Edit tour

Windows Analysis Report
https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000

Overview

General Information

Sample URL:	https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000
Analysis ID:	1619228
Infos:

Detection

Score:	52
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

AI detected landing page (webpage, office document or email)

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6340 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7164 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1920,i,12650101475467269513,10063398656032857998,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8F

Joe Sandbox AI: Score: 9 Reasons: The brand 'Docusign' is a well-known electronic signature service., The URL 'victoryacademytc.com' does not match the legitimate domain 'docusign.com'., There is no apparent association between 'victoryacademytc.com' and Docusign., The URL does not contain any recognizable elements related to Docusign., The presence of an email input field could be used to harvest credentials, which is a common phishing tactic. DOM: 3.3.pages.csv

AI detected landing page (webpage, office document or email)

Source: https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000&slide=id.p

Joe Sandbox AI: Page contains button: 'CLICK HERE TO ACCESS DOCUMENT' Source: '2.0.pages.csv'

Source: https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8F

HTTP Parser: Number of links: 0

Source: https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8F

HTTP Parser: Title: DocuSign does not match URL

Source: https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8F	HTTP Parser: No <meta name="author".. found
Source: https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8F	HTTP Parser: No <meta name="author".. found
Source: https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8F	HTTP Parser: No <meta name="author".. found

Source: https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8F	HTTP Parser: No <meta name="copyright".. found
Source: https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8F	HTTP Parser: No <meta name="copyright".. found
Source: https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8F	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172

Source: global traffic	HTTP traffic detected: GET /presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000 HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/css/4046644970-viewer_css_ltr.css HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=NXDBZcsnAc6byyY8_rRVuIbvapuYtOtb959jYKiZOO1Xb3imy-LtvGcRGe45kMrLuZytiQNr-4gXrC5oHqWnIn_8ycVP408wvN2ZZBA2pKGcWheerhHPYTYgVjRfCENCi_7YENSySDSxOAOD3j5IJDqIrzpkqupjcOfwkXR58EDqsnF5z1aONRM5uwd8hM3V; GFE_RTT=353
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/345947954-viewer_integrated_core.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=NXDBZcsnAc6byyY8_rRVuIbvapuYtOtb959jYKiZOO1Xb3imy-LtvGcRGe45kMrLuZytiQNr-4gXrC5oHqWnIn_8ycVP408wvN2ZZBA2pKGcWheerhHPYTYgVjRfCENCi_7YENSySDSxOAOD3j5IJDqIrzpkqupjcOfwkXR58EDqsnF5z1aONRM5uwd8hM3V; GFE_RTT=353
Source: global traffic	HTTP traffic detected: GET /slidesz/AGV_vUeT1zL1r49lfyvGFzk7-yUXBXaL0PZoaCqf56sTCBMtq0x8kliaD1nJl0Jo24hqvJBbeMSiJawB4ZybrYLwVgy_coQthTZi22YYAjuLqvXVYOPMvB4y0jnD8i06goofEQ=s2048?key=T_I-lQuJcqYAiWo1JomhSoqH HTTP/1.1Host: lh7-rt.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /slidesz/AGV_vUeT1zL1r49lfyvGFzk7-yUXBXaL0PZoaCqf56sTCBMtq0x8kliaD1nJl0Jo24hqvJBbeMSiJawB4ZybrYLwVgy_coQthTZi22YYAjuLqvXVYOPMvB4y0jnD8i06goofEQ=s2048?key=T_I-lQuJcqYAiWo1JomhSoqH HTTP/1.1Host: lh7-rt.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/345947954-viewer_integrated_core.js HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=NXDBZcsnAc6byyY8_rRVuIbvapuYtOtb959jYKiZOO1Xb3imy-LtvGcRGe45kMrLuZytiQNr-4gXrC5oHqWnIn_8ycVP408wvN2ZZBA2pKGcWheerhHPYTYgVjRfCENCi_7YENSySDSxOAOD3j5IJDqIrzpkqupjcOfwkXR58EDqsnF5z1aONRM5uwd8hM3V; GFE_RTT=353
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/4044290882-punch_viewer_worker_binary_viewercore.js HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=NXDBZcsnAc6byyY8_rRVuIbvapuYtOtb959jYKiZOO1Xb3imy-LtvGcRGe45kMrLuZytiQNr-4gXrC5oHqWnIn_8ycVP408wvN2ZZBA2pKGcWheerhHPYTYgVjRfCENCi_7YENSySDSxOAOD3j5IJDqIrzpkqupjcOfwkXR58EDqsnF5z1aONRM5uwd8hM3V
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/1183082385-viewer_integrated_app.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=NXDBZcsnAc6byyY8_rRVuIbvapuYtOtb959jYKiZOO1Xb3imy-LtvGcRGe45kMrLuZytiQNr-4gXrC5oHqWnIn_8ycVP408wvN2ZZBA2pKGcWheerhHPYTYgVjRfCENCi_7YENSySDSxOAOD3j5IJDqIrzpkqupjcOfwkXR58EDqsnF5z1aONRM5uwd8hM3V; GFE_RTT=353
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/4044290882-punch_viewer_worker_binary_viewercore.js HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=NXDBZcsnAc6byyY8_rRVuIbvapuYtOtb959jYKiZOO1Xb3imy-LtvGcRGe45kMrLuZytiQNr-4gXrC5oHqWnIn_8ycVP408wvN2ZZBA2pKGcWheerhHPYTYgVjRfCENCi_7YENSySDSxOAOD3j5IJDqIrzpkqupjcOfwkXR58EDqsnF5z1aONRM5uwd8hM3V
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/37351684-viewer_integrated_help.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=NXDBZcsnAc6byyY8_rRVuIbvapuYtOtb959jYKiZOO1Xb3imy-LtvGcRGe45kMrLuZytiQNr-4gXrC5oHqWnIn_8ycVP408wvN2ZZBA2pKGcWheerhHPYTYgVjRfCENCi_7YENSySDSxOAOD3j5IJDqIrzpkqupjcOfwkXR58EDqsnF5z1aONRM5uwd8hM3V
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/1183082385-viewer_integrated_app.js HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=NXDBZcsnAc6byyY8_rRVuIbvapuYtOtb959jYKiZOO1Xb3imy-LtvGcRGe45kMrLuZytiQNr-4gXrC5oHqWnIn_8ycVP408wvN2ZZBA2pKGcWheerhHPYTYgVjRfCENCi_7YENSySDSxOAOD3j5IJDqIrzpkqupjcOfwkXR58EDqsnF5z1aONRM5uwd8hM3V
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=j658EKh8eSWaRWgZsaowfcf7oloG6dybdV4fzjguBWLYoPtjUEpxhcU-kIuEKhVQE8KVtAUYEKVcQdpc0kcUSsnaUN44LXJxjVnpnIq51b9_aLAW9wYUztrfTweQF1B8WCOOSomDmk4rerFfadm76e5-nb4ku8EVtZxiA2Phx6oayb9dJlCNSdxLfP1lzvbSQ7XTor3F
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/37351684-viewer_integrated_help.js HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=j658EKh8eSWaRWgZsaowfcf7oloG6dybdV4fzjguBWLYoPtjUEpxhcU-kIuEKhVQE8KVtAUYEKVcQdpc0kcUSsnaUN44LXJxjVnpnIq51b9_aLAW9wYUztrfTweQF1B8WCOOSomDmk4rerFfadm76e5-nb4ku8EVtZxiA2Phx6oayb9dJlCNSdxLfP1lzvbSQ7XTor3F
Source: global traffic	HTTP traffic detected: GET /presentation/manifest.json HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=j658EKh8eSWaRWgZsaowfcf7oloG6dybdV4fzjguBWLYoPtjUEpxhcU-kIuEKhVQE8KVtAUYEKVcQdpc0kcUSsnaUN44LXJxjVnpnIq51b9_aLAW9wYUztrfTweQF1B8WCOOSomDmk4rerFfadm76e5-nb4ku8EVtZxiA2Phx6oayb9dJlCNSdxLfP1lzvbSQ7XTor3F
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=j658EKh8eSWaRWgZsaowfcf7oloG6dybdV4fzjguBWLYoPtjUEpxhcU-kIuEKhVQE8KVtAUYEKVcQdpc0kcUSsnaUN44LXJxjVnpnIq51b9_aLAW9wYUztrfTweQF1B8WCOOSomDmk4rerFfadm76e5-nb4ku8EVtZxiA2Phx6oayb9dJlCNSdxLfP1lzvbSQ7XTor3F
Source: global traffic	HTTP traffic detected: GET /KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8F HTTP/1.1Host: victoryacademytc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/dSignCall.jpeg HTTP/1.1Host: victoryacademytc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8FAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@5.3.2/dist/css/bootstrap.min.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://victoryacademytc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.5.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://victoryacademytc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/nero.webp HTTP/1.1Host: victoryacademytc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8FAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/DocuSign-Logo.png HTTP/1.1Host: victoryacademytc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8FAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/dSignCall.jpeg HTTP/1.1Host: victoryacademytc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@5.3.2/dist/js/bootstrap.bundle.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://victoryacademytc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.5.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/DocuSign-Logo.png HTTP/1.1Host: victoryacademytc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Signing/Images/logo_docusign_new_white.png HTTP/1.1Host: www.docusign.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://victoryacademytc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /olive/fonts/3.0.0/DSIndigo-Regular.woff2 HTTP/1.1Host: docucdn-a.akamaihd.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://victoryacademytc.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://victoryacademytc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /olive/fonts/3.0.0/DSIndigo-Bold.woff2 HTTP/1.1Host: docucdn-a.akamaihd.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://victoryacademytc.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://victoryacademytc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@5.3.2/dist/js/bootstrap.bundle.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Signing/Images/logo_docusign_new_white.png HTTP/1.1Host: www.docusign.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/new_favicon.png HTTP/1.1Host: victoryacademytc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8FAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/new_favicon.png HTTP/1.1Host: victoryacademytc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/yourBack.png HTTP/1.1Host: victoryacademytc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8FAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /signing/1.9.0/fonts/maven-pro/MavenPro-Bold.ttf HTTP/1.1Host: docucdn-a.akamaihd.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://victoryacademytc.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://victoryacademytc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/yourBack.png HTTP/1.1Host: victoryacademytc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=j658EKh8eSWaRWgZsaowfcf7oloG6dybdV4fzjguBWLYoPtjUEpxhcU-kIuEKhVQE8KVtAUYEKVcQdpc0kcUSsnaUN44LXJxjVnpnIq51b9_aLAW9wYUztrfTweQF1B8WCOOSomDmk4rerFfadm76e5-nb4ku8EVtZxiA2Phx6oayb9dJlCNSdxLfP1lzvbSQ7XTor3F

