Play interactive tour

Edit tour

Analysis Report https://www.ctc.ca.gov/educator-prep/program-accred-sch-act

Overview

General Information

Sample URL:	https://www.ctc.ca.gov/educator-prep/program-accred-sch-act
Analysis ID:	356829
Infos:
Most interesting Screenshot:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Startup

System is w10x64

iexplore.exe (PID: 4980 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 3124 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4980 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Compliance:

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown	HTTPS traffic detected: 134.186.81.178:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 134.186.81.178:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 134.186.81.178:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.12.157:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.12.157:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.206.155:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.206.155:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.130.35:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.130.35:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.218.112:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.218.112:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.125.230.89:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.125.230.89:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.162:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.162:443 -> 192.168.2.4:49790 version: TLS 1.2

Networking:

Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=:id equals www.youtube.com (Youtube)
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: <a href="/" title="Home" class="utility-home-icon ca-gov-icon-home"><span class="sr-only">Home</span></a><a class="utility-social-facebook ca-gov-icon-facebook" href="https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ca.gov%2F&display=popup" title="Share via Facebook" target="_blank"><span class="sr-only">Facebook</span></a><a class="utility-social-twitter ca-gov-icon-twitter" href="https://twitter.com/intent/tweet?text=CA.Gov%20:%20Services&url=https%3A%2F%2Fwww.ca.gov%2FServices" title="Share via Twitter" target="_blank"><span class="sr-only">Twitter</span></a> equals www.facebook.com (Facebook)
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: <a href="/" title="Home" class="utility-home-icon ca-gov-icon-home"><span class="sr-only">Home</span></a><a class="utility-social-facebook ca-gov-icon-facebook" href="https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.ca.gov%2F&display=popup" title="Share via Facebook" target="_blank"><span class="sr-only">Facebook</span></a><a class="utility-social-twitter ca-gov-icon-twitter" href="https://twitter.com/intent/tweet?text=CA.Gov%20:%20Services&url=https%3A%2F%2Fwww.ca.gov%2FServices" title="Share via Twitter" target="_blank"><span class="sr-only">Twitter</span></a> equals www.twitter.com (Twitter)
Source: cagovapplets[1].js.2.dr	String found in binary or memory: facebookItem = facebookItem.replace("www.facebook.com/", ""); equals www.facebook.com (Facebook)
Source: cagovapplets[1].js.2.dr	String found in binary or memory: textToDisplay += "<a aria-label=\"YouTube Information for " + this.apiData[r].FriendlyName + "\" href=\"https://www.youtube.com/" + equals www.youtube.com (Youtube)
Source: cagovapplets[1].js.2.dr	String found in binary or memory: textToDisplay += "<a aria-label=\"Facebook Information for " + this.apiData[r].FriendlyName + "\" href=\"https://www.facebook.com/" + equals www.facebook.com (Facebook)
Source: cagovapplets[1].js.2.dr	String found in binary or memory: twitterItem = twitterItem.replace("www.twitter.com/", ""); equals www.twitter.com (Twitter)
Source: cagovapplets[1].js.2.dr	String found in binary or memory: youTubeItem = youTubeItem.replace("www.youtube.com/", ""); equals www.youtube.com (Youtube)
Source: cagovapplets[1].js.2.dr	String found in binary or memory: cardToBuild += "<a aria-label=\"Facebook Information for " + agencyFriendlyName + "\" href=\"https://www.facebook.com/" + thisitem2 + "\" id=\"facebook-" + agencyId + "-" + agencyAcronym.replace( ' ', '') + "\"><span class=\"ca-gov-icon-facebook\" aria-hidden=\"true\"><span class=\"sr-only\">Facebook for " + agencyFriendlyName + "</span></span></a>"; equals www.facebook.com (Facebook)
Source: cagovapplets[1].js.2.dr	String found in binary or memory: cardToBuild += "<a aria-label=\"YouTube Information for " + agencyFriendlyName + " \" href=\"https://www.youtube.com/" + thisitem3 + "\" id=\"youtube-" + agencyId + "-" + agencyAcronym.replace( ' ', '') + "\"><span class=\"ca-gov-icon-youtube\" aria-hidden=\"true\"><span class=\"sr-only\">YouTube for " + agencyFriendlyName + "</span></span></a>"; equals www.youtube.com (Youtube)
Source: cagov.core[1].js0.2.dr	String found in binary or memory: html.attr('src', '//www.youtube.com/embed/' + video.id + '?autoplay=1&rel=0&v=' + video.id); equals www.youtube.com (Youtube)
Source: cagovapplets[1].js.2.dr	String found in binary or memory: thisitem1 = thisitem1.replace("www.twitter.com/", ""); equals www.twitter.com (Twitter)
Source: cagovapplets[1].js.2.dr	String found in binary or memory: thisitem2 = thisitem2.replace("www.facebook.com/", ""); equals www.facebook.com (Facebook)
Source: cagovapplets[1].js.2.dr	String found in binary or memory: thisitem3 = thisitem3.replace("www.youtube.com/", ""); equals www.youtube.com (Youtube)
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: <iframe src="https://www.youtube.com/embed/6D19FjzPJgc" style="width:560px; max-width:100%; height:315px;" frameborder="0" allowfullscreen></iframe> equals www.youtube.com (Youtube)
Source: plugins[1].js.2.dr	String found in binary or memory: $.getScript('https://www.youtube.com/iframe_api').fail(function () { equals www.youtube.com (Youtube)
Source: cagov.core[1].js0.2.dr	String found in binary or memory: PopupCentered('https://www.facebook.com/sharer/sharer.php?u=' + docURL + '&display=popup', 'socialsharer', '658', '450'); equals www.facebook.com (Facebook)
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: <div><h3>Commission Webinars on the COVID-19 Actions</h3><p><span class="red-color">Webinar questions and answers can be found below the table</span></p><table class="table table-bordered k-table"><thead><tr><th>Presentation</th><th>Date </th></tr></thead><tbody><tr><td><p><a href="https://www.youtube.com/watch?v=iqODcICtloE" target="_blank">Certification Update based on Executive Order N-66-20</a></p><ul><li><a href="/docs/default-source/commission/files/n-66-20-certification-webinar.pdf?sfvrsn=a68f2eb1_2" title="Slides">Slides</a></li></ul></td><td>6/11/2020</td></tr><tr><td><p><a href="https://www.youtube.com/watch?v=07DDUQQwLSE" target="_blank">Teacher Preparation Program Update based on Executive Order N-66-20</a></p><ul><li><a href="/docs/default-source/commission/files/n-66-20-teaching-program-update.pdf?sfvrsn=6d02eb1_2" title="Slides">Slides</a></li></ul></td><td>6/8/2020</td></tr><tr><td><p><a href="https://www.youtube.com/watch?v=sS1vsIdDD0Q&feature=youtu.be" target="_blank">Administrator Preparation Program Update based on Executive Order N-66-20.</a></p><ul><li><a href="/docs/default-source/commission/files/n-66-20-administative-services-program-update.pdf?sfvrsn=8bd12eb1_2" title="Slides">Slides</a></li></ul></td><td>6/5/2020</td></tr><tr><td><p><a href="https://youtu.be/xuVK4qtneKg" target="_blank">Executive Order N-66-20</a></p><ul><li><a href="/docs/default-source/commission/files/eo-n-66-20-ada.pdf?sfvrsn=d4d92fb1_2" title="Slides">Slides</a></li></ul></td><td>6/1/2020</td></tr><tr><td><p><a href="https://youtu.be/ISAE6uSg_Yc" target="_blank">Preliminary Multiple Subject, Single Subject, and Education Specialist</a></p><ul><li><a href="/docs/default-source/commission/files/ada-compliant-prelim-prog-support-webinar-pp.pdf?sfvrsn=e6f92fb1_4" title="Slides">Slides</a></li></ul></td><td>5/4/2020</td></tr><tr><td><p><a href="https://www.youtube.com/watch?v=L879qHemJ2Y" target="_blank">CalTPA</a> (Preliminary Multiple Subject & Single Subject)</p><ul><li><a href="/docs/default-source/commission/files/program-update-caltpa.pdf?sfvrsn=1d132cb1_2" title="Slides">Slides</a></li></ul></td><td>4/28/2020</td></tr><tr><td><p><a href="https://www.youtube.com/watch?v=ZzTqwvCgggc" target="_blank">Teacher Induction</a></p><ul><li><a href="/docs/default-source/commission/files/induction-program-support-webinar.pdf?sfvrsn=f1122cb1_4" title="Slides">Slides</a></li></ul></td><td>4/30/2020</td></tr><tr><td><p><a href="https://www.youtube.com/watch?v=iwHbKTJHavI" target="_blank">CalAPA</a> (Preliminary Administrative Services)</p><ul><li><a href="/docs/default-source/commission/files/program-update-calapa-ada.pdf?sfvrsn=6ef92fb1_2" title="Slides">Slides</a></li></ul></td><td>4/29/2020</td></tr><tr><td><p><a href="https://youtu.be/eYF-KJrgj6U" target="_blank">Administrator Induction</a></p><ul><li><a href="/docs/default-source/commission/files/webinar-casc-ada-compliant.pdf?sfvrsn=42f92fb1_2" title="Slides">Slides</a></li></ul></td><td>5/1/2
