Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://drive.google.com/file/d/1TGAYvCGjv6YK_GOk0u61dvaGCS2lIOOG/view?usp=sharing

Overview

General Information

Sample URL:https://drive.google.com/file/d/1TGAYvCGjv6YK_GOk0u61dvaGCS2lIOOG/view?usp=sharing
Analysis ID:1431647

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • chrome.exe (PID: 7068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://drive.google.com/file/d/1TGAYvCGjv6YK_GOk0u61dvaGCS2lIOOG/view?usp=sharing MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6200 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1916,i,8458528868166588571,13488920488925843696,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdrive.google.com%2Fdrivesharing%2Fclientmodel%3Fid%3D1TGAYvCGjv6YK_GOk0u61dvaGCS2lIOOG%26foreignService%3Dtexmex%26authuser%3D0%26origin%3Dhttps%3A%2F%2Fdrive.google.com&followup=https%3A%2F%2Fdrive.google.com%2Fdrivesharing%2Fclientmodel%3Fid%3D1TGAYvCGjv6YK_GOk0u61dvaGCS2lIOOG%26foreignService%3Dtexmex%26authuser%3D0%26origin%3Dhttps%3A%2F%2Fdrive.google.com&ifkv=AaSxoQwL9Tp4A_57AM2YqGN76bL0Un4bI1wTA5tZbU-2yWroW9elptgOoOM1OiHwMHhChXmyA7_s8w&osid=1&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-284839042%3A1714050517269765&theme=mn&ddm=0HTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 184.24.36.112:443 -> 192.168.2.16:49784 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.24.36.112:443 -> 192.168.2.16:49786 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49785 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49814 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: unknownTCP traffic detected without corresponding DNS query: 184.24.36.112
Source: global trafficDNS traffic detected: DNS query: drive.google.com
Source: global trafficDNS traffic detected: DNS query: lh3.googleusercontent.com
Source: global trafficDNS traffic detected: DNS query: apis.google.com
Source: global trafficDNS traffic detected: DNS query: play.google.com
Source: global trafficDNS traffic detected: DNS query: blobcomments-pa.clients6.google.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: peoplestackwebexperiments-pa.clients6.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49688 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49700
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownHTTPS traffic detected: 184.24.36.112:443 -> 192.168.2.16:49784 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.24.36.112:443 -> 192.168.2.16:49786 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49785 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49814 version: TLS 1.2
Source: classification engineClassification label: clean0.win@16/38@26/253
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://drive.google.com/file/d/1TGAYvCGjv6YK_GOk0u61dvaGCS2lIOOG/view?usp=sharing
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1916,i,8458528868166588571,13488920488925843696,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1916,i,8458528868166588571,13488920488925843696,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder		1
Process Injection		1
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder		1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://drive.google.com/file/d/1TGAYvCGjv6YK_GOk0u61dvaGCS2lIOOG/view?usp=sharing0%Avira URL Cloudsafe
https://drive.google.com/file/d/1TGAYvCGjv6YK_GOk0u61dvaGCS2lIOOG/view?usp=sharing0%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
about:blank0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
blobcomments-pa.clients6.google.com
74.125.136.95
truefalse
    		high
    plus.l.google.com
    		142.250.9.138
    		truefalse
      		high
      play.google.com
      		64.233.177.139
      		truefalse
        		high
        drive.google.com
        		172.217.215.139
        		truefalse
          		high
          www.google.com
          		108.177.122.103
          		truefalse
            		high
            peoplestackwebexperiments-pa.clients6.google.com
            		172.217.215.95
            		truefalse
              		high
              googlehosted.l.googleusercontent.com
              		64.233.177.132
              		truefalse
                		high
                lh3.googleusercontent.com
                		unknown
                		unknownfalse
                  		high
                  apis.google.com
                  		unknown
                  		unknownfalse
                    		high

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    https://drive.google.com/auth_warmupfalse
                      		high
                      about:blankfalse
                      • Avira URL Cloud: safe
                      		low
                      https://drive.google.com/file/d/1TGAYvCGjv6YK_GOk0u61dvaGCS2lIOOG/viewfalse
                        		high

                        World Map of Contacted IPs

                        • No. of IPs < 25%
                        • 25% < No. of IPs < 50%
                        • 50% < No. of IPs < 75%
                        • 75% < No. of IPs

                        Public IPs

                        IPDomainCountryFlagASNASN NameMalicious
                        74.125.138.113
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        64.233.176.94
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        173.194.219.95
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        64.233.177.139
                        		play.google.comUnited States
                        		15169GOOGLEUSfalse
                        64.233.177.138
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        64.233.177.132
                        		googlehosted.l.googleusercontent.comUnited States
                        		15169GOOGLEUSfalse
                        64.233.176.113
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        74.125.138.94
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        172.217.215.95
                        		peoplestackwebexperiments-pa.clients6.google.comUnited States
                        		15169GOOGLEUSfalse
                        172.217.215.113
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        74.125.136.94
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        1.1.1.1
                        		unknownAustralia
                        		13335CLOUDFLARENETUSfalse
                        142.250.105.94
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        74.125.136.95
                        		blobcomments-pa.clients6.google.comUnited States
                        		15169GOOGLEUSfalse
                        142.250.9.138
                        		plus.l.google.comUnited States
                        		15169GOOGLEUSfalse
                        142.250.105.95
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        172.217.215.139
                        		drive.google.comUnited States
                        		15169GOOGLEUSfalse
                        172.253.124.138
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        142.251.15.132
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        239.255.255.250
                        		unknownReserved
                        		unknownunknownfalse
                        142.250.9.84
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        64.233.185.95
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        108.177.122.94
                        		unknownUnited States
                        		15169GOOGLEUSfalse
                        108.177.122.103
                        		www.google.comUnited States
                        		15169GOOGLEUSfalse
                        64.233.185.104
                        		unknownUnited States
                        		15169GOOGLEUSfalse

                        Private

                        IP
                        192.168.2.16

                        General Information

                        Joe Sandbox version:40.0.0 Tourmaline
                        Analysis ID:1431647
                        Start date and time:2024-04-25 15:08:08 +02:00
                        Joe Sandbox product:CloudBasic
                        Overall analysis duration:
                        Hypervisor based Inspection enabled:false
                        Report type:full
                        Cookbook file name:defaultwindowsinteractivecookbook.jbs
                        Sample URL:https://drive.google.com/file/d/1TGAYvCGjv6YK_GOk0u61dvaGCS2lIOOG/view?usp=sharing
                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                        Number of analysed new started processes analysed:14
                        Number of new started drivers analysed:0
                        Number of existing processes analysed:0
                        Number of existing drivers analysed:0
                        Number of injected processes analysed:0
                        Technologies:
                        • EGA enabled
                        Analysis Mode:stream
                        Analysis stop reason:Timeout
                        Detection:CLEAN
                        Classification:clean0.win@16/38@26/253

                        Warnings

                        • Exclude process from analysis (whitelisted): svchost.exe
                        • Excluded IPs from analysis (whitelisted): 142.250.105.94, 172.253.124.138, 172.253.124.101, 172.253.124.100, 172.253.124.113, 172.253.124.139, 172.253.124.102, 142.250.9.84, 34.104.35.123, 142.250.105.95, 74.125.136.94, 64.233.176.94, 64.233.185.95, 172.217.215.95, 173.194.219.95, 142.251.15.95, 74.125.138.95, 74.125.136.95, 64.233.177.95, 64.233.176.95, 172.253.124.95, 142.250.9.95, 108.177.122.94, 108.177.122.95
                        • Excluded domains from analysis (whitelisted): fonts.googleapis.com, ssl.gstatic.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, fonts.gstatic.com, content.googleapis.com, clientservices.googleapis.com, clients.l.google.com, www.gstatic.com
                        • Not all processes where analyzed, report is missing behavior information