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: lh7-rt.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: victoryacademytc.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: www.docusign.net
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 3025sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/binaryContent-Encoding: gzipX-Goog-AuthUser: 0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://docs.google.comX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=NXDBZcsnAc6byyY8_rRVuIbvapuYtOtb959jYKiZOO1Xb3imy-LtvGcRGe45kMrLuZytiQNr-4gXrC5oHqWnIn_8ycVP408wvN2ZZBA2pKGcWheerhHPYTYgVjRfCENCi_7YENSySDSxOAOD3j5IJDqIrzpkqupjcOfwkXR58EDqsnF5z1aONRM5uwd8hM3V

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 16:49:18 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Fri, 30 Sep 2022 11:51:02 GMTAccept-Ranges: bytesContent-Length: 11816Vary: Accept-EncodingContent-Type: text/html

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: classification engine

Classification label: mal52.phis.win@18/36@34/269

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1920,i,12650101475467269513,10063398656032857998,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1920,i,12650101475467269513,10063398656032857998,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://docs.google.com/static/presentation/client/js/345947954-viewer_integrated_core.js	0%	Avira URL Cloud	safe
https://docs.google.com/static/presentation/client/js/4044290882-punch_viewer_worker_binary_viewercore.js	0%	Avira URL Cloud	safe
https://docs.google.com/static/presentation/client/js/1183082385-viewer_integrated_app.js	0%	Avira URL Cloud	safe
https://lh7-rt.googleusercontent.com/slidesz/AGV_vUeT1zL1r49lfyvGFzk7-yUXBXaL0PZoaCqf56sTCBMtq0x8kliaD1nJl0Jo24hqvJBbeMSiJawB4ZybrYLwVgy_coQthTZi22YYAjuLqvXVYOPMvB4y0jnD8i06goofEQ=s2048?key=T_I-lQuJcqYAiWo1JomhSoqH	0%	Avira URL Cloud	safe
https://docs.google.com/static/presentation/client/css/4046644970-viewer_css_ltr.css	0%	Avira URL Cloud	safe
https://docs.google.com/static/presentation/client/js/37351684-viewer_integrated_help.js	0%	Avira URL Cloud	safe
https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/dSignCall.jpeg	0%	Avira URL Cloud	safe
https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/nero.webp	0%	Avira URL Cloud	safe
https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/DocuSign-Logo.png	0%	Avira URL Cloud	safe
https://www.docusign.net/Signing/Images/logo_docusign_new_white.png	0%	Avira URL Cloud	safe
https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/yourBack.png	0%	Avira URL Cloud	safe
https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/new_favicon.png	0%	Avira URL Cloud	safe
https://docucdn-a.akamaihd.net/signing/1.9.0/fonts/maven-pro/MavenPro-Bold.ttf	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.129.229	true	false	high
docs.google.com	142.250.185.174	true	false	high
a1737.b.akamai.net	2.19.11.109	true	false	high
play.google.com	142.250.186.78	true	false	high
code.jquery.com	151.101.194.137	true	false	high
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	high
victoryacademytc.com	192.185.150.180	true	false	high
na1-se.docusign.net.akadns.net	162.248.184.179	true	false	unknown
www.google.com	142.250.186.164	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.225	true	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
www.docusign.net	unknown	unknown	false	high
docucdn-a.akamaihd.net	unknown	unknown	false	high
lh7-rt.googleusercontent.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://docucdn-a.akamaihd.net/olive/fonts/3.0.0/DSIndigo-Bold.woff2	false		high
https://docs.google.com/static/presentation/client/js/1183082385-viewer_integrated_app.js	false	Avira URL Cloud: safe	unknown
https://www.docusign.net/Signing/Images/logo_docusign_new_white.png	false	Avira URL Cloud: safe	unknown
https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/yourBack.png	false	Avira URL Cloud: safe	unknown
https://docs.google.com/static/presentation/client/js/37351684-viewer_integrated_help.js	false	Avira URL Cloud: safe	unknown
https://docucdn-a.akamaihd.net/olive/fonts/3.0.0/DSIndigo-Regular.woff2	false		high
https://docs.google.com/static/presentation/client/js/4044290882-punch_viewer_worker_binary_viewercore.js	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css	false		high
https://docs.google.com/static/presentation/client/css/4046644970-viewer_css_ltr.css	false	Avira URL Cloud: safe	unknown
https://docs.google.com/presentation/manifest.json	false		high
https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/new_favicon.png	false	Avira URL Cloud: safe	unknown
https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000	false		unknown
https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000&slide=id.p	true		unknown
https://lh7-rt.googleusercontent.com/slidesz/AGV_vUeT1zL1r49lfyvGFzk7-yUXBXaL0PZoaCqf56sTCBMtq0x8kliaD1nJl0Jo24hqvJBbeMSiJawB4ZybrYLwVgy_coQthTZi22YYAjuLqvXVYOPMvB4y0jnD8i06goofEQ=s2048?key=T_I-lQuJcqYAiWo1JomhSoqH	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.5.1.min.js	false		high
https://play.google.com/log?format=json&hasfast=true&authuser=0	false		high
https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/nero.webp	false	Avira URL Cloud: safe	unknown
https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/DocuSign-Logo.png	false	Avira URL Cloud: safe	unknown
https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/dSignCall.jpeg	false	Avira URL Cloud: safe	unknown
https://docs.google.com/static/presentation/client/js/345947954-viewer_integrated_core.js	false	Avira URL Cloud: safe	unknown
https://docucdn-a.akamaihd.net/signing/1.9.0/fonts/maven-pro/MavenPro-Bold.ttf	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/js/bootstrap.bundle.min.js	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
142.250.186.170	unknown	United States	15169	GOOGLEUS	false
172.217.18.14	unknown	United States	15169	GOOGLEUS	false
151.101.129.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
216.58.206.78	unknown	United States	15169	GOOGLEUS	false
162.248.184.180	unknown	United States	62856	DOCUS-6-PRODUS	false
74.125.206.84	unknown	United States	15169	GOOGLEUS	false
151.101.66.137	unknown	United States	54113	FASTLYUS	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
172.217.18.99	unknown	United States	15169	GOOGLEUS	false
142.250.186.99	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	play.google.com	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.184.193	unknown	United States	15169	GOOGLEUS	false
142.250.186.163	unknown	United States	15169	GOOGLEUS	false
2.19.11.109	a1737.b.akamai.net	European Union	719	ELISA-ASHelsinkiFinlandEU	false
142.250.185.170	unknown	United States	15169	GOOGLEUS	false
142.250.181.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	docs.google.com	United States	15169	GOOGLEUS	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
192.185.150.180	victoryacademytc.com	United States	46606	UNIFIEDLAYER-AS-1US	false
162.248.184.179	na1-se.docusign.net.akadns.net	United States	62856	DOCUS-6-PRODUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
172.217.16.131	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1619228
Start date and time:	2025-02-19 17:48:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.win@18/36@34/269