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: <div><h3>Program Guidance for COVID-19</h3><ul><li><a href="/docs/default-source/commission/files/teacher-preparation-guidance-ada.pdf?sfvrsn=afd12eb1_10" title="Multiple Subject, Single Subject, and Education Specialist (Preliminary and Induction)">Multiple Subject, Single Subject, and Education Specialist (Preliminary and Induction)</a> - <em>(Updated August 13, 2020)</em></li><li><a href="/docs/default-source/commission/files/covid-19-asc-prep-pog-suport-vtw.pdf?sfvrsn=dc152cb1_8" title="Administrative Services (Preliminary and Induction)">Administrative Services (Preliminary and Induction)</a> - <em>(Updated August 14, 2020)</em></li><li><a href="/docs/default-source/commission/files/covid-19-preparation-prog-support-pps-slp-on-vtw.pdf?sfvrsn=d71a2cb1_2" title="Pupil Personnel Services and Speech-Language Pathology">Pupil Personnel Services and Speech-Language Pathology</a></li><li><a href="https://www.youtube.com/watch?v=ePNNPPSwffg&feature=youtu.be" target="_blank">Certification Office Hours Webinar - Questions on COVID Flexibilities</a> - <em>(August 27, 2020)</em></li></ul></div> equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: (g.Sm(b,"www.youtube.com"),c=b.toString()):c=Xx(c);b=new Zx(c);b.set("cmo=pf","1");d&&b.set("cmo=td","a1.googlevideo.com");return b}; equals www.youtube.com (Youtube)
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: )https://www.youtube.com/embed/6D19FjzPJgc equals www.youtube.com (Youtube)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x11abd8c2,0x01d70a01</date><accdate>0x11abd8c2,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x11abd8c2,0x01d70a01</date><accdate>0x11abd8c2,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x11b09d99,0x01d70a01</date><accdate>0x11b09d99,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x11b09d99,0x01d70a01</date><accdate>0x11b09d99,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x11b09d99,0x01d70a01</date><accdate>0x11b09d99,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x11b09d99,0x01d70a01</date><accdate>0x11b09d99,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: <ul class="social-links"><li><a href="http://www.facebook.com/CalCTC" target="_blank"><label class="visuallyhidden" for="facebookfooter">Facebook</label><svg aria-hidden="true" class="icon icon-facebook" focusable="false" id="facebookfooter"><use xlink:href="#icon-facebook"></use></svg></a></li><li><a href="https://twitter.com/CalCTC" target="_blank"><label class="visuallyhidden" for="twitterfooter">Twitter</label><svg aria-hidden="true" class="icon icon-twitter" focusable="false" id="facebookfooter"><use xlink:href="#icon-twitter"></use></svg></a></li></ul></div></div> equals www.facebook.com (Facebook)
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: <ul class="social-links"><li><a href="http://www.facebook.com/CalCTC" target="_blank"><label class="visuallyhidden" for="facebookfooter">Facebook</label><svg aria-hidden="true" class="icon icon-facebook" focusable="false" id="facebookfooter"><use xlink:href="#icon-facebook"></use></svg></a></li><li><a href="https://twitter.com/CalCTC" target="_blank"><label class="visuallyhidden" for="twitterfooter">Twitter</label><svg aria-hidden="true" class="icon icon-twitter" focusable="false" id="facebookfooter"><use xlink:href="#icon-twitter"></use></svg></a></li></ul></div></div> equals www.twitter.com (Twitter)
Source: base[1].js.2.dr	String found in binary or memory: FC("en",a.host_language);this.fj=!this.ga&&Math.random()<g.R(this.experiments,"web_player_api_logging_fraction");this.ia=!this.ga;this.enabledEngageTypes=new Set;this.deviceHasDisplay=b?!b.deviceIsAudioOnly:T(!0,a.deviceHasDisplay);this.Uc=EC(this.Uc,a.ismb);t=a;g.oA(this.experiments,"html5_qoe_intercept")?t=g.oA(this.experiments,"html5_qoe_intercept"):this.Aj?(t=t.vss_host\|\|"s.youtube.com",this.Z("www_for_videostats")&&"s.youtube.com"===t&&(t=$C(this.W)\|\|"www.youtube.com")):t="video.google.com"; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: LK.prototype.replace=function(a,b){for(var c=g.q(a),d=c.next();!d.done;d=c.next())delete this.i[d.value.encryptedTokenJarContents];$ka(this,b)};MK.prototype.dn=function(a){var b,c,d=null===(b=a.responseContext)\|\|void 0===b?void 0:b.locationPlayabilityToken;void 0!==d&&(this.locationPlayabilityToken=d,this.i=void 0,"TVHTML5"===(null===(c=a.responseContext)\|\|void 0===c?void 0:c.clientName)?(this.localStorage=ala(this))&&this.localStorage.set("yt-location-playability-token",d,15552E3):g.Rq("YT_CL",JSON.stringify({E3:d}),15552E3,void 0,!0))};var PK;g.u(OK,Mr);OK.prototype.Ft=function(a,b){var c=Mr.prototype.Ft.call(this,a,b);return Object.assign(Object.assign({},c),this.i)};var tla=/[&\?]action_proxy=1/,sla=/[&\?]token=([\w-])/,ula=/[&\?]video_id=([\w-])/,vla=/[&\?]index=([\d-])/,wla=/[&\?]m_pos_ms=([\d-])/,zla=/[&\?]vvt=([\w-])/,Ala=/[&\?]mt=([\d-])/,nla="ca_type dt el flash u_tz u_his u_h u_w u_ah u_aw u_cd u_nplug u_nmime frm u_java bc bih biw brdim vis wgl".split(" "),xla="www.youtube-nocookie.com youtube-nocookie.com www.youtube-nocookie.com:443 youtube.googleapis.com www.youtubeedu.com www.youtubeeducation.com video.google.com redirector.gvt1.com".split(" "), equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: Uga=function(a,b){if(!a.i["0"]){var c=new wA("0","fakesb",void 0,new sA(0,0,0,void 0,void 0,"auto"),null,null,1);a.i["0"]=b?new hz(new Zx("http://www.youtube.com/videoplayback"),c,"fake"):new Gy(new Zx("http://www.youtube.com/videoplayback"),c,new hv(0,0),new hv(0,0),0,NaN)}}; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: g.eO.prototype.l=function(a){var b=this;cpa(this);var c=a.Fx,d=this.api.T();"GENERIC_WITHOUT_LINK"!==c\|\|d.I?"TOO_MANY_REQUESTS"===c?(d=this.api.getVideoData(),this.Fc(hO(this,"TOO_MANY_REQUESTS_WITH_LINK",d.ul(),void 0,void 0,void 0,!1))):"HTML5_NO_AVAILABLE_FORMATS_FALLBACK"!==c\|\|d.I?this.Fc(g.fO(a.errorMessage)):this.Fc(hO(this,"HTML5_NO_AVAILABLE_FORMATS_FALLBACK_WITH_LINK_SHORT","//www.youtube.com/supported_browsers")):(a=d.hostLanguage,c="//support.google.com/youtube/?p=player_error1",a&&(c= equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: g.jD=function(a){a=$C(a.W);return"www.youtube-nocookie.com"===a?"www.youtube.com":a}; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: g.k.clone=function(){var a=new Wm;a.u=this.u;this.i&&(a.i=this.i.clone(),a.l=this.l);return a};var cn="://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav".split(" "),Bda=/\bocr\b/;var Cda=/(?:\[\|%5B)([a-zA-Z0-9_]+)(?:\]\|%5D)/g;var fD={mX:"LIVING_ROOM_APP_MODE_UNSPECIFIED",jX:"LIVING_ROOM_APP_MODE_MAIN",iX:"LIVING_ROOM_APP_MODE_KIDS",kX:"LIVING_ROOM_APP_MODE_MUSIC",lX:"LIVING_ROOM_APP_MODE_UNPLUGGED",hX:"LIVING_ROOM_APP_MODE_GAMING"},Gya={G_:"PLAYBACK_TYPE_UNKNOWN",A_:"PLAYBACK_TYPE_APPLICATION",z_:"PLAYBACK_TYPE_ADS",E_:"PLAYBACK_TYPE_REMOTE",F_:"PLAYBACK_TYPE_SECONDARY_CAMERA",D_:"PLAYBACK_TYPE_PREROLL_INTERSTITIAL",C_:"PLAYBACK_TYPE_POSTROLL_INTERSTITIAL",B_:"PLAYBACK_TYPE_MIDROLL_INTERSTITIAL"};fn.prototype.set=function(a,b){b=void 0===b?!0:b;0<=a&&52>a&&0===a%1&&this.i[a]!=b&&(this.i[a]=b,this.l=-1)}; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: g.k.getVideoUrl=function(a,b,c,d,e){b={list:b};c&&(e?b.time_continue=c:b.t=c);c=g.kD(this);d&&"www.youtube.com"===c?d="https://youtu.be/"+a:g.VC(this)?(d="https://"+c+"/fire",b.v=a):(d=this.protocol+"://"+c+"/watch",b.v=a,oq&&(a=zp())&&(b.ebc=a));return g.Id(d,b)}; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: g.zD=function(a){var b=g.kD(a);!a.Z("yt_embeds_disable_new_error_lozenge_url")&&pha.includes(b)&&(b="www.youtube.com");return a.protocol+"://"+b}; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: l,"Trusted Ad Domain URL");this.ga=T(!1,a.privembed);this.protocol=0===this.oc.indexOf("http:")?"http":"https";this.W=Sx((b?b.customBaseYoutubeUrl:a.BASE_YT_URL)\|\|"")\|\|Sx(this.oc)\|\|this.protocol+"://www.youtube.com/";l=b?b.eventLabel:a.el;h="detailpage";"adunit"===l?h=this.l?"embedded":"detailpage":"embedded"===l\|\|this.u?h=DC(h,l,mha):l&&(h="embedded");this.ea=h;wp();l=null;h=b?b.playerStyle:a.ps;var m=g.db(JC,h);!h\|\|m&&!this.u\|\|(l=h);this.playerStyle=l;this.J=(this.I=g.db(JC,this.playerStyle))&& equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: this.V("highrepfallback");else if(a.i){var d=this.l?this.l.l.B:null;if(Tua(a)&&d&&d.isLocked())var e="FORMAT_UNAVAILABLE";else if(!this.i.I&&"auth"===a.errorCode&&"429"===a.details.rc){e="TOO_MANY_REQUESTS";var f="6"}this.V("playererror",a.errorCode,e,g.LA(a.details),f)}else d=/^pp/.test(this.videoData.clientPlaybackNonce),pU(this,a.errorCode,a.details),d&&"manifest.net.connect"===a.errorCode&&(d="https://www.youtube.com/generate_204?cpn="+this.videoData.clientPlaybackNonce+"&t="+(0,g.P)(),(new xT(d, equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: www.ctc.ca.gov

