Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Message.eml

Overview

General Information

Sample name:Message.eml
Analysis ID:1591119
MD5:d8c2b3b7019bdf03a6c217ca0ff3b590
SHA1:54f3788d494b70612fd1200f5d5c04bcf375baa7
SHA256:cecdb8beb225d584ee97826cf9b10a8cb4ec1ad5852f8482858d25deab8521e1
Infos:

Detection

HTMLPhisher
Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected BlockedWebSite
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 7044 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Message.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6192 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "FAD60584-3469-45EE-A4CA-E93E2A680AE4" "7FE11D6A-C59C-4401-BAC4-855B94BA1379" "7044" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 7040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fazbex.acemlna.com%2Flt.php%3Fx%3D3DZy~GDMJnDL65OuzQ5NhOKh1aIji_f3wuY3X5M7JXWZE5z~yUy.0OFz13FziNfujfYxbHHFKXSa&data=05%7C02%7Cbhuey%40carollo.com%7Ca80c66979fc242bd1d2608dd349328b9%7Cf50354a04a5a4fa1b18f8d1efb41b024%7C0%7C0%7C638724528856822158%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=A9KZ4SEWrgSCTOmUbkM40BenkS%2FCpr99TYThOPEp6SI%3D&reserved=0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 1444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1936,i,1876279333433813221,88509731900339423,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
dropped/chromecache_77JoeSecurity_BlockedWebSiteYara detected BlockedWebSiteJoe Security

    HTML

    SourceRuleDescriptionAuthorStrings
    0.0.pages.csvJoeSecurity_BlockedWebSiteYara detected BlockedWebSiteJoe Security

      Sigma Signatures

      Sigma detected: Office Autorun Keys Modification
      Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7044, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

      Suricata Signatures

      ⊘No Suricata rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      Phishing

      barindex
      Yara detected BlockedWebSite
      Source: Yara matchFile source: 0.0.pages.csv, type: HTML
      Source: Yara matchFile source: dropped/chromecache_77, type: DROPPED
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
      Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
      Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
      Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
      Source: unknownTCP traffic detected without corresponding DNS query: 54.235.205.181
      Source: unknownTCP traffic detected without corresponding DNS query: 54.235.205.181
      Source: unknownTCP traffic detected without corresponding DNS query: 216.58.206.74
      Source: unknownTCP traffic detected without corresponding DNS query: 216.58.206.74
      Source: unknownTCP traffic detected without corresponding DNS query: 216.58.206.67
      Source: unknownTCP traffic detected without corresponding DNS query: 216.58.206.67
      Source: global trafficDNS traffic detected: DNS query: nam10.safelinks.protection.outlook.com
      Source: global trafficDNS traffic detected: DNS query: carollo.com
      Source: global trafficDNS traffic detected: DNS query: www.google.com
      Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
      Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49691 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
      Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
      Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
      Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
      Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49694 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49694
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49691
      Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
      Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
      Source: classification engineClassification label: mal48.phis.winEML@17/14@10/184
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250114T1153390007-7044.etl
      Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Message.eml"
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "FAD60584-3469-45EE-A4CA-E93E2A680AE4" "7FE11D6A-C59C-4401-BAC4-855B94BA1379" "7044" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fazbex.acemlna.com%2Flt.php%3Fx%3D3DZy~GDMJnDL65OuzQ5NhOKh1aIji_f3wuY3X5M7JXWZE5z~yUy.0OFz13FziNfujfYxbHHFKXSa&data=05%7C02%7Cbhuey%40carollo.com%7Ca80c66979fc242bd1d2608dd349328b9%7Cf50354a04a5a4fa1b18f8d1efb41b024%7C0%7C0%7C638724528856822158%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=A9KZ4SEWrgSCTOmUbkM40BenkS%2FCpr99TYThOPEp6SI%3D&reserved=0
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1936,i,1876279333433813221,88509731900339423,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "FAD60584-3469-45EE-A4CA-E93E2A680AE4" "7FE11D6A-C59C-4401-BAC4-855B94BA1379" "7044" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fazbex.acemlna.com%2Flt.php%3Fx%3D3DZy~GDMJnDL65OuzQ5NhOKh1aIji_f3wuY3X5M7JXWZE5z~yUy.0OFz13FziNfujfYxbHHFKXSa&data=05%7C02%7Cbhuey%40carollo.com%7Ca80c66979fc242bd1d2608dd349328b9%7Cf50354a04a5a4fa1b18f8d1efb41b024%7C0%7C0%7C638724528856822158%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=A9KZ4SEWrgSCTOmUbkM40BenkS%2FCpr99TYThOPEp6SI%3D&reserved=0
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1936,i,1876279333433813221,88509731900339423,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
      DLL Side-Loading      		1
      Process Injection      		1
      Masquerading      		OS Credential Dumping1
      Process Discovery      		Remote ServicesData from Local System2
      Encrypted Channel      		Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/Job1
      Registry Run Keys / Startup Folder      		1
      DLL Side-Loading      		1
      Process Injection      		LSASS Memory13
      System Information Discovery      		Remote Desktop ProtocolData from Removable Media1
      Non-Application Layer Protocol      		Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
      Registry Run Keys / Startup Folder      		1
      DLL Side-Loading      		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
      Application Layer Protocol      		Automated ExfiltrationData Encrypted for Impact

