04D971C25CE6606E648509699D43100499A441F3440136
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://carollo.com/wp-content/uploads/2021/03/Project-H-Houston-NEWPP-1200x670.jpg
                                      Preview:......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.O..s.r..$...s.&....5....}..Ye...4..7D...k..)..H;..i...4.....e.9.M...8...ps...I.k<..Zo.J.f..Ori>.....M8.Q....?'...a.J..x?..........&.\G.T..>o.......A.L..?J.....qp$.HI.;.....+......T..(....8C.}(...<...n..q..qT..#...9.........n).r.'..K&Ol..N2....(..>.....G....x...R..J2...}E+...g.).......P..Zg9...'.5

                                      Chrome Cache Entry: 113

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 82", baseline, precision 8, 1200x670, components 3
                                      Category:dropped
                                      Size (bytes):133079
                                      Entropy (8bit):7.967119455976767
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:579CFAD0079BB2BCACE42D88E2AB8A29
                                      SHA1:3C7D1E6A2B45C12D23F13A9EE255C9268B0863DD
                                      SHA-256:FFDD0745306EDA3FF00A5A2CBB92FF6FFA43AD49FFF104A3A17358D88F479233
                                      SHA-512:9524E1CFA7EBC4F469748525560C0A710549DDF52208231116178454EB885F5FFBA3BD7937F652269E0E31EFD831B8AF5FB8C15E953CE6CD8250F1512B2E83E3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.._..v....w.{6.p..3&.....=.O.\..)..._.j.-.[...O=.R..r..Z\...8..G.tn.F.Q..`.z.\n.s..,.....]d7I4P.p.t.....Xa.g.{t...'....E...3....8......z...N.).k....).9.T..#...n.0..V.H..OL..8.D...=I.q)L.3........... .D.a...sR....m\.....;.$...#.........\....=h..D.....2}pjVl.:.l........q@.P.../..V.....FOZ.H[..ld...a;.

                                      Chrome Cache Entry: 114

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 600x334, components 3
                                      Category:dropped
                                      Size (bytes):60112
                                      Entropy (8bit):7.98310294589672
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:655D5C10CEAEB3C8379609E3AB6C1931
                                      SHA1:556FFED244B2B7C91316961E4D4D8FB37FBCE54F
                                      SHA-256:AA5062B45FAEFD64EC913837D6AE72682A006344F30D07ABCE3C98B81B6C22BD
                                      SHA-512:3B02C96027F18C953CB85374410B1E8B24FD05CB67FB602E8ABC7E4B48697853490BF56EE86BB6F8120A577FE4D42BA68E6C2061AB4F12320FBFB3425A06C480
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:......Exif..II*.................Ducky.......<.....2http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.1462899777, 2023/06/25-23:57:14 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 25.2 (Macintosh)" xmpMM:InstanceID="xmp.iid:AFB060F996D011EE9A07A4C18865CD9D" xmpMM:DocumentID="xmp.did:AFB060FA96D011EE9A07A4C18865CD9D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AFB060F796D011EE9A07A4C18865CD9D" stRef:documentID="xmp.did:AFB060F896D011EE9A07A4C18865CD9D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d..........................................................................................................................

                                      Chrome Cache Entry: 115

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines (46754)
                                      Category:dropped
                                      Size (bytes):434470
                                      Entropy (8bit):5.374131121619558
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:EBC70C507A7345F226FDE2D8E7B2720A
                                      SHA1:73F52F238453CBD0C8A4E471973172541395885D
                                      SHA-256:F23A8CF45269E52D847F2678CDD01444D13D28C17489548EB39023BAD887C4E9
                                      SHA-512:C588E3800FA62FAD01F1381B358DE97E1CD17803B56C70FAF02BE9294A92A4828B71CC7EE9B6F62D5D6FB304822D0638DE1F73797D96F7174C6A14F7D1575C85
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:/* VimeoPlayer - v4.39.52 - 2025-01-13 - https://player.vimeo.com/NOTICE.txt */.const e={MANIFEST:"manifest",SEGMENT:"segment"},t={method:"GET",async:!0,retry:0,throwHttpErrors:!0,headers:{},hooks:{beforeRequest:[],beforeRetry:[],afterResponse:[]},validateStatus:function(e){return e>=200&&e<300},retryStatus:function(e){return[408,413,429].includes(e)||e>=500&&e<600}};function n(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=Array(t);n<t;n++)r[n]=e[n];return r}function r(e,t,n){if("function"==typeof e?e===t:e.has(t))return arguments.length<3?t:n;throw new TypeError("Private element is not present on this object")}function i(e,t){if(t.has(e))throw new TypeError("Cannot initialize the same private elements twice on an object")}function o(e,t){return e.get(r(e,t))}function s(e,t,n){i(e,t),t.set(e,n)}function a(e,t,n){return e.set(r(e,t),n),n}function u(e,t){i(e,t),t.add(e)}function c(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable||!1,r.configurable=!0,"value"

                                      Chrome Cache Entry: 118

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines (423)
                                      Category:downloaded
                                      Size (bytes):48800
                                      Entropy (8bit):4.80131042728952
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:61C3F058F104A6C7E5BD4548F7ADBC59
                                      SHA1:A839F6C9542C7CA7FE4ADEB64616581B412258F1
                                      SHA-256:DAAD2AA3CE521B6E7E58F8465A6935AD1F5568BA373BBF3DA670C37429235DEF
                                      SHA-512:30FFD2A4727A28CD907D7E5DBD03C0857A02C37AA88AAB6B05B83D396A25D0310D5D93B0EB83B84F6694B984F7401B0740D23794F83C16C506E9D5E496C72612
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://carollo.com/wp-content/themes/carollo_2020/css/custombox.css?ver=07.11.2024
                                      Preview:/*. * custombox - Modal dialog effects with transitions CSS3. * version: 4.0.3. * http://dixso.github.io/custombox/. * (c) 2017 Julio de la Calle - @dixso9. *. * Under MIT License - http://opensource.org/licenses/MIT. */..custombox-content, .custombox-overlay {. position: fixed;. overflow: hidden;. top: 0;. width: 100%;. height: 100%;.}...custombox-overlay {. z-index: 9997;. opacity: 0;. transition-delay: 0s;. transition-timing-function: linear;. transition-property: opacity;.}...custombox-content {. z-index: 9999;. display: flex;. flex-direction: row;. flex-wrap: nowrap;. align-items: center;. align-content: stretch;.}...custombox-lock {. overflow: hidden;.}...custombox-reference {. display: none;.}...custombox-content {. overflow-y: auto;.}...custombox-content > * {. max-width: 100%;. max-height: 95%;.}...custombox-fullscreen.custombox-content {. justify-content: flex-start;. align-items: stretch;.}...custombox-fullscreen.custombox-content > * {. width: 1

                                      Chrome Cache Entry: 119

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines (1572)
                                      Category:downloaded
                                      Size (bytes):17382
                                      Entropy (8bit):5.321201920900169
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:76246C36F20ABA470361EDB688FAFBAD
                                      SHA1:3E2FBA1219E7ACF5F6A1A21658CC2A917B67159C
                                      SHA-256:AB1DC4BDCD239CD0D211870064F9481CAEA7191FEBF67AA4301671D64EC6E8D4
                                      SHA-512:8C4FDB7B3AAE84906AE2C5D2072569318D1EFB988BCBD4172A5FBD4A7D401B9FF88BDA05035ABE188B8D055D08C093C9D50C2B79BD8FECFE2649C70BC3637340
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700
                                      Preview:/* cyrillic-ext */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Open Sans';. font-style: normal;