Source: plugins[1].js.2.dr	String found in binary or memory: http://api.jquery.com/event.namespace/
Source: plugins[1].js.2.dr	String found in binary or memory: http://api.jquery.com/jQuery.browser/
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://benalman.com/projects/jquery-misc-plugins/#scrollbarwidth
Source: plugins[1].js.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12140
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12273
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/6724
Source: plugins[1].js.2.dr	String found in binary or memory: http://caniuse.com/#feat=mutationobserver
Source: plugins[1].js.2.dr	String found in binary or memory: http://caniuse.com/#search=json)
Source: cse_element__en[1].js.2.dr	String found in binary or memory: http://code.google.com/apis/ajaxsearch/faq.html
Source: cagov.core[1].css0.2.dr	String found in binary or memory: http://commons.wikimedia.org/wiki/File:Blue_a_v.svg#mediaviewer/File:Blue_a_v.svg
Source: plugins[1].js.2.dr	String found in binary or memory: http://css-tricks.com/13465-persistent-headers/
Source: cagov.core[1].css0.2.dr	String found in binary or memory: http://daneden.github.io/animate.css/
Source: plugins[1].js.2.dr	String found in binary or memory: http://dev.aol.com/dhtml_style_guide/#mediaplayer
Source: plugins[1].js.2.dr	String found in binary or memory: http://dev.opera.com/articles/accessible-drag-and-drop/
Source: plugins[1].js.2.dr	String found in binary or memory: http://dev.w3.org/html5/spec-author-view/video.html
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://fancyapps.com/fancybox/
Source: plugins[1].js.2.dr	String found in binary or memory: http://html5doctor.com/u-element/
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/context
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/context-destroy
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/context-find-by-element
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/context-refresh
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/destroy
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/destroy-all
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/disable
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/disable-all
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/enable
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/enable-all
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/first
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/group
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/last
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/next
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/previous
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/refresh-all
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/viewport-height
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/viewport-width
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://imakewebthings.com/waypoints/api/waypoint
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://img.youtube.com/vi/
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://jsliang.github.com/eqHeight.coffee
Source: plugins[1].js.2.dr	String found in binary or memory: http://jsonlint.com/
Source: plugins[1].js.2.dr	String found in binary or memory: http://jsperf.com/jquery-vs-instanceof-jquery/2
Source: cagovapplets[1].js.2.dr	String found in binary or memory: http://maps.google.com/?daddr=
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://oaa-accessibility.org/examplep/accordian1/
Source: plugins[1].js.2.dr	String found in binary or memory: http://regexr.com/3c3tk
Source: NGH2BVFL.htm.2.dr	String found in binary or memory: http://registertovote.ca.gov/
Source: cagovapplets[1].js.2.dr	String found in binary or memory: http://schema.org/Organization
Source: plugins[1].js.2.dr	String found in binary or memory: http://stackoverflow.com/a/20892048/145346
Source: plugins[1].js.2.dr	String found in binary or memory: http://stackoverflow.com/q/14990971/145346
Source: plugins[1].js.2.dr	String found in binary or memory: http://stackoverflow.com/q/36449711/145346
Source: plugins[1].js.2.dr	String found in binary or memory: http://stackoverflow.com/questions/12301435/html5-video-tag-volume-support
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://stackoverflow.com/questions/17328742
Source: plugins[1].js.2.dr	String found in binary or memory: http://stackoverflow.com/questions/3217492/list-of-language-codes-in-yaml-or-json/4900304#4900304
Source: plugins[1].js.2.dr	String found in binary or memory: http://stackoverflow.com/questions/5312849/jquery-find-self;
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://stackoverflow.com/questions/9361968/
Source: plugins[1].js.2.dr	String found in binary or memory: http://support.jwplayer.com/customer/portal/articles/1413089-javascript-api-reference
Source: plugins[1].js.2.dr	String found in binary or memory: http://support.jwplayer.com/customer/portal/articles/1413113-configuration-options-reference
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: http://t.co/dKP3o1e
Source: plugins[1].js.2.dr	String found in binary or memory: http://terrillthompson.com/blog/648
Source: cagov.core[1].css0.2.dr	String found in binary or memory: http://v4-alpha.getbootstrap.com/components/utilities/
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://webstandards.ca.gov/tools/design-enhancements/breadcrumbs/
Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: element_main[1].js.2.dr	String found in binary or memory: http://www.broofa.com
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: http://www.ca.gov/
Source: NGH2BVFL.htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov/commission/covid-19-commission-action-related-to-covid-19
Source: credentials[1].htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov/credentials
Source: apply[1].htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov/credentials/apply
Source: clear-credential[1].htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov/credentials/clear-credential
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov/credentials/complete-recommend
Source: ctc-online-written-instructions[1].htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov/credentials/ctc-online-written-instructions
Source: extend[1].htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov/credentials/extend
Source: NGH2BVFL.htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov/credentials/renew
Source: req-credentials[1].htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov/credentials/req-credentials
Source: apply[1].htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov/credentials/req-credentials.html
Source: apply[1].htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov/credentials/submit-online.html
Source: program-accred-sch-act[1].htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov/educator-prep/program-accred-sch-act
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov/search-results/credentials-search/credentials
Source: program-accred-sch-act[1].htm.2.dr	String found in binary or memory: http://www.ctc.ca.gov/search-results/program-sponsors-search/program-sponsors
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://www.gianlucaguarini.com/
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://www.goodwebpractices.com/roi/track-downloads-in-google-analytics-automatically.html
Source: cse_element__en[1].js.2.dr	String found in binary or memory: http://www.google.com
Source: msapplication.xml1.1.dr	String found in binary or memory: http://www.google.com/
Source: cse_element__en[1].js.2.dr	String found in binary or memory: http://www.google.com/support/websearch/bin/answer.py?hl=
Source: cagov.core[1].js0.2.dr	String found in binary or memory: http://www.hnldesign.nl/work/code/check-if-element-is-visible/
Source: plugins[1].js.2.dr	String found in binary or memory: http://www.javascripttoolbox.com/lib/table/examples.php
Source: plugins[1].js.2.dr	String found in binary or memory: http://www.javascripttoolbox.com/temp/table_cellindex.html
Source: plugins[1].js.2.dr	String found in binary or memory: http://www.kellegous.com/j/2013/02/27/innertext-vs-textcontent/
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: plugins[1].js.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.twitter.com/
Source: plugins[1].js.2.dr	String found in binary or memory: http://www.w3schools.com/tags/tag_ruby.asp
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.youtube.com/
Source: base[1].js.2.dr	String found in binary or memory: http://www.youtube.com/videoplayback
Source: base[1].js.2.dr	String found in binary or memory: http://youtube.com/drm/2012/10/10
Source: base[1].js.2.dr	String found in binary or memory: http://youtube.com/streaming/metadata/segment/102015
Source: base[1].js.2.dr	String found in binary or memory: http://youtube.com/streaming/otf/durations/112015
Source: base[1].js.2.dr	String found in binary or memory: http://youtube.com/yt/2012/10/10
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://COVID19.CA.gov
Source: base[1].js.2.dr	String found in binary or memory: https://admin.youtube.com
Source: gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/ddm/regclk
Source: gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: analytics[1].js.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: cagovapplets[1].js.2.dr	String found in binary or memory: https://api.stateentityprofile.ca.gov/
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://app.vzaar.com/videos/:id
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Bay-Area/Summer/Day/Summer-Day-G
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Bay-Area/Summer/Day/Summer-Day-M
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Bay-Area/Summer/Day/Summer-Day-O
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Bay-Area/Summer/Night/Summer-Nig
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Bay-Area/Winter/Day/GettyImages-
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Bay-Area/Winter/Day/Parks-090-P9
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Bay-Area/Winter/Night/GettyImage
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Coast/Summer/Day/GettyIm
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Coast/Summer/Day/Summer-
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Coast/Summer/Night/Getty
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Coast/Summer/Night/Summe
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Coast/Winter/Day/Bixby-B
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Coast/Winter/Day/Parks-0
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Coast/Winter/Night/Getty
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Sierra/Summer/Day/Day-Su
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Sierra/Summer/Day/Summer
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Sierra/Summer/Night/Summ
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Sierra/Winter/Day/GettyI
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Sierra/Winter/Day/Parks-
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Sierra/Winter/Night/Gett
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Valley/Summer/Day/Summer
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Valley/Summer/Night/Summ
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Valley/Winter/Day/GettyI
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Valley/Winter/Night/Gett
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Central-Valley/Winter/Night/SRA-
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Inland-Empire/Summer/Day/Summer-
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Inland-Empire/Summer/Night/Summe
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Inland-Empire/Winter/Day/GettyIm
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Inland-Empire/Winter/Night/Getty
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Los-Angeles/Summer/Day/GettyImag
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Los-Angeles/Summer/Day/Summer-Da
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Los-Angeles/Summer/Night/GettyIm
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Los-Angeles/Summer/Night/Summer-
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Los-Angeles/Winter/Day/GettyImag
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Los-Angeles/Winter/Night/GettyIm
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Orange-County/Summer/Day/Summer-
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Orange-County/Summer/Night/Getty
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Orange-County/Summer/Night/Summe
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Orange-County/Winter/Day/GettyIm
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Orange-County/Winter/Day/SP-090-
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Orange-County/Winter/Night/Getty
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Sacramento-Region/Summer/Day/Sum
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Sacramento-Region/Summer/Night/G
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Sacramento-Region/Summer/Night/S
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Sacramento-Region/Winter/Day/Get
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Sacramento-Region/Winter/Day/Win
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/Sacramento-Region/Winter/Night/G
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/San-Diego-Imperial/Summer/Day/Ge
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/San-Diego-Imperial/Summer/Day/Su
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/San-Diego-Imperial/Summer/Night/
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/San-Diego-Imperial/Winter/Day/Ge
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/San-Diego-Imperial/Winter/Day/Wi
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/San-Diego-Imperial/Winter/Night/
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/UpState/Summer/Day/Summer-Day-Ge
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/UpState/Summer/Day/Summer-Day-Hu
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/UpState/Summer/Night/Summer-Nigh
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/UpState/Summer/Night/Weed-Califo
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/UpState/Winter/Day/GettyImages-1
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/UpState/Winter/Day/GettyImages-6
Source: js4geo[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/Hero-Banner-Images/UpState/Winter/Night/GettyImages
Source: cagovapplets[1].js.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/images/Uploads
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/js/cagovapplets.js
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/CAgovPortal/offline/dialog_cagov-final.css
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/css/cagov.core.css
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/css/colorscheme-oceanside.css
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/images/apple-touch-icon-114x114.png
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/images/apple-touch-icon-120x120.png
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/images/apple-touch-icon-144x144.png
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/images/apple-touch-icon-152x152.png
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/images/apple-touch-icon-180x180.png
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/images/apple-touch-icon-57x57.png
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/images/apple-touch-icon-72x72.png
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/images/apple-touch-icon-precomposed.png
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/images/apple-touch-icon.png
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/js/libs/html5shiv.min.js
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/js/libs/jquery-migrate.min.js
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/js/libs/jquery.js
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/js/libs/respond.min.js
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://california.azureedge.net/cdt/statetemplate/6.0.1/js/libs/selectivizr-min.js
Source: gtm[1].js.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.4.1.min.js
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://code.jquery.com/jquery-migrate-3.1.0.min.js
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://codepen.io/lemagus/pen/RWxEYz
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://cse.google.com/?ref=b&hl=en
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://cse.google.com/cse.js?cx=
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://cse.google.com/cse/element/v1
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://cse.google.com/cse?cx=
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://csqr-autopush.corp.google.com/cse/element/v1
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://css-tricks.com/slightly-careful-sub-elements-clickable-things/
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://data.ca.gov/api/3/action/package_list
Source: custom[1].css.2.dr	String found in binary or memory: https://datatables.net/download
Source: custom[1].css.2.dr	String found in binary or memory: https://datatables.net/download/#dt/dt-1.10.12
Source: js4geo[1].js.2.dr	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: plugins[1].js.2.dr	String found in binary or memory: https://developers.google.com/api-client-library/javascript/dev/dev_jscript
Source: plugins[1].js.2.dr	String found in binary or memory: https://developers.google.com/apis-explorer/#s/youtube/v3/
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://developers.google.com/custom-search/docs/element.
Source: plugins[1].js.2.dr	String found in binary or memory: https://developers.google.com/youtube/iframe_api_reference
Source: plugins[1].js.2.dr	String found in binary or memory: https://developers.google.com/youtube/player_parameters?playerVersion=HTML5
Source: plugins[1].js.2.dr	String found in binary or memory: https://developers.google.com/youtube/v3