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      ⊘No Antivirus matches

      Dropped Files

      ⊘No Antivirus matches

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      nam10.safelinks.eop-tm2.outlook.com
      		104.47.55.28
      		truefalse
        		unknown
        carollo.com
        		172.66.41.15
        		truefalse
          		high
          www.google.com
          		142.250.185.100
          		truefalse
            		high
            nam10.safelinks.protection.outlook.com
            		unknown
            		unknownfalse
              		unknown

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fazbex.acemlna.com%2Flt.php%3Fx%3D3DZy~GDMJnDL65OuzQ5NhOKh1aIji_f3wuY3X5M7JXWZE5z~yUy.0OFz13FziNfujfYxbHHFKXSa&data=05%7C02%7Cbhuey%40carollo.com%7Ca80c66979fc242bd1d2608dd349328b9%7Cf50354a04a5a4fa1b18f8d1efb41b024%7C0%7C0%7C638724528856822158%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=A9KZ4SEWrgSCTOmUbkM40BenkS%2FCpr99TYThOPEp6SI%3D&reserved=0false
                		unknown

                World Map of Contacted IPs

                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs

                Public IPs

                IPDomainCountryFlagASNASN NameMalicious
                52.113.194.132
                		unknownUnited States
                		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                172.66.41.15
                		carollo.comUnited States
                		13335CLOUDFLARENETUSfalse
                104.47.70.28
                		unknownUnited States
                		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                1.1.1.1
                		unknownAustralia
                		13335CLOUDFLARENETUSfalse
                173.194.76.84
                		unknownUnited States
                		15169GOOGLEUSfalse
                216.58.206.78
                		unknownUnited States
                		15169GOOGLEUSfalse
                2.16.168.101
                		unknownEuropean Union
                		20940AKAMAI-ASN1EUfalse
                142.250.185.100
                		www.google.comUnited States
                		15169GOOGLEUSfalse
                104.47.55.28
                		nam10.safelinks.eop-tm2.outlook.comUnited States
                		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                172.217.23.110
                		unknownUnited States
                		15169GOOGLEUSfalse
                104.208.16.91
                		unknownUnited States
                		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                239.255.255.250
                		unknownReserved
                		unknownunknownfalse
                52.109.28.47
                		unknownUnited States
                		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                52.109.32.97
                		unknownUnited States
                		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                142.250.186.131
                		unknownUnited States
                		15169GOOGLEUSfalse
                2.23.242.162
                		unknownEuropean Union
                		8781QA-ISPQAfalse
                142.250.184.227
                		unknownUnited States
                		15169GOOGLEUSfalse

                Private

                IP
                192.168.2.17
                192.168.2.16
                192.168.2.4

                General Information

                Joe Sandbox version:42.0.0 Malachite
                Analysis ID:1591119
                Start date and time:2025-01-14 17:53:04 +01:00
                Joe Sandbox product:CloudBasic
                Overall analysis duration:
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:defaultwindowsinteractivecookbook.jbs
                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                Number of analysed new started processes analysed:16
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • EGA enabled
                Analysis Mode:stream
                Analysis stop reason:Timeout
                Sample name:Message.eml
                Detection:MAL
                Classification:mal48.phis.winEML@17/14@10/184
                Cookbook Comments:
                • Found application associated with file extension: .eml

                Warnings

                • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
                • Excluded IPs from analysis (whitelisted): 52.109.32.97, 2.23.242.162, 52.109.28.47, 52.113.194.132, 2.16.168.101, 2.16.168.119, 20.190.159.2, 20.190.159.64, 20.190.159.73, 20.190.159.4, 40.126.31.71, 40.126.31.73, 20.190.159.71, 20.190.159.68, 4.245.163.56
                • Excluded domains from analysis (whitelisted): omex.cdn.office.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, login.live.com, e16604.g.akamaiedge.net, sls.update.microsoft.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, prod.fs.microsoft.com.akadns.net, a1864.dscd.akamai.net, glb.sls.prod.dcat.dsp.trafficmanager.net, ecs.office.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, s-0005-office.config.skype.com, login.msa.msidentity.com, uks-azsc-000.roaming.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, ww
                • Not all processes where analyzed, report is missing behavior information
                • Report size getting too big, too many NtQueryAttributesFile calls found.
                • Report size getting too big, too many NtQueryValueKey calls found.
                • Report size getting too big, too many NtReadVirtualMemory calls found.
                • VT rate limit hit for: nam10.safelinks.eop-tm2.outlook.com