                                      Chrome Cache Entry: 120

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:Unicode text, UTF-8 text, with very long lines (65446)
                                      Category:downloaded
                                      Size (bytes):578585
                                      Entropy (8bit):5.645433785159769
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:E31CF3D762B391DAE27F49D67DC61B86
                                      SHA1:F61E20F40299D401DF4C545FD5DB1C5D18AAFDCA
                                      SHA-256:942C9226733A855BB251AA40D764973D76781E37C1E086962A5B2B98DDAF41D0
                                      SHA-512:19F2F8F7F98F9D327553DDDE7474577B33F8DA0F78FF0B24603F161AE4A13C566D4A8F1D91682140A68714CFEA46A018DF88891C87E25A84F935EE01A109815C
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://f.vimeocdn.com/p/4.39.52/js/player.module.js
                                      Preview:/* VimeoPlayer - v4.39.52 - 2025-01-13 - https://player.vimeo.com/NOTICE.txt */.import{_ as e,d as t,a as n,i,s as o,C as r,c as a,b as s,e as l,u as c,L as d,g as u,f as _,x as p,h as v,j as m,t as f,k as h,l as g,V as E,m as b,n as C,o as y,r as T,p as L,q as A,P as I,T as S,v as P,w as O,E as w,y as R,z as N,G as k,A as D,B as M,F as B,D as V,Q as x,S as U,H,I as F,J as G,R as W,K as Y,M as $,N as q,O as K,U as z,W as j,X,Y as Z,Z as Q,$ as J,a0 as ee,a1 as te,a2 as ne,a3 as ie,a4 as oe,a5 as re,a6 as ae,a7 as se,a8 as le,a9 as ce,aa as de,ab as ue,ac as _e,ad as pe,ae as ve,af as me,ag as fe,ah as he,ai as ge,aj as Ee,ak as be,al as Ce,am as ye,an as Te,ao as Le,ap as Ae,aq as Ie,ar as Se,as as Pe,at as Oe,au as we,av as Re,aw as Ne,ax as ke,ay as De,az as Me,aA as Be,aB as Ve,aC as xe,aD as Ue,aE as He,aF as Fe,aG as Ge,aH as We,aI as Ye,aJ as $e,aK as qe,aL as Ke,aM as ze,aN as je,aO as Xe,aP as Ze,aQ as Qe,aR as Je,aS as et,aT as tt,aU as nt,aV as it,aW as ot,aX as rt,aY as at,a

                                      Chrome Cache Entry: 122

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 80x45, components 3
                                      Category:dropped
                                      Size (bytes):576
                                      Entropy (8bit):5.876856030187316
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:A8C982C64A58A243438254AD6AD481ED
                                      SHA1:09E53954610F41DDA4A2C7FE7442B55E9C1321B8
                                      SHA-256:F381D33785BE2DDE8174ED67C6BC28ADF8D7876583032AB90FADC993FB7EC33B
                                      SHA-512:69234497B9674147F3F3725556CBF2DC629E80AC8EA6479624F4426CE156DBCC374C0DE2FCC6A6818128730277A98F905F7576F296162A017F0D9BFD5958D7FD
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......-.P.."..................................................&...;dI.l.YR.....................................zs.....................................f.....(.........................!Q.1. "0@ARa.........?....j^6.BiQ.5....u..R-.....c~..n.\......7.V3......Z...C.5.d...p......x.>2.d..RyR.T..R.J...P.G.B..y'.......................... .Sq.........?..H[P.>`q...DU.&.......................... .!AR........?...mD}..]&;...

                                      Chrome Cache Entry: 126

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ISO Media, AVIF Image
                                      Category:downloaded
                                      Size (bytes):445
                                      Entropy (8bit):5.594668472295285
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:E75FF5EF94D2EA0D12BC551F9A888DFF
                                      SHA1:EDFB047ED251B7C41A775F66DA99FC74FD030C6E
                                      SHA-256:999D28BC353AB9992578B8A6638C28815EEC796418B13DF89F1E9643D7D8EEB4
                                      SHA-512:B880B45FDEDC207BDE1DA46C62A7AAE49D57E5E12FEC7CEC42F94BDB3A240E83834CCBAC524E9C9B9863915E88343D9CF982FE8587F29B727D52DF75A7B1EBB6
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://i.vimeocdn.com/video/1765545840-36276e8f2e462e662acf471b726926ffe2493e72e049a8eb0dd919a2c40a544d-d?mw=80&q=85
                                      Preview:... ftypavif....avifmif1miafMA1B....meta.......(hdlr........pict............libavif.....pitm..........iloc....D....................(iinf..........infe........av01Color....jiprp...Kipco....ispe.......P...-....pixi............av1C........colrnclx...........ipma...................mdat......g......2..Dx.a.....b.[....e.......w.N.......u.w..Z.)5..&....g.V...3^.E!......L.&..D.Z...m.Sk.J...j..OANq,~0...<.B'.0.]&..G...P~.'L..B..o..2...&.].">..V.M.

                                      Chrome Cache Entry: 127

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines (1839)
                                      Category:dropped
                                      Size (bytes):1862
                                      Entropy (8bit):5.378704584910478
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:83583A4061DDC27E8B6EE0DC269519CD
                                      SHA1:8B1C0ACC28729208F640473EB5D8FB82C4BA3E15
                                      SHA-256:C051B8B5EB2A0AEF699780F15A449491868FAA6F8B39B684B5AE8F64F345B94A
                                      SHA-512:3652AB4345C138245677F415607E6447358DC064B8B3AD7820F34BF225A0D70B0820AFD87E5D2235919AFC703248DA54F126DF8F793DFDA529D1FA336FBA22C3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:(function(t){var e=false,n,o,i,r=typeof t.navigator.sendBeacon==="function",u="https://vimeo.com/ablincoln/vuid",a;function f(){return 2147483647}function c(t,e){if(arguments.length===0){e=0;t=f()}return Math.floor(Math.random()*(t-e+1))+e}function d(t){var e=(new Date).getTime()/1e3,n=parseInt(e,10);return t?e:Math.round((e-n)*1e3)/1e3+" "+n}function v(t,e,n){var o,i,r,u;e|=0;o=Math.pow(10,e);t*=o;u=t>0|-(t<0);r=t%1===.5*u;i=Math.floor(t);if(r){t=i+(u>0)}return(r?t:Math.round(t))/o}function h(t){var e=t+"",n=e.charCodeAt(0),o,i;if(55296<=n&&n<=56319){o=n;if(e.length===1){return n}i=e.charCodeAt(1);return(o-55296)*1024+(i-56320)+65536}if(56320<=n&&n<=57343){return n}return n}function g(){return v(c()/f()*2147483647)}function l(t){var e=t.toString(),n=1,o,i,r;if(typeof e!=="undefined"&&e!==""){n=0;o=e.length-1;for(o;o>=0;o--){i=h(e.charAt(o));n=(n<<6&268435455)+i+(i<<14);r=n&266338304;if(r){n^=r>>21}}}return n}function s(t,e,n,o,i,r,u){var a,f;if(arguments.length>1){if(n){a=new Date;a.s

                                      Chrome Cache Entry: 128

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1588
                                      Entropy (8bit):5.174121809218917
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:3AF1FDB9A3F664A6683D212F4787733A
                                      SHA1:59063D49B723A1988236C8D39C2804C6EBC5FF95
                                      SHA-256:A9CE4840FF0D613B456081DEA64E46EB717A1F8BFA5AFB05D3BD058F294E416C
                                      SHA-512:F8872E0C875BE6037C14480630E461FC1ADFA2049DB03BAE5D8CB6B320A2C084D4B266AEB02E24009B4BA84821E216690CA875B165164447FE8329B48C9E261F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:window.onload = function OnLoadHandler(){...if (window.history.length <= 1) {....document.getElementById("close").style.display = "none";...}..}....var theme = null;..try {.. (function (URLSearchParams, str) {.. if (!new URLSearchParams(window.location.search).get(str)){....throw URLSearchParams;...}....var urlParams = new URLSearchParams(window.location.search);....if (urlParams.has(str)){.....theme = String(urlParams.get(str));....}.. }(URLSearchParams, "theme"));..} catch(URLSearchParams){...var params = {}...var parts = window.location.search.substring(1).split('&');...for (var i = 0; i < parts.length; i++) {....var val = parts[i].split('=');....if (!val[0]) continue;....params[val[0]] = val[1] || true;...}...theme = params["theme"];...}....// Load theme specific css..if (theme === "dark"){...AddCSS("Safelinksv2-dark.css");..}..else if (theme === "contrast"){...AddCSS("Safelinksv2-highcontrast.css")..}....// Add CSS based on theme..function AddCSS(fileName){... var ss = docume