Source: plugins[1].js.2.dr	String found in binary or memory: https://developers.google.com/youtube/v3/docs/captions/download
Source: base[1].js.2.dr	String found in binary or memory: https://docs.google.com/get_video_info
Source: complete-recommend[1].htm.2.dr, ctc-online-written-instructions[1].htm.2.dr	String found in binary or memory: https://educator.ctc.ca.gov/esales_enu/start.swe?SWECmd=GotoView&SWEView=CTC
Source: NGH2BVFL.htm.2.dr	String found in binary or memory: https://educator.ctc.ca.gov/esales_enu/start.swe?SWECmd=GotoView&SWEView=Login
Source: NGH2BVFL.htm.2.dr	String found in binary or memory: https://educator.ctc.ca.gov/siebel/app/esales/enu?SWECmd=GotoView&SWEView=CTC
Source: complete-recommend[1].htm.2.dr, NGH2BVFL.htm.2.dr	String found in binary or memory: https://educator.ctc.ca.gov/siebel/app/esales/enu?SWECmd=GotoView&SWEView=Login
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Asap
Source: custom[1].css.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: css[1].css0.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/asapcondensed/v7/pxidypY1o9NHyXh3WvSbGSggdOeMaEo.woff)
Source: css[1].css0.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/asapcondensed/v7/pxieypY1o9NHyXh3WvSbGSggdO9TTFlDim0.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzQ.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc-.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc-.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: css[1].css0.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j.woff)
Source: css[1].css0.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdo.woff)
Source: program-accred-sch-act[1].htm.2.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ctc.ca.gov%2Feducator-prep%2Fp
Source: cagov.core[1].css0.2.dr	String found in binary or memory: https://getbootstrap.com/
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: plugins[1].js.2.dr	String found in binary or memory: https://gist.github.com/paulirish/5558557
Source: plugins[1].js.2.dr	String found in binary or memory: https://gist.github.com/purtuga/8257269
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://github.com/FezVrasta/popper.js/issues/373).
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://github.com/FezVrasta/popper.js/pull/715
Source: plugins[1].js.2.dr	String found in binary or memory: https://github.com/Keyamoon/svgxuse
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://github.com/Modernizr/Modernizr/blob/master/feature-detects/css-filters.js
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://github.com/Modernizr/Modernizr/blob/master/feature-detects/svg-filters.js
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://github.com/OwlCarousel2/OwlCarousel2/blob/master/LICENSE
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://github.com/OwlFonk/OwlCarousel2
Source: plugins[1].js.2.dr	String found in binary or memory: https://github.com/ableplayer/ableplayer/issues/162
Source: plugins[1].js.2.dr	String found in binary or memory: https://github.com/ableplayer/ableplayer/issues/81
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://github.com/angular/angular/blob/7.2.4/packages/core/src/sanitization/url_sanitizer.ts
Source: plugins[1].js.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://github.com/imakewebthings/waypoints/blog/master/licenses.txt
Source: plugins[1].js.2.dr	String found in binary or memory: https://github.com/jmosbech/StickyTableHeaders
Source: plugins[1].js.2.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://github.com/jsliang/eqHeight.coffee
Source: gtm[1].js.2.dr	String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://github.com/louisremi/jquery-smartresize/blob/master/jquery.debouncedresize.js
Source: plugins[1].js.2.dr	String found in binary or memory: https://github.com/mattyork/fuzzy
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://github.com/nico3333fr/van11y-accessible-accordion-aria/blob/master/LICENSE
Source: plugins[1].js.2.dr	String found in binary or memory: https://github.com/overset/javascript-natural-sort
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/issues/24251
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://goo.gl/Gs1KIc.
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://goo.gl/pxwQGp)
Source: program-accred-sch-act[1].htm.2.dr	String found in binary or memory: https://info.ctc.ca.gov/fmp/accreditation/accreditation_reports.php
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: https://info.ctc.ca.gov/fmp/program-sponsors-contact/all.php
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.5/css/bootstrap.min.css
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://modernizr.com/download/?-flexbox-setclasses
Source: gtm[1].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: base[1].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/osd.js
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://plus.google.com/share?url=
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://popper.js.org
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://popper.js.org/)
Source: widgets[1].js.2.dr	String found in binary or memory: https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://regexper.com/#(http%3A%7Chttps%3A%7C)%5C%2F%5C%2F(player.%7Cwww.%7Capp.)%3F(vimeo%5C.com%7Cy
Source: cagovapplets[1].js.2.dr	String found in binary or memory: https://stateentityprofile.ca.gov/Uploads
Source: analytics[1].js.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: base[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=missing_quality
Source: base[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=noaudio
Source: base[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=report_playback
Source: base[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/answer/6276924
Source: remote[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/answer/7640706
Source: element_main[1].js.2.dr	String found in binary or memory: https://translate.google.com
Source: cagovapplets[1].js.2.dr	String found in binary or memory: https://twitter.com/
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://twitter.com/intent/tweet?text=
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://van11y.net/accessible-accordion/
Source: base[1].js.2.dr	String found in binary or memory: https://viacon.corp.google.com
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://vimeo.com/:id
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://vimeo.com/channels/:channel/:id
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://vimeo.com/groups/:group/videos/:id
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ca.gov/
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ca.gov/%%www.ca.gov
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ca.gov/Hwww.ca.gov
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://www.ca.gov/agency/
Source: imagestore.dat.2.dr	String found in binary or memory: https://www.ca.gov/images/apple-touch-icon-192x192.pngkG
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ca.gov/ov
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ca.gov/ov/educator-prep/program-accred-sch-act#main-anchorcovid-19(
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://www.ca.gov/service/
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.c
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.c/Root
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.c/commission/covid-19-commission-action-related-to-covid-19Root
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.c/credentials/applyRoot
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.c/credentials/clear-credentialn-ls/complete-recommend
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.c/credentials/complete-recommendRoot
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.c/credentials/ctc-online-written-ls/complete-recommend
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.c/credentials/extenddentialsn-ls/complete-recommend
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.c/credentials/req-credentialsn-ls/complete-recommend
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.c/credentialspplyRoot
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.c/educator-prep/program-accred-sch-act#main-anchorcovid-19Root
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.cRoot
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr, ctc-online-written-instructions[1].htm.2.dr	String found in binary or memory: https://www.ctc.ca.gov
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr, ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov//www.ctc.ca.gov/favicon.ico
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr, ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/commission/covid-19-commission-action-related-to-covid-19
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentRoot
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentiaRoot
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr, ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/apply
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/apply0Apply
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/applyls
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/applyr
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/clear-credential
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/clear-credentialn-instructions
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/complete-recommend
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/complete-recommend#help
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/complete-recommend#more
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/complete-recommend#pfq
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/complete-recommend#program
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/complete-recommend#recommend
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/complete-recommend#return
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/complete-recommend#video
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/complete-recommend8Complete
Source: apply[1].htm.2.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/ctc-online---login-help
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr, ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/ctc-online-written-instructions
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/ctc-online-written-instructionszCTC
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/extend
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/extend(Extensions
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/extenddentialsn-instructions
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/extenddentialsn-instructionst
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/req-credentials
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/req-credentials.Credential
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials/req-credentialsn-instructions
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentials2Credentialing
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentialspply
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/credentialspplyc.ca.gov/credentials/apply
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: https://www.ctc.ca.gov/docs/default-source/commission/files/accessibility-cert-2019-07-01.pdf
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: https://www.ctc.ca.gov/docs/default-source/leaflets/41-nc.pdf
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/ducator-prep/program-accred-sch-act#main-anchorcovid-19tps://www.ca.gov/%%www
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/educator-prep/program-accred-sRoot
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/educator-prep/program-accred-sch-act
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/educator-prep/program-accred-sch-act#main-anchor
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/educator-prep/program-accred-sch-act#main-anchorcovid-19
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/educator-prep/program-accred-sch-act&
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/educator-prep/program-accred-sch-actJAccreditation
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.ca.gov/educator-prep/program-accred-sch-actRoot
Source: program-accred-sch-act[1].htm.2.dr	String found in binary or memory: https://www.ctc.ca.gov/educator-prep/program-accred/annual-data-submission
Source: ~DFC50940B530D7E907.TMP.1.dr	String found in binary or memory: https://www.ctc.ca.gov/favicon.ico
Source: imagestore.dat.2.dr	String found in binary or memory: https://www.ctc.ca.gov/favicon.ico~
Source: {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ctc.cch-act
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: cse_element__en[1].js.2.dr, gtm[1].js.2.dr	String found in binary or memory: https://www.google.com
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://www.google.com/cse/static
Source: f[1].txt.2.dr	String found in binary or memory: https://www.google.com/cse/static/element/%
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://www.google.com/cse/static/images/1x/
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://www.google.com/cse/static/images/2x/
Source: f[1].txt.2.dr	String found in binary or memory: https://www.google.com/cse/static/style/look/%
Source: element_main[1].js.2.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: element_main[1].js.2.dr	String found in binary or memory: https://www.google.com/support/translate
Source: base[1].js.2.dr	String found in binary or memory: https://www.googleapis.com/certificateprovisioning/v1/devicecertificates/create?key=AIzaSyB-5OLKTx2i
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://www.googleapis.com/customsearch/v1element?key=AIzaSyCVAXiUzRYsML1Pv6RwSG1gunmMikTzQqY&rsz=
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://www.googleapis.com/generate_204
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-PZGPNNV
Source: NGH2BVFL.htm.2.dr	String found in binary or memory: https://www.gov.ca.gov
Source: remote[1].js.2.dr	String found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Source: element_main[1].js.2.dr	String found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png
Source: element_main[1].js.2.dr	String found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_68x28dp.png
Source: element_main[1].js.2.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/1x/translate_24dp.png
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://www.surveymonkey.com/r/GFDXW5B?source=ca
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://www.surveymonkey.com/r/GFDXW5B?source=ca&src=
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://www.surveymonkey.com/r/K8JNQF3?source=ca
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://www.surveymonkey.com/r/T2V3FMJ?source=ca
Source: DRHAAZ24.htm.2.dr	String found in binary or memory: https://www.surveymonkey.com/r/YF8KGLW?source=ca&src=
Source: cagovapplets[1].js.2.dr	String found in binary or memory: https://www.youtube.com/
Source: complete-recommend[1].htm.2.dr, {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.youtube.com/embed/6D19FjzPJgc
Source: base[1].js.2.dr	String found in binary or memory: https://www.youtube.com/generate_204?cpn=
Source: plugins[1].js.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=07DDUQQwLSE
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=:id
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=L879qHemJ2Y
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=ZzTqwvCgggc
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=ePNNPPSwffg&feature=youtu.be
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=iqODcICtloE
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=iwHbKTJHavI
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=sS1vsIdDD0Q&feature=youtu.be
Source: complete-recommend[1].htm.2.dr	String found in binary or memory: https://wwwedit.ctc.ca.gov/credentials
Source: ctc-online-written-instructions[1].htm.2.dr	String found in binary or memory: https://wwwedit.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---ren
Source: ctc-online-written-instructions[1].htm.2.dr	String found in binary or memory: https://wwwedit.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---sel
Source: base[1].js.2.dr	String found in binary or memory: https://youtu.be/
Source: cagov.core[1].js0.2.dr	String found in binary or memory: https://youtu.be/:id
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: https://youtu.be/ISAE6uSg_Yc
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: https://youtu.be/P4qBIGBKP5s
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: https://youtu.be/eYF-KJrgj6U
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: https://youtu.be/s61CVECGQHI
Source: covid-19-commission-action-related-to-covid-19[1].htm.2.dr	String found in binary or memory: https://youtu.be/xuVK4qtneKg
Source: base[1].js.2.dr	String found in binary or memory: https://youtube.com/api/drm/fps?ek=uninitialized
Source: base[1].js.2.dr	String found in binary or memory: https://youtubei.googleapis.com/youtubei/
Source: base[1].js.2.dr	String found in binary or memory: https://yurt.corp.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 134.186.81.178:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 134.186.81.178:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 134.186.81.178:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.12.157:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.12.157:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.206.155:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.206.155:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.130.35:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.130.35:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.218.112:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.218.112:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.125.230.89:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.125.230.89:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.162:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.162:443 -> 192.168.2.4:49790 version: TLS 1.2