                        Created / dropped Files

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:08:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2673
                        Entropy (8bit):3.9825297982887387
                        Encrypted:false
                        SSDEEP:
                        MD5:C53689C70A7F37A0DF39106F802C03D7
                        SHA1:14B13DA97DDD85D7096F309F6F95AD62297B8D77
                        SHA-256:A848A644229DA7E53834B5FE621E7DCC59F78DCE5A5DCDF05E2581F99D83C848
                        SHA-512:42023C729856CFA0F9493B42E2F124203B4AC806B516EAF67C18D1E23C743BEE6D3548DE824570E67F73B933CCFE856B2929FFC9BC69771977FAEFB797B4B49F
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.i....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.i...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........JO,{.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:08:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2675
                        Entropy (8bit):3.99942117846766
                        Encrypted:false
                        SSDEEP:
                        MD5:826C509275E14F196F1F1FBCF8FE879E
                        SHA1:E9180E0B7D1BFC5573002BAEB49FD5042A5DD98E
                        SHA-256:A759511EAD69A207B6CFB6FBBA85A399BA8FF165E8A259D781288E85B2CA50C1
                        SHA-512:CE9F44C69AD4CBDC6C8D37E6D6505A977BE9726579675F49EA5EFE1DE624F8957D5B9E9A07C1B16B76E59F94E71A8C1F10D20AB63C15404BF4A97521A0A72C3A
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.i....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.i...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........JO,{.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2689
                        Entropy (8bit):4.006034162549361
                        Encrypted:false
                        SSDEEP:
                        MD5:FA9E004BD3DDD595A4E8EEC4D91FA564
                        SHA1:14C737F54A9D5EC5A416EF4D737FCF519D6DCDE1
                        SHA-256:C239222652CC70C9483AB056D1582D15101168ACB211909693AAC3543921B2A7
                        SHA-512:B9ADD0F54A4C836E981E3DBA8AE94C51710324A76BA9716B151FA5974CC5BE39B381652A7874110E265CF02A3BBA7E68D271B6AC15EA0DC40941781D64678073
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.i....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........JO,{.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:08:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2677
                        Entropy (8bit):3.997169030689295
                        Encrypted:false
                        SSDEEP:
                        MD5:8DC243D59BC4EDBBA9240C570A9C1789
                        SHA1:0B32A700556E996C7593776E57F6294EA2D11A70
                        SHA-256:91040793797805E0EF32C724489EA558092DD5A647B6B5E40E2BB82CEB78911B
                        SHA-512:2B7B27B62EE10F07F3CEFBA7092AFC7C1141C8A77ADA0BE2E0AF046B4D4E9153781DEB363E364329EE8E72674A7BC1CBF69FF000593E57C8B175BAF8B9000DF9
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,....d......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.i....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.i...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........JO,{.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:08:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2677
                        Entropy (8bit):3.985175564915092
                        Encrypted:false
                        SSDEEP:
                        MD5:96F3B96B54946F8CBD8049023E80E499
                        SHA1:EC127AD8DAEA34E57CB5813468FCEE009080818F
                        SHA-256:A754C041955520421349AD24168423E5F90408730FB6A0702346389A22E84869
                        SHA-512:59858C11F49BE30458209A0DACCBF836D17138D6B155D2AD702EAB0D3B72F3A6330609110FCD793EC8DC4C68F99E99CF25F032D06458AE73E72EFEDDCA4A7BE3
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,..... ......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.i....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.i...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........JO,{.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:08:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2679
                        Entropy (8bit):3.9959709871323383
                        Encrypted:false
                        SSDEEP:
                        MD5:30B2DCB6A76AE136AD19763E53B6C885
                        SHA1:2760C87697018BD9DADC2A1B50D5523BB330E2B6
                        SHA-256:0BFBE16E11C45D35ADD0F55BF69F8ECDB5935CCC8CBD4309896C9409798FBDFF
                        SHA-512:F4072B03F2448C106B7F5A0B9BB0C08C5E1C352E206744571EC7D78D22C72529A695863B7861E0DCE0B3F84FB6C8537CE7EFB28791F9DF22FDA2FE86C9CE3CCA
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,.....u.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.i....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.i...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........JO,{.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        Chrome Cache Entry: 100

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (2114)
                        Category:downloaded
                        Size (bytes):213814
                        Entropy (8bit):5.522382982921398
                        Encrypted:false
                        SSDEEP:
                        MD5:DFB1C20B409BCBEC4DAE300CC3651C6D
                        SHA1:4BEA498C43ACE7B538852DC4BD713CECB370B93E
                        SHA-256:F97BC1115687033194E62AE733FADCE1BF41297F835136C10D7FE4F870643909
                        SHA-512:F65C4F91B7B5EF5156BF32DBDA163B8A68A02F8B475E5E02D3FF735F3726A62A11FA371F779C278FDCA6CF816C57D1885882346F191479011B8E8E353AC2F380
                        Malicious:false
                        Reputation:unknown
                        URL:"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.oT1FwJRCVC4.2019.O/rt=j/m=qabr,q_dnp,qapid,qads,q_dg/exm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/rs=AA2YrTvBynad-nWEy1xIb9j1w6LpLOF6IQ"
                        Preview:this.gbar_=this.gbar_||{};(function(_){var window=this;.try{._.pe=function(a){return _.od(a)&&1==a.nodeType};_.qe=function(a,b){if("textContent"in a)a.textContent=b;else if(3==a.nodeType)a.data=String(b);else if(a.firstChild&&3==a.firstChild.nodeType){for(;a.lastChild!=a.firstChild;)a.removeChild(a.lastChild);a.firstChild.data=String(b)}else _.ne(a),a.appendChild(_.oe(a).createTextNode(String(b)))};var re;_.se=function(a,b,c){Array.isArray(c)&&(c=c.join(" "));var d="aria-"+b;""===c||void 0==c?(re||(re={atomic:!1,autocomplete:"none",dropeffect:"none",haspopup:!1,live:"off",multiline:!1,multiselectable:!1,orientation:"vertical",readonly:!1,relevant:"additions text",required:!1,sort:"none",busy:!1,disabled:!1,hidden:!1,invalid:"false"}),c=re,b in c?a.setAttribute(d,c[b]):a.removeAttribute(d)):a.setAttribute(d,c)};var we;_.ve=function(a,b,c,d,e,f){if(_.Kb&&e)return _.te(a);if(e&&!d)return!1;if(!_.Ib){"number"===typeof b&&(b=_.ue(b));var g=17==b||18==b||_.Kb&&91==b;if((!c||_.Kb)&&g||_.Kb&&1

                        Chrome Cache Entry: 101

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:Web Open Font Format (Version 2), TrueType, length 11976, version 1.0
                        Category:downloaded
                        Size (bytes):11976
                        Entropy (8bit):7.980783230412596
                        Encrypted:false
                        SSDEEP:
                        MD5:2D0D70BFE210BA9BD13AF1CD4D15C681
                        SHA1:A07917168423A82AC9080FED97D791D67552C391
                        SHA-256:01BF85E47C4E3C68EBAC95BE013A5BC36B1D4C8E9E484C4568CFA474970AD55C
                        SHA-512:72472E7E87F8A04962397FCE9140197B215ADD625B26AAF45F7DC7FE6BD781D0E20308501D009D1AB9E0BDA6143C2FDEA01DAD0008B5B4D2E40415DE6CF6BAC8
                        Malicious:false
                        Reputation:unknown
                        URL:https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjAUvaYr.woff2
                        Preview:wOF2..............m....W..........................Z..t..h?HVAR...`?STAT..'..../<....$.y..J.0.,.6.$.... ..B.......c5....."u.......$.,d...IG.maU].?I.\aee&...K.D6...0"G.}"3.....EB.S.}O. 8D.P......U.b=..rQR.+...2.z.w.;...u..Ec.$...........f...-...[2Cv..c......Ds......$.5j.#..Qq...D..'b..... J.........D....k..~.j;.jL....?..o7.p.......E.a...zx.%...K....h..,..%......W....A.......l-o...yk7......9...............{~rsm..5.. ...a?...'b..4.&B2.T..Bh.B..t.z.......=...,.~.S..t.l...V.p.D..Q..:,...!Kk.vD.5p,.vB...;t....*...s.............@.z...I..P.w.v..6X....G%Dj.YLK.9{.`....q.;....M$P..q....*..'...KQG*....W..Tc.;...B.........X..nP.E.x.oP...9.9E.R.s.M.s.qSy\.!W...Mg_\.R=.....ybmP.lD.P.R.qJ.c..P.Qi.-j....f....].)...%..`.a....H..._/..........&.BY.x.V..W$..{..ko..EK.G...%..\H..(..~.S.o..j4..SJ..k.F.SEN..... .2....d2..`.RHC..P......B.!@h.$u.d.y..K...>m..B.p.b...E.q..d.>.....,.-...+...:[l..v;..n{..~..q.I.2.FB...p..f.c.E.[j....`..:....C.... ..5!....@.....