                                      Chrome Cache Entry: 129

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:HTML document, Unicode text, UTF-8 text, with very long lines (19330)
                                      Category:downloaded
                                      Size (bytes):119448
                                      Entropy (8bit):5.251558709058098
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:062B58A19A5C3672ABD58EA9C736F4DC
                                      SHA1:8F096E51E9CF3ECD3E7AB3A40DFB15EEB24BC87D
                                      SHA-256:0A342BBD862338FF94F73AC93D3705EBE9E49FF8E42D069EDDA21640A8C6D4F0
                                      SHA-512:1E276ECFEF75E9463F63A775EAFBAFAD34EDD723C2867DC6AE19E534237EA8778109DB7891B3885C42E12FF1EDAFAB60B37472D7232CC386A95BADA576C5762E
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://carollo.com/
                                      Preview:<!DOCTYPE html>.<html class="no-js" lang="en-US">...<head>...<meta charset="UTF-8">...<meta name="viewport" content="width=device-width, initial-scale=1.0" >....<link rel="profile" href="https://gmpg.org/xfn/11">....<meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' />..<style>img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }</style>.... This site is optimized with the Yoast SEO plugin v24.0 - https://yoast.com/wordpress/plugins/seo/ -->..<title>Carollo Engineers | Water Engineering Consulting Firm</title>..<meta name="description" content="Carollo Engineers is an environmental engineering firm that specializes in the planning, design, and construction of water and wastewater facilities." />..<link rel="canonical" href="https://carollo.com/" />..<meta property="og:locale" content="en_US" />..<meta property="og:type" content="website" />..<meta property="og:title" content="Carollo Engineers

                                      Chrome Cache Entry: 130

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3
                                      Category:dropped
                                      Size (bytes):907
                                      Entropy (8bit):6.869107979470723
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:B884C628116F72E1FEC1A7D9BB1789ED
                                      SHA1:9EE765143C46C517ABF766ADE2207CE2632F79A5
                                      SHA-256:20D650F641E3DA3AED98C88C54CBFD12AA688EAC6142E6033C030FA551FF2EC9
                                      SHA-512:CE07A23A396748938703B2E27FC2F584478F2EFBA645889F88FCB982768C282DDE68099B4C7B73FD08F6D167B966B39430ED73305DCCA0CFAFF0F3B44B67F2F0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......<.<.."...................................................m.X..u.4^.D4..TF.............................................A.....................................K.BA...(........................!...1.."@Q..$A........?.....#.2....m.9....q..33."#...S...uFwR.S..../6yx...:...&..e..-T...;...;...."g.|H...su$#$N...b.q+g..@.Ou..;.U.)......l...*.x..k..,..0+..K.|E.n.]Y..ff.P;..%...3...Z...W.,n....O:w.%[.:..p.....E.O..+Y.N.l..E......?..s....}s..Q..|.C.`........,|e.E9..G..9..u:.XI(...n......c.0Q.....P......^M+%$..y..%.Hc...-[.K....T.r............O#.....d..s.,9..%._... .......................1. q."R........?..2.L.Uw.6.I.U e.m..]N..:....1C.:.2#.Y..A..(...|.....q...!........................ 1AR.!Q........?....*..3.S..z...J....f"\........

                                      Chrome Cache Entry: 131

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
                                      Category:downloaded
                                      Size (bytes):48236
                                      Entropy (8bit):7.994912604882335
                                      Encrypted:true
                                      SSDEEP:
                                      MD5:015C126A3520C9A8F6A27979D0266E96
                                      SHA1:2ACF956561D44434A6D84204670CF849D3215D5F
                                      SHA-256:3C4D6A1421C7DDB7E404521FE8C4CD5BE5AF446D7689CD880BE26612EAAD3CFA
                                      SHA-512:02A20F2788BB1C3B2C7D3142C664CDEC306B6BA5366E57E33C008EDB3EB78638B98DC03CDF932A9DC440DED7827956F99117E7A3A4D55ACADD29B006032D9C5C
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
                                      Preview:wOF2.......l......D...............................O..B..h?HVAR.x.`?STAT.$'...0+...|.../V........+..2.0..6.6.$..`. ..~......[B4q.....t..P.M_.z...1..R.S*...u.#..R....fR.1.N.v.N.P...;.2........!Z......Qs...5f.G.K.an2&....2...*......C.H.t..N!.....nh.<(.vN.....j.._.L.P.t..Ai.%.............._I.i,..o,C.].H.X9.....a.=N....k.....n.L..k.f.u..{...:.}^\[..~5...Z`...........`!...%4..,...K0..&.a/....P....S....m.Z......u...D.j.F...f.0`I.`.`.h#..)(FQ.F!o$........S.).MV8%Rh...r...x...T]$.=......Y...!.3.&U..."....Q....{.l/0..d..4iJ/..}...3....i[Z..NG.WD...>.[U..Q.h..@m.=..S...1C2...d...<..v.?.q.f..n...OUz.....&Z......Z."..N.....n...9.B..C..W....}...W..6Zs.i.+Z........jB.n..x.8M.....q..@I....-.%..,C,..K..#.2...4)/.v_..x.<....t.....%[.4?.=j.V..jj''..W.u..q....I.L.=......E...\.M.7{.>......W........C.`...,9$......\..o........y...4A..m.P.,X..=?.:................wF`..+.P..........M!.4.......l.>M..t.ff5r..^..Z.g...!fA,hIIQ...e.R>B.AH.VuX..>..\.=.ky...1>C....>C.c.;...6D.

                                      Chrome Cache Entry: 132

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):2024
                                      Entropy (8bit):4.722898285973187
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:FEAB52014A1A0BFB3AD06EE56134047A
                                      SHA1:17BEC1C1908956FC8887DA15BDF3016FC250D31E
                                      SHA-256:0E9D153861FC3A9506AA23A141A46522E73AD2D88ED4A5958AE9B2751C559598
                                      SHA-512:C7367B60EF70D110B259B36F607B71E227597810E343862CC4EBB647579B41D8028DAE07C08EF50B62F9D788135D25C15A68B85D149FC967265A41200874B872
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<svg width="22px" height="18px" viewBox="0 0 22 18" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. Generator: Sketch 58 (84663) - https://sketch.com -->. <title>footer-twitter</title>. <desc>Created with Sketch.</desc>. <g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="footer-twitter" transform="translate(0.000000, -0.188547)" fill="#003CB9" fill-rule="nonzero">. <path d="M6.91734198,18.0167477 C10.3223098,18.0421485 13.5960393,16.7048386 16.0093568,14.3026835 C18.4226744,11.9005283 19.7751471,8.63303386 19.7655321,5.22798487 C19.7655321,5.02593193 19.7655321,4.83576445 19.7655321,4.64559697 C20.6547195,3.99504571 21.4196439,3.18986209 22.0237709,2.26850351 C21.2006644,2.63458442 20.3272467,2.87497462 19.4327391,2.98163155 C20.3546356,2.41678074 21.0487596,1.54597068 21.3938412,0.521339816 C20.506158,1.04188289 19.5381916,1.411397