System Summary:

Source: classification engine

Classification label: clean0.win@3/136@14/8

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{38854918-75F4-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF358A34EB9D432497.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4980 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4980 CREDAT:17410 /prefetch:2

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Windows\SysWOW64\Macromed\Flash\ss.cfg

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	File and Directory Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://www.ctc.ca.gov/educator-prep/program-accred-sch-act	0%	Avira URL Cloud	safe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://daneden.github.io/animate.css/	0%	Avira URL Cloud	safe
https://www.ctc.c/credentialspplyRoot	0%	Avira URL Cloud	safe
http://oaa-accessibility.org/examplep/accordian1/	0%	Avira URL Cloud	safe
https://www.ctc.cch-act	0%	Avira URL Cloud	safe
https://www.ctc.c/educator-prep/program-accred-sch-act#main-anchorcovid-19Root	0%	Avira URL Cloud	safe
http://www.kellegous.com/j/2013/02/27/innertext-vs-textcontent/	0%	Avira URL Cloud	safe
https://www.ctc.c	0%	Avira URL Cloud	safe
https://www.ctc.c/credentials/ctc-online-written-ls/complete-recommend	0%	Avira URL Cloud	safe
https://www.ctc.c/commission/covid-19-commission-action-related-to-covid-19Root	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ctc.ca.gov	134.186.81.178	true	false	high
siteimproveanalytics.com	172.64.130.35	true	false	unknown
stats.l.doubleclick.net	74.125.206.155	true	false	high
googleads.g.doubleclick.net	142.250.186.162	true	false	high
ana-cf-col-elb-78-567119012.eu-central-1.elb.amazonaws.com	3.125.230.89	true	false	high
caprod.ogopendata.com	104.19.218.112	true	false	unknown
platform.twitter.map.fastly.net	151.101.12.157	true	false	unknown
api.stateentityprofile.ca.gov	unknown	unknown	false	high
stateentityprofile.ca.gov	unknown	unknown	false	high
static.doubleclick.net	unknown	unknown	false	high
www.ca.gov	unknown	unknown	false	high
stats.g.doubleclick.net	unknown	unknown	false	high
77584.global.siteimproveanalytics.io	unknown	unknown	false	unknown
www.ctc.ca.gov	unknown	unknown	false	high
code.jquery.com	unknown	unknown	false	high
platform.twitter.com	unknown	unknown	false	high
data.ca.gov	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.ctc.ca.gov/credentials/clear-credential	false		high
https://www.ctc.ca.gov/credentials/apply	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://daneden.github.io/animate.css/	cagov.core[1].css0.2.dr	false	Avira URL Cloud: safe	unknown
http://jsperf.com/jquery-vs-instanceof-jquery/2	plugins[1].js.2.dr	false		high
https://educator.ctc.ca.gov/esales_enu/start.swe?SWECmd=GotoView&SWEView=Login	NGH2BVFL.htm.2.dr	false		high
https://vimeo.com/groups/:group/videos/:id	cagov.core[1].js0.2.dr	false		high
https://www.youtube.com/embed/6D19FjzPJgc	complete-recommend[1].htm.2.dr, {3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.ctc.ca.gov/credentials/clear-credentialn-instructions	~DFC50940B530D7E907.TMP.1.dr	false		high
http://benalman.com/projects/jquery-misc-plugins/#scrollbarwidth	cagov.core[1].js0.2.dr	false		high
https://youtu.be/:id	cagov.core[1].js0.2.dr	false		high
https://www.ctc.c/credentialspplyRoot	{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
http://imakewebthings.com/waypoints/api/context	cagov.core[1].js0.2.dr	false		high
http://imakewebthings.com/waypoints/api/next	cagov.core[1].js0.2.dr	false		high
http://jsonlint.com/	plugins[1].js.2.dr	false		high
https://www.ctc.ca.gov/credentials/extenddentialsn-instructions	~DFC50940B530D7E907.TMP.1.dr	false		high
http://www.opensource.org/licenses/mit-license.php	plugins[1].js.2.dr	false		high
https://codepen.io/lemagus/pen/RWxEYz	cagov.core[1].js0.2.dr	false		high
https://gist.github.com/purtuga/8257269	plugins[1].js.2.dr	false		high
https://github.com/twbs/bootstrap/graphs/contributors)	cagov.core[1].js0.2.dr	false		high
http://oaa-accessibility.org/examplep/accordian1/	cagov.core[1].js0.2.dr	false	Avira URL Cloud: safe	unknown
https://admin.youtube.com	base[1].js.2.dr	false		high
https://www.ctc.cch-act	{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
http://imakewebthings.com/waypoints/api/viewport-width	cagov.core[1].js0.2.dr	false		high
http://dev.aol.com/dhtml_style_guide/#mediaplayer	plugins[1].js.2.dr	false		high
https://gist.github.com/paulirish/5558557	plugins[1].js.2.dr	false		high
http://imakewebthings.com/waypoints/api/context-destroy	cagov.core[1].js0.2.dr	false		high
http://stackoverflow.com/questions/17328742	cagov.core[1].js0.2.dr	false		high
https://stats.g.doubleclick.net/j/collect	analytics[1].js.2.dr	false		high
https://www.ctc.ca.gov/credentials/extend(Extensions	{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://css-tricks.com/slightly-careful-sub-elements-clickable-things/	cagov.core[1].js0.2.dr	false		high
https://www.ctc.c/educator-prep/program-accred-sch-act#main-anchorcovid-19Root	{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://datatables.net/download	custom[1].css.2.dr	false		high
http://stackoverflow.com/a/20892048/145346	plugins[1].js.2.dr	false		high
http://www.reddit.com/	msapplication.xml4.1.dr	false		high
https://www.ctc.ca.gov/credentials/extend	{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://wwwedit.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---sel	ctc-online-written-instructions[1].htm.2.dr	false		high
http://commons.wikimedia.org/wiki/File:Blue_a_v.svg#mediaviewer/File:Blue_a_v.svg	cagov.core[1].css0.2.dr	false		high
http://imakewebthings.com/waypoints/api/group	cagov.core[1].js0.2.dr	false		high
https://www.ctc.ca.gov/credentials/apply0Apply	{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.youtube.com/generate_204?cpn=	base[1].js.2.dr	false		high
https://www.ctc.ca.gov/favicon.ico	~DFC50940B530D7E907.TMP.1.dr	false		high
https://www.surveymonkey.com/r/T2V3FMJ?source=ca	DRHAAZ24.htm.2.dr	false		high
https://github.com/Modernizr/Modernizr/blob/master/feature-detects/css-filters.js	cagov.core[1].js0.2.dr	false		high
https://www.ca.gov/ov/educator-prep/program-accred-sch-act#main-anchorcovid-19(	~DFC50940B530D7E907.TMP.1.dr	false		high
http://imakewebthings.com/waypoints/api/destroy	cagov.core[1].js0.2.dr	false		high
http://www.kellegous.com/j/2013/02/27/innertext-vs-textcontent/	plugins[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://www.ctc.c	{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.ctc.c/credentials/ctc-online-written-ls/complete-recommend	{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
http://www.javascripttoolbox.com/temp/table_cellindex.html	plugins[1].js.2.dr	false		high
https://youtu.be/eYF-KJrgj6U	covid-19-commission-action-related-to-covid-19[1].htm.2.dr	false		high
https://www.youtube.com/watch?v=sS1vsIdDD0Q&feature=youtu.be	covid-19-commission-action-related-to-covid-19[1].htm.2.dr	false		high
https://github.com/imakewebthings/waypoints/blog/master/licenses.txt	cagov.core[1].js0.2.dr	false		high
http://www.ctc.ca.gov/search-results/program-sponsors-search/program-sponsors	program-accred-sch-act[1].htm.2.dr	false		high
https://wwwedit.ctc.ca.gov/credentials	complete-recommend[1].htm.2.dr	false		high
https://www.ctc.ca.gov/credentials/complete-recommend8Complete	{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://github.com/douglascrockford/JSON-js	plugins[1].js.2.dr	false		high
https://dev.virtualearth.net/REST/v1/Locations	js4geo[1].js.2.dr	false		high
https://www.ctc.ca.gov/credentials/ctc-online-written-instructionszCTC	{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.youtube.com/	cagovapplets[1].js.2.dr	false		high
http://www.ctc.ca.gov/credentials/req-credentials.html	apply[1].htm.2.dr	false		high
https://www.ctc.c/commission/covid-19-commission-action-related-to-covid-19Root	{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.ctc.ca.gov/credentials/req-credentials.Credential	{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://app.vzaar.com/videos/:id	cagov.core[1].js0.2.dr	false		high
http://fancyapps.com/fancybox/	cagov.core[1].js0.2.dr	false		high
http://imakewebthings.com/waypoints/api/last	cagov.core[1].js0.2.dr	false		high
https://www.ctc.ca.gov/credentials/complete-recommend#program	complete-recommend[1].htm.2.dr	false		high
http://api.jquery.com/event.namespace/	plugins[1].js.2.dr	false		high
http://t.co/dKP3o1e	DRHAAZ24.htm.2.dr	false		high
https://www.ctc.ca.gov/ducator-prep/program-accred-sch-act#main-anchorcovid-19tps://www.ca.gov/%%www	~DFC50940B530D7E907.TMP.1.dr	false		high
https://www.youtube.com/watch?v=iqODcICtloE	covid-19-commission-action-related-to-covid-19[1].htm.2.dr	false		high
http://stackoverflow.com/questions/5312849/jquery-find-self;	plugins[1].js.2.dr	false		high
https://www.ctc.ca.gov/credentials/req-credentialsn-instructions	~DFC50940B530D7E907.TMP.1.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	cagov.core[1].js0.2.dr	false		high
https://github.com/js-cookie/js-cookie	plugins[1].js.2.dr	false		high
http://www.ctc.ca.gov/credentials	credentials[1].htm.2.dr	false		high
http://www.ca.gov/	complete-recommend[1].htm.2.dr	false		high
http://jsliang.github.com/eqHeight.coffee	cagov.core[1].js0.2.dr	false		high
https://github.com/Modernizr/Modernizr/blob/master/feature-detects/svg-filters.js	cagov.core[1].js0.2.dr	false		high
http://css-tricks.com/13465-persistent-headers/	plugins[1].js.2.dr	false		high
https://github.com/overset/javascript-natural-sort	plugins[1].js.2.dr	false		high
https://www.ctc.ca.gov/commission/covid-19-commission-action-related-to-covid-19	{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr, ~DFC50940B530D7E907.TMP.1.dr	false		high
https://www.surveymonkey.com/r/GFDXW5B?source=ca&src=	DRHAAZ24.htm.2.dr	false		high
http://imakewebthings.com/waypoints/api/first	cagov.core[1].js0.2.dr	false		high
http://registertovote.ca.gov/	NGH2BVFL.htm.2.dr	false		high
http://www.ctc.ca.gov/credentials/submit-online.html	apply[1].htm.2.dr	false		high
https://twitter.com/intent/tweet?text=	cagov.core[1].js0.2.dr	false		high
https://github.com/FezVrasta/popper.js/pull/715	cagov.core[1].js0.2.dr	false		high
https://www.ctc.ca.gov/credentiaRoot	{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://vimeo.com/channels/:channel/:id	cagov.core[1].js0.2.dr	false		high
http://imakewebthings.com/waypoints/api/destroy-all	cagov.core[1].js0.2.dr	false		high
http://www.amazon.com/	msapplication.xml.1.dr	false		high
http://www.twitter.com/	msapplication.xml5.1.dr	false		high
https://www.surveymonkey.com/r/K8JNQF3?source=ca	DRHAAZ24.htm.2.dr	false		high
http://youtube.com/streaming/metadata/segment/102015	base[1].js.2.dr	false		high
https://youtu.be/	base[1].js.2.dr	false		high
http://www.ctc.ca.gov/search-results/credentials-search/credentials	complete-recommend[1].htm.2.dr	false		high
http://www.ctc.ca.gov/credentials/ctc-online-written-instructions	ctc-online-written-instructions[1].htm.2.dr	false		high
https://www.gov.ca.gov	NGH2BVFL.htm.2.dr	false		high
http://www.ctc.ca.gov/credentials/complete-recommend	complete-recommend[1].htm.2.dr	false		high
https://www.ctc.ca.gov//www.ctc.ca.gov/favicon.ico	~DFC50940B530D7E907.TMP.1.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
134.186.81.178	unknown	United States	1226	CTA-42-AS1226US	false
104.19.218.112	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.162	unknown	United States	15169	GOOGLEUS	false
3.125.230.89	unknown	United States	16509	AMAZON-02US	false
74.125.206.155	unknown	United States	15169	GOOGLEUS	false
172.64.130.35	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.12.157	unknown	United States	54113	FASTLYUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	356829
Start date:	23.02.2021
Start time:	17:28:07
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 40s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	https://www.ctc.ca.gov/educator-prep/program-accred-sch-act
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@3/136@14/8
Cookbook Comments:	Adjust boot time Enable AMSI Browsing link: https://www.ctc.ca.gov/commission/covid-19-commission-action-related-to-covid-19 Browsing link: https://www.ctc.ca.gov/educator-prep/program-accred-sch-act#main-anchor Browsing link: http://www.ca.gov/ Browsing link: https://www.ctc.ca.gov/ Browsing link: https://www.ctc.ca.gov/credentials Browsing link: https://www.ctc.ca.gov/credentials/apply Browsing link: https://www.ctc.ca.gov/credentials/complete-recommend Browsing link: https://www.ctc.ca.gov/credentials/renew Browsing link: https://www.ctc.ca.gov/credentials/clear-credential Browsing link: https://www.ctc.ca.gov/credentials/req-credentials Browsing link: https://www.ctc.ca.gov/credentials/extend
Warnings:	Show All Exclude process from analysis (whitelisted): ielowutil.exe TCP Packets have been reduced to 100 Created / dropped Files have been reduced to 100 Excluded IPs from analysis (whitelisted): 104.42.151.234, 13.64.90.137, 104.43.193.48, 104.43.139.144, 88.221.62.148, 142.250.185.202, 142.250.186.78, 142.250.186.131, 80.67.82.43, 80.67.82.51, 209.197.3.24, 13.107.246.19, 13.107.213.19, 216.58.212.168, 142.250.74.206, 142.250.185.206, 142.250.185.164, 142.250.186.138, 142.250.185.227, 152.199.19.161, 142.250.185.174, 142.250.185.238, 216.58.212.174, 142.250.186.110, 142.250.186.142, 172.217.18.110, 172.217.23.110, 216.58.212.142, 142.250.185.78, 172.217.16.142, 142.250.185.110, 142.250.185.142, 142.250.185.102, 2.20.142.209, 2.20.142.210 Excluded domains from analysis (whitelisted): gstaticadssl.l.google.com, au.download.windowsupdate.com.edgesuite.net, www.ca.gov.edgekey.net, cds.s5x3j6q5.hwcdn.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, go.microsoft.com, dual.t-0009.t-msedge.net, www.googletagmanager.com, star-azurefd-prod.trafficmanager.net, audownload.windowsupdate.nsatc.net, cse.google.com, www.google.com, e65017.dscb.akamaiedge.net, watson.telemetry.microsoft.com, www.gstatic.com, au-bg-shim.trafficmanager.net, www.google-analytics.com, california.azureedge.net, skypedataprdcolwus17.cloudapp.net, fonts.googleapis.com, www-google-analytics.l.google.com, fonts.gstatic.com, ie9comview.vo.msecnd.net, www-googletagmanager.l.google.com, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, star-azureedge-prod.trafficmanager.net, california.afd.azureedge.net, static-doubleclick-net.l.google.com, skypedataprdcolcus15.cloudapp.net, youtube-ui.l.google.com, www3.l.google.com, t-0009.t-msedge.net, translate.googleapis.com, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, translate.google.com, skypedataprdcolwus16.cloudapp.net, cs9.wpc.v0cdn.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtQueryAttributesFile calls found. VT rate limit hit for: https://www.ctc.ca.gov/educator-prep/program-accred-sch-act