                        Chrome Cache Entry: 102

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                        Category:downloaded
                        Size (bytes):831
                        Entropy (8bit):7.690596689293278
                        Encrypted:false
                        SSDEEP:
                        MD5:916C9BCCCF19525AD9D3CD1514008746
                        SHA1:9CCCE6978D2417927B5150FFAAC22F907FF27B6E
                        SHA-256:358E814139D3ED8469B36935A071BE6696CCAD7DD9BDBFDB80C052B068AE2A50
                        SHA-512:B73C1A81997ABE12DBA4AE1FA38F070079448C3798E7161C9262CCBA6EE6A91E8A243F0E4888C8AEF33CE1CF83818FC44C85AE454A522A079D08121CD8628D00
                        Malicious:false
                        Reputation:unknown
                        URL:https://ssl.gstatic.com/images/branding/product/1x/drive_2020q4_32dp.png
                        Preview:.PNG........IHDR... ... .....szz.....IDATx.b .....+......m..dW.@..tm.Y.....m.....m.m..L.|.....{..b...t..........=H..qt..V..X..<jQc...p...fdU.\2.....9T...Jz!9...L.)&.....n....`~.T.\.\.$.....qQ.....LFOx......^&,"bB..Lh9$_.6<...A...Q.T&y.,'...p...W`.2.?X(.o.4.J?.2...@.4...*..X..c......[UZJ...MN.].z..f..DFe.J.....:!r...0X......).....^*..!....u..c..R4.GH....Y....E....Q......+!..)...e"......,.Ge.r.T..!..r..(.|.9f...}......(...s..N...[..~.%6QF..g..r......CN.e"(..uY.h._1.H.e....r.k..%^S.c..<..0.s.j..,D........]..y.2(..OC.o\.3..".....cw...:;.btq......w=.......R-[].4..]...?.....o..K../cC.<O...y..O.......{.-'Ln9..M.*6t.(.........o.K.$....bz.X._d......Z].U.....t....Bf.Zl.^vA._..g.{l....V...{....=.jua..[...k......j....Y\...!..+.m..X..t(....."..Mz.26l....7X.C...-...Z.lvl.......y}x..........7.m.VV....IEND.B`.

                        Chrome Cache Entry: 104

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (2101)
                        Category:downloaded
                        Size (bytes):92313
                        Entropy (8bit):5.657635087568358
                        Encrypted:false
                        SSDEEP:
                        MD5:EB82B04C850C440BE128627A22068270
                        SHA1:0C13D3E86026FA87AF82D38BC3D8A6F95DFF5852
                        SHA-256:8AA1F8C8A196F223C11AFD821B7CBF28CC53E72F2E8E7E8920CFA5EA154EA720
                        SHA-512:B5BA41224537297CE9D003174D13DBF421981EBAF5CD6EEE10AA3AF901D3D1675C8B05E9FA56907AD3484A81DFEF4BF19680AB91737C026960FC19D10F909F15
                        Malicious:false
                        Reputation:unknown
                        URL:"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.9-tWEU_WTXw.O/am=AAw/d=0/rs=AO0039tMQJLD0qTIDmSwVt_r4CF-V_b3-A/m=sy5q,sy16,sy5t,sy61,sy62,sy64,sy63,sy67,rj51oe,gypOCd"
                        Preview:try{.var xSc=function(){IF.apply(this,arguments)};N(xSc,IF);xSc.prototype.enqueue=function(a,b){this.insert(a,b)};var ySc=function(a,b){a%=b;return 0>a*b?a+b:a},zSc=function(a){return 1-Math.pow(1-a,3)};.}catch(e){_DumpException(e)}.try{.var LYb=function(){return faa&&ia?!ia.mobile&&(ka("iPad")||ka("Android")||ka("Silk")):ka("iPad")||ka("Android")&&!ka("Mobile")||ka("Silk")},$L=function(){return!(faa&&ia?ia.mobile:!LYb()&&(ka("iPod")||ka("iPhone")||ka("Android")||ka("IEMobile")))&&!LYb()};.}catch(e){_DumpException(e)}.try{.var VHd=function(a,b){this.C=a instanceof Or?a:new Or(a,b)};Bj(VHd,RZa);VHd.prototype.Od=function(a,b,c,d){var e=Ur(a);var f=e.body;e=e.documentElement;e=new Or(f.scrollLeft||e.scrollLeft,f.scrollTop||e.scrollTop);f=this.C.x+e.x;e=this.C.y+e.y;var g=SZa(a);f-=g.x;e-=g.y;DA(new Or(f,e),a,b,c,null,null,d)};var WHd=function(a,b){VHd.call(this,a,b)};Bj(WHd,VHd);WHd.prototype.F=0;WHd.prototype.D=function(a){this.F=a};.WHd.prototype.Od=function(a,b,c,d){var e=Ft(a);e=Ht(e)

                        Chrome Cache Entry: 106

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (3383)
                        Category:downloaded
                        Size (bytes):108855
                        Entropy (8bit):5.485794699594584
                        Encrypted:false
                        SSDEEP:
                        MD5:DE2F04957196AC8C3C7678AD4C33A46A
                        SHA1:4788D5B2576E992626DF52268F212A5A2D141D02
                        SHA-256:E4073A5D69E86546E65B01C6F50F43B91691CEEE2A9EEDFE2DDFCBB90A8D695B
                        SHA-512:74316ECAAA611B47C1CB5D192BC77A71877B610A456605CCF35A2C35449D8A35861290C7B3012DA6F6E54D25C59423D1D568C8D7904DDF0FE0BCE864EEB9200D
                        Malicious:false
                        Reputation:unknown
                        URL:https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
                        Preview:(function(){var m,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},da=ca(this),r=function(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.r("Symbol",function(a){if(a)return a;var b=function(f,g){this.vc=f;ba(this,"description",{configurable:!0,writable:!0,value:g})};b.prototype.toString=function(){return this.vc};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function

                        Chrome Cache Entry: 107

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:GIF image data, version 89a, 1 x 1
                        Category:downloaded
                        Size (bytes):43
                        Entropy (8bit):3.16293190511019
                        Encrypted:false
                        SSDEEP:
                        MD5:FC94FB0C3ED8A8F909DBC7630A0987FF
                        SHA1:56D45F8A17F5078A20AF9962C992CA4678450765
                        SHA-256:2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
                        SHA-512:C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
                        Malicious:false
                        Reputation:unknown
                        URL:https://ssl.gstatic.com/docs/common/cleardot.gif?zx=nslgs4j7qum0
                        Preview:GIF89a.............!.......,...........D..;

                        Chrome Cache Entry: 108

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:PNG image data, 150 x 54, 8-bit/color RGBA, non-interlaced
                        Category:dropped
                        Size (bytes):3170
                        Entropy (8bit):7.934630496764965
                        Encrypted:false
                        SSDEEP:
                        MD5:9D73B3AA30BCE9D8F166DE5178AE4338
                        SHA1:D0CBC46850D8ED54625A3B2B01A2C31F37977E75
                        SHA-256:DBEF5E5530003B7233E944856C23D1437902A2D3568CDFD2BEAF2166E9CA9139
                        SHA-512:8E55D1677CDBFE9DB6700840041C815329A57DF69E303ADC1F994757C64100FE4A3A17E86EF4613F4243E29014517234DEBFBCEE58DAB9FC56C81DD147FDC058
                        Malicious:false
                        Reputation:unknown
                        Preview:.PNG........IHDR.......6.....%.`....)IDATx..].pT..>.l......b..(Hv7 D7.n.8....V..H_.R;S.hY`w.(..*.N_R."0`.-.A..|.*N..`....n..{.&..l.o..;.....a....d..$.................J.1.*.....7+.c...o..T/.~V.r.....D..G.Ic.....E_.FUR.&..U%...X.4!!Q.H";......e(Ic...$..."1..jR[.L..../Ek.}AH...W.L.V....Y..S..q...!._r.D....G,%...Hu.$q..\.j.x...G.....]....B.i.I.+B.....Hu.....Q...K;...J.q..._......_.x....A:......j....:c...^.....k=GIj..Y]B.V..m...Y.\....$..!....+.R%..U/;p.....R4.g.R...XH.3%..JHHby.eqOZdnS..$.. ....dn...$.w....E.o.8...b@.z.)5.L4|.F...9......pP.8.|....-.M..:..ux...7.]...'..(q..~.....KQ.W..,b..L<.Y.].V+....t4.$.V.O.....D.5..v.j...Hd.M....z.......V..q.p.......;:.J.%2.G.;./.E...!.H. ..../Dk.8.T....+..%Vs4..DC.R.`..Z..........0.[)N!.....%.>&.b.$.M....P.!...!....'Kv..Nd...mvR.:.L....w..y%.i..H..u....s.Se1.[.)."..)%.I.....(.#M..4.@....#.....X..P<...k..g....O..I..>-...'._.Q..T.y.=Z.GR{]..&t}*......>J..!,..X6.HC..$.:.}..z...._b.b.4.E.....;.Ha.?s.