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.195, 142.250.186.46, 74.125.206.84, 142.250.185.110, 142.250.184.238, 142.250.186.170, 142.250.186.99, 172.217.16.206, 172.217.16.195, 2.19.106.160, 20.12.23.50, 13.107.253.45
Excluded domains from analysis (whitelisted): fonts.googleapis.com, ssl.gstatic.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, fonts.gstatic.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, redirector.gvt1.com, e16604.g.akamaiedge.net, azureedge-t-prod.trafficmanager.net, clients.l.google.com, prod.fs.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 19 15:48:51 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9922879631358374
Encrypted:	false
SSDEEP:
MD5:	C9A3354F4CDF807AA4568445C9C3D336
SHA1:	82EE14797CED93E5E6B164D416F69ABAE72C3731
SHA-256:	111C5DA6AFA784960990A568FFCA9F21D28804FA427B3A72B877DC581F0E72E1
SHA-512:	1C06DD8F36C31F93BAD969BD7270C9F30F33EDC53872F22EA866C5DA3054E845E1998A7023ECE9C3C5A44061A89D5F153A7A648C5A60F30543E9EFCAF3CC20DD
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....2d.'...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ISZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VSZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VSZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VSZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VSZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............+.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 19 15:48:51 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.010238387076719
Encrypted:	false
SSDEEP:
MD5:	6D4F8AB187823B8656E7A3725812F568
SHA1:	FE9F483002F3CC79AC9F6D751185C1061DC1BB54
SHA-256:	38E117A9FE7F0F81D975C404EE4778ACD7B04EA13368A3E1D50569CA29071828
SHA-512:	1590A1C1862214AE3211EA74467A358458CC74382AC51855F1F1C5EEDF086DB157ED9FDE2F74D0C51F4472D29F960CAE48E61E3FBDEE33336F393BB3C36C5791
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......'...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ISZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VSZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VSZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VSZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VSZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............+.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.018169418979174
Encrypted:	false
SSDEEP:
MD5:	2271F50B2CB5902B288DC528C43C28DA
SHA1:	61635E0D88BA5F08CEB7B9EC82E497CB74BB9CAD
SHA-256:	E4DC800F3976D55662CBE41DC6308EE4E8E1E35379523DA578866765C40EB588
SHA-512:	947D31AF7050CAB79092DD5CADFCEC4734FAB70087C7442C501B4CF7A5A53F7CD681F127F4BC89425DDAF7FC9045583888E73E4E8A46A0244959723A9FC4B1F6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ISZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VSZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VSZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VSZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............+.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 19 15:48:51 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.008555430174367
Encrypted:	false
SSDEEP:
MD5:	F85A966EDD6984F6BCC2CA23D297718F
SHA1:	D1E2764AB5F31899E888F4E15B96E4F689C03F17
SHA-256:	7C487CBC15F6F1011BBB49A0CD674180FF0BFB80AA6C7438F6FAA45CCA05A2C4
SHA-512:	657842269AA1FFA81C3042F2726D236A793043ED3673B67354759B872146214696B9B8465E86D0BBA38EAE967A5F83F28F8B737564715E4C51D8A1D1E8A8CC86
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......'...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ISZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VSZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VSZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VSZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VSZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............+.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 19 15:48:51 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9963332215937015
Encrypted:	false
SSDEEP:
MD5:	E0E3BFEF23867F9F825B8A57C302BB3E
SHA1:	C30EDC30796ACB6DDBF92AB642C62B3DD6D23976
SHA-256:	81A2C78258B79500706FB56C12E459D4C2FC30CFA6851771F6DD0483F2FACD1A
SHA-512:	FF918ED90A9990003D80B615CC69A37A9410C6E5D082D2F73367523B0DC1A984021B08DD5F287C952F22BB6A8DA05D5C82A3FD72F1E13B79353FA7AEC392CE06
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....4.'...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ISZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VSZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VSZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VSZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VSZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............+.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 19 15:48:51 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.008115891364124
Encrypted:	false
SSDEEP:
MD5:	77FC20695D590A57229F702F2E7DF455
SHA1:	2C8A32E90EA4D09BDCE947BEE8C22A9CCE90D08D
SHA-256:	E6586DEB3D899522DD9DCDBE7F47C8E7FA8CC0896CD8BFD908B9E6492F72A697
SHA-512:	87684E08EF1BC1BE836BD1C69164BE8B39BA68B0055C6DD169897623081FF916C58AAAA4685E769E9F69E3C6B572D717494D62C57768EF88B3BC6F4554483D1C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......'...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ISZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VSZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VSZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VSZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VSZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............+.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:
MD5:	2A328AC74847EB2ED4532DAB536AEBD0
SHA1:	96604653F561EF33393F7BF00A973510881F974D
SHA-256:	FA010E5C153B81CEC17053CFE23EAFF149D88EDCB00AC55F1FD9A7C38091799D
SHA-512:	7A16D330B82EB0684CF7C6ACCE7467763E198C5240634687830C67226FFDF329A38BDE2909A44B1D7D7896258F4AC8DDF189660F385E93E991158415B254C425
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAnAGGdLFe3DnhIFDfRSUYQ=?alt=proto
Preview:	CgkKBw30UlGEGgA=

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	55815
Entropy (8bit):	4.5764486217099964
Encrypted:	false
SSDEEP:
MD5:	34776B813C1BD6DCD2F108FF3BC704AE
SHA1:	47069BD29B2AEFDDD622FB0A678ABB2DEC9C6A13
SHA-256:	F9B41BB504C0F7773A898244E1E28486040366380BFFEBF4F36120835016824C
SHA-512:	0E155E3EFD7A8E3EAE78176DCEC13CE01F60137C1A0331E1DC306C8BD812616225D32A1347DBC63351B2F87FDA054B141E82FEBF73941465EFCD1C2BA57180C0
Malicious:	false
Reputation:	unknown
URL:	https://ssl.gstatic.com/docs/presentations/images/punchviewer_material_sprite46_grey_medium.svg
Preview:	<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" x="0" y="0" width="52px" height="1258px" viewBox="0 0 52 1258" preserveAspectRatio="none"><g transform="translate(0,1014)"><path fill="#80868B" fill-rule="evenodd" d="m7 10 5 5 5-5z"/>.</g><g transform="translate(26,1038)"><path fill="#80868B" d="m7 14 5-5 5 5H7Z"/>.</g><g transform="translate(26,640)"><path fill="#80868B" d="M10 21.5c-.13333 0-.25-.05-.35-.15-.1-.1-.15-.2167-.15-.35 0-.1333.05-.25.15-.35.1-.1.21667-.15.35-.15.1333 0 .25.05.35.15.1.1.15.2167.15.35 0 .1333-.05.25-.15.35-.1.1-.2167.15-.35.15Zm4 0c-.1333 0-.25-.05-.35-.15-.1-.1-.15-.2167-.15-.35 0-.1333.05-.25.15-.35.1-.1.2167-.15.35-.15.1333 0 .25.05.35.15.1.1.15.2167.15.35 0 .1333-.05.25-.15.35-.1.1-.2167.15-.35.15ZM6 19c-.28333 0-.525-.0917-.725-.275C5.09167 18.525 5 18.2833 5 18s.09167-.51