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\BACZYXTY\www.youtube[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	864
Entropy (8bit):	5.102375905833574
Encrypted:	false
SSDEEP:	24:W0UJwQ70UJNiQ70Ub+dqJ6/wQ7Ub+dqJ6/wQ4tr+3QkQ5:0mQxDiQxisIIQAisIIQ/ZQ5
MD5:	D8C148270238FED2E958F1C1CB7F2FCE
SHA1:	DDADC067E978450AFF46D7C7A6CDA052C534B2D5
SHA-256:	0D189345F939E672CF3D7CCA562C96C9855561CDFCDC4E453257150BE2310F86
SHA-512:	F37230DD2E64317FA28AC45D0ADAEC453D9648FD2C6FCFC67C0167CD0DFD5D132DE7D0F20D415DBCB13E64040726AB98304C3F7AF6D04FFA6E188EA77FAFC626
Malicious:	false
Reputation:	low
Preview:	<root></root><root></root><root><item name="__sak" value="1" ltime="343685968" htime="30870017" /></root><root></root><root><item name="__sak" value="1" ltime="421165968" htime="30870017" /></root><root></root><root><item name="yt-remote-device-id" value="{"data":"5ec49742-e694-4513-a7c4-6d1f352354fd","expiration":1645633786365,"creation":1614097786392}" ltime="422685968" htime="30870017" /></root><root><item name="yt-remote-device-id" value="{"data":"5ec49742-e694-4513-a7c4-6d1f352354fd","expiration":1645633786365,"creation":1614097786392}" ltime="422685968" htime="30870017" /><item name="yt-remote-connected-devices" value="{"data":"[]","expiration":1614184186563,"creation":1614097786563}" ltime="423765968" htime="30870017" /></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\E5F0NRSV\www.ctc.ca[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aKb:JFKb
MD5:	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA1:	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966
SHA-256:	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
SHA-512:	6BE8CEC7C862AFAE5B37AA32DC5BB45912881A3276606DA41BF808A4EF92C318B355E616BF45A257B995520D72B7C08752C0BE445DCEADE5CF79F73480910FED
Malicious:	false
Reputation:	low
Preview:	<root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\URW0GA4Q\www.ca[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aKb:JFKb
MD5:	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA1:	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966
SHA-256:	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
SHA-512:	6BE8CEC7C862AFAE5B37AA32DC5BB45912881A3276606DA41BF808A4EF92C318B355E616BF45A257B995520D72B7C08752C0BE445DCEADE5CF79F73480910FED
Malicious:	false
Reputation:	low
Preview:	<root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{38854918-75F4-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	30296
Entropy (8bit):	1.844624669440254
Encrypted:	false
SSDEEP:	192:rSZxZo2CWhTthBifh7V7zMPPDBGNJDGHsfGxVCjX:rOX/hhRhehWPlGbGyGG
MD5:	07BEFA6F8E3CC3975CCE36125CF75F2A
SHA1:	D44C514F6074287B8FCD5EDA554AF9E89C305AB2
SHA-256:	1B1F6580C1CEB46F0A29F8A397373C8E8ADD53804F9145004824FB891DDFD3A5
SHA-512:	73FF0AD48DD8276C0C74FEAC9F187D247D155506DEFB2CE26F4639A1B188BFD057384F6521C749450200DE86C0C4EB140F34C4C48520B12885E4F55BFAE79E02
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3885491A-75F4-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	193470
Entropy (8bit):	2.5556605165550925
Encrypted:	false
SSDEEP:	384:r3XdlHQ/kKhQf/9c6HsPtrlBdY05dM9yPX9lacqUSBMa0df8lfU4NwZ/lNn5hHoo:jICg
MD5:	3640791129B5F2F993AF57DCF81CD2CB
SHA1:	05C58A7A0FD09578FB00398476E717CD379654DC
SHA-256:	912B9B1031F25452E61C00A1F46913AA0E1551E2C07B8B3816D426227E13CEF2
SHA-512:	80C84BB8CCDCD8BE27A83EA798FA3D1F43091EFA3688044B0E2E29F2811467579F2CAA1B948F47DF43F9ADB062D6E9995D76D9EF5CC0BDA5734A721575F19460
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3F1AE735-75F4-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.5623414589249676
Encrypted:	false
SSDEEP:	48:IwGGcprrGwpaMG4pQQGrapbSkbGQpKyG7HpRTTGIpG:raZlQM6uBSkVAdTZA
MD5:	07B28059B6D904C8D87D3DE5F5F47C68
SHA1:	AFA0280AB5C39CF3C83FF8731670F9157C2F96A2
SHA-256:	52BBD23DB5C628DFEEF5BA992C4644203EB39FF1F3CAC58E6909DCA1EDD95F23
SHA-512:	D32D55F796B399D5BFB54B65CB5E8A80DB9A04BA896CA4E59035F7750C982222AC77EDE313D16476A41EBEB3E8E6B9D412B098DBF08BFE0E12B71EE5D7598DCF
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.034147827930483
Encrypted:	false
SSDEEP:	12:TMHdNMNxOEAFiF1nWimI002EtM3MHdNMNxOEAFiF1nWimI00OYGVbkEtMb:2d6NxOwSZHKd6NxOwSZ7YLb
MD5:	CDCE02F3B52AB91866C70016BB3DEE4C
SHA1:	8B53194504AAB74E5F93B299FC3154FC502401E2
SHA-256:	F03ED1CDEB16EB9E685247AF150CED97686B3C099622EEC4077D54A172DB1853
SHA-512:	ADAF82B6334BF67FE2DBC324CFE2F2CA1DE92D8003B812743632532801E5E8A4B1640B82C933B8257A1015A6F3233C82F8224F42E529874AB44B0D92A5655E68
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x11b09d99,0x01d70a01</date><accdate>0x11b09d99,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x11b09d99,0x01d70a01</date><accdate>0x11b09d99,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.058409145653463
Encrypted:	false
SSDEEP:	12:TMHdNMNxe2krN1nWimI002EtM3MHdNMNxe2krN1nWimI00OYGkak6EtMb:2d6NxrGSZHKd6NxrGSZ7Yza7b
MD5:	2FFEB4F2474B725589B6040267240234
SHA1:	8A96E6079701E604A227EBC4611F321D430B47DB
SHA-256:	3FDEE976CC4D5927EF1F749278AF71BBC7EB395FDE2554ACF08CEF10D96434AF
SHA-512:	DB990E6BF95B7509437FACB4C4064B1A2BFFB4FBB7266801E8764AAC9F87B4896EA62FC2428FFFFE6C8D1A296140FFA622E0798D14D9CACC7666943738A98F73
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x11a97670,0x01d70a01</date><accdate>0x11a97670,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x11a97670,0x01d70a01</date><accdate>0x11a97670,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	662
Entropy (8bit):	5.052774013363098
Encrypted:	false
SSDEEP:	12:TMHdNMNxvLAFiF1nWimI002EtM3MHdNMNxvLAFiF1nWimI00OYGmZEtMb:2d6NxvpSZHKd6NxvpSZ7Yjb
MD5:	C325DFB5D3BD5F7ABF827C507683B7A7
SHA1:	3A07EDF452A05B29D79B48896C6E452F0F0E7E34
SHA-256:	300817C0F3FA0E86D956A5D20F9E2F1E56818A18C3568783C32AC8CD32E74202
SHA-512:	0203C4A6F77A8975B38D8A12ABA0D7B5BE701C6D77014E3B3567FDD4ED176B836E0974A51A15B5BDD8853FA9A54038866519887884AA03E41A1250922E733A6C
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x11b09d99,0x01d70a01</date><accdate>0x11b09d99,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x11b09d99,0x01d70a01</date><accdate>0x11b09d99,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.0311974202451175
Encrypted:	false
SSDEEP:	12:TMHdNMNxiNn1nWimI002EtM3MHdNMNxiNn1nWimI00OYGd5EtMb:2d6NxASZHKd6NxASZ7YEjb
MD5:	EA66DB8E85A9DEFDC3DE8B88CFDBAA7C
SHA1:	5990348B72C7A05F05719A93E6DDEE95AD764837
SHA-256:	72E69144BB97328F47D23E8D6BD7D1058642F2C4D6A4AE1669C3194166D66E7E
SHA-512:	662C86DBDCF9C19F4E064DE2C4E0348B736E9EEF80ED25BF94C3E1777B4963353688DF1A1B8BAC46E3F610A60AC292F15B376C6E116D4FC36D084A85B9DC6BBC
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x11ae3b4c,0x01d70a01</date><accdate>0x11ae3b4c,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x11ae3b4c,0x01d70a01</date><accdate>0x11ae3b4c,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.064787294279794
Encrypted:	false
SSDEEP:	12:TMHdNMNxhGwAFiF1nWimI002EtM3MHdNMNxhGwAFiF1nWimI00OYG8K075EtMb:2d6NxQESZHKd6NxQESZ7YrKajb
MD5:	151CC0BF3773D7FAB02720EF136A5832
SHA1:	9A12EBCDBAA444730A742FD47BA90809FF6D710E
SHA-256:	EB7AD76B960A1A211C0B5EBE3F5D100A47EDFEDC6DA31557D685F2E96201C4E7
SHA-512:	12D13465464EF1BA1F32B89CDED3100F9A29DE1A17BDCA52AD81150FF5C634051B9EF6170E494DA65FADAFD965ACA0E7CFD96E03F384EDC94ED2FCBE0F7D4EC3
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x11b09d99,0x01d70a01</date><accdate>0x11b09d99,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x11b09d99,0x01d70a01</date><accdate>0x11b09d99,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.020216100857313