                                      Chrome Cache Entry: 133

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines (1143)
                                      Category:dropped
                                      Size (bytes):4272
                                      Entropy (8bit):5.407649241930215
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:B427175FA1078775EB792756E7B6D1E7
                                      SHA1:4C55C0233D3D9002B3449C025F97821F8BB8900D
                                      SHA-256:EE147E859AD0F09AA50367974E38AB53E7C7054C4A51D400A7F45B0EB251454F
                                      SHA-512:AF8D384188363378BC99C2E51523E74E1D18BA77D51BFF7647A377A117499421F9E94477E09907925E46DAD0A908B799A616D0B4855FFFF064BA6350815063D3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.'use strict';var l=function(){var a=h,b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},m=this||self,n=/^[\w+/_-]+[=]{0,2}$/,p=null,q=function(a){return(a=a.querySelector&&a.querySelector("script[nonce]"))&&(a=a.nonce||a.getAttribute("nonce"))&&n.test(a)?a:""},r=function(a,b){function e(){}e.prototype=b.prototype;a.i=b.prototype;a.prototype=new e;a.prototype.constructor=a;a.h=function(c,g,k){for(var f=Array(arguments.length-2),d=2;d<arguments.length;d++)f[d-2]=arguments[d];.return b.prototype[g].apply(c,f)}},t=function(a){return a};function u(a){if(Error.captureStackTrace)Error.captureStackTrace(this,u);else{var b=Error().stack;b&&(this.stack=b)}a&&(this.message=String(a))}r(u,Error);u.prototype.name="CustomError";var v=function(a,b){a=a.split("%s");for(var e="",c=a.length-1,g=0;g<c;g++)e+=a[g]+(g<b.length?b[g]:"%s");u.call(this,e+a[c])};r(v,u);v.prototype.name="Asse

                                      Chrome Cache Entry: 136

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:Unicode text, UTF-8 text, with very long lines (37362)
                                      Category:downloaded
                                      Size (bytes):169161
                                      Entropy (8bit):5.25937317692948
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:BCD69D938E067E8E876DA6FCB79B1226
                                      SHA1:D953B7DB27EFC640A31FDED23561A573DB9DC34B
                                      SHA-256:FF59E856BB9BBD8D2CE7D98BA6A8EFC023E7517E0D1A38FBDBEC3C0AF27A0CF6
                                      SHA-512:A1B4BAFB9A126CA619EA031A981025B1F88C405AE50C4F35672B3730D196140266486CAA225104E477836715412D3211156CC135F5E7CBC794724BD158138142
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://f.vimeocdn.com/p/4.39.52/css/player.css
                                      Preview:/* VimeoPlayer - v4.39.52 - 2025-01-13 */.@keyframes buffer{100%{transform:translateX(-10px)}}@-moz-keyframes bufferLeft{0%{left:0}100%{left:-10px}}@keyframes throb{0%,100%{background-color:#555}50%{background-color:#444}}@keyframes wiggle{0%{transform:translateY(10px)}20%{transform:translateY(0)}40%,80%{transform:translateX(8px)}60%{transform:translateX(-8px)}100%{transform:translateX(0)}}@keyframes pulse{50%{transform:scale(.9)}}@keyframes dash{0%{stroke-dasharray:1,200;stroke-dashoffset:0}50%{stroke-dasharray:89,200;stroke-dashoffset:-35px}100%{stroke-dasharray:89,200;stroke-dashoffset:-135px}}@keyframes rotate{100%{transform:rotate(360deg)}}@keyframes scaleAnimation{0%{transform:scale(.9,.9)}100%{transform:scale(1,1)}}:fullscreen-ancestor>:not(:fullscreen-ancestor):not(:fullscreen){display:none!important}body:not(.showfocus) .player a,body:not(.showfocus) .player button,body:not(.showfocus) .player li,body:not(.showfocus) .player span,body:not(.showfocus) .player svg{outline:0!impo

                                      Chrome Cache Entry: 137

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:downloaded
                                      Size (bytes):12846
                                      Entropy (8bit):4.058063978969568
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:CB2BABD7A52089A96904773E3C50E9F8
                                      SHA1:443E2D2A3EB366D3C325AB9888099325B005F451
                                      SHA-256:F414A488EA1635817E07BFE24E073D3D658A2E293C055DC8C76F22FAE3B26CF3
                                      SHA-512:AF4807D8C5E8C52D79F0AB3FD56182618B32377ABF2023DAC63B513F8BDE381B4A72059DB03C898B75FF287A04D8C68AA046C023B4F14B795D415FBB96F93CEC
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://carollo.com/wp-content/themes/carollo_2020/images/logo-header.svg
                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<svg width="165px" height="26px" viewBox="0 0 165 26" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. Generator: Sketch 58 (84663) - https://sketch.com -->. <title>Carollo Logo_Wave</title>. <desc>Created with Sketch.</desc>. <g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="Carollo-Logo_Wave" fill="#003CB9">. <path d="M29.3483607,5.95081967 C-12.6680328,9.64754098 -5.86065574,30.6106557 28.6270492,24.9754098 C1.93852459,26.8688525 -2.52459016,10.7745902 29.3483607,5.95081967 Z" id="Path"></path>. <path d="M41.8811475,5.54508197 C21.6393443,11.5409836 21.8196721,23.0819672 39.4918033,22.5860656 C2.3442623,30.7909836 -5.3647541,7.43852459 41.8811475,5.54508197 Z" id="Path"></path>. <path d="M125.327869,0.0901639344 L122.352459,10.9098361 C124.606557,10.8647541 126.905738,10.8647541 129.114754,11 L132.090164,0.0

                                      Chrome Cache Entry: 138

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 500x281, components 3
                                      Category:dropped
                                      Size (bytes):8093
                                      Entropy (8bit):7.840556842162773
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:6C1A36373023EC860CCE8F1238644D3C
                                      SHA1:6BE18D8E601B5C15DC4A515B0C3875857D27144F
                                      SHA-256:828FE82D892BE11F4715C15CE4B6A02772EF5667A6724A0DEBBC219D0EE91ACE
                                      SHA-512:C495B098A90FAAB6AA1BC23A57762203E855D15E26CA4B1E9AA7BC0465BD7D44A8045C61953E27C361EE7896ACBF142C86503FCA66CD4D540F5C2A04EC97CF13
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}...........".............................................................................................................................................................N^p.........5..o..u..N...oy......t......}..{.o.|?s....]..|.I.._..<........|..[.pz.y...?..~k.x...|..<......../.>....].G...].....|....N......@.... ....( .A...".......@*..H7m.......&Y..j.1.7uy`...P.d.....Fu......"..!.-.Q.......(..A4....U"...H.*B.*..<.k&.4...r.+...RZ.P(..p.e.w|+..n..e.h....x0...#.....K..D8..+:".Mf......*.f....K.e.(J.!P.....+6k6j.%EJE%.+ .f.Yb...,Q*Qb..X.J.e...e...,..D....bkXo%AR.X..........&.fw..Y.....$cNN9...-...................................................................9........w..0........4......D.@U..I............E.K. @..........%....t.@..IS...............................................................@.....F3....p...