                Created / dropped Files

                C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250114T1153390007-7044.etl

                Download File
                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                File Type:data
                Category:modified
                Size (bytes):98304
                Entropy (8bit):4.473607905429714
                Encrypted:false
                SSDEEP:
                MD5:1521779EAFAB64117BF17B5EF70421C6
                SHA1:D443CD6E6F308820CAE47E5FFBAF76080628FDD0
                SHA-256:B533E421EEE9DC5D4E21CA867A96A7657DD3F3DA5A9E8C813481C09F45CF4963
                SHA-512:77A770221130938A32F7145F0671C41FF6B3E8AB9B0059552B72930B751A565B5A1EDE09E373A19A941A92B4B503D8D9963D3E35A5C2F72016B319C82AE6D3FA
                Malicious:false
                Reputation:unknown
                Preview:............................................................................`...............f..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0..z.Y..............f..........v.2._.O.U.T.L.O.O.K.:.1.b.8.4.:.9.6.1.4.5.a.6.7.2.6.8.5.4.5.f.1.a.c.f.c.6.4.8.f.f.1.5.7.0.0.8.1...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.5.0.1.1.4.T.1.1.5.3.3.9.0.0.0.7.-.7.0.4.4...e.t.l.......P.P..........{..f..........................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 15:53:56 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                Category:dropped
                Size (bytes):2673
                Entropy (8bit):3.989087427279164
                Encrypted:false
                SSDEEP:
                MD5:EABB6E865C31726C16D547B1F78CAA09
                SHA1:FB9417268DB848746BA71535FEE5D01EA6ABA3FB
                SHA-256:18CD6AC7889DCD2CCC68D0B2EA44F3AEB7EACC306B4A34EEEF08EBE71F51BA21
                SHA-512:E923AB7D90160EF7A3660831ABB85DEC7B2A422904A817EAA2112A299AC5A12718C402757248028B79D6794EE9BE74D774D3E2D415BEB5C8CE63B59397228288
                Malicious:false
                Reputation:unknown
                Preview:L..................F.@.. ...$+.,....O...f..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 15:53:56 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                Category:dropped
                Size (bytes):2675
                Entropy (8bit):4.004191931244718
                Encrypted:false
                SSDEEP:
                MD5:3AB488FDC5C8CFA7055C131540978776
                SHA1:0822B472C4898B19A64D8F73A9BE08952DDE7F2C
                SHA-256:0C6C7C237CAC7EB963EE1780A3EC6835C71483C8599AB89450F314F0BF48BCC0
                SHA-512:D7B3081271F7B1707DF83ABF26F49C4C338DD53EA9F10C2B8BF8F5F457D5932BD333A92399AE6D4674365211C267B516052864A6838016F0127A70835CA5A2B9
                Malicious:false
                Reputation:unknown
                Preview:L..................F.@.. ...$+.,........f..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                Category:dropped
                Size (bytes):2689
                Entropy (8bit):4.012506659585017
                Encrypted:false
                SSDEEP:
                MD5:2CBE4AEFD153A49B152FBB913B036A24
                SHA1:E31A1C5A9CDC2931EBAF62579F529D8F69228B71
                SHA-256:2B731FE46F90C86522C3AC9EE3256E87DD85AFA8072126B1CF58D86BB0278AC4
                SHA-512:26C8194304AE3F9455583DA3A5DF64B32E6B378E595DEB84B803F1E01FD054053BBB60972D541A6A48DD63C6AA41F9B22ABD571DA44CB8377118B28725B11987
                Malicious:false
                Reputation:unknown
                Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 15:53:56 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                Category:dropped
                Size (bytes):2677
                Entropy (8bit):4.002643722004718
                Encrypted:false
                SSDEEP:
                MD5:DD0C19BC5178EF697E0BC0C4E62CFA1D
                SHA1:2F02BE00727AA311F2B5EB2DF3434A14B287B9E2
                SHA-256:022EC82C9E904D54B198F927DC4724C9DBCC70C5E9E90E6EAE86B190FB82407E
                SHA-512:7C50AF62D924E5049A4777A4A53F70DD0C38E49889AB26CCB49D83266204CF29662E6F0FDB82B50584A4832DDCD4E46EFA6DB0B74E54218A273CE290FE0A7895
                Malicious:false
                Reputation:unknown
                Preview:L..................F.@.. ...$+.,........f..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 15:53:56 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                Category:dropped
                Size (bytes):2677
                Entropy (8bit):3.9948487829906427
                Encrypted:false
                SSDEEP:
                MD5:1CB8F5D3E7536D7CFF7D0D5FBECD2CEC
                SHA1:7C7EEFBCA64040A991B05980A56E895DC24B229A
                SHA-256:E775215C08ED5ED5438B06054597A92A3736B9CC35569C0B037511F1284D7DF9
                SHA-512:68D230EBB6232D9CF00102EEAF6C9D383957098E187CFCFA4B140D1E4756A4F07A4ECDCE733A514745F44C3FB935D99758F45F56CCFA1C30FCF88A7DA73A7D2D
                Malicious:false
                Reputation:unknown
                Preview:L..................F.@.. ...$+.,........f..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 15:53:56 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                Category:dropped
                Size (bytes):2679
                Entropy (8bit):4.0033657307642745
                Encrypted:false
                SSDEEP:
                MD5:62000F3AEE85BC89820B760691FDA72F
                SHA1:A84295A05C35B2511A97F8A1C93660F2458866AE
                SHA-256:AA6925FDFFA8320F8B15D5BF6D59FDD140651B04E4594F94FF7F1CD77B4FE023
                SHA-512:3F696623C49AB3F373E058320D4B1C7721E29837BF2901CE18FBC8D077F0AB4AEAF6F96B22C86DE26FD4FF822838A6B547EC7E0EF974ED3DA9370B904F54073D
                Malicious:false
                Reputation:unknown
                Preview:L..................F.@.. ...$+.,.....u..f..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                Download File
                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                File Type:Microsoft Outlook email folder (>=2003)
                Category:dropped
                Size (bytes):271360
                Entropy (8bit):3.849426595553037
                Encrypted:false
                SSDEEP:
                MD5:3482EE699EF5CC4A3C0417D8CAE24297
                SHA1:E37348461FBEA5D01AF4978E822B09624A77C8BC
                SHA-256:0873E1342081D6686143BE0A5707F7227D2B3A97FBE36DE9810F490C55F2430B
                SHA-512:F29FEDCAB8EF4FEF185E407E3EBA8DEBE85DB8B8C51817FDC447018DB35413B695DD4C3AF52A958B57D9F84B415297C794B5D652581FDFE906CFF7EDB2D10311
                Malicious:false
                Reputation:unknown
                Preview:!BDN..?.SM......\...............>.......`................@...........@...@...................................@...........................................................................$.......D......@...............=........2......:...........................................................................................................................................................................................................................................................................................(........h,.D.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                Download File
                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                File Type:data
                Category:dropped
                Size (bytes):131072
                Entropy (8bit):5.076145967739276
                Encrypted:false
                SSDEEP:
                MD5:37AE6A0C88A8DE4EA65CE85C27D1A184
                SHA1:3E745F18BF9B0DA7EFC5CC5B717BF0B54D309C6F
                SHA-256:F94D59FE60343AA0A072C78E64BACB4D0C1C0F1B5AD99F711E456CDB047C97A3
                SHA-512:092E0A8F76D87B8EFB622E4B3B5ADE6808A455C6D8314C186BFB4EFACC4690E118AF7753290D627825EDE36C8A1445E1D0873D317E622F231DE269C55B5D3E64
                Malicious:false
                Reputation:unknown
                Preview:....C...d...........`u..f....................#.!BDN..?.SM......\...............>.......`................@...........@...@...................................@...........................................................................$.......D......@...............=........2......:...........................................................................................................................................................................................................................................................................................(........h,.D...`u..f.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                Chrome Cache Entry: 71