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 960x720, components 3
Category:	dropped
Size (bytes):	207596
Entropy (8bit):	7.914992332292183
Encrypted:	false
SSDEEP:
MD5:	960C2714C85D9AF0A4F82F322C7F2899
SHA1:	0C44D301DF169D5229C4ACFEBADCA7A37E0FD7E7
SHA-256:	96B0256CFCE70BC3529DACFFEF6F4888A2EE0B76FD5B56059D3FC49D101C224B
SHA-512:	E58079B860D40A3B768D3C971B923418AE637DED009CAF0F35BF2548A0C136E2C0B9689AD39FC56C28C69F963294BFBD0CBA0A85018907FAC43BF10EFFDC2090
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C....................................................................C......................................................................................................................V........................".2BR..#b.3r.....$C...S....!1c..%4as..AQ....DTdqt.....&5.....................................=.......................!..1..A."2Qaq.......#B....3CR.b..$..............?..P..e2..".1...'..I5.e..a...Jc.2.D./...=U .FT\|V......H.......r.....[q"...`..Gy."#...Up^l.Q.r..BYzk,J.t....[.U...m....FLf.e..21]%.&T..F.2,G.A...5....."......Mb.$.1........W.(.."0.$^.u.s...Eq.U!^..n.@l8...W&...uQC..1.5...!.......A....q.}.qh-X...I..}.0....;U .%.CA.{\Y.s..../....^%[C.b.8..4.wQ....".q.&.g.K.A...&t.LC..P.a.."D...L+...).-.1].....X1.....pz-...L&w..j...!~....^B.^,".yv.YR\bE..Z..DE....c.,./....!.3..~.......).o..1.d...).XD..F......&.R...@.........^.......".....R.t.9fbE...wU..=.-.H..Fc.n........`.Lr"....R.6...r..&n.....)I....">e.$.qIF1.Z..[W....z...4....<.u

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 813 x 754, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	112985
Entropy (8bit):	7.956024764492402
Encrypted:	false
SSDEEP:
MD5:	3C6F160F758750EC4B357B9F72295C89
SHA1:	2AB37745EDB13F6114F94E7CE4F236FEE6BC4CDB
SHA-256:	07841D9994E198AD416752F52E16AEE4391F1A9BF8FA6ABF04B876FBD0528467
SHA-512:	1446B950D249B1891530CEF065185928EF5891948A320B581FA61E9B4F0B99EC3D8C212B6E5AB6B96F03432B2FFB5246C2D2FA76F293FB1654E94ABE213B6AEB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...-...........;H...\|iCCPICC Profile..X..y.TT.v..3..r..$.s. .C..0D.E.Q.".....D...T.A.(J.... .T.PA%...=......k..o.....:....odd...............?.=......`.%GG...Y...n..,...py..!........M.....49..w.@."GRc..l..c"7.~.3Sa.a\....p.....-.<N..0...G..K...~.....`9..p.1.....<s..9.....;.G:<\|..N..8.........Cf.....#..7....f..Q.#.\|...]....:D.J.L5s.?.........~6...........@..c......hC.....r..F.0.ID...6./.bb.c.g..J.....a\|8 ..q..,u...Dc .P......wC.hl...../.......N.0&.X8..b.cz..F.:Zn.h%......:l./.c...S.-..@...6.Vx..."..S.m..`'.-. ;....sA..D.;.....f.{...F.[sG..D8;n....c.5.E.....G....n..a....=..../.-.....;.-;Q.!..v[....+`...?......B...l.,.k.....*...@f..{..fO..t......@..q.... .....n=e@.fo..P0..p`......".hs..`...........7.7.o.>L.........c.1.aL0.(N..J.e.?..RC.......)t..-z.=.~...F....`..o.......%..TF...a.d.+....`=.(]X.2L5.{.+.....3.G4...rx........HzIz.?R6\|.O.l......z........[..s".#.......d....#...n...gu..\]..9l..........d.\..{.........g.;r......

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 3840 x 2160, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	43432
Entropy (8bit):	7.399864353387509
Encrypted:	false
SSDEEP:
MD5:	2454936B8BB75BEE32C74E3E4D62BAC7
SHA1:	B975625E81D7AF77469582B36F1250680988A7CA
SHA-256:	8AFBD1757A1521F41C2CEBD59BE5EA8A67162545E4ECC07A0D96A17613399C6B
SHA-512:	7B6D11D20620E286B9AA8D83E324B6D6BF4661F3F5A6FFE8C8F06607A44835851058B6283E5B24BDC5A0ECFA31416AE6838D6A8C3E9A0EF7D4C3745A7A01BEC5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......p......`;@...ZPLTE.........333.......LLL...&&&EEE......<<<TTT.......................ddd...ssszzzkkk\\\.....8....tRNS.@..f....IDATx.........................................................................`..@.........TUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.=8........m.UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUa........._.AUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU....... ..FPUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU...@.........TUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.=8........m.UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUa........._.AUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU....... ..FPUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU...@.........TUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.=8........m.UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUa........._.AUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 231 x 76, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4010
Entropy (8bit):	7.9163177616282265
Encrypted:	false
SSDEEP:
MD5:	2B83C7B55DD89651CCBF62A5153D1984
SHA1:	E6664BC6D6AC06AAC70ABBE21CBD83ADB776441A
SHA-256:	EDD5EB91A05EF65653A6E9C4DDB60482EE93AD2994C1925CD2B7A310E7BDCC73
SHA-512:	23B4A4389AEFAA88CB5D5404E15655B2A52ED4AB9FF258458B8E830886C106826F66448A67C2AFD69B15811A2C9D4E33A9507ECFBADB6DF90A1C5B2A0A97B836
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......L....../......pHYs................\IDATx..{.]E...E.7...........$...5.h....t...8...P.y..DP..%.hJ.G..F$.(.D..3H..$.'...a..7..}...s.{.....[.{.z.}....k..L&..d2.L&..d2.L&..d2.L&..d2.L&..d2.L&.`}.L.F.``..E3{...=a.&..c3..X.,3..[oV..H..8.8.x.p(..0.Fl...x...p?0..6..s$.c........FQ{.(.qI.%..)...9..J."...YI.K.#.....;}..(>.T.H......I.%}_..mz..I.....s.....^...q$.$./.z...C.v.4..m...c..t.^.......Fu..G..:.{..[..`w..I.v.f...v#0...tV.ml.4.u.W...t.........%An#p;....X...........Iwe.kub..E..G.{.o.;_.!..%.mf..Z.i.....p.p..-m$........p6......GQ.X.i..Edr....A.N.{hS......I.F...e...v.tkD.2I;u.i"77.s...I...s...:qM.......ZAg......:p9..mw....3.....l....3M.+r\|FY.f...rD.z3N'.B..G.!a.8S.f.2U.......\w$0..+[.<.L..4.......p.Z&....$..y.J./...=.}f.......N.c.....Ef.........._.....R.....'i/.Y..8........u0..I.;..V.r.....g......3q..>..q..9......o..x..a`....ofw...(=..3~......%.z.......6..ok.5.B."i.G.?)........vL...,";...T.....$.!...6E.E....z..N.......`I.T.

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	24177
Entropy (8bit):	2.600128307982013
Encrypted:	false
SSDEEP:
MD5:	5A0EB0DCD9EE0EECD82FB9A75AC67677
SHA1:	99C103FF8EFFC753757E90F14AE73526F4124F66
SHA-256:	1D2B1BF6C2921393F0EEB1B21613BB9E1C9144DFDA918306EF99DBF0D9D2AEE4
SHA-512:	8BC453A194708858AB81AC1048847848E99FE61198FFEBF32BDCDEB34DEDAE4FFAC9242633A7A6665E493E5DD2C60F97CB038B95CF3CB2C6A9C2B0CC3D622355
Malicious:	false
Reputation:	unknown
Preview:	............ .h...F... .... .........@@.... .(B..V......... .....~W..(....... ..... ............................`...........................................................`..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2048 x 540, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	353450
Entropy (8bit):	7.94474819446976
Encrypted:	false
SSDEEP:
MD5:	2DC7A985B6479DD8CD2114F09B5BE5AE
SHA1:	973D19C67B7C6DDA0C63EEA093BD6834A04C6405
SHA-256:	B989E38304D04E6E263C375FCD2E955CB64510ABFCCD5E34ED3DB8FC65643710
SHA-512:	7DA83B0BFEF0C96FC4523CC319B813E28580A7FDF3C7D980F7E4466E72BEF60EBB313B833E377053BBE73E288BD445FE285DBCDBC556163179B4B93AB280BD7C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............b.N.....sRGB....... .IDATx^..YY....Z....@@-01B! *. ...D.51qh..cb2...../p....:F......A..H...W..J...A(....k]k......g.S.].#.]{5.3.5.yw..9r....K..@..@..@..@..@..@..@..@..@..@..@..@..@..@..@.<...i...z....(..(..(..(..(..(..(..(..(..(..(..(..(..(....Z.PA(..(..(..(..(..(..(..(..(..(..(..(..(..(..(.C@....`...(..(..(..(..(..(..(..(..(..(..(..(..(..(..h.@e..J..J..J..J..J..J..J..J..J..J..J..J..J..J.........Al.J..J..J..J..J..J..J..J..J..J..J..J..J..J..J......(..(..(..(..(..(..(..(..(..(..(..(..(..(..8..Z.p...](..(..(..(..(..(..(..(..(..(..(..(..(..(..(...T.J..J..J..J..J..J..J..J..J..J..J..J..J..J..J...h..!..v..J..J..J..J..J..J..J..J..J..J..J..J..J..J..Z.P.(..(..(..(..(..(..(..(..(..(..(..(..(..(..(.C@....`...(..(..(..(..(..(..(..(..(..(..(..(..(..(..h.@e..J..J..J..J..J..J..J..J..J..J..J..J..J..J.........Al.J..J..J..J..J..J..J..J..J..J..J..J..J..J..J......(..(..(..(..(..(..(..(..(..(..(..(..(..(..8..Z.p...](..(..(..(..(..(..(..(..(..(..(..(..(..(..(...T.J..J..J.