                                      Chrome Cache Entry: 139

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text
                                      Category:downloaded
                                      Size (bytes):2894
                                      Entropy (8bit):5.130108035080603
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:3FD2AFA98866679439097F4AB102FE0A
                                      SHA1:DBC9C4139E49D0D9FB41B7191AAD1A2DB6C555FD
                                      SHA-256:CCD31FFA708D025833F954B3E0560CEDD58DF9A0D2706B2CCEE5F501C5B2467B
                                      SHA-512:82811EF42ABD80CBEBD4A74D35475FC3871478FC25A486B08BB7E04921B7824DB56C56B2191E9AB56A421552B483A2E64F966396711E5F248AFAE9D1DED22CB2
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://carollo.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.0.1
                                      Preview:.wpcf7 .screen-reader-response {..position: absolute;..overflow: hidden;..clip: rect(1px, 1px, 1px, 1px);..clip-path: inset(50%);..height: 1px;..width: 1px;..margin: -1px;..padding: 0;..border: 0;..word-wrap: normal !important;.}...wpcf7 form .wpcf7-response-output {..margin: 2em 0.5em 1em;..padding: 0.2em 1em;..border: 2px solid #00a0d2; /* Blue */.}...wpcf7 form.init .wpcf7-response-output,..wpcf7 form.resetting .wpcf7-response-output,..wpcf7 form.submitting .wpcf7-response-output {..display: none;.}...wpcf7 form.sent .wpcf7-response-output {..border-color: #46b450; /* Green */.}...wpcf7 form.failed .wpcf7-response-output,..wpcf7 form.aborted .wpcf7-response-output {..border-color: #dc3232; /* Red */.}...wpcf7 form.spam .wpcf7-response-output {..border-color: #f56e28; /* Orange */.}...wpcf7 form.invalid .wpcf7-response-output,..wpcf7 form.unaccepted .wpcf7-response-output,..wpcf7 form.payment-required .wpcf7-response-output {..border-color: #ffb900; /* Yellow */.}...wpcf7-form-contro

                                      Chrome Cache Entry: 140

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ISO Media, MP4 v2 [ISO 14496-14]
                                      Category:downloaded
                                      Size (bytes):358631
                                      Entropy (8bit):7.967398613307534
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:8A5B8AA7F19CB6D1463D38397D23F893
                                      SHA1:992E76734603965A3F3C045BC9A22E3B50F2607D
                                      SHA-256:1F2F044E435AB305C7F9D407B0FF8B307F5E2375F20BC7FEF53E3094C8B4273F
                                      SHA-512:693153D63B385B38DA05360F64C021CB16B563F2E123F19648315E0A939F9897FBB82FEC608A5435ACD0D4F912CC6FE0B3AC0E8D797AB7A8B27E5101040843CE
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://carollo.com/wp-content/uploads/2023/08/carollo90homepage.mp4:2f8a432d696168:0
                                      Preview:....ftypmp42....mp42mp41..#.moov...lmvhd.......1...2.._.....................................................@..................................#trak...\tkhd.......1...1............................................................@..............$edts....elst........................mdia... mdhd.......1...1..u0...^.......@hdlr........vide.............Mainconcept Video Media Handler...3minf....vmhd...............3hdlr........alis............Alias Data Handler....$dinf....dref............url ........stbl....stsd............avc1.............................H...H.........AVC Coding............................0avcC.M@)....gM@).R...t............`....h..5 ....stts....................stsc........................stsz.......................a...........Z...........<......pj......m...bZ..........r{..a...t?...'..v...^...vQ...O..t...t...q...............F...mm..h...Y...sF......s...H...{.......t......../......W!..v........'..L...y$......^...............K...z...........K...W...g...J...sL......w|..1...k...m

                                      Chrome Cache Entry: 141

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:HTML document, ASCII text, with very long lines (2258), with CRLF line terminators
                                      Category:downloaded
                                      Size (bytes):4777
                                      Entropy (8bit):5.773074209840209
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:227C8A5356EB6A0CA3205E49DCD573DF
                                      SHA1:C6C5FDE546469E7B2D85D1659F28A42F8D92ED10
                                      SHA-256:50931DC1E97365DE906FF323AFB0C98DACE0934AD9994E6D91FF56F8236DE005
                                      SHA-512:22F5C34ACB5C7AB31C2145FB633B83EE07EE8379C3E0309471193FEE11740AD05F0726DEDE3B301E35D3479C9CE96A6CFE266F9B3A47A7B33E97C5FE0837FEF1
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fazbex.acemlna.com%2Flt.php%3Fx%3D3DZy~GDMJnDL65OuzQ5NhOKh1aIji_f3wuY3X5M7JXWZE5z~yUy.0OFz13FziNfujfYxbHHFKXSa&data=05%7C02%7Cbhuey%40carollo.com%7Ca80c66979fc242bd1d2608dd349328b9%7Cf50354a04a5a4fa1b18f8d1efb41b024%7C0%7C0%7C638724528856822158%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=A9KZ4SEWrgSCTOmUbkM40BenkS%2FCpr99TYThOPEp6SI%3D&reserved=0
                                      Preview:<!doctype html>..<html>..<head>.. <meta charset="UTF-8">.. <title>Microsoft Defender for Office 365</title>.. <meta name="referrer" content="same-origin" />.. <meta name="robots" content="noindex,nofollow" />.. <link rel="icon" href="data:,">.... <base href="https://nam10.safelinks.protection.outlook.com">.... <link href="/Content/Scripts/safelinksv2.css" rel="stylesheet" />.. <script src="/Content/Scripts/site.js" type="text/javascript"></script>..</head>..<body>.. <div id="header_container_branding" style="background-color: #000000;">.. <div id="header_branding">.. <a href="https://www.carollo.com/"><img src="https://carollo.com/wp-content/themes/carollo_2020/images/logo-home.svg" style="max-height: 30px;" /></a>.. </div>.. </div>.. <div id="header_container_blocked">.. <div id="header">.. <div id="icon"><img src="/Content/images/cross.png" alt="" height="100" width="94"></div>..

                                      Chrome Cache Entry: 143

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines (59458)
                                      Category:downloaded
                                      Size (bytes):114706
                                      Entropy (8bit):4.924852554644207
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:8C9F31823282E4E056EB0AA7FAC262A9
                                      SHA1:DC3B1A37381E079FDA8DB59C1A9469852CD18B80
                                      SHA-256:3BB38D0F302677FF4104564454F60F495133579D6E6DFB722B3DE850DF596502
                                      SHA-512:39F239C875550BF9A31254EED1F0358EA3C6309D9FCBF6005D8852843EAF60BC20B8626D169F810A6C71B7DCDB769B8512314B89BA1FDEEA2CB3089BE9D21AE0
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://carollo.com/wp-includes/css/dist/block-library/style.min.css?ver=d9f37183c921f934df0fc4067a50f9af
                                      Preview:@charset "UTF-8";.wp-block-archives{box-sizing:border-box}.wp-block-archives-dropdown label{display:block}.wp-block-avatar{line-height:0}.wp-block-avatar,.wp-block-avatar img{box-sizing:border-box}.wp-block-avatar.aligncenter{text-align:center}.wp-block-audio{box-sizing:border-box}.wp-block-audio :where(figcaption){margin-bottom:1em;margin-top:.5em}.wp-block-audio audio{min-width:300px;width:100%}.wp-block-button__link{box-sizing:border-box;cursor:pointer;display:inline-block;text-align:center;word-break:break-word}.wp-block-button__link.aligncenter{text-align:center}.wp-block-button__link.alignright{text-align:right}:where(.wp-block-button__link){border-radius:9999px;box-shadow:none;padding:calc(.667em + 2px) calc(1.333em + 2px);text-decoration:none}.wp-block-button[style*=text-decoration] .wp-block-button__link{text-decoration:inherit}.wp-block-buttons>.wp-block-button.has-custom-width{max-width:none}.wp-block-buttons>.wp-block-button.has-custom-width .wp-block-button__link{width:100