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:SVG Scalable Vector Graphics image
                Category:dropped
                Size (bytes):13436
                Entropy (8bit):4.164300805839878
                Encrypted:false
                SSDEEP:
                MD5:FD8B472142D08A399531F41F01F4876D
                SHA1:9120EAF66293457B10D9DE9A9BBC385275B1382B
                SHA-256:ED66E49C9B7621B3024991508FA3873E060149A24ED3216451F704D5CBB0F419
                SHA-512:265923DC3653102C75759A6F8840CD82494037EC1C33D57E5687A2A5D57A0A57BE4D6945B9150065611FEA95A2749E82D7ADBD305EA5A48AF41775C93BB6A61B
                Malicious:false
                Reputation:unknown
                Preview:<?xml version="1.0" encoding="UTF-8"?>.<svg width="200px" height="32px" viewBox="0 0 200 32" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. Generator: Sketch 58 (84663) - https://sketch.com -->. <title>Group</title>. <desc>Created with Sketch.</desc>. <defs>. <polygon id="path-1" points="0 0.440983607 50.4825137 0.440983607 50.4825137 25.136612 0 25.136612"></polygon>. </defs>. <g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="Carollo-Logo_White">. <g id="Group" transform="translate(0.000000, 0.648000)">. <g id="Group-4" transform="translate(0.000000, 6.203279)">. <mask id="mask-2" fill="white">. <use xlink:href="#path-1"></use>. </mask>. <g id="Clip-2"></g>. <path d="M35.2535519,0.886885246 C-15.6513661,5.40382514 -7.42021858,30.8174863 34.397

                Chrome Cache Entry: 72

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:ASCII text, with CRLF line terminators
                Category:downloaded
                Size (bytes):3932
                Entropy (8bit):5.202197618496175
                Encrypted:false
                SSDEEP:
                MD5:BBAD95C4A0BE4E5775B7D5B409FBF602
                SHA1:FAD598750B15C207DFEF6E1FEA3C072BAEAC2B66
                SHA-256:41F78D15AE18C36B84C819D9AF3511C342C180F0ABA8F91DC1CCF4046B56B308
                SHA-512:4006994F240E4DAB7134F1B716E51E4FFC0DD495EAF3269165FB0C27D89B2F19063AF17086553B39507199D62DBCD8BA6F07F34770BCAF15C40CF5EF06419631
                Malicious:false
                Reputation:unknown
                URL:https://nam10.safelinks.protection.outlook.com/Content/Scripts/safelinksv2.css
                Preview:@charset "UTF-8";../* CSS Document */....body{...margin:0px;...padding:0px;..}....div{.. text-align:left;..}....#recommendation_container{...width:100%;..}....#icon img {...margin-left: 40px;...margin-top: 45px;..}....#url {height: 32px;..background-color: #f4f4f4;..margin-left: 40px;..margin-right: 40px;..margin-bottom: 20px;..margin-top: 0px;..font-family: Segoe, "Segoe UI", "DejaVu Sans", "Trebuchet MS", Verdana, "sans-serif";..display: inline-block;..}....#url p {...margin:4px 12px;..}......#close {height: 32px;..background-color: #0078d7;..margin-left: 40px;..margin-right:40px;..margin-top:20px;..padding: 4px 12px 8px 12px;..font-family: Segoe, "Segoe UI", "DejaVu Sans", "Trebuchet MS", Verdana, "sans-serif";..width: auto;..display: inline-block;..color: #fff;..border: 0;...font-size:100%;..}....#text {...margin-left:40px;...margin-right: 40px;...margin-top: 0px;...font-family: Segoe, "Segoe UI", "DejaVu Sans", "Trebuchet MS", Verdana, "sans-serif";..}....#tips {...margin-left:

                Chrome Cache Entry: 74

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:PNG image data, 186 x 200, 8-bit/color RGBA, non-interlaced
                Category:downloaded
                Size (bytes):25664
                Entropy (8bit):4.972505404550475
                Encrypted:false
                SSDEEP:
                MD5:FF4FEDB556605288FEC259EE6B8D5981
                SHA1:BBC525AB65E54999044F14FF8F31CF25EEDB7754
                SHA-256:2809B6F62DC341D238F02C33C7347A7BA714F10B6F075BDD39A1CD7C68CE9807
                SHA-512:9EAE6F8D1822A1EF91B909B0D6A8826BFB323BD34FA76FBF0A2DCA99B5F580BA09173ECD2068F393979EBAE248BF5FF1FC592C5D43D5EEB33E0EC6DDE93E8349
                Malicious:false
                Reputation:unknown
                URL:https://nam10.safelinks.protection.outlook.com/Content/images/cross.png
                Preview:.PNG........IHDR............._..;....pHYs...%...%.IR$....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                Chrome Cache Entry: 75

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1588
                Entropy (8bit):5.174121809218917
                Encrypted:false
                SSDEEP:
                MD5:3AF1FDB9A3F664A6683D212F4787733A
                SHA1:59063D49B723A1988236C8D39C2804C6EBC5FF95
                SHA-256:A9CE4840FF0D613B456081DEA64E46EB717A1F8BFA5AFB05D3BD058F294E416C
                SHA-512:F8872E0C875BE6037C14480630E461FC1ADFA2049DB03BAE5D8CB6B320A2C084D4B266AEB02E24009B4BA84821E216690CA875B165164447FE8329B48C9E261F
                Malicious:false
                Reputation:unknown
                Preview:window.onload = function OnLoadHandler(){...if (window.history.length <= 1) {....document.getElementById("close").style.display = "none";...}..}....var theme = null;..try {.. (function (URLSearchParams, str) {.. if (!new URLSearchParams(window.location.search).get(str)){....throw URLSearchParams;...}....var urlParams = new URLSearchParams(window.location.search);....if (urlParams.has(str)){.....theme = String(urlParams.get(str));....}.. }(URLSearchParams, "theme"));..} catch(URLSearchParams){...var params = {}...var parts = window.location.search.substring(1).split('&');...for (var i = 0; i < parts.length; i++) {....var val = parts[i].split('=');....if (!val[0]) continue;....params[val[0]] = val[1] || true;...}...theme = params["theme"];...}....// Load theme specific css..if (theme === "dark"){...AddCSS("Safelinksv2-dark.css");..}..else if (theme === "contrast"){...AddCSS("Safelinksv2-highcontrast.css")..}....// Add CSS based on theme..function AddCSS(fileName){... var ss = docume

                Chrome Cache Entry: 77

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:HTML document, ASCII text, with very long lines (2258), with CRLF line terminators
                Category:downloaded
                Size (bytes):4777
                Entropy (8bit):5.776061581475435
                Encrypted:false
                SSDEEP:
                MD5:25B4792AD1F904B97B31B3D509721569
                SHA1:EE0A83D4E9A0F6D410380BD0E3275C3ADA49A503
                SHA-256:11495599B90986CD08FF89D7236B717D919269F62FEFCA3FBA5690403D065623
                SHA-512:E9152A19A7E9F96EAEB0222FBAC92037F03956518DD1B1828A739AFD14054AF14CC89E60F634AEA7AF8296486EDF83E37889F267527D911043CB8D950D51320A
                Malicious:false
                Reputation:unknown
                URL:https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fazbex.acemlna.com%2Flt.php%3Fx%3D3DZy~GDMJnDL65OuzQ5NhOKh1aIji_f3wuY3X5M7JXWZE5z~yUy.0OFz13FziNfujfYxbHHFKXSa&data=05%7C02%7Cbhuey%40carollo.com%7Ca80c66979fc242bd1d2608dd349328b9%7Cf50354a04a5a4fa1b18f8d1efb41b024%7C0%7C0%7C638724528856822158%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=A9KZ4SEWrgSCTOmUbkM40BenkS%2FCpr99TYThOPEp6SI%3D&reserved=0
                Preview:<!doctype html>..<html>..<head>.. <meta charset="UTF-8">.. <title>Microsoft Defender for Office 365</title>.. <meta name="referrer" content="same-origin" />.. <meta name="robots" content="noindex,nofollow" />.. <link rel="icon" href="data:,">.... <base href="https://nam10.safelinks.protection.outlook.com">.... <link href="/Content/Scripts/safelinksv2.css" rel="stylesheet" />.. <script src="/Content/Scripts/site.js" type="text/javascript"></script>..</head>..<body>.. <div id="header_container_branding" style="background-color: #000000;">.. <div id="header_branding">.. <a href="https://www.carollo.com/"><img src="https://carollo.com/wp-content/themes/carollo_2020/images/logo-home.svg" style="max-height: 30px;" /></a>.. </div>.. </div>.. <div id="header_container_blocked">.. <div id="header">.. <div id="icon"><img src="/Content/images/cross.png" alt="" height="100" width="94"></div>..