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65342)
Category:	downloaded
Size (bytes):	232948
Entropy (8bit):	4.9772469761951434
Encrypted:	false
SSDEEP:
MD5:	CD822B7FD22C8A95A68470C795ADEA69
SHA1:	1F139981B9B47A766EFA0A61BB78ADA351F16C4B
SHA-256:	3017DF4A76DB5F01C2B99B603D88B03106DF13BCFE18E67B7C13C2341D3A67DF
SHA-512:	6F641C4B94AC03CB59A1D703B464442E21AFE5268A4A4D6F0C70DA41175AD21B4F61667AD38EA5AF7909E5B00041DA55DA6980FF8BF4C1017D33253AFE90C802
Malicious:	false
Reputation:	unknown
URL:	https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css
Preview:	@charset "UTF-8";/!. Bootstrap v5.3.2 (https://getbootstrap.com/). * Copyright 2011-2023 The Bootstrap Authors. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE). */:root,[data-bs-theme=light]{--bs-blue:#0d6efd;--bs-indigo:#6610f2;--bs-purple:#6f42c1;--bs-pink:#d63384;--bs-red:#dc3545;--bs-orange:#fd7e14;--bs-yellow:#ffc107;--bs-green:#198754;--bs-teal:#20c997;--bs-cyan:#0dcaf0;--bs-black:#000;--bs-white:#fff;--bs-gray:#6c757d;--bs-gray-dark:#343a40;--bs-gray-100:#f8f9fa;--bs-gray-200:#e9ecef;--bs-gray-300:#dee2e6;--bs-gray-400:#ced4da;--bs-gray-500:#adb5bd;--bs-gray-600:#6c757d;--bs-gray-700:#495057;--bs-gray-800:#343a40;--bs-gray-900:#212529;--bs-primary:#0d6efd;--bs-secondary:#6c757d;--bs-success:#198754;--bs-info:#0dcaf0;--bs-warning:#ffc107;--bs-danger:#dc3545;--bs-light:#f8f9fa;--bs-dark:#212529;--bs-primary-rgb:13,110,253;--bs-secondary-rgb:108,117,125;--bs-success-rgb:25,135,84;--bs-info-rgb:13,202,240;--bs-warning-rgb:255,193,7;--bs-danger-rgb:220,

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2073)
Category:	downloaded
Size (bytes):	55249
Entropy (8bit):	5.527067455484261
Encrypted:	false
SSDEEP:
MD5:	6F30A8ED402CC1DD79EF974396830EE2
SHA1:	B3A07F56951C12FA378D0456FF1283098288F5A1
SHA-256:	6B6BA151FDF91BA46E051A30755D9DF85B72B6627B0C85F2CBF3F79EFD669FA4
SHA-512:	AE72924473514615B617A34BB152F273FE4AB4FAAF24CFA835D0FA0C518C17D371B7689E00D2510C260A9DD3AD2F8F1B84F566753F2C29EB4FF26C93B3B9B5AE
Malicious:	false
Reputation:	unknown
URL:	https://docs.google.com/static/presentation/client/js/37351684-viewer_integrated_help.js
Preview:	or(Be);.var O8b=" apps-actiondatawidget-content-element",P8b='" tabindex="0" role="button">',Q8b='" viewBox="0 0 24 24" focusable="false" fill="',R8b="Compatible spreadsheet shortcut",S8b="DuplicateFormError",T8b="Feedback binary script tag failed to load: ",U8b="Search keyboard shortcuts",V8b="apps-actiondatawidget-key-focused",W8b="apps-actiondatawidget-override-info-icon",X8b="apps-shortcutshelpcontentimpl-bottom-bar",Y8b="apps-shortcutshelpcontentimpl-help-center-link",Z8b="apps-shortcutshelpcontentimpl-input",.$8b="apps-shortcutshelpcontentimpl-link",a9b="apps-shortcutshelpcontentimpl-override-banner",b9b="apps-shortcutshelpcontentimpl-override-button-container",c9b="apps-shortcutshelpcontentimpl-override-label",d9b="apps-shortcutshelpcontentimpl-override-shortcut-link",e9b="apps-shortcutshelpcontentimpl-reset-search-button",f9b="apps-shortcutshelpcontentimpl-search",g9b="apps-shortcutshelpcontentimpl-search-banner",h9b="apps-shortcutshelpcontentimpl-search-focused",i9b="apps-shor

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 29516, version 1.0
Category:	downloaded
Size (bytes):	29516
Entropy (8bit):	7.993944632054563
Encrypted:	true
SSDEEP:
MD5:	5D66C3D97D4F69A2B3527E3997CBB66B
SHA1:	94EF4F31C1A1CD780A172EDFBF9E3DE61697EF5A
SHA-256:	1BF53B33743C5C45D6C944815F74CBF58B228806858FB6E3A0B86C1204F4BE06
SHA-512:	FEB229CF976DC037130CE7E7A6C0E32FA8BD0C63382B0FFAD82E4448767B88F8C17C431055BF834AF6A5E92E2D34A6EC7432AFDABCEA9FAE867517613AFD3621
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/olive/fonts/3.0.0/DSIndigo-Regular.woff2
Preview:	wOF2......sL......b...r.........................?FFTM..6...l..t.`..V...e.....\..V.....6.$..(. ..Z..3..p[sDq....2.r...n....%2...z..q.Te-;@..%..I......;......{...Rk...@...HG.)G...8.U.x2.q.qZ.../....6".tQw..YVg9V.k.b.)...j.x..D4L_(.Y0.....k(.w...#U.. .;F.T8..j.v.x..p.:$-[o-.W.~~...{.u..3...)..J.<w..M.V.(a.......;..7g.,X.fu...............i.]..@..Y.[x......!....lG....a"...Nd../.k.V...Q...(.BPe.S.E...C$.........W....L.2.%.2.+O..D..TV...h"T.h/N!....,.gaX.....%...x..r.,.Zz....-...f^.T..sZ..e.Ed.8N....%:./...B...m3......E@A...#.....#.}.~.f,2..3.o_..wX.U.uRI...`i...../D.../~.3.......W..#....U2.r.2.u.B.{.]r"rP{M....V.........LhNU=..{L.......'.U...].0.`...$...4Y..RN...E/........i..<@Y.....:...X.-...R.]..@z...(....p...Y.....").N=...!....,..]D....Z.......o........N.y......g.t..1f#.........o.Y;.y..{...G.......K......>/.,.d.....NU.>7v..KQ....J..l..{w.FH..&..!..?4.q...1wY..7..RJ):..a....<..*..G.M.m..k......."Vhq..xsk...M\|...o..d.....w......F.(..(..(..(..(..(..(::