                                      Chrome Cache Entry: 144

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ISO Media, AVIF Image
                                      Category:downloaded
                                      Size (bytes):648
                                      Entropy (8bit):6.457979792300883
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:95FADB592C17F58906B55CA5F55F2145
                                      SHA1:FC37347333DADFFB05BB1F891C72CC7BD24D854C
                                      SHA-256:4FB1BCE8846CE0C0E9990F594B94A1C34AA36B31FD993D2CA0B791A13DF8709D
                                      SHA-512:D6E0E73FC1669808B5190DDD838EFD7363BB13BC08C3BB50DACD942F81C0A57472B9C5124162C12D59BE18A912664E3CFABC6B980B470C4D559AE7B4488B453E
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://i.vimeocdn.com/portrait/88682438_60x60?sig=2211afd4beab6017c8e966cfbd90e90a62ac50d877ea93ba76d8bff9faee85b3&v=1
                                      Preview:... ftypavif....avifmif1miafMA1B....meta.......(hdlr........pict............libavif.....pitm..........iloc....D................n...(iinf..........infe........av01Color....jiprp...Kipco....ispe.......<...<....pixi............av1C........colrnclx...........ipma..................vmdat......{....H2..D....1@.i._q....R.b.{.....?....1.......E..M`l./9..!....@.}V.\.V...L*.*<r.$..........{f|...s...[....Q.Y(=..:?.....h......-...U]J..Dn....}~..Z.;Pt@x.C..+....y......XB.U........Pv.>...*.j..`.u^..i*'*e..z..[.M]2j.O...^]...>...c..fF. ..@<..!....<|d..2w.:.dK^<G|IB@..9.[...+...|...@..A..(.F.F....x...<......eM.:...../...X..v.;........{ ..@

                                      Chrome Cache Entry: 145

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):1536
                                      Entropy (8bit):4.940855733111792
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:0C3B5C7F2B8A866EA4C19127482A2078
                                      SHA1:53A83C19FBD14F677A5DAD1947857BD9FAAE7905
                                      SHA-256:70B95B137D5B9BDA4E394C91559C11295E0F8768AC0337FE0155979D0D01BFCC
                                      SHA-512:2EAEACF437FF08AAA685AC9C268506090641691721F46AF651AF5412E0278F49B787EF733863C840B382709DE703134FAAB28667BDF7D8EEA72CB5E09598AAD7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<svg width="23px" height="17px" viewBox="0 0 23 17" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. Generator: Sketch 58 (84663) - https://sketch.com -->. <title>footer-youtube</title>. <desc>Created with Sketch.</desc>. <g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="footer-youtube" transform="translate(-0.216288, -0.216288)" fill="#003CB9" fill-rule="nonzero">. <path d="M22.7297726,2.74616605 C22.4638254,1.75254585 21.6905869,0.974677256 20.6985722,0.70280275 C17.7165116,0.341972584 14.7137918,0.179443768 11.7102062,0.216287678 C8.71066644,0.179517059 5.71199681,0.342046578 2.73400317,0.70280275 C1.73805905,0.9679106 0.961959994,1.74865696 0.70280275,2.74616605 C0.367093626,4.58377353 0.204210807,6.44878181 0.216287678,8.31676362 C0.204210807,10.1847454 0.367093626,12.0497537 0.70280275,13.8873612 C0.961959994,14.8848703 1.7380

                                      Chrome Cache Entry: 147

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):1047
                                      Entropy (8bit):5.156729616798558
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:0C29E54BB70C36C02439FEDE9E4B620E
                                      SHA1:61A8D86D6E5D4814FEEE6FC603D1289A4E6B133E
                                      SHA-256:9FC208F066DCE4EA886795781080B2D326C640377D211348F1822E059D0E0716
                                      SHA-512:64DDF3DEE4BADEE39A9CEC8DEA65A5C5D48219DF909A975B6FCCA1E437EF7C33E727E3E73981C694621CEC5BF2361A0A17B1E773443379089382200551B8DAF3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<svg width="12px" height="24px" viewBox="0 0 12 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. Generator: Sketch 58 (84663) - https://sketch.com -->. <title>footer-facebook</title>. <desc>Created with Sketch.</desc>. <g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="footer-facebook" fill="#003CB9" fill-rule="nonzero">. <path d="M7.79570991,23.1297242 L7.79570991,12.6006129 L11.3503575,12.6006129 L11.8774259,8.46986721 L7.79570991,8.46986721 L7.79570991,5.84678243 C7.79570991,4.62104188 8.12665986,3.83656793 9.83043922,3.83656793 L12,3.83656793 L12,0.159346272 C10.9453804,0.0495992106 9.88564038,-0.00359237537 8.82533197,-0.000170458014 C5.68743616,-0.000170458014 3.54239019,1.91215526 3.54239019,5.43003064 L3.54239019,8.46986721 L0,8.46986721 L0,12.6006129 L3.54239019,12.6006129 L3.54239019,23.1297242 L7.79570991,23.1297242 Z"

                                      Chrome Cache Entry: 96

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:downloaded
                                      Size (bytes):2719
                                      Entropy (8bit):4.862682380065637
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:403FAAC2A7838A89EE0439D057FF4FA3
                                      SHA1:AA2B817699F7F3894C1F05FA3CB95266083603BD
                                      SHA-256:AB5C273A954E98968A8E5065421B2FF3A3E7CE9F31657FB6E5B9644CE29C62B0
                                      SHA-512:C78B93D0BBF2094AEB3EE4D6899E378BB46FEA2C8AA2128E58068B890DCEC9D117193A3BC800C108E24399EFA486C144AF0EBB2E0A5B17EB4ADC4BA95A81A79D
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://carollo.com/wp-content/themes/carollo_2020/print.css?ver=07.11.2024
                                      Preview:@charset "UTF-8";../*..Theme Name: Twenty Twenty..Adding print support. The print styles are based on the the great work of..Andreas Hecht in https://www.jotform.com/blog/css-perfect-print-stylesheet-98272/...*/..../*--------------------------------------------------------------..>>> TABLE OF CONTENTS:..----------------------------------------------------------------..# Margins..# Paddings..# Width..# Typography..# Page breaks..# Links..# Visibility..--------------------------------------------------------------*/....@media print {.. /* Margins */.. @page {.. margin: 2cm;.. }.. .entry-header, .site-footer {.. margin: 0;.. }.. /* Paddings */.. .posts {.. padding: 0;.. }.. /* Width */.. .entry-content, .entry-content p, .section-inner, .section-inner.max-percentage, .section-inner.medium, .section-inner.small, .section-inner.thin {.. max-width: 100%;.. width: 100%;.. }.. /* Fonts */.. body {.. background: #fff !important;.. color: #000;.. font: 13pt;.

                                      Chrome Cache Entry: 99

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):13436
                                      Entropy (8bit):4.164300805839878
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:FD8B472142D08A399531F41F01F4876D
                                      SHA1:9120EAF66293457B10D9DE9A9BBC385275B1382B
                                      SHA-256:ED66E49C9B7621B3024991508FA3873E060149A24ED3216451F704D5CBB0F419
                                      SHA-512:265923DC3653102C75759A6F8840CD82494037EC1C33D57E5687A2A5D57A0A57BE4D6945B9150065611FEA95A2749E82D7ADBD305EA5A48AF41775C93BB6A61B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<svg width="200px" height="32px" viewBox="0 0 200 32" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. Generator: Sketch 58 (84663) - https://sketch.com -->. <title>Group</title>. <desc>Created with Sketch.</desc>. <defs>. <polygon id="path-1" points="0 0.440983607 50.4825137 0.440983607 50.4825137 25.136612 0 25.136612"></polygon>. </defs>. <g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="Carollo-Logo_White">. <g id="Group" transform="translate(0.000000, 0.648000)">. <g id="Group-4" transform="translate(0.000000, 6.203279)">. <mask id="mask-2" fill="white">. <use xlink:href="#path-1"></use>. </mask>. <g id="Clip-2"></g>. <path d="M35.2535519,0.886885246 C-15.6513661,5.40382514 -7.42021858,30.8174863 34.397