                        Chrome Cache Entry: 109

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1136)
                        Category:dropped
                        Size (bytes):1555
                        Entropy (8bit):5.249530958699059
                        Encrypted:false
                        SSDEEP:
                        MD5:FBE36EB2EECF1B90451A3A72701E49D2
                        SHA1:AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D
                        SHA-256:E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
                        SHA-512:7B1FD6CF34C26AF2436AF61A1DE16C9DBFB4C43579A9499F4852A7848F873BAC15BEEEA6124CF17F46A9F5DD632162364E0EC120ACA5F65E7C5615FF178A248F
                        Malicious:false
                        Reputation:unknown
                        Preview:<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 400 (Bad Request)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//ww

                        Chrome Cache Entry: 110

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with no line terminators
                        Category:downloaded
                        Size (bytes):28
                        Entropy (8bit):4.280394654123195
                        Encrypted:false
                        SSDEEP:
                        MD5:4708D1B37F72B842EFE4238A9825064B
                        SHA1:889321990FC6854DD351DF9DE8D41D2C9253BAF0
                        SHA-256:10B772A54149F2086265D2CAF0C434B7CABE913BBE3665CB9DE5FAEC5EB2FB7F
                        SHA-512:1285F4AEFE4F061D9D53FE96509AD93070843265C306123D197DF3603EEFF92FC6017019410015203B2DF139CC9594E387246D4211EADE320A7E77CCCA6EFDDA
                        Malicious:false
                        Reputation:unknown
                        URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwncHhV_nsiGYRIFDZFhlU4SBQ0G7bv_?alt=proto
                        Preview:ChIKBw2RYZVOGgAKBw0G7bv/GgA=

                        Chrome Cache Entry: 112

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:Web Open Font Format (Version 2), TrueType, length 34108, version 1.0
                        Category:downloaded
                        Size (bytes):34108
                        Entropy (8bit):7.993096562158293
                        Encrypted:true
                        SSDEEP:
                        MD5:C15D33A9508923BE839D315A999AB9C7
                        SHA1:D17F6E786A1464E13D4EC8E842F4EB121B103842
                        SHA-256:65C99D3B9F1A1B905046E30D00A97F2D4D605E565C32917E7A89A35926E04B98
                        SHA-512:959490E7AE26D4821170482D302E8772DD641FFBBE08CFEE47F3AA2D7B1126DCCD6DEC5F1448CA71A4A8602981966EF8790AE0077429857367A33718B5097D06
                        Malicious:false
                        Reputation:unknown
                        URL:https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
                        Preview:wOF2.......<..........................................\..4?HVAR.t.`?STAT..'...J/<.....`..(..Z.0..,.6.$.... ..B..K..[.h...c.....nC .../.V.v..6>nT.*R...b.8.@.......ON.ch.......k..."..".9..\D...JBJ."T%5...Z2..Q.)wJ...sA.h..m....n..F.....t..ig.=..y.s@............t..j.*....n.h(...........N..)9.....v`|z....8.7..kTq....^.......[.K.O..1ZP.....;.HP.......>..+..j:.V.......A......[.f.l..v`x....F_..vo...e....n...H..X.2.v}...(.1J...x.....}.....5.3.....?..?..7...S..0.9..C.0.M..M9..e.b....bc..b4.0"e.G.....XT....z............E'c.(."...x`].]..e.rQ..ye.z........kFh;....Y.yPt.._Q.._-q..mi.Og.W.-qUI*...m5..r.mvA~o....S.f........s..ql.aXD...H..wy.P..k...f$.V^.2...8U{...f.....]]..G..cf.......D.c&B'S.2~..N..........R;..).5...../... 6....b....]d6."C..T..........OI\+V'...E.[.g.u.E....,*!F.....*U.q. :x.s..1..C....H..S%..)....h......K..........pw.f...f.......an3....9....@......%.2.c.+........cXD..F...B.....0'...O.z8.B....4...\..&c...H....;..p....@.l...:........L..`...5..xo&.

                        Chrome Cache Entry: 113

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x1447, Suserng: [none]x[none], YUV color, decoders should clamp
                        Category:downloaded
                        Size (bytes):62658
                        Entropy (8bit):7.995110290466068
                        Encrypted:true
                        SSDEEP:
                        MD5:1A7E3E8669ADE7AC2A865438FCFAD9F3
                        SHA1:F18C983969DC2E562DB8F5157D9A74C1F3313C8F
                        SHA-256:B056C99D501C1CF66BB033F9F545C3D3FBEC41ACC641F415E2AFD69E7FF55B0C
                        SHA-512:618497E48F504A19F82C8A5DCFE4448FD750C0F1690B64DC3B107ADB1C8190EE29E3BA3036C7AB3973E57A28E56511282BBC3CD1206938BF535E0E89E676DB0B
                        Malicious:false
                        Reputation:unknown
                        URL:https://lh3.googleusercontent.com/drive-viewer/AKGpihYh_T5VzF1OOg1s-8vZAyx6t-9swRnJ1GyDabGwU4Cz2cIOdeBnh6xlyk_HxnJAPWD1dJiZmsdRgyqSQ_IcDZWI5RAcPSON-g=s1600-rw-v1
                        Preview:RIFF....WEBPVP8 .........*....>.X.O'$..".Y....in.VL. i^.E..2}_.....g.._....>0...?..........~...............~.M.?....;.w........w...O.............C.:..._..........K...g..._......../._..,[.._._.............?....9...................?..o.....?...../......K...o..........;......._...x...........o.......C...'.......?........+.s....._.....Py..vg...o....).w...f}.`.....B..y..vg...o....).w...f}.`.....B..y..vg...o....).w...f}.`.....B..y..vg...o....).w...f}.`.....B..y..vg...o....).w...f}.`.....B..y..vg...o....).w...f}.1;.{..\.d....'..M..d...1.qf.)$<..;3.S..7.....?w....v.e...I.7s.EL...0..p..M.z}0..k5....tZ.2.\...2..\Ym..\........O@...I>Z..4..e.B....R.p=..?...o....).w..n.4.....EN.........r...o..=9`lng._.m.bJ..].p.T.Ud.......g.o.........;....Qe..7......;....E...mI..7......;...>.0...p..L....;3.S..7......;...>.0...p..L....;3.S..7......;......2..8...CQ...a|...4.TN...+_.vg...o....).w...f}.`.....]}.....N........;..& ...r.....*~|=8...;...>.0...p..L....;3.S.3|y...

                        Chrome Cache Entry: 116

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
                        Category:downloaded
                        Size (bytes):15344
                        Entropy (8bit):7.984625225844861
                        Encrypted:false
                        SSDEEP:
                        MD5:5D4AEB4E5F5EF754E307D7FFAEF688BD
                        SHA1:06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
                        SHA-256:3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
                        SHA-512:7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
                        Malicious:false
                        Reputation:unknown
                        URL:https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
                        Preview:wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h|.l....A....b6........(......@e.]...*:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#*e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.*UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...*$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf*.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed.*.'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