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3447)
Category:	dropped
Size (bytes):	374399
Entropy (8bit):	5.596639382674855
Encrypted:	false
SSDEEP:
MD5:	45FF1337FD1CBFF1CAFC137832ECDBA2
SHA1:	3FC8B9DD2014382FFFA24F8D12917459CE1B3CE4
SHA-256:	EBBB6FAB244F42186A9CDE686C8D9C97E5B43A69AA6C012213FB7A1F3425DF62
SHA-512:	0AE3553B864C2A915B3E3841DF80E9FDC50D68A349EB3F919A1BCEC28DECDB54D71F61034CD3FEC6AEFB0F3FC3BAD19283C65C5FAAA43B3AAC581BB6805F28AB
Malicious:	false
Reputation:	unknown
Preview:	or("app");./..Math.uuid.js (v1.4).http://www.broofa.com.mailto:robert@broofa.com.Copyright (c) 2010 Robert Kieffer.Dual licensed under the MIT and GPL licenses../.var $Ab=" aria-hidden='true'",aBb=' aria-labelledby="',bBb=" but found ",cBb=' data-idom-class="',dBb=" data-use-native-focus-logic='true'",iP=' jsname="',eBb=" requested by ",jP=" ssk='",fBb=" task: cannot enqueue task before CREATE.",gBb=" task: tasks(s) already in the queue.",hBb=" task: this task already completed.",iBb=" task: this task type is already running.",jBb='" d=""/></svg><svg class="',kBb='" data-progressvalue="',kP='" height="',lP='" jsaction="',lBb='" jsaction="click:',mP='" jscontroller="',.nP='" jsname="',mBb='" placeholder="',nBb='" role="progressbar" aria-label="',oP='" style="',oBb='" xmlns="http://www.w3.org/2000/svg" jsname="',pBb='"><path jsname="',qBb='"><span class="',rBb='"><svg class="',sBb="(preventDefault=true)",tBb="--progress-value: ",uBb="-visible-label",vBb=".focusSentinel",wBb=".javascrip

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	89476
Entropy (8bit):	5.2896589255084425
Encrypted:	false
SSDEEP:
MD5:	DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA1:	C8E1C8B386DC5B7A9184C763C88D19A346EB3342
SHA-256:	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
SHA-512:	6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516
Malicious:	false
Reputation:	unknown
URL:	https://code.jquery.com/jquery-3.5.1.min.js
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 21 x 21, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	275
Entropy (8bit):	6.5201105410432945
Encrypted:	false
SSDEEP:
MD5:	E6D4B60D1F1070F9C70E11E181BD4821
SHA1:	54860D1365CB29C657E6B3066FE9B081F8A15609
SHA-256:	C4529BB647D07FBC3A858BD39FE0AFF051DD7B5CCBA99C7CEA5A307FDD7F4241
SHA-512:	2E76103A0A0A542FFB020C6987547F3A7250FA7B7EE0DBF7787C3C07956A9A49218E1D0B230790BC20E362A2CBF0F10756302A8280D3974553AE7137DE6D422E
Malicious:	false
Reputation:	unknown
URL:	https://ssl.gstatic.com/ui/v1/button/search-white.png
Preview:	.PNG........IHDR.....................sRGB.........bKGD..............pHYs.................IDAT8...Q..@...'..HX..P.+a%....P.H@....y.@.%..3._.A..J...........i...U.....@...,....0J-..Cz..<.!.B..8.&.q.....:,R.+P.F<.Hs\|..Y.P..h.0../LV5.j...P...4..........b[k.......IEND.B`.

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 144 x 144, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	484
Entropy (8bit):	6.771560291298439
Encrypted:	false
SSDEEP:
MD5:	0D15D393DAC5E0236D6EF35C65E9597C
SHA1:	54A8C64CC47BC346E4F2E1C615FD5117A95852EE
SHA-256:	1B001080D4B135431DC6E7377B1697C564ABBFB0BA3518DFFFCA00470C644464
SHA-512:	9615674ABF29670EB39568DCF924B6A398176BCD5AED3E195F390EBB81B1079143AFD10AC88B54C2AE9656D6C2A88DCF5D8A22B0393989587981AEC4C44179B9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...................QPLTE..............................................................................].....tRNS.8....o$..<.(.K......W...S.......'IDATx...Gv.0..Q.....9...^{....zU'....[#..k..Y..g....h...P{.f....h...\....\...5..*A.E..de.Y.@V6...de.Y.@V6...de.Y.@V6...de.Y.@V6...de.Y.@V6...de.Y.@V6...T!.......@......."@...g..\...@.(.... @....... @.>..n....sE........ @....... @....P..D.b.5..U..E..b....[.....z1...M.].....i3..~.^.q..n .w...Y7:.V.....IEND.B`.

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	55815
Entropy (8bit):	4.571385054156492
Encrypted:	false
SSDEEP:
MD5:	84700E082111B342A8D112BFD774F61F
SHA1:	B0A0F8E6FFA65C3C2BED34CA1034B302D277C184
SHA-256:	D644F890D4021407715F113DFDD56C6F60963BF5850BAA1C58B48A0AF70D700C
SHA-512:	6B2AE7764127799D472031049BDA31E38A58DCF81E1229D770AE8D8CF173B6D129A4EC5C96DEBB080D7A21246C205CC0AF96B955F24A722DDBEA9C20866F7B14
Malicious:	false
Reputation:	unknown
Preview:	<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" x="0" y="0" width="52px" height="1258px" viewBox="0 0 52 1258" preserveAspectRatio="none"><g transform="translate(0,1014)"><path fill="#3C4043" fill-rule="evenodd" d="m7 10 5 5 5-5z"/>.</g><g transform="translate(26,1038)"><path fill="#3C4043" d="m7 14 5-5 5 5H7Z"/>.</g><g transform="translate(26,640)"><path fill="#3C4043" d="M10 21.5c-.13333 0-.25-.05-.35-.15-.1-.1-.15-.2167-.15-.35 0-.1333.05-.25.15-.35.1-.1.21667-.15.35-.15.1333 0 .25.05.35.15.1.1.15.2167.15.35 0 .1333-.05.25-.15.35-.1.1-.2167.15-.35.15Zm4 0c-.1333 0-.25-.05-.35-.15-.1-.1-.15-.2167-.15-.35 0-.1333.05-.25.15-.35.1-.1.2167-.15.35-.15.1333 0 .25.05.35.15.1.1.15.2167.15.35 0 .1333-.05.25-.15.35-.1.1-.2167.15-.35.15ZM6 19c-.28333 0-.525-.0917-.725-.275C5.09167 18.525 5 18.2833 5 18s.09167-.51

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3451)
Category:	downloaded
Size (bytes):	23577
Entropy (8bit):	5.112835803431694
Encrypted:	false
SSDEEP:
MD5:	F1280AE0026A350DCFBF875C5FE00555
SHA1:	C9F1D3D8C2563F783CDAC6F3735D66E86941336D
SHA-256:	170BBCBFF9F707C71ED909C5618D0E6F6A2625661ECB4CFBAF9EB8C90A9DB56B
SHA-512:	D864ED9C5D7661A12E88BF930E97C2079A3675E6802245A107FACDCE13E2008284D00A9BDB4D73EAEA032C2E562958398FC9239252EB1DD17061B56C8536D426
Malicious:	false
Reputation:	unknown
URL:	https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/KypzRhWTaJkcqBWgUfDp1tRU1GdGRgwsA1EvfAWyCXP9Dm8uZv8F
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="robots" content="noindex, noarchive, nofollow, nosnippet">. <meta name="googlebot" content="noindex, noarchive, nofollow, nosnippet, noimageindex">. <meta name="slurp" content="noindex, noarchive, nofollow, nosnippet, noodp, noydir">. <meta name="msnbot" content="noindex, noarchive, nofollow, nosnippet">. <meta name="teoma" content="noindex, noarchive, nofollow, nosnippet">. <meta property="og:description" content="Docusign \| #1 in Electronic Signature and Intelligent Agreement Management. This is a security verification Page, commit to, and manage your agreements all in one platform with Docusign IAM. Electronically sign for free.">. <meta id="meta-title" name="title" content="Connect, protect, and build everywhere \| Cloudflare" data-gatsby-head="true">. <meta id="meta-description" name="description" content=" Docusign \| #1 in Electronic Signature Make employees, applications and ne