                                      Static File Info

                                      General

                                      File type:Unicode text, UTF-8 (with BOM) text, with very long lines (302), with CRLF line terminators
                                      Entropy (8bit):5.678299861245422
                                      TrID:
                                      • Text - UTF-8 encoded (3003/1) 100.00%
                                      File name:Message.eml
                                      File size:62'946 bytes
                                      MD5:d8c2b3b7019bdf03a6c217ca0ff3b590
                                      SHA1:54f3788d494b70612fd1200f5d5c04bcf375baa7
                                      SHA256:cecdb8beb225d584ee97826cf9b10a8cb4ec1ad5852f8482858d25deab8521e1
                                      SHA512:e8a4fae69b7b903175aee63775745b0200ed453f7a03fa6b6857868f2020587ea0ca36eeafbae56df432b333c24b357e25e15bf8228fe7867713c8f5674c467f
                                      SSDEEP:1536:g7o/97f/i4Nx8m5HA8Qll0elF7xlW4LV7:gu/78gQllv71V7
                                      TLSH:DB53A453D3426792807AC8B1B31277B4FB782A0C835245B091E776269F4EF5322A97FD
                                      File Content Preview:..."Received: from DS0PR10MB6703.namprd10.prod.outlook.com (2603:10b6:8:139::12).. by PH0PR10MB5793.namprd10.prod.outlook.com with HTTPS; Tue, 14 Jan 2025.. 12:01:25 +0000..Received: from SN6PR04CA0074.namprd04.prod.outlook.com (2603:10b6:805:f2::15).. by

                                      Static Mail

                                      General

                                      Subject:AZBEX 01-14-2025 - Back to Industrial for 6-Acre Tempe Site
                                      From:AZBEX <bex@azbex.com>
                                      To:B Huey <bhuey@carollo.com>
                                      Cc:
                                      BCC:
                                      Date:Tue, 14 Jan 2025 06:01:17 -0600
                                      Communications:
                                      • CAUTION: This email originated from outside Carollo Engineers. Do not open attachments or click links unless you recognize the sender. Check out the latest issue of AZBEX! [https://content.app-us1.com/cdn-cgi/image/onerror=redirect,width=650,dpr=2,fit=scale-down,format=auto/4GpbJ/2021/06/01/0bcd0bc2c9fb46e30d3143942715988e610ed0f4.jpeg?r=682257016] AZBEX FEATURED ARTICLE Back to Industrial for 6-Acre Tempe Site AZBEX 01-14-2025 Volume: 15 Issue: 92 START READING HERE <https://azbex.acemlna.com/lt.php?x=3DZy~GDMJnDL65OuzQ5NhOKh1aIji_f3wuY3X5M7JXWZE5z~yUy.0OFz13FziNfujfYxbHHFKXSa> UPCOMING BEX EVENTS [https://content.app-us1.com/cdn-cgi/image/onerror=redirect,width=650,dpr=2,fit=scale-down,format=auto/4GpbJ/2024/12/12/ca6ae514-2a15-4db0-b253-22738be6dcfe.jpeg?r=755188278]<https://azbex.acemlna.com/lt.php?x=3DZy~GDMJnDL65OuzQ5NhOKh1aIji_f3wuY3X5M7JXWZE5z~yUy.0OFz13FziNfujfYxbHHFKXOh> 2024 Arizona Builder's Exchange, LLC. All Rights Reserved. Forwarding, distributing or disseminating the downloaded copy, or any portion thereof, or of the content, is a violation of copyright and is expressly prohibited. Copyright violations will be prosecuted. Sent to: bhuey@carollo.com Unsubscribe<https://azbex.acemlna.com/proc.php?nl=2&c=1835&m=1900&s=950b57e5c8e2f1f3099e1802f450e081&act=unsub> Arizona Builder's Exchange, P.O. Box 12196, Tempe, AZ 85284, United States
                                      Attachments:

                                        Headers

                                        Key Value
                                        "Receivedfrom DS0PR10MB6703.namprd10.prod.outlook.com (2603:10b6:8:139::12) by PH0PR10MB5793.namprd10.prod.outlook.com with HTTPS; Tue, 14 Jan 2025 12:01:25 +0000
                                        Receivedby acems1.com id hgp90q395q8m for <bhuey@carollo.com>; Tue, 14 Jan 2025 12:01:17 +0000 (envelope-from <bounce-793876-1835-74-bhuey=carollo.com@em-793876.azbex.com>)
                                        Authentication-Resultsspf=pass (sender IP is 52.128.40.27) smtp.mailfrom=em-793876.azbex.com; dkim=pass (signature was verified) header.d=azbex.com;dmarc=pass action=none header.from=azbex.com;compauth=pass reason=100
                                        Received-SPFPass (protection.outlook.com: domain of em-793876.azbex.com designates 52.128.40.27 as permitted sender) receiver=protection.outlook.com; client-ip=52.128.40.27; helo=s4.csa2.acemsa3.com; pr=C
                                        DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; s=dk; d=acems5.com; h=To:From:Subject:Date:MIME-Version:Content-Type:Content-Transfer-Encoding: List-Unsubscribe:List-Unsubscribe-Post:Message-ID:From:To:Subject:Date; x=1736942477; bh=oHF4X7zv+C/h4iMmEjR+fLi7JNMjcSGznBrAh9eyKsM=; b=SxLfexBYctH7eLNCJf+YW4TyF8Cet+qluNjD79A2YDHsIExBlopuaiCOebAvCBiVQWl9bZiiHtsK Ep1c29iTXILxkq20vBL5rxurqSfj9PuUy0QhMTkK6kgQyLFRqmrIJF0jlDXZWKcoRRlWdWTH34sS IUICUNKKzk0xQDrB1uQ=
                                        X-MailerActiveCampaign Mailer
                                        CFBL-Addressfbl-report@acems1.com; report=arf
                                        ToB Huey <bhuey@carollo.com>
                                        FromAZBEX <bex@azbex.com>
                                        SubjectAZBEX 01-14-2025 - Back to Industrial for 6-Acre Tempe Site
                                        DateTue, 14 Jan 2025 06:01:17 -0600
                                        Content-Typemultipart/alternative; boundary="_=_swift-11966694706786520d7bf421.52066470_=_"
                                        Content-Transfer-Encoding7bit
                                        X-Report-AbusePlease report abuse here: abuse@acemserv.com
                                        X-midYmh1ZXlAY2Fyb2xsby5jb20gLCBjMTgzNSAsIG0xOTAwICwgczcyMjc
                                        x-virtual-mtas4.csa2.acemsa1.com
                                        Feedback-ID793876:793876.1835:s4.csa2.acemsa1.com:activecampaign
                                        X-250ok-CID793876-1835
                                        List-Unsubscribe<https://azbex.activehosted.com/box.php?nl=2&c=1835&m=1900&s=950b57e5c8e2f1f3099e1802f450e081&funcml=unsub2&luha=1>,<mailto:unsubscribe-dc89e422575a6cc4a1d0b6c3065e832f-1835-950b57e5c8e2f1f3099e1802f450e081@s4.csa2.acemsa2.com>
                                        List-Unsubscribe-PostList-Unsubscribe=One-Click
                                        X-DKIM-Optionss=acdkim1
                                        Message-ID<0.1.5.5B0.1DB667C04AE8D00.0@s4.csa1.acemsd5.com>
                                        Return-Pathbounce-793876-1835-74-bhuey=carollo.com@em-793876.azbex.com
                                        X-MS-Exchange-Organization-ExpirationStartTime14 Jan 2025 12:01:20.4535 (UTC)
                                        X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                                        X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                                        X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                                        X-MS-Exchange-Organization-Network-Message-Ida80c6697-9fc2-42bd-1d26-08dd349328b9
                                        X-EOPAttributedMessage0
                                        X-EOPTenantAttributedMessagef50354a0-4a5a-4fa1-b18f-8d1efb41b024:0
                                        X-MS-Exchange-Organization-MessageDirectionalityIncoming
                                        X-MS-PublicTrafficTypeEmail
                                        X-MS-TrafficTypeDiagnosticSA2PEPF000015CD:EE_|DS0PR10MB6703:EE_|PH0PR10MB5793:EE_
                                        X-MS-Exchange-Organization-AuthSourceSA2PEPF000015CD.namprd03.prod.outlook.com
                                        X-MS-Exchange-Organization-AuthAsAnonymous
                                        X-MS-Office365-Filtering-Correlation-Ida80c6697-9fc2-42bd-1d26-08dd349328b9
                                        X-MS-Exchange-AtpMessagePropertiesSA|SL
                                        X-MS-Exchange-Organization-SCL-1
                                        X-Microsoft-AntispamBCL:3;ARA:13230040|12012899012|4022899009|3072899012|2092899012|69100299015|1032899013|7053199007|5133199007|4076899003|2066899003|8096899003;
                                        X-Forefront-Antispam-ReportCIP:52.128.40.27;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKA;H:s4.csa2.acemsa3.com;PTR:s4.csa2.acemsa3.com;CAT:NONE;SFS:(13230040)(12012899012)(4022899009)(3072899012)(2092899012)(69100299015)(1032899013)(7053199007)(5133199007)(4076899003)(2066899003)(8096899003);DIR:INB;
                                        X-MS-Exchange-CrossTenant-OriginalArrivalTime14 Jan 2025 12:01:20.3285 (UTC)
                                        X-MS-Exchange-CrossTenant-Network-Message-Ida80c6697-9fc2-42bd-1d26-08dd349328b9
                                        X-MS-Exchange-CrossTenant-Idf50354a0-4a5a-4fa1-b18f-8d1efb41b024
                                        X-MS-Exchange-CrossTenant-AuthSourceSA2PEPF000015CD.namprd03.prod.outlook.com
                                        X-MS-Exchange-CrossTenant-AuthAsAnonymous
                                        X-MS-Exchange-CrossTenant-FromEntityHeaderInternet
                                        X-MS-Exchange-Transport-CrossTenantHeadersStampedDS0PR10MB6703
                                        X-MS-Exchange-Transport-EndToEndLatency00:00:05.0991719
                                        X-MS-Exchange-Processed-By-BccFoldering15.20.8356.008
                                        X-Microsoft-Antispam-Mailbox-Delivery ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
                                        X-Microsoft-Antispam-Message-Info OEIjWVvGCrnGspXsEPBaJfLOM1oc4lqC1jS35mHGQdpzl4XEmqyzd3qmjYdFiw3gqTZ4pA8LrG+nNOvSLiexLq8WSAKqZBmS2yTVuwHNFuG69cVfwnuSM/RYw8nWicPx1NuOrqG6NzxnWIHuczLF/qiQUORKP9r6hfv5ZsojaB3LCVMShrEnJRxioM8q0m7GiYFOl9DtSVLRAHw3djgVekz/rQFTge0aPxkGxGze3b1H+FYa5yo3RZibs0Xh5mMrWDCZyLrXI6MhmN5HUCvBsF8Th1HRtt93UmVXFQr39lZQfsO8QJsuKPpBlnGKbR5dhs/jmjAL2NXi4GKg/6qvA7+1v1FCkcULMPgWM5jI4QhH9oq+jEVwiHecBft9fa5cxbguyBYjzmBjGmJPEocpN4OZuu/MNUQmbn0G74yrBDwokFeoLs+yAckKml1BssAlKMY1ThkScVIO/ltKVmDIJEBrWVQjBuc83Eqx7VwCxvgsZ0ifhHktyY7OOWtQ2Fyoc/jqzbjgbtIfZioibK1awvsAcYZcT9dvY+JFw8cBJc05T3PZMAcf0y29VdGHmo5aZAsWRkuCSuwH8nMxdNjKptLDzYAkeqIheccExMSX28tSzzY5O9Rhd6WgNUfWmghYT2jj90tukB2gkSCbQ6xUr5oQQBJpkinqHOyvGs4+i5dqAIuv+uQruV5pLlxltR8HfNM8ulyNq6HaoMDnFCEVXVHXTBX4DvG1cIRxh2dX/pWd4+SS9E5UvtTT/C2SSCA+VkW/6MwGjtWEGYeUCZVNo0eDKAiM02l66sYNAmZOud90s/K/fp69bFSFZuAXNH/ZNDrP58+x+9qgpecS7HoAwcnKOSUmg5I7NE4D+DzqSgUquZlCOXNYREWPlkD+Ye4oyz8takikbMX0gU5aJfklWe30TN9Tj61xtLQ7PcCOiWH8YSd2PgphlYnk8lGw6mSc+PMxae9B3xdskFtjwLuWvFzCy+f7KNfjru6MnGdCvW28uwojYOM5ykxsW94/J/r4qyUXsARgPjtCVgiAhFUSKcBBm9d/TLXBOs4tVK9t+LCidWwgsReJHwyqrbYprZBjaqu07lT2TF9eqIkbnv6EUJRkySTwriojKVxvuO54BSW99UL0Pa5FxsAEursTA3t7ZUqxk7F2YwtzgQzqRORNOjAF2PVENiI0j3JYkLpdRvFDsrFfnZV+hUHJpmEpCrx29N9mUD7dZIuxG7uPgT4Ei8iZnKWvQDpiDXdO0AE/bAnj4IQolN8R4/1Zd6JenzJsoxhk1pEWcVGFSAgrH84yGvy4YYtALzu9C6ZsFLKN3dQ+khuGKVjVfkb12AKj7XM7pWqoL0gJ77H3khdOFDQF90I8GDaYIwq6clS9U1GGWv2XiE/lae3+bQz/+XYt0oJ++Z2XBLoEN9YDc/6YNJlUILhINnUkjfwylJtWSilkJpPTt0ko32UvWPYKAEgq1e2wGyh7AnKnTH8mHiX/KTnZsP0pc4W+nWZont326k2EqkDW7NuzLY6/2EYeqlK4OZ1ieENOEP1mjTAzToe/ORkAygu1i0zReQGBf271hAEaeNs6PtfqJenATQ4vXxbkMFh42nwOYZstHX1tObrIRA1JW7PmCgST0CSFHRNVrWz5t1Pc8aUL8sZumYmgeuDPv2W23vpSnSQo2FGNhoTJzVKRQWopMs198iW2PnZoTfGecBqwJWh0ii3uVNrnPFRRV0hBpwZWQYO0OrS6a+weSq89YbIpVloUYAs3oMpjaZAKxu0dpNksjJ7WT54thE/ni/Ef41/tK/D5MtevE4ifgdMgKVdYne+X56VW7bSps29O/I/W2p+AY/G8/BW4cp7Wy46bd5WiJEMLyZ70IOYb5KTSiHfyosDYSMiVQ9WDrEMMgPr/o9lnyB0/zDHyRDlLTZ5gD1g2WS1CX+RwOjwoKzZBwoZ3c7weimCghZySfIZAOyM2ijT2FeEu3bJgd1Ef42LJh4Xo1sGYOFhCgYoYVO5HOpo8ghco1MmsrRuB3xhCqJKEZFZkGutBN4ULJTZ3X2NrqIfuD3oAnusJR1/cPQWL64K1YhZQxV/Wis5mtiyuErebexN7EPqsGotOXVGCw7eCVgcYS19mLYhVVYl9vmVQ5WhwlWGoIVfxO/yUYlJDm+INxgz4o1pvL4t4ahKTJf60ouwnP8Jsvr7IfklD/3mAtFVpvHB53uLqmuuYxxFLmAZS07qBLXDkTj21iB1wIAFtCDBJk81l0nHed82XZlOulEW5nkw26t8xv0mbv0vFj8IZ7ngrwUXbIxNJFrABY1YTw37UA/Ydx97hE670G3CeFAV21Pu24bgEyGCj0VPifrCv6nXGb5VwwJ4RuNPnQNxb/fuV0MK2WTeWos8Ra3GkiYsylKuFk7u675iqJX3ADMWfsJFbLaJL13htKMn4HESa
                                        MIME-Version1.0

                                        File Icon

                                        Icon Hash:46070c0a8e0c67d6