                        Chrome Cache Entry: 118

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (65536), with no line terminators
                        Category:downloaded
                        Size (bytes):2555126
                        Entropy (8bit):5.689231326615333
                        Encrypted:false
                        SSDEEP:
                        MD5:B30684149D9314B57EA4EB7FB39067B0
                        SHA1:0E66A4BCECED11B744E97F50BD9531EC5115A7D9
                        SHA-256:51BEF573F90F9636D84E2C6CD5F0EF28357BC0373EF3E1091D4E657C0AB8E5E0
                        SHA-512:EE6BCE25D8982614568D2CA7B625854E49201B9792FAD5985BFF1E0FBE3B0FB253678E07404EF04BED61AE2170AB90711E498D68A9FF88603AE206DD24F40D66
                        Malicious:false
                        Reputation:unknown
                        URL:https://www.gstatic.com/_/apps-fileview/_/ss/k=apps-fileview.v.oXWFn4yqGvc.L.W.O/am=AAw/d=0/rs=AO0039vgYAc5bT8aXfr2kk-MxvzYuWIq0A
                        Preview:@-webkit-keyframes mdc-ripple-fg-radius-in{0%{-webkit-animation-timing-function:cubic-bezier(0.4,0,0.2,1);-webkit-animation-timing-function:cubic-bezier(0.4,0,0.2,1);animation-timing-function:cubic-bezier(0.4,0,0.2,1);-webkit-transform:translate(var(--mdc-ripple-fg-translate-start,0)) scale(1);-webkit-transform:translate(var(--mdc-ripple-fg-translate-start,0)) scale(1);transform:translate(var(--mdc-ripple-fg-translate-start,0)) scale(1)}to{-webkit-transform:translate(var(--mdc-ripple-fg-translate-end,0)) scale(var(--mdc-ripple-fg-scale,1));-webkit-transform:translate(var(--mdc-ripple-fg-translate-end,0)) scale(var(--mdc-ripple-fg-scale,1));transform:translate(var(--mdc-ripple-fg-translate-end,0)) scale(var(--mdc-ripple-fg-scale,1))}}@keyframes mdc-ripple-fg-radius-in{0%{-webkit-animation-timing-function:cubic-bezier(0.4,0,0.2,1);-webkit-animation-timing-function:cubic-bezier(0.4,0,0.2,1);animation-timing-function:cubic-bezier(0.4,0,0.2,1);-webkit-transform:translate(var(--mdc-ripple-fg

                        Chrome Cache Entry: 119

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:Web Open Font Format (Version 2), TrueType, length 46580, version 1.0
                        Category:downloaded
                        Size (bytes):46580
                        Entropy (8bit):7.99518568800345
                        Encrypted:true
                        SSDEEP:
                        MD5:EAEAB0AB77C2F306957649E25D97B1AC
                        SHA1:FF41A006C6939392CBC09D2FC59B6D05A413A2CD
                        SHA-256:404B9B1BF15CB5E84FCAE14211A6A8FE6BA252605DB04CDA2A7D69E1CFD2765F
                        SHA-512:DFC23F87DEEE14DC663C1F369C98E163BC5A182818A70B3EB5733E19246BEE5F3658673A225F586219CB955F80FE171145E0A55859B266E7608735BB3D462180
                        Malicious:false
                        Reputation:unknown
                        URL:https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjMUvaYr.woff2
                        Preview:wOF2...................~..........................X..(...$?HVAR...`?STAT..'...4/<.....T../..J.0....6.$.... ..B.....[..q...(6..`...:.5..D.c.DrYv..8..w..c....@u..w...._.Ld..RvIZ..&.....?I.!....H..6&e..J...c...Xi.pkx3w..9d.5.Wj.}..W|H....k.SG....U}.......>.f...p|..>.6Y.;N~.E _).T.B........."........q..K.%.hp/z.o.3.O.9-............eK.X.H....'..b.xv$*{..M*.&.&...J..........W......r{6n$.kAC.k..%......QrZ......[9.9...1.....@.!h#CXN....k...MD0.X.0......5..-Fn|............Q.b..b,........t....1&..y.4I..r...9.;6d.......^..L...u".w.U?i.YS.u.gl..!...C.._9........Nf.M~.....lUO..R....p8.v........5.|..N.N.S..D..M.:....TU.L..."VD..o.......D......u:k.Y.:...V':.b...?..}..<.$......tAKnv?o.X.A.....[..cM...f2.q7VmX..[.\D....z.=>.......M.....9.@...".P.V.m...d.}..,q.....XU...p...$.^H...j..\.\W2.....C...n...Q.5j.T.......y..j.. 2b.z.h...-.E`..|7.,...\3L/.#..C...s...S~S:{|...x..+...Q..:U.x&E......6..ut@@C.....a.o.n...v[....%v<...;.......3j..;..~....:ZUN#....>...l.....dd...

                        Chrome Cache Entry: 121

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):626
                        Entropy (8bit):4.60225951443478
                        Encrypted:false
                        SSDEEP:
                        MD5:83A8719F50F54A04835CF33B68E9DA68
                        SHA1:9A5B826814B6AF5960092F0D995E5D9C6317FC49
                        SHA-256:E4C44B356156B57A483B9B8468946997FDEFFBCD600482C0B362ED9768A071FA
                        SHA-512:D1BAC50E7CD13A1654A9A20F245CA53C4E100155F3669DF6A431E75FF198C2D2798A5C58EF46F335A69FA632CA08E0763F7B08D07721E2F82490565EE92942C3
                        Malicious:false
                        Reputation:unknown
                        Preview:{. "error": {. "code": 403,. "message": "Requests from referer \u003cempty\u003e are blocked.",. "errors": [. {. "message": "Requests from referer \u003cempty\u003e are blocked.",. "domain": "global",. "reason": "forbidden". }. ],. "status": "PERMISSION_DENIED",. "details": [. {. "@type": "type.googleapis.com/google.rpc.ErrorInfo",. "reason": "API_KEY_HTTP_REFERRER_BLOCKED",. "domain": "googleapis.com",. "metadata": {. "service": "drive.googleapis.com",. "consumer": "projects/847707997455". }. }. ]. }.}.

                        Chrome Cache Entry: 122

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (2124)
                        Category:downloaded
                        Size (bytes):121628
                        Entropy (8bit):5.506662476672723
                        Encrypted:false
                        SSDEEP:
                        MD5:F46ACD807A10216E6EEE8EA51E0F14D6
                        SHA1:4702F47070F7046689432DCF605F11364BC0FBED
                        SHA-256:D6B84873D27E7E83CF5184AAEF778F1CCB896467576CD8AF2CAD09B31B3C6086
                        SHA-512:811263DC85C8DAA3A6E5D8A002CCCB953CD01E6A77797109835FE8B07CABE0DEE7EB126274E84266229880A90782B3B016BA034E31F0E3B259BF9E66CA797028
                        Malicious:false
                        Reputation:unknown
                        URL:"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0"
                        Preview:gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x20000, ]);.var ba,ca,da,na,pa,va,wa,za;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=da(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)re

                        Chrome Cache Entry: 123

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (2124)
                        Category:downloaded
                        Size (bytes):79644
                        Entropy (8bit):5.598027612956531
                        Encrypted:false
                        SSDEEP:
                        MD5:5845C4B4039A782892BA98EEFE3537FE
                        SHA1:53094E84BE77E96AFE3B3F3CF337044A8AC3C4DB
                        SHA-256:F730FB8496D16C5F117388BB3F5F2B117DB2D49AA9C35E7BFD5318C7253DBFD2
                        SHA-512:57C823B9BD9F56F2081766D9F083FDC70BA6277B3B1A897BF75891329E83F95C967A647676C3573E33471D3A8F61F599D4A1949303D2033DC25CAD37CE76A602
                        Malicious:false
                        Reputation:unknown
                        URL:https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0?le=scs
                        Preview:gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x20000, ]);.var ba,ca,da,na,pa,va,wa,za;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=da(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)re

                        Chrome Cache Entry: 125

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with no line terminators
                        Category:downloaded
                        Size (bytes):72
                        Entropy (8bit):4.87915143242082
                        Encrypted:false
                        SSDEEP:
                        MD5:6C92F12D9E60D60E72F6B1ABD225C6F9
                        SHA1:B1710A756D8C991E52A387D41DE9D89A016E16C4
                        SHA-256:84EA9D40293D6E45C2FEE8B3F655B1BA5E5B2667DE4D6355CD9D22B7C0363DAC
                        SHA-512:502A1CD80E887AF855566E517D5DC0EE2FAE5FCF4A95BD41D2444EC88184D88DE43DBB6C9F6BC4BFC0162E981DBD6C92F34ABE25C2FCC9AAEDE7FB0270C04CC5
                        Malicious:false
                        Reputation:unknown
                        URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISJQm4AQ_njqwvuhIFDZFhlU4SBQ0G7bv_EgUNkWGVThIFDQbtu_8=?alt=proto
                        Preview:CjQKCw2RYZVOGgQIVhgCCgsNBu27/xoECFYYAgoLDZFhlU4aBAhWGAIKCw0G7bv/GgQIVhgC