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 18 tables, 1st "FFTM", 8 names, Microsoft, language 0x409, Copyright (c) 2011 by Vissol Ltd. All rights reserved.Maven ProBoldwebfontMaven Pro BoldVersion
Category:	downloaded
Size (bytes):	99544
Entropy (8bit):	5.697510686503389
Encrypted:	false
SSDEEP:
MD5:	886D42DE54F54F89DB3F912B21174CD8
SHA1:	21183A0C584549EC804F135D3FE297B95BE9F022
SHA-256:	E1B12E36C2E781FDBE301BC99C4638ADF0747FB3DBDA8DF5ADD226ACAC0BCC73
SHA-512:	1F33D18B48D12F32A2E01DAB0747CF10F63CE2187F4010928A865A8111B79C76799584FAAF0294C1D3CB801F46A06D98B5825B855980B2834C06BA26AC1A688B
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/signing/1.9.0/fonts/maven-pro/MavenPro-Bold.ttf
Preview:	........... FFTM[.....,....GDEF.......H... GPOS.......h....GSUBl.t....4... OS/2...#...T...`cmap..v.........cvt ...........(fpgm../........egasp............glyf."..... ....head..}..z....6hhea.U.>..z....$hmtx.Xl7..{....Xloca.:.Z..~d....maxp........... name#.?....4....post...f........prep.EAL.............................................................................,..latn................kern.....................fml...............$.R.................(.J.d.............&.T.......<.......d.........Z.........D.......(.V.4.F........P.j.........J...............Z. .>.d.......8...$....@.P...f.x.....................Z.Z.Z.Z.Z.......................j..j...j.j.....................d.d.d.d...6.X...6.6.....@.f...........%.$.%.-.%.5...6...7...9...;.%.<...=...I.................................................7.%.O...P...Q...U...V.................&......2...4...M.................................H...L...M...O...R...\...........s.....-...................................s.....................&...'...

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	755205
Entropy (8bit):	5.056224186046051
Encrypted:	false
SSDEEP:
MD5:	4E440BFEA9057BBCEFD1199905C95D15
SHA1:	CBF2F11D066395134256DA43865754D04C004BD2
SHA-256:	BC1BAFAE5A12C46BC6530DBFE48E4E728D2B97BD839A249BEB92452CB1779A11
SHA-512:	B616A06AC877A1F6542614587D9C0D18448AD67B5EC2FCFA26A4E66988DFCC8797293DFC79CD5CE483F30FC97262F2A5852E04FF424B5DC70EC2FD9D7458C084
Malicious:	false
Reputation:	unknown
URL:	https://docs.google.com/static/presentation/client/css/4046644970-viewer_css_ltr.css
Preview:	@charset "UTF-8";@import url(https://fonts.googleapis.com/css?family=Google+Sans);.apps-action-shortcut-icon{direction:ltr;text-align:left;overflow:hidden;position:relative;vertical-align:middle}.apps-action-shortcut-img:before{content:url(https://ssl.gstatic.com/docs/common/shortcut_sprite1.png)}.apps-action-shortcut-img{height:95px;position:absolute;width:21px}.apps-action-shortcut-back{left:0;top:-63px}.apps-action-shortcut-back-white{left:0;top:-21px}.apps-action-shortcut-close-x{left:0;top:-84px}.apps-action-shortcut-search{left:0;top:-42px}.apps-action-shortcut-search-white{left:0;top:0}.apps-ui-material-slide-toggle-container{align-items:center;background:none;display:flex;height:21px;outline:0;position:relative;width:35px}.apps-ui-material-slide-toggle-thumb{transition-duration:.28s;transition-property:all;transition-timing-function:cubic-bezier(.4,0,.2,1);left:0;right:inherit;top:0;will-change:background-color;background-color:#f1f1f1;border-radius:100%;box-shadow:0 0 2px rgba

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65299)
Category:	dropped
Size (bytes):	80663
Entropy (8bit):	5.204798779868606
Encrypted:	false
SSDEEP:
MD5:	6BAF57F25796C332144ED58A2A0CD9EE
SHA1:	F7FD0F3DC84B2CF93BF81E832505A673F354E0A3
SHA-256:	82F64F62BB03C1BC1824B0F9C9E05F70DBA33E146818E63CDF5C306C8CF3DEDD
SHA-512:	5FF6240D9CA34DFE30C9CD95CB5E981823C7C0063CAD9258F8F3A0A24663401DA684844524272410673A6325FD78DB0F7E7D0FCD3844B8DB3EB9AA2613908EE8
Malicious:	false
Reputation:	unknown
Preview:	/!. Bootstrap v5.3.2 (https://getbootstrap.com/). * Copyright 2011-2023 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof globalThis?globalThis:t\|\|self).bootstrap=e()}(this,(function(){"use strict";const t=new Map,e={set(e,i,n){t.has(e)\|\|t.set(e,new Map);const s=t.get(e);s.has(i)\|\|0===s.size?s.set(i,n):console.error(`Bootstrap doesn't allow more than one instance per element. Bound instance: ${Array.from(s.keys())[0]}.`)},get:(e,i)=>t.has(e)&&t.get(e).get(i)\|\|null,remove(e,i){if(!t.has(e))return;const n=t.get(e);n.delete(i),0===n.size&&t.delete(e)}},i="transitionend",n=t=>(t&&window.CSS&&window.CSS.escape&&(t=t.replace(/#([^\s"#']+)/g,((t,e)=>`#${CSS.escape(e)}`))),t),s=t=>{t.dispatchEvent(new Event(i))},o=t=>!(!t\|\|"o

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7609)
Category:	downloaded
Size (bytes):	32434
Entropy (8bit):	5.483888942403893
Encrypted:	false
SSDEEP:
MD5:	A551AD9B7644B224EEB41CB686441091
SHA1:	A8F25510F1BD6390DF498C21C67CF8A01900DB9C
SHA-256:	E0E445A15E4CB1AAD38CBB67C8E8E20F1329BF5A76812BDAC25384803AF8BC96
SHA-512:	08E3F8F4EDB196240CBD385CA74E7B282BEDD76F09B2CBB976B7A74CE01A735D52551A334B9BCE661C78EA610FB9A6B945CCDA6DB6304BF2894291E5DAABA90F
Malicious:	false
Reputation:	unknown
URL:	https://docs.google.com/static/presentation/client/js/4044290882-punch_viewer_worker_binary_viewercore.js
Preview:	function _F_toggles_initialize(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]}_F_toggles_initialize([]);.function m(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");}var da=ca(this);function r(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 31468, version 1.0
Category:	downloaded
Size (bytes):	31468
Entropy (8bit):	7.993603561926699
Encrypted:	true
SSDEEP:
MD5:	B70FB054C362CBA0FE0E6233920555E4
SHA1:	C1C2CDF248E7042B196EE18512C1DE9418ED61F2
SHA-256:	C2DD95A4FD1D3569F219994B8BA845A5AE065733B80619B87157FA7BA97CCB74
SHA-512:	FBB77AC8709799B21EE698C88914A30E449BC37EAA2042A76D450A1FF27A8C9AB48376B539E8DBB67C9BE04DC18379FBCB4A4BCFF388BFFAB689AEFE1DAB570A
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/olive/fonts/3.0.0/DSIndigo-Bold.woff2
Preview:	wOF2......z.......h...z.........................?FFTM..6...B..t.`..V...e.....L........6.$..(. .....3..M[.J....{.....t..?.:..O.%x....&c.e.(c.E....q`.}.8.......$..3. m....z......;\.g..<X'."..X..+3<..5sbc.'e.c...uj..X.. .r..)..."(M6I.U...l.$....pWI.TI.T{..:..7..?L.jL..^...qh1..];.........fE.[...-...]/jX)._X.9....J.d...Vm....1.v..i..[.v..m..TQEG."...."Dd..]60......".{.f\.B....3....,..;u:...E`..:./aZ....$_......Y..E...^.A......p..E....@u...$-a...X....PLP!.M.d..=.1..6..I{...(.......K........(f...'<.,..$2.D..I.....Q.r`.-.`l..Y.n...2.....B{FoF.. QJ..J..".. !6&....)N]..m.m.OW.........4.Z.0.!-s...GbD......B#1..C.....e).E-.{' ~W!...TH.F(..;X..S...g.cH.w...$...5...GFA..Y..P./*...c:.w...k:......D.O.T.u.t...?8.Y....$=C.F......P.Ue....=\....+T..g...6A,..........Ey^ ..p...N...c.C...................qhdV.J....a...d.6.MyxA........KY...Y..F.@.t.:...1.6...;.C.K.4(..{.i..}7.5KD....q,;i...(YF.$>....wZ.S.EQ.EQ.EQ.EQ.EQ.E...t:.N...t:..i.T;vO........;....tlE0....