                Static File Info

                General

                File type:Unicode text, UTF-8 (with BOM) text, with very long lines (302), with CRLF line terminators
                Entropy (8bit):5.678299861245422
                TrID:
                • Text - UTF-8 encoded (3003/1) 100.00%
                File name:Message.eml
                File size:62'946 bytes
                MD5:d8c2b3b7019bdf03a6c217ca0ff3b590
                SHA1:54f3788d494b70612fd1200f5d5c04bcf375baa7
                SHA256:cecdb8beb225d584ee97826cf9b10a8cb4ec1ad5852f8482858d25deab8521e1
                SHA512:e8a4fae69b7b903175aee63775745b0200ed453f7a03fa6b6857868f2020587ea0ca36eeafbae56df432b333c24b357e25e15bf8228fe7867713c8f5674c467f
                SSDEEP:1536:g7o/97f/i4Nx8m5HA8Qll0elF7xlW4LV7:gu/78gQllv71V7
                TLSH:DB53A453D3426792807AC8B1B31277B4FB782A0C835245B091E776269F4EF5322A97FD
                File Content Preview:..."Received: from DS0PR10MB6703.namprd10.prod.outlook.com (2603:10b6:8:139::12).. by PH0PR10MB5793.namprd10.prod.outlook.com with HTTPS; Tue, 14 Jan 2025.. 12:01:25 +0000..Received: from SN6PR04CA0074.namprd04.prod.outlook.com (2603:10b6:805:f2::15).. by

                Static Mail

                General

                Subject:AZBEX 01-14-2025 - Back to Industrial for 6-Acre Tempe Site
                From:AZBEX <bex@azbex.com>
                To:B Huey <bhuey@carollo.com>
                Cc:
                BCC:
                Date:Tue, 14 Jan 2025 06:01:17 -0600
                Communications:
                • CAUTION: This email originated from outside Carollo Engineers. Do not open attachments or click links unless you recognize the sender. Check out the latest issue of AZBEX! [https://content.app-us1.com/cdn-cgi/image/onerror=redirect,width=650,dpr=2,fit=scale-down,format=auto/4GpbJ/2021/06/01/0bcd0bc2c9fb46e30d3143942715988e610ed0f4.jpeg?r=682257016] AZBEX FEATURED ARTICLE Back to Industrial for 6-Acre Tempe Site AZBEX 01-14-2025 Volume: 15 Issue: 92 START READING HERE <https://azbex.acemlna.com/lt.php?x=3DZy~GDMJnDL65OuzQ5NhOKh1aIji_f3wuY3X5M7JXWZE5z~yUy.0OFz13FziNfujfYxbHHFKXSa> UPCOMING BEX EVENTS [https://content.app-us1.com/cdn-cgi/image/onerror=redirect,width=650,dpr=2,fit=scale-down,format=auto/4GpbJ/2024/12/12/ca6ae514-2a15-4db0-b253-22738be6dcfe.jpeg?r=755188278]<https://azbex.acemlna.com/lt.php?x=3DZy~GDMJnDL65OuzQ5NhOKh1aIji_f3wuY3X5M7JXWZE5z~yUy.0OFz13FziNfujfYxbHHFKXOh> 2024 Arizona Builder's Exchange, LLC. All Rights Reserved. Forwarding, distributing or disseminating the downloaded copy, or any portion thereof, or of the content, is a violation of copyright and is expressly prohibited. Copyright violations will be prosecuted. Sent to: bhuey@carollo.com Unsubscribe<https://azbex.acemlna.com/proc.php?nl=2&c=1835&m=1900&s=950b57e5c8e2f1f3099e1802f450e081&act=unsub> Arizona Builder's Exchange, P.O. Box 12196, Tempe, AZ 85284, United States
                Attachments:

                  Headers

                  Key Value
                  "Receivedfrom DS0PR10MB6703.namprd10.prod.outlook.com (2603:10b6:8:139::12) by PH0PR10MB5793.namprd10.prod.outlook.com with HTTPS; Tue, 14 Jan 2025 12:01:25 +0000
                  Receivedby acems1.com id hgp90q395q8m for <bhuey@carollo.com>; Tue, 14 Jan 2025 12:01:17 +0000 (envelope-from <bounce-793876-1835-74-bhuey=carollo.com@em-793876.azbex.com>)
                  Authentication-Resultsspf=pass (sender IP is 52.128.40.27) smtp.mailfrom=em-793876.azbex.com; dkim=pass (signature was verified) header.d=azbex.com;dmarc=pass action=none header.from=azbex.com;compauth=pass reason=100
                  Received-SPFPass (protection.outlook.com: domain of em-793876.azbex.com designates 52.128.40.27 as permitted sender) receiver=protection.outlook.com; client-ip=52.128.40.27; helo=s4.csa2.acemsa3.com; pr=C
                  DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; s=dk; d=acems5.com; h=To:From:Subject:Date:MIME-Version:Content-Type:Content-Transfer-Encoding: List-Unsubscribe:List-Unsubscribe-Post:Message-ID:From:To:Subject:Date; x=1736942477; bh=oHF4X7zv+C/h4iMmEjR+fLi7JNMjcSGznBrAh9eyKsM=; b=SxLfexBYctH7eLNCJf+YW4TyF8Cet+qluNjD79A2YDHsIExBlopuaiCOebAvCBiVQWl9bZiiHtsK Ep1c29iTXILxkq20vBL5rxurqSfj9PuUy0QhMTkK6kgQyLFRqmrIJF0jlDXZWKcoRRlWdWTH34sS IUICUNKKzk0xQDrB1uQ=
                  X-MailerActiveCampaign Mailer
                  CFBL-Addressfbl-report@acems1.com; report=arf
                  ToB Huey <bhuey@carollo.com>
                  FromAZBEX <bex@azbex.com>
                  SubjectAZBEX 01-14-2025 - Back to Industrial for 6-Acre Tempe Site
                  DateTue, 14 Jan 2025 06:01:17 -0600
                  Content-Typemultipart/alternative; boundary="_=_swift-11966694706786520d7bf421.52066470_=_"
                  Content-Transfer-Encoding7bit
                  X-Report-AbusePlease report abuse here: abuse@acemserv.com
                  X-midYmh1ZXlAY2Fyb2xsby5jb20gLCBjMTgzNSAsIG0xOTAwICwgczcyMjc
                  x-virtual-mtas4.csa2.acemsa1.com
                  Feedback-ID793876:793876.1835:s4.csa2.acemsa1.com:activecampaign
                  X-250ok-CID793876-1835
                  List-Unsubscribe<https://azbex.activehosted.com/box.php?nl=2&c=1835&m=1900&s=950b57e5c8e2f1f3099e1802f450e081&funcml=unsub2&luha=1>,<mailto:unsubscribe-dc89e422575a6cc4a1d0b6c3065e832f-1835-950b57e5c8e2f1f3099e1802f450e081@s4.csa2.acemsa2.com>
                  List-Unsubscribe-PostList-Unsubscribe=One-Click
                  X-DKIM-Optionss=acdkim1
                  Message-ID<0.1.5.5B0.1DB667C04AE8D00.0@s4.csa1.acemsd5.com>
                  Return-Pathbounce-793876-1835-74-bhuey=carollo.com@em-793876.azbex.com
                  X-MS-Exchange-Organization-ExpirationStartTime14 Jan 2025 12:01:20.4535 (UTC)
                  X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                  X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                  X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                  X-MS-Exchange-Organization-Network-Message-Ida80c6697-9fc2-42bd-1d26-08dd349328b9
                  X-EOPAttributedMessage0
                  X-EOPTenantAttributedMessagef50354a0-4a5a-4fa1-b18f-8d1efb41b024:0
                  X-MS-Exchange-Organization-MessageDirectionalityIncoming
                  X-MS-PublicTrafficTypeEmail
                  X-MS-TrafficTypeDiagnosticSA2PEPF000015CD:EE_|DS0PR10MB6703:EE_|PH0PR10MB5793:EE_
                  X-MS-Exchange-Organization-AuthSourceSA2PEPF000015CD.namprd03.prod.outlook.com
                  X-MS-Exchange-Organization-AuthAsAnonymous
                  X-MS-Office365-Filtering-Correlation-Ida80c6697-9fc2-42bd-1d26-08dd349328b9
                  X-MS-Exchange-AtpMessagePropertiesSA|SL
                  X-MS-Exchange-Organization-SCL-1