                        Chrome Cache Entry: 126

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with no line terminators
                        Category:downloaded
                        Size (bytes):16
                        Entropy (8bit):3.75
                        Encrypted:false
                        SSDEEP:
                        MD5:EC331136E75314D2030EE013B6069921
                        SHA1:6B7428B8B15616A67F767D42964AF94FCBE2A803
                        SHA-256:A7358DF6B7B60280F2A0D7CD5B70A9F1DFA4FCE5C31FB1A24FB2F109AF7EE977
                        SHA-512:30C9B411C937F7D3DE9E59D8BE1CDE4F262B05C6AC2EC2D2C1956E705FE255D84DE17913826A0378B7FD4E51E075EE72A6BF16B870BF78B83D4F1D4507A44278
                        Malicious:false
                        Reputation:unknown
                        URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmlNHcUu78_khIFDQbtu_8=?alt=proto
                        Preview:CgkKBw0G7bv/GgA=

                        Chrome Cache Entry: 81

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):464
                        Entropy (8bit):4.758217138015706
                        Encrypted:false
                        SSDEEP:
                        MD5:7AC766454A72FBACB6EBDB5A01830BAA
                        SHA1:023C1D4870A63E02F128B39C0387553619C5E56B
                        SHA-256:22AE3C615F83AB97EDA448B27FC68E89D11DF3FAB1A486FC4A33C1C139D42B16
                        SHA-512:E4068FFD44BD272C9696FB333D58100775FA1525B55B7884A4487195CFF4031EC68D023EF4C887659E7409C58E44C96521888E968ECC145B0F381AD5A8B56F5D
                        Malicious:false
                        Reputation:unknown
                        Preview:{. "error": {. "code": 403,. "message": "Requests from referer \u003cempty\u003e are blocked.",. "status": "PERMISSION_DENIED",. "details": [. {. "@type": "type.googleapis.com/google.rpc.ErrorInfo",. "reason": "API_KEY_HTTP_REFERRER_BLOCKED",. "domain": "googleapis.com",. "metadata": {. "consumer": "projects/298134251447",. "service": "blobcomments-pa.googleapis.com". }. }. ]. }.}.

                        Chrome Cache Entry: 82

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:JSON data
                        Category:downloaded
                        Size (bytes):1824
                        Entropy (8bit):4.410895833842643
                        Encrypted:false
                        SSDEEP:
                        MD5:BCEF0399C2427248F38D13BEC551E732
                        SHA1:6D076D439E44451A914A39A040FBE1163DE2421A
                        SHA-256:3CF517BBE8D2CCD8759CB315EE816F470869E56D7CE90D6BB417B7BEAE96F297
                        SHA-512:A716056C2405E523A31A41CCAE36796486C3E9E861FDAA2E3358322AB08891BA1A41D881B301B39DC0A4EDBC30359C1BB3BED14DBE4FF831E2FA8ED32C5069F9
                        Malicious:false
                        Reputation:unknown
                        URL:https://blobcomments-pa.clients6.google.com/v1/metadata?docId=1TGAYvCGjv6YK_GOk0u61dvaGCS2lIOOG&revisionId=0B5XE47eO8H-hWC9TMmxHbGdyZk1VL2pXdGZGeXluMm9Wd2VFPQ&userLocale=en&timeZoneId=Etc%2FGMT-2&documentResourceKey.resourceKey&forceImportEnabled=true&key=AIzaSyCMp6sr4oTC18AWkE2Ii4UBZHTHEpGZWZM&%24unique=gc797
                        Preview:{. "serializedDocosKeyData": "[null,null,0,null,null,null,null,1,[\"Anonymous\",null,\"//ssl.gstatic.com/docs/common/blue_silhouette96-0.png\",\"ANONYMOUS_105250506097979753968\",1,null,1,null,1],1,\"AAHRpnXueK0oJHGvw41Ze8WzfQB52SmJJnRHhZxEbaRqYROUyq1F0ofuojFQbI6iubApBTmHGRuBDG7ycelEkRuqR6Z7X1sGPqA\",null,null,null,null,null,1,null,null,1,null,null,null,null,1,0,null,null,null,0,null,null,0,null,null,null,null,1,0,null,null,null,null,[\"tf\",60000,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,null,null,null,1,null,null,null,null,null,null,0,null,null,\"\",null,0,null,null,null,null,0],[[5703839,5704621,5704745,5707899,5711538,5712270,5712639,5712647,5713195,5714051,5737800,5748810,5779500,5792878,48966262,49372463,49375342,49451659,49453005,49472091,49622751,49623141,49643963,49769

                        Chrome Cache Entry: 84

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (1841)
                        Category:downloaded
                        Size (bytes):938214
                        Entropy (8bit):5.551655115348745
                        Encrypted:false
                        SSDEEP:
                        MD5:3578007C1231B0D29CC746A619C0CCDD
                        SHA1:F80566856E1BC2E39C18AECE643ACF227A55A3CC
                        SHA-256:2DF27A9EF238232086B5803A184231840C8BE7FF3AE646D8A40652829060C22A
                        SHA-512:DA466CECF91EC0C0AE789B5F8BD1DA348431EBB91EE48AEFF927013681211F0A92E331EC1C23741F5BCDB777224679FBBA9D18C6BBF954DB108C127FCD74D5E7
                        Malicious:false
                        Reputation:unknown
                        URL:"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.9-tWEU_WTXw.O/am=AAw/d=0/rs=AO0039tMQJLD0qTIDmSwVt_r4CF-V_b3-A/m=dSirkf,sy5o,sy1p,n90YA,ZGAB2e,sLGWFe,sy1k,sy2r,sy1r,sy3f,M79aPc,sys,syu,sy13,sy1m,sy1q,sy1x,sy2k,sy2s,sy2x,sy34,sy3h,sy3v,sy3s,sy56,nJ4XF,sy5p,sy5r,UKcSG,AtsVYc"
                        Preview:try{.z("dSirkf");..A();.}catch(e){_DumpException(e)}.try{.z("n90YA");.var iSc=new Dr;iSc.altKey=!0;iSc.keyCode=39;(new Dr).keyCode=13;.A();.}catch(e){_DumpException(e)}.try{.z("ZGAB2e");..A();.}catch(e){_DumpException(e)}.try{.z("sLGWFe");..A();.}catch(e){_DumpException(e)}.try{.var ON=function(a){this.da=q(a)};N(ON,v);ON.prototype.Hk=function(){return Xh(this,7)};var PN=function(a){this.da=q(a)};N(PN,v);PN.prototype.getName=function(){return E(this,4)};PN.prototype.Fp=function(){return E(this,11)};var QN=function(a){this.da=q(a)};N(QN,v);QN.prototype.getInfo=function(){return M(this,PN,1)};QN.prototype.Bl=function(){return M(this,ON,3)};.}catch(e){_DumpException(e)}.try{.var j0b=function(a){this.da=q(a)};N(j0b,v);j0b.prototype.getSeconds=function(){return ue(this,1)};.}catch(e){_DumpException(e)}.try{.var f$b=function(a){return a instanceof tO},tO=function(a,b){En.call(this,a,b)};N(tO,En);tO.prototype.Wv=function(a){a=K(a,f$b,tO);if(!Sl(this.constructor,a.constructor))throw a=new Cn,Y

                        Chrome Cache Entry: 85

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:Web Open Font Format (Version 2), TrueType, length 67004, version 1.0
                        Category:downloaded
                        Size (bytes):67004
                        Entropy (8bit):7.995980219115886
                        Encrypted:true
                        SSDEEP:
                        MD5:3C1B9E7E6ACA4306AF6D43FDA6866A3F
                        SHA1:ABBFAD859F34DC5A89D8C346E880B68249BB8BA8
                        SHA-256:0BDE36BA54CA0CDCD941552D81C8F7A2834B726351876759C5F4C6F98DB38DB0
                        SHA-512:4D5463FC086F1F9315BE3A2F4755B1663194DB140F9FB715323036C3ABC976F61AD796E4E08F32B36F84C2A0F52E8C1D2C384B5B0CB2F1D4ADB81EDC4FCF1083
                        Malicious:false
                        Reputation:unknown
                        URL:https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPi4UvaYr.woff2
                        Preview:wOF2..............}p...J..........................G..2...?HVAR...`?STAT..'..../<.....D..E..L.0.. .6.$..H. ..B.._..[.....x.hc*.[....s...(.N.y~..@...Z#.`..xBqZk..!....c...o..........Y.2....}....PUT..n......".xO/G.L......z..5..R,..)V..8..9y.`..#..9..LQ....Xos...H..9.D..i.HiT(.e3m2....&...U.M.....*..}Gi.P..4*s.J....D.X...`.|.."a.!..hrO..C{.r....{.......k.-..(.....XM<.{.s....K).nI.CV..s..P...0....Y%U6.e%.]..Iekn.L.]#&...."/.cw.(.J:..T..~....~.9. .J.......X.[;.=...B.6.)...O.Z.?zr|eD|x.f.*..<..%%..YC....X..}..Y.....ew.+...S..*.r.;..p:....yD...)U,.R.m.$......~..gYG...{j.M..4R..PZH.?m.M.......1..s..F..o.......!...8&^....t.Q\.......g....(D+.B.*.........*...v=.........M(s^.O$.p...+h.T...S........w.q\...W.RJ)"bE.."".H.""R.....RD.<R...H..y.".>EDD..<".H.bE.#"ED.....Dz....4...b...$...E....b.o.m..EL...bC6`.S........f>..[.P-....."..Z...c....??5aQ.( }.....r...@)..5.Bmx=.>N.t.8..d..B....$/zASi.f..[.dI6.$.C..o.D..<..v.|`.Lw...U...IYN.S......Myus..,.Dz/S.c..=./"./Q,y"D.H