Encrypted:	false
SSDEEP:	12:TMHdNMNx0nNn1nWimI002EtM3MHdNMNx0nNn1nWimI00OYGxEtMb:2d6Nx07SZHKd6Nx07SZ7Ygb
MD5:	D0D51E698C481A2A8B8210396870E1E2
SHA1:	6FC0E0F67EE0FE5E3F289F0B981327FF7E07349E
SHA-256:	51D0A59B7674E0173ED0CFF9E2DE332C76A0DDDA982C34AB63DBBB2CFAF98B43
SHA-512:	090D339782A08A168139163D93DA3F789D00C46A562F2599717A4F065E502DA451B8177C4AD7502A1664190F7A7DA96E1998C2D900D5FE49A5179C2129B32571
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x11ae3b4c,0x01d70a01</date><accdate>0x11ae3b4c,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x11ae3b4c,0x01d70a01</date><accdate>0x11ae3b4c,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.056443461114694
Encrypted:	false
SSDEEP:	12:TMHdNMNxxNn1nWimI002EtM3MHdNMNxxNn1nWimI00OYG6Kq5EtMb:2d6NxtSZHKd6NxtSZ7Yhb
MD5:	0D0374B8A07BA3AD3C2AB76BF8963EF6
SHA1:	3BE1B1D92BEC4E47A64CC788022A0EDEEDFF3DC9
SHA-256:	D32FEAC962747E4C88060488FAB3BAE517AE445338AD33B21E649F9F79D747A0
SHA-512:	FE29CE8DCE58B600492048F1C1669C4DACF23D98EF8E395E486EEBEF35E60330DCF9720F112147A0E9CF301B92F9335239894C8CC1A2BA1887FAD4664DB4D031
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x11ae3b4c,0x01d70a01</date><accdate>0x11ae3b4c,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x11ae3b4c,0x01d70a01</date><accdate>0x11ae3b4c,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	659
Entropy (8bit):	5.0449145254259875
Encrypted:	false
SSDEEP:	12:TMHdNMNxctP1nWimI002EtM3MHdNMNxctP1nWimI00OYGVEtMb:2d6Nx6SZHKd6Nx6SZ7Ykb
MD5:	3297BDA9DBB50465101AC1EB4E4C01E9
SHA1:	EDC8E63862C312BF80CFD79C0D14EDBCFF0786CB
SHA-256:	F2E305FACA86F3CE2804393C686A5A5146FF2A834EA70E7E6EEDAFF63609B113
SHA-512:	8BFBA75382281A299B9683D08DBE054171F414B058BAB8FE0119811E935AFECD5F36A4CEDCBB51EBCEDB85EB7EBB6E90414F93D8DA31B4FFE2AAD248EA4946B8
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x11abd8c2,0x01d70a01</date><accdate>0x11abd8c2,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x11abd8c2,0x01d70a01</date><accdate>0x11abd8c2,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.030072210451255
Encrypted:	false
SSDEEP:	12:TMHdNMNxfntP1nWimI002EtM3MHdNMNxfntP1nWimI00OYGe5EtMb:2d6NxzSZHKd6NxzSZ7YLjb
MD5:	DB6FDC03EDFE62923D40121547308A62
SHA1:	45E68AF86ED5AC7D3F88326AF4036341F366E419
SHA-256:	24946DBD96F2584350CF45E9BF71FC76AB8F93041F7F42B318D230B94D8476AF
SHA-512:	198460A2A56B4C7B9FB846B106EDD21BE649A1C98E7A5E69D1D58B3CE5846D36026FAC5BD858C6C62CE7A909E738E166AD121AD227631D2736E3C5544F13761D
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x11abd8c2,0x01d70a01</date><accdate>0x11abd8c2,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x11abd8c2,0x01d70a01</date><accdate>0x11abd8c2,0x01d70a01</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	19941
Entropy (8bit):	7.887520524794524
Encrypted:	false
SSDEEP:	384:MJZ6S3SFzlQD5mL+o6oZXZNeLQQ+Qa2m3aCk1zFOGBmf8XthE8W9AXlxqf0CI:MJZ6S3SpK5mL+PoY42FOGBm+VWglK0H
MD5:	63A16B354B107EB75DF5A542378C6996
SHA1:	6F185C132289675D52D568E0854E28DC605DF7F2
SHA-256:	7F5176AA938D22BAB727627CFC06696FF0A74B0194994753334DA859EAD1E39B
SHA-512:	904A21098034E07738D1AB712E551F255539AE0DC452A57DB6E5E00989B93307F75B40A87A2DFB5887EBFCA7926DA3D1346ED57036E10E4E1C34F478AE86275F
Malicious:	false
Reputation:	low
Preview:	".h.t.t.p.s.:././.w.w.w...c.t.c...c.a...g.o.v./.f.a.v.i.c.o.n...i.c.o.~.................h.......(....... ...............................Y0..xd=.[0....y.+...Z6..g/..&...e5..h7..............m0..k7..i:..3...n4..0...0.......P3..[7..]5.._4..\1.....a4..b:..)......i0..j2..k2..j3../...0.......m=..4...s3..A...v5..J1........g.j@%.]..b2.....b0..[<..`2..d...e0..1......,........tn...p...y.1...n'..RE#.............q+..q=..Z1..........W2..A...Z9......Y3.....^9..b2..h0..+...i0..d9..i1..e1..e9..,...g3..3...l-..m3..l6..j3..k3..g;..2...k9..b<......m-..o6..Q"......A-..C+..l:...~`.....9....\|l.U&..N2......S7.........]2..D...Z;..Z3....../.../...e/..c7..F$..f2..m-../...o4..;...3........kD.r7..L...P,.....Z1..U5..Y/..^1..].....m.+.......j......j-..-...3...n3......J&..........t&..o6..x0..t4.......kE.M...V;..Q...X;..S....sT.W9..a2..d/..b2..#.....z.$...d5..`;../.......a3..e5..*...b4..n,..`5..j5..k+...f@.n2..h/..m5..p5..1...6....mL...}...........~.X3..\|]A.`3..b/..a8..-...'...j(..a;..j5..p+..o0..k6..3......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20180, version 1.1
Category:	downloaded
Size (bytes):	20180
Entropy (8bit):	7.97320012816743
Encrypted:	false
SSDEEP:	384:S3ECNC9EU5uXBx/d17jzOBmhUXQOTF3IHrYZEFeWXU5ebGLtCjUdtjVOTg:S3EC2rMXBdjzOBRx3IHrYOFeWLotCYL7
MD5:	5CC3AAE674EA3B199313B3B83BD795BC
SHA1:	993DB0EC4347B0CC53128CFDCBB767606D8A3576
SHA-256:	38399EFE707A8FFC12359A0086E7340315B42194A10FD2E1D1288BE12DA9E39C
SHA-512:	2346622E53705ABB58BDC45818D497CB17E9F9869B546CAF298D1E4D4A2D7E15B5A3C3EE8E6779D64C4C4BB0F98A58216A394BCA81F6660AE137FC6326B48955
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j.woff
Preview:	wOFF......N.................................GDEF.......6...F....GPOS...........f.x.{GSUB.......{... J.c.OS/2...8...V...`[.t.cmap..............3cvt ..........."..fpgm...........s.Y.7gasp................glyf......4...f.....head..E....6...6....hhea..F.... ...$....hmtx..F .......P.=).loca..H4..."....s.Tmaxp..JX... ... .3.zname..Jx...A....[.s.post..K.........SF.prep..N....S...V.c..x....@....{..::#0.ZGK..`....R...^qT..qW<^...../....x....a.......f.]C..fe.5fs...m.a<]Cv}...7..NG..7l.#.}&..J........^c.S.....>..yv.<{.C...N...p@...>....$..!......:...BH...p.C.}).O/..M...t...TB....E....t.....s..L.H _..G3.l.....l?..y.`..............=.....Q.6.e....v.n.]T.........}w..iz..czc;.....C....Z6...m.2G\|....b.8....x\|I'T..Lb%.xI'Q.H.p.%..."UbH.$.%..I&SR.&.4.$...RP2($a..4JJ.e$...M9...DSA..(.T.<S.xjI:Mh..vD.^.. !t..)t.'i../..`....&.1.%..L".)L.a.8.....#...@\|...".Y....J..$.....f%k.a.d.N<...r..6.#...}.gf~S.9......A.A..affff~.......Y.TZ..j....E..N...pO.l..Ze)......`.V..[.c.W.10./.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdo[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 19896, version 1.1
Category:	downloaded
Size (bytes):	19896
Entropy (8bit):	7.973207257576149
Encrypted:	false
SSDEEP:	384:vi9GdFUguXBNV01KI0EhV+xnP+gu9ZLpanYwJz1aRRxaFsq+6LVnQVOTa:vi94iVXBYQnmUYwJz87kLhxnQVOTa
MD5:	B03F2EC28F8E60E61974DD8C57610E5B
SHA1:	DFF9B2C95F626F894185C98CFBB976BB98B50F33
SHA-256:	D8DD0DE638293EB62DBA15A6E410FB0AF9A5B36C35DF226237B1B609D573C63E
SHA-512:	A585B769AA7CD7311FB4075DB5EEBE09E65A46CEA773639482DE0EAAD248C0BCDC571BEF16BCC9EE1196596014871FF39541AF66C1A53FA8B026A82C0F00904D
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdo.woff
Preview:	wOFF......M.................................GDEF.......6...F....GPOS...........f.o..GSUB.......{... J.c.OS/2...,...V...`\?v.cmap..............3cvt .............9fpgm...........s.Y.7gasp................glyf......3...e.q.B4head..D....6...6....hhea..D.... ...$....hmtx..E........P.k!Nloca..G(........].(maxp..IH... ... .3.rname..Ih...8....X.p.post..J.........SF.prep..Md...R...V2...x....@....{..::#0.ZGK..`....R...^qT..qW<^...../....x.....]...w.jm{..m....m...m.F1.n....\|.........8....w..Uj.6oWkX......?..0.{...{3....4.K..pP....(.{.%..!./(.x....}C.d.`.....29x.@...+.!.......Q...T..+]g.^p.9....x.agI.W[jg.m.K........-.c.E.D......6..r...!.7>.......X+.ok..+7k.o.yj.%..<.uw.*....v.N...>...L`.....x...&..I.......4B$.p. F..4.$.D.#I.I.HR$.TI$MbI.$2$.,rH%WR...t.P.T>.T>.L>.,>..>.(........\.....I......)B8E%.b....H.4.I...I..u4.!Y4.114..)..=.....t..>z..^.x.#^.........3Pr.$~.3.l.H:......FmS%.R....#.S..cvE...6^[...v....Z..`A..]R.hg.\S../w.([.s.n..y.{.....osc....At.....x.%Q