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1369)
Category:	downloaded
Size (bytes):	1268669
Entropy (8bit):	5.544752602115744
Encrypted:	false
SSDEEP:
MD5:	7AE926FBC082F683B23BD6FDCA171C50
SHA1:	F9007F498C015485885DB8D30ECD3EB526C00FA3
SHA-256:	4BE7A8E5E013857D9CFABB5B013FE7ADB95C7D5F3780E9A1D6A3A5EEFD5E9D27
SHA-512:	C947F16295969499EAF9137A60ED4007F21530ECC6831B78CEAE7A69C01B9472AB27E45EBED238C4720C51CE6B1373D6D003C1B7AE0E05021345D5577FF0C4D5
Malicious:	false
Reputation:	unknown
URL:	https://docs.google.com/static/presentation/client/js/345947954-viewer_integrated_core.js
Preview:	function _F_toggles_initialize(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]}_F_toggles_initialize([]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT./.var aa=" - ",aaa=' aria-describedby="',baa=' aria-disabled="true"',ba=' aria-label="',ca=' class="',da=' id="',ea=" of ",caa=" seconds",daa='" aria-label="',fa='" class="',eaa='" href="',ha='" id="',faa='" tabindex="-1" role="tabpanel"><div class="',gaa='" target="_blank">',ia='">',ja='"></div>',ka='"></div></div>',ma='"></div></div></div>',na='"></div></div><div class="',oa='"></div><div class="',qa='"></span>',ra='"><div class="',ta="&",va

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	5.249530958699059
Encrypted:	false
SSDEEP:
MD5:	FBE36EB2EECF1B90451A3A72701E49D2
SHA1:	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D
SHA-256:	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
SHA-512:	7B1FD6CF34C26AF2436AF61A1DE16C9DBFB4C43579A9499F4852A7848F873BAC15BEEEA6124CF17F46A9F5DD632162364E0EC120ACA5F65E7C5615FF178A248F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 400 (Bad Request)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//ww

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	10717
Entropy (8bit):	5.628149335409592
Encrypted:	false
SSDEEP:
MD5:	FB1809FEB9DB1EAB65CE754ED28AD243
SHA1:	30E58AB89311BBF9056D06916161231087195E5B
SHA-256:	10D91823E45B6940F49D2AC0ED5B44BF28F12B4580EF20595424E392978AA1C4
SHA-512:	74BB7274DE06AEA7BE94FB4BE77B4D8A4ACC3C1EE48397E1C285FC3E10CE7CA6A9D20D2C485D9F9B2B7DC8971C9B90C9BD65BAAB1A963FCE40F8FCE10EEFE210
Malicious:	false
Reputation:	unknown
URL:	https://fonts.googleapis.com/css?family=Google+Sans
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ armenian /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v62/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJl1pynSEg.woff2) format('woff2');. unicode-range: U+0308, U+0530-058F, U+2010, U+2024, U+25CC, U+FB13-FB17;.}./ bengali /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v62/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJl3pynSEg.woff2) format('woff2');. unicode-range: U+0951-0952, U+0964-0965, U+0980-09FE, U+1CD0, U+1CD2, U+1CD5-1CD6, U+1CD8, U+1CE1, U+1CEA, U+1CED, U+1CF2, U+1CF5-1CF7, U+200C-200D, U+20B9, U+25CC, U+A8F1;.}./ canadian-aboriginal */.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.864140296366014
Encrypted:	false
SSDEEP:
MD5:	CFEA5FE04E58B83AEBD4DF3EBB3C4B2E
SHA1:	3359610772742850775A5FE444566B6EA9E9D1C1
SHA-256:	890025E99A02F1DE41D921F4B717E91325D8617D222E3435315C202D99AE74CB
SHA-512:	38CE4ED249B733C09D8CDF56EE2EFD5C51180F86D9DE07EDF767F50CC1999DD896CB0265FC18FE7897E3A1591C571DCCAECC010043BF914CF471D0D048A242B4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz....$iCCPICC Profile..8..U.o.T.>.oR..? XG...US[......I...J....$.:7......O{.7...@...H<!..b{....IS..IH{...!&..U.vb'S.\...9.9.;.^.D=_i...U......$......M...K...N-..................N.#.z..."O.n..}...Q..k.K.....i.......6.....}..x..'=N!?.........<..f/.a_....Un.."f....ar../.q.1....u..].X....c....+.T..?....K._..Ia......\|.x.Q...}t..G__......{.p..M.ju1{.....%..#8.ug......V...c..Si.a..J}.._.qV...Z...#.d......?.......:73...KWkn..A..YQ..2.;^..)m.......v....J...&..fzg............t..y.?.:/....].Rb...G.DD#N.-b.J;.P.2..F6<%2....a1"O..l.y9.......-.Q.;.p..X?S....b..0.g...7...K.:....rm:..}(..OuT.:NP..@}(.Q..........K+.#O.14[.. ..hu7.>.kk?..<......kkt.q..m.6.n.....-.mR.;`z.....v..x#.=\..%..o.Y..R.......#&.?.>........n._....;j..;.$}*}+.(}'}/.L.tY.".$].....9..%.{._a..]h.k.5'SN.{.......<...._..............t..jM.{-...4.%.....T..t.Y...R6....#.v\..x:..'H..O...3.....^.&.......0::.m,L%.3.:qVE..t...]~....I.v.6..W...).\|.2].G...4...(6

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2219
Entropy (8bit):	5.409739127256831
Encrypted:	false
SSDEEP:
MD5:	A1B66AE4FBB0EFF2B25D263E7E0E3776
SHA1:	3C2688F0D491CA74EA7150AF27F4232401D46767
SHA-256:	ADF768C23E06CAA3676973294122E24048A1296AE400745BA47E08BD39276E06
SHA-512:	A4E5CD3C596FDA473D5BF9B16AD25CE91ED5DC91265BCA9C24897DEE75F8D12EEFE56400098D46364411D06F414BCCDE5AFC53F18B15B2AACE104A7AD893D41C
Malicious:	false
Reputation:	unknown
URL:	https://fonts.googleapis.com/css?family=Roboto_old:400
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu5mxKOzY.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7mxKOzY.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4WxKOzY.woff2) format('woff2');. unicode-range: U+0370-0377

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (358)
Category:	downloaded
Size (bytes):	11816
Entropy (8bit):	5.037139572888145
Encrypted:	false
SSDEEP:
MD5:	A8063BD37D3C8FB3176A6BF140558A4D
SHA1:	E32CF4B407DB3D3773DED13FF64B70FDBAD7735F
SHA-256:	BCCB23D41C2CC69CF0C7D22C4314CA8181A513C6999B73E45307792830F4E482
SHA-512:	82D749F6B17B21587FB345CA196A2AA83ECA80AD66ED9C1AB88B36709BED14175D53AFEFE9ACC0DAFC4FAD78FFB8DF155193A6829BC857AD6D68B1C84AF7B854
Malicious:	false
Reputation:	unknown
URL:	https://victoryacademytc.com/KzPszu38yuMPEy1fhbxiNqNfpRrQwMnBmWfsvTSL9i4SXYkaqBa4/nero.webp
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">.<head profile="http://gmpg.org/xfn/11">. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />. <title>404 - PAGE NOT FOUND</title>...... Add Slide Outs -->.....<script src="http://code.jquery.com/jquery-3.3.1.min.js"></script> .....<script src="/cgi-sys/js/simple-expand.min.js"></script>. . <style type="text/css">. body{padding:0;margin:0;font-family:helvetica;}. #container{margin:20px auto;width:868px;}. #container #top404{background-image:url('/cgi-sys/images/404top_w.jpg');background-repeat:no-repeat;width:868px;height:168px;}. #container #mid404{background-image:url('/cgi-sys/images/404mid.gif');background-repeat:repeat-y;width:868px;}. #container #mid404 #gatorbottom{position:relative;left:39px;float:left;}. #

Static File Info

⊘No static file info

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 118

Chrome Cache Entry: 120

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 130

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 137

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Static File Info

Windows Analysis Report
https://docs.google.com/presentation/d/e/2PACX-1vR9fDeGf5MUCkInjRJmTQP_A7A1KiesFeAK7tBzfJ0WswmG-_qOqxWXat0f6mojkSTW_rQDaj-I4ALz/pub?start=false&loop=false&delayms=3000