                        Chrome Cache Entry: 86

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:HTML document, ASCII text
                        Category:downloaded
                        Size (bytes):382
                        Entropy (8bit):5.338078082461882
                        Encrypted:false
                        SSDEEP:
                        MD5:C491810DC22A446D9CC7D246E9B6ED5C
                        SHA1:4B507556B79C20F1F2EEA57CA51566A6A583423E
                        SHA-256:CA47592363DE0D001D1BDB171E33132DDDB47A270CA3AAC23F3DC55A1AE82AAC
                        SHA-512:FADDC91DF6156322A166A9DCA5E279D99A408EA7A30A67EFD78F2EB6C701DBC45849500729B7C9C2D47C09510522AD0959B265FBAF1425AA5170CD5A4FAD442C
                        Malicious:false
                        Reputation:unknown
                        URL:https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.gapi.en.SCWmpDDGjPk.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA%2Fm%3D__features__
                        Preview:<!DOCTYPE html>.<html>.<head>.<title></title>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<script nonce="Fx-nJGE_w_8gNJiBbfr-rQ">. window['startup'] = function() {. googleapis.server.init();. };.</script>.<script src="https://apis.google.com/js/googleapis.proxy.js?onload=startup" async defer nonce="Fx-nJGE_w_8gNJiBbfr-rQ"></script>.</head>.<body>.</body>.</html>.

                        Chrome Cache Entry: 87

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:PNG image data, 64 x 64, 8-bit/color RGB, non-interlaced
                        Category:dropped
                        Size (bytes):980
                        Entropy (8bit):7.685602089003844
                        Encrypted:false
                        SSDEEP:
                        MD5:90B5E9C2D4B21FEE7360E13315938708
                        SHA1:21E9BD7088EB9AE98C6A9EC0E026F7ED5E41D3E8
                        SHA-256:EE5CE812E0D2DD3F22E7EEB625219E03EB5834C8C1C32452CAFC78C10141319E
                        SHA-512:FD7E2CDC58707B11E09258C32D81EB795547A1B84CBC1E25F12D5A37F86DF1C90B23215D796F95C5B27E5C68506F88C02650E792EB402C2EB256EABFFCDD515B
                        Malicious:false
                        Reputation:unknown
                        Preview:.PNG........IHDR...@...@.....%......sBIT.....O.....IDATh...k.G...{3..%.I....*n .....6.?!..BR|)u}h..%.A.r...{.[.6$.'.A,.v\$.?P..vg.......j....w..........w.. Ci'..L m2.....&.H.L m2...x..u.gu...|...a(...~.B....[....f.H". ..8.6.X....<~.i.y..j.R.ms{Gyy!=..H...RHOy.......f..&.pN..7.P$>x,IH!..r.......bM..l(U..6.A.....".>.........A..z..f.X....&..>.I..6Y6.A....^...k5........c.CH..~...........@|..%.. .\....a. ..C&........H..;....Gg.(..Y.w....?.@.`M.w.5a...A`jji|.b.N.)&.OT....R.Rb.....x..5^nt..OQ.V....I.%kB...."W\........!.......s.*..._.4.p...........;&..Q..G..^g...w.8.j.c..<._.....*p:.|[%.H..4.&'.g.A...........*.U..9.B8.......s..._.|.E..b.xF.9.(....>...k.....a...@...@.lO8p`.s...T......2.O...../?..^..C..".Q.*.]..3..R..O..f.W....-..z..&. R=.}......>......F....~..em@B.N1...D...W..U.-......../..._]nTg...".....ZCy.Z..AP^.......I..-....R.......P..x...8.... u.8.X.[....~.a...=.......M._.e.i...M&.6.@.d.i3......9.......IEND.B`.

                        Chrome Cache Entry: 88

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:SVG Scalable Vector Graphics image
                        Category:dropped
                        Size (bytes):118370
                        Entropy (8bit):5.846748398907928
                        Encrypted:false
                        SSDEEP:
                        MD5:BA7AB7044D6C6C0240C3917858948CFF
                        SHA1:3B840B104CB3D74D5A35FBD193ACA32D27815D3E
                        SHA-256:0189F7C6ED35A7BE5E51A30366FBC54C9C9E27D2511DB44895D85A1458F83AB5
                        SHA-512:660D3407052C6965E6451C8D2AA9DC302C0F97129864E320731B89174F2A87B776201A57AA30A8CCF1A455700A6D9E2C42A070CC0F964D14A6D9E73DA47C4697
                        Malicious:false
                        Reputation:unknown
                        Preview:<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" x="0" y="0" width="31px" height="3980px" viewBox="0 0 31 3980" preserveAspectRatio="none"><g transform="translate(0,960)"><path d="M20 2H4c-1.1 0-2 .9-2 2v18l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm0 14H4V4h16v12zm-9-5H7V9h4V5h2v4h4v2h-4v4h-2v-4z"/></g><g transform="translate(0,432)"><path fill="#C4C7C5" d="M20 2H4c-1.1 0-2 .9-2 2v18l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm0 14H4V4h16v12zm-9-5H7V9h4V5h2v4h4v2h-4v4h-2v-4z"/></g><g transform="translate(0,2152)"><path d="M17.705 10.1401L14.3 4H9.70001L3.60001 15L5.70001 19H13.8027C14.2671 19.8028 14.9121 20.488 15.6822 21H5.70001C5.00001 21 4.30001 20.6 3.90001 19.9L1.80001 15.9C1.50001 15.3 1.50001 14.6 1.80001 14L8.00001 3C8.30001 2.4 9.00001 2 9.70001 2H14.3C15 2 15.7 2.4 16.1 3L20.0307 10.0882C19.6959 10.0

                        Chrome Cache Entry: 89

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (618)
                        Category:downloaded
                        Size (bytes):6796
                        Entropy (8bit):5.413890068658508
                        Encrypted:false
                        SSDEEP:
                        MD5:F1E25DBA0C173122E39EA7D312B1BA9A
                        SHA1:2960F4AC52B18B5BAE19C923F7B7B6869DF87768
                        SHA-256:451BB3BE1C54F1C670523707516B53E68537E90AC19EBB0920BEE90FADEB75F3
                        SHA-512:64F51508AF5D1BAE15EDDA0791AF3ECB807332D6B22E0A9A56C84A0EA461714A4093A9F18F9DF0260384D53A2FEAA2856AAA54061A9717124B63114B5B310072
                        Malicious:false
                        Reputation:unknown
                        URL:"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.9-tWEU_WTXw.O/am=AAw/d=0/rs=AO0039tMQJLD0qTIDmSwVt_r4CF-V_b3-A/m=MpJwZc,UUJqVe,sy5,s39S4,syn,pw70Gc"
                        Preview:try{.z("MpJwZc");..A();.}catch(e){_DumpException(e)}.try{.z("UUJqVe");..A();.}catch(e){_DumpException(e)}.try{.Se(Ow);.}catch(e){_DumpException(e)}.try{.z("s39S4");.var HRb=function(a,b,c){c?a.setAttribute(b,c):a.removeAttribute(b);a.hasAttribute("c-wiz")||(b=a,"C-DATA"===a.tagName&&(b=a.parentElement),NGa(b,!1))},IRb=function(a,b,c){var d=a.getAttribute(b)||"";c=String(c||"");c=c.split(";").filter(function(e){return e});d=d.split(";").filter(function(e){return Jg(e,":.CLIENT")});Fa(c,d);(c=c.join(";"))?a.setAttribute(b,c):a.removeAttribute(b);jha(a)},MRb=function(){JRb||(JRb=!0,KRb=ufa,ufa=function(a){KRb&&KRb(a);for(var b=0;b<a.length;b++){var c=a[b];He(c)&&.Ue(c).lAa(c)}},LRb=vfa,vfa=function(a){LRb&&LRb(a);for(var b=0;b<a.length;b++){var c=a[b];He(c)&&Ue(c).mAa(c)}})},NRb=function(a){if(a=a||document.body){var b=document.head.querySelector("style[data-late-css]");a=n(Array.from(a.querySelectorAll("style[data-server-css-collection], link[data-server-css-collection]")));for(var c=a.n