                  X-Microsoft-AntispamBCL:3;ARA:13230040|12012899012|4022899009|3072899012|2092899012|69100299015|1032899013|7053199007|5133199007|4076899003|2066899003|8096899003;
                  X-Forefront-Antispam-ReportCIP:52.128.40.27;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKA;H:s4.csa2.acemsa3.com;PTR:s4.csa2.acemsa3.com;CAT:NONE;SFS:(13230040)(12012899012)(4022899009)(3072899012)(2092899012)(69100299015)(1032899013)(7053199007)(5133199007)(4076899003)(2066899003)(8096899003);DIR:INB;
                  X-MS-Exchange-CrossTenant-OriginalArrivalTime14 Jan 2025 12:01:20.3285 (UTC)
                  X-MS-Exchange-CrossTenant-Network-Message-Ida80c6697-9fc2-42bd-1d26-08dd349328b9
                  X-MS-Exchange-CrossTenant-Idf50354a0-4a5a-4fa1-b18f-8d1efb41b024
                  X-MS-Exchange-CrossTenant-AuthSourceSA2PEPF000015CD.namprd03.prod.outlook.com
                  X-MS-Exchange-CrossTenant-AuthAsAnonymous
                  X-MS-Exchange-CrossTenant-FromEntityHeaderInternet
                  X-MS-Exchange-Transport-CrossTenantHeadersStampedDS0PR10MB6703
                  X-MS-Exchange-Transport-EndToEndLatency00:00:05.0991719
                  X-MS-Exchange-Processed-By-BccFoldering15.20.8356.008
                  X-Microsoft-Antispam-Mailbox-Delivery ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
                  X-Microsoft-Antispam-Message-Info OEIjWVvGCrnGspXsEPBaJfLOM1oc4lqC1jS35mHGQdpzl4XEmqyzd3qmjYdFiw3gqTZ4pA8LrG+nNOvSLiexLq8WSAKqZBmS2yTVuwHNFuG69cVfwnuSM/RYw8nWicPx1NuOrqG6NzxnWIHuczLF/qiQUORKP9r6hfv5ZsojaB3LCVMShrEnJRxioM8q0m7GiYFOl9DtSVLRAHw3djgVekz/rQFTge0aPxkGxGze3b1H+FYa5yo3RZibs0Xh5mMrWDCZyLrXI6MhmN5HUCvBsF8Th1HRtt93UmVXFQr39lZQfsO8QJsuKPpBlnGKbR5dhs/jmjAL2NXi4GKg/6qvA7+1v1FCkcULMPgWM5jI4QhH9oq+jEVwiHecBft9fa5cxbguyBYjzmBjGmJPEocpN4OZuu/MNUQmbn0G74yrBDwokFeoLs+yAckKml1BssAlKMY1ThkScVIO/ltKVmDIJEBrWVQjBuc83Eqx7VwCxvgsZ0ifhHktyY7OOWtQ2Fyoc/jqzbjgbtIfZioibK1awvsAcYZcT9dvY+JFw8cBJc05T3PZMAcf0y29VdGHmo5aZAsWRkuCSuwH8nMxdNjKptLDzYAkeqIheccExMSX28tSzzY5O9Rhd6WgNUfWmghYT2jj90tukB2gkSCbQ6xUr5oQQBJpkinqHOyvGs4+i5dqAIuv+uQruV5pLlxltR8HfNM8ulyNq6HaoMDnFCEVXVHXTBX4DvG1cIRxh2dX/pWd4+SS9E5UvtTT/C2SSCA+VkW/6MwGjtWEGYeUCZVNo0eDKAiM02l66sYNAmZOud90s/K/fp69bFSFZuAXNH/ZNDrP58+x+9qgpecS7HoAwcnKOSUmg5I7NE4D+DzqSgUquZlCOXNYREWPlkD+Ye4oyz8takikbMX0gU5aJfklWe30TN9Tj61xtLQ7PcCOiWH8YSd2PgphlYnk8lGw6mSc+PMxae9B3xdskFtjwLuWvFzCy+f7KNfjru6MnGdCvW28uwojYOM5ykxsW94/J/r4qyUXsARgPjtCVgiAhFUSKcBBm9d/TLXBOs4tVK9t+LCidWwgsReJHwyqrbYprZBjaqu07lT2TF9eqIkbnv6EUJRkySTwriojKVxvuO54BSW99UL0Pa5FxsAEursTA3t7ZUqxk7F2YwtzgQzqRORNOjAF2PVENiI0j3JYkLpdRvFDsrFfnZV+hUHJpmEpCrx29N9mUD7dZIuxG7uPgT4Ei8iZnKWvQDpiDXdO0AE/bAnj4IQolN8R4/1Zd6JenzJsoxhk1pEWcVGFSAgrH84yGvy4YYtALzu9C6ZsFLKN3dQ+khuGKVjVfkb12AKj7XM7pWqoL0gJ77H3khdOFDQF90I8GDaYIwq6clS9U1GGWv2XiE/lae3+bQz/+XYt0oJ++Z2XBLoEN9YDc/6YNJlUILhINnUkjfwylJtWSilkJpPTt0ko32UvWPYKAEgq1e2wGyh7AnKnTH8mHiX/KTnZsP0pc4W+nWZont326k2EqkDW7NuzLY6/2EYeqlK4OZ1ieENOEP1mjTAzToe/ORkAygu1i0zReQGBf271hAEaeNs6PtfqJenATQ4vXxbkMFh42nwOYZstHX1tObrIRA1JW7PmCgST0CSFHRNVrWz5t1Pc8aUL8sZumYmgeuDPv2W23vpSnSQo2FGNhoTJzVKRQWopMs198iW2PnZoTfGecBqwJWh0ii3uVNrnPFRRV0hBpwZWQYO0OrS6a+weSq89YbIpVloUYAs3oMpjaZAKxu0dpNksjJ7WT54thE/ni/Ef41/tK/D5MtevE4ifgdMgKVdYne+X56VW7bSps29O/I/W2p+AY/G8/BW4cp7Wy46bd5WiJEMLyZ70IOYb5KTSiHfyosDYSMiVQ9WDrEMMgPr/o9lnyB0/zDHyRDlLTZ5gD1g2WS1CX+RwOjwoKzZBwoZ3c7weimCghZySfIZAOyM2ijT2FeEu3bJgd1Ef42LJh4Xo1sGYOFhCgYoYVO5HOpo8ghco1MmsrRuB3xhCqJKEZFZkGutBN4ULJTZ3X2NrqIfuD3oAnusJR1/cPQWL64K1YhZQxV/Wis5mtiyuErebexN7EPqsGotOXVGCw7eCVgcYS19mLYhVVYl9vmVQ5WhwlWGoIVfxO/yUYlJDm+INxgz4o1pvL4t4ahKTJf60ouwnP8Jsvr7IfklD/3mAtFVpvHB53uLqmuuYxxFLmAZS07qBLXDkTj21iB1wIAFtCDBJk81l0nHed82XZlOulEW5nkw26t8xv0mbv0vFj8IZ7ngrwUXbIxNJFrABY1YTw37UA/Ydx97hE670G3CeFAV21Pu24bgEyGCj0VPifrCv6nXGb5VwwJ4RuNPnQNxb/fuV0MK2WTeWos8Ra3GkiYsylKuFk7u675iqJX3ADMWfsJFbLaJL13htKMn4HESa
                  MIME-Version1.0

                  File Icon

                  Icon Hash:46070c0a8e0c67d6