                        Chrome Cache Entry: 90

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (2054)
                        Category:downloaded
                        Size (bytes):15118
                        Entropy (8bit):5.4657756428542035
                        Encrypted:false
                        SSDEEP:
                        MD5:EAB0DC82067FB5758A121009C7040231
                        SHA1:8D869354F7A947ECC087B23868999BC53F77BDF7
                        SHA-256:9C77D6DB3131248F92AE41075F189B4ECC2E51BCFDCCA143719A83145F8AC070
                        SHA-512:280694C2A85A67CFFB24DEED946E46D7BF8F2C52194EEE037F981CA25A58730974B5F0CDC74CE86E81C5D252362E6792EB0B38C8816B3BF6C096A58C6C84F1C4
                        Malicious:false
                        Reputation:unknown
                        URL:https://apis.google.com/js/googleapis.proxy.js?onload=startup
                        Preview:(function(){var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ca=ba(this),g=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-.1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a,b,c){if(null==a)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regular expression");return a+""};.g("String.prototype.endsWith",function(a){return a?a:function(b,c){var d=h(this

                        Chrome Cache Entry: 91

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (609)
                        Category:downloaded
                        Size (bytes):1751361
                        Entropy (8bit):5.6280869637058855
                        Encrypted:false
                        SSDEEP:
                        MD5:A324422B213E012C359002AAC8AAD0EA
                        SHA1:FCF6305DBD8AA976186174B733506F02DD5CB18A
                        SHA-256:FA0C61814E9BAA7B817CF4FE5F081D6FF4F2B58E458151744FADDCAEF536C864
                        SHA-512:A9CC6FCE87FF8539BFA8AC5FE1BDE96DCB7B646A82B8F91922E3A12080EC5212EDC3BE1CCBC429CB736E1BB343CCED1B59E091BAA9C9B710A4B1B4839C7633FA
                        Malicious:false
                        Reputation:unknown
                        URL:"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.9-tWEU_WTXw.O/am=AAw/d=1/rs=AO0039tMQJLD0qTIDmSwVt_r4CF-V_b3-A/m=v,wb"
                        Preview:try{.var _F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a||[]};_F_toggles_initialize([0xc00, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. SPDX-License-Identifier: Apache-2.0.*/./*... Copyright (c) 2015-2018 Google, Inc., Netflix, Inc., Microsoft Corp. and contributors. Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License..*/./*. SPDX-License-Identifier: Apache-2.0.*/./*. Copyright The Closure L

                        Chrome Cache Entry: 92

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (1293)
                        Category:downloaded
                        Size (bytes):208027
                        Entropy (8bit):5.521227524487725
                        Encrypted:false
                        SSDEEP:
                        MD5:E2965C7B2C07132BA0770965EFE81CA4
                        SHA1:B1AA82452465DD74BC80BDA33C62CE7ECB172064
                        SHA-256:82B3F379A1BBB41DE5081E80DD9583AD5E77C011B501CDE5F9317463001F3CA2
                        SHA-512:B88E3C8D16B64DB36D5A87808C04CA91A30525765ED7ECF117684C2A99F3BC6F12CA7B93C3BFCA99F7A3225A638A7ED0F1D25F47555EF3044A49575777F00DC3
                        Malicious:false
                        Reputation:unknown
                        URL:"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=client/exm=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_1"
                        Preview:gapi.loaded_1(function(_){var window=this;._.yh=(window.gapi||{}).load;._.Ko=_.lf(_.yf,"rw",_.mf());.var Lo=function(a,b){(a=_.Ko[a])&&a.state<b&&(a.state=b)};var Mo=function(a){a=(a=_.Ko[a])?a.oid:void 0;if(a){var b=_.hf.getElementById(a);b&&b.parentNode.removeChild(b);delete _.Ko[a];Mo(a)}};_.No=function(a){a=a.container;"string"===typeof a&&(a=document.getElementById(a));return a};_.Oo=function(a){var b=a.clientWidth;return"position:absolute;top:-10000px;width:"+(b?b+"px":a.style.width||"300px")+";margin:0px;border-style:none;"};._.Po=function(a,b){var c={},d=a.Gc(),e=b&&b.width,f=b&&b.height,h=b&&b.verticalAlign;h&&(c.verticalAlign=h);e||(e=d.width||a.width);f||(f=d.height||a.height);d.width=c.width=e;d.height=c.height=f;d=a.getIframeEl();e=a.getId();Lo(e,2);a:{e=a.getSiteEl();c=c||{};if(_.yf.oa){var k=d.id;if(k){f=(f=_.Ko[k])?f.state:void 0;if(1===f||4===f)break a;Mo(k)}}(f=e.nextSibling)&&f.dataset&&f.dataset.gapistub&&(e.parentNode.removeChild(f),e.style.cssText="");f=c.width;h=

                        Chrome Cache Entry: 95

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                        Category:downloaded
                        Size (bytes):259
                        Entropy (8bit):6.7268503778685105
                        Encrypted:false
                        SSDEEP:
                        MD5:AF848AEE503A57E479B0FB57318F3F2F
                        SHA1:68FE7097531D492691C6FA3454C8192D13E8572F
                        SHA-256:33DD0582F6972DDDB05BEE6FD5EA0312FBD782A8003F4C7876AFEBD0F08F49AD
                        SHA-512:1225614BBD2BD8DCF57B31759093EC92096A16AB428DE43606A8F71367BF247B9ADFE1F2C18E5F7156A216CBC4B35CF5070A39E4740FBDE1BAE5709D43734619
                        Malicious:false
                        Reputation:unknown
                        URL:https://ssl.gstatic.com/docs/doclist/images/mediatype/icon_3_pdf_x16.png
                        Preview:.PNG........IHDR................a....IDATx.cx.l......+g.....N... ...=....D.|Y8.......]Z...E.p....`5.....}.lD5..3.....?.......?..8..D......H.....n..(?..r.....L3....|.....cm...@j@..j.8..|T/ ....4...^..P>PC:<.>#......CBz.d..".^8.....h......V...Q......IEND.B`.

                        Chrome Cache Entry: 98

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text
                        Category:downloaded
                        Size (bytes):21836
                        Entropy (8bit):5.612275151948576
                        Encrypted:false
                        SSDEEP:
                        MD5:087964E8AC859B87529454C53FAE4F73
                        SHA1:FFD324F4787D9D80265071B14D0EEA980327555E
                        SHA-256:8E20748D4F2809DE43DDEC5EBA1D8CBAC192079F996FC4FE88DD3A5C159D31E3
                        SHA-512:FE5461898F46415A540012BACB2060EF7A20AF0B5504195AACEB009BCF25FC9B6C76E50BA24361B9EFD5AA54EEE9126CECEDC33D0502127052818CCE5691E873
                        Malicious:false
                        Reputation:unknown
                        URL:"https://fonts.googleapis.com/css?family=Google+Sans:300,400,500,700"
                        Preview:/*. * See: https://fonts.google.com/license/googlerestricted. */./* armenian */.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiIUvaYr.woff2) format('woff2');. unicode-range: U+0308, U+0530-058F, U+2010, U+2024, U+25CC, U+FB13-FB17;.}./* bengali */.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiAUvaYr.woff2) format('woff2');. unicode-range: U+0951-0952, U+0964-0965, U+0980-09FE, U+1CD0, U+1CD2, U+1CD5-1CD6, U+1CD8, U+1CE1, U+1CEA, U+1CED, U+1CF2, U+1CF5-1CF7, U+200C-200D, U+20B9, U+25CC, U+A8F1;.}./* cyrillic-ext */.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_I

                        Static File Info

                        ⊘No static file info