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\CaGov[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), icomoon family
Category:	downloaded
Size (bytes):	115904
Entropy (8bit):	6.385095588674892
Encrypted:	false
SSDEEP:	3072:dDyvTaLSAqR5UkfZHQyUCrt8mkzdGw/VddMqq54EahxYGsaLMNkeLtzj7U6OgIEY:tyvTaLSXR5UkfZHQpCrtMzdGw/VdWqqm
MD5:	E80D57CEA566BAB8E941986FB295F48E
SHA1:	D45855CC81F3C08038DD892DB5CC6D71665D114D
SHA-256:	7656DADA3AB7D823BC9ABC98D68031CD96A6240998C35E0B2A3152C9E8BE532B
SHA-512:	0A7DEF82A6BAD8B50ECA729B413C8238D54DD6C911D43460E76644D160F28473012FCFD51DB71B0523CF69C240A5FAFC03AC405E5E1468DD562D9D0BC4DF275D
Malicious:	false
Reputation:	low
IE Cache URL:	https://california.azureedge.net/cdt/statetemplate/6.0.1/fonts/CaGov.eot?ocljyw
Preview:	..................................LP................................................i.c.o.m.o.o.n.....R.e.g.u.l.a.r.....V.e.r.s.i.o.n. .1...0.....i.c.o.m.o.o.n................0OS/2.}.........`cmap..E........Tgasp.......p....glyf..\P...x....head...'...h...6hhea...4.......$hmtx..wr........loca.i.(...x....maxp...4...T... name.J.....t....post........... ...........................3...................................@........@...@...........k... .................................8...J.@....... .I.R.U.Y.j.l...%.5.@.R.\.d.j.r.\|.............................a.{.......... .2.K.U.X.j.l...$.5.9.C.\.b.i.r.\|...............................f...................... . ..............................y.x.w.v.u.j.g.b.`.\......................................................................................................79..................79..................79.......:.$...*.....7..2764/...#".......27.g.....................$......................:............'&".......326?.64'&".........................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\KFOlCnqEu92Fr1MmWUlfBBc-[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20356, version 1.1
Category:	downloaded
Size (bytes):	20356
Entropy (8bit):	7.972919215442608
Encrypted:	false
SSDEEP:	384:of+dt1ebKR28EPpAXxR5wthZZv4B8Te/h4+ctr5NH9NwZaUp4VsEgm:of+P1eeRcU8Hqdy+UHHbEw/
MD5:	ADCDE98F1D584DE52060AD7B16373DA3
SHA1:	0A9B76D81989A7A45336EBD7B48ED25803F344B9
SHA-256:	806EA46C426AF8FC24E5CF42A210228739696933D36299EB28AEE64F69FC71F1
SHA-512:	7B1D6CC0D841A9E5EFEC540387BC5F9B47E07A21FDC3DC4CE029BB0E3C74664BBC9F1BCCFD8FB575B595C2CC1FD16925C533E062C4C82EEE0C310FFD2B4C2927
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc-.woff
Preview:	wOFF......O.................................GDEF.......G...d....GPOS.............~..GSUB.......'......r.OS/2.......Q...`u...cmap...\..........W.cvt ...T...H...H+~..fpgm.......3...._...gasp................glyf......;...k....hdmx..H....m....!$..head..H....6...6...\hhea..I,.......$.&..hmtx..IL...y.....XF.loca..K.........`.C.maxp..M.... ... .(..name..M........~..9.post..N........ .m.dprep..N........)v60x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R...A.J.x....dK...{....?..F?.\|.~.m...ms.{.Z..;......U.]7s......\.=D.=.7...>....x...D..O\|.U:...\|o..3.x.j.r"B.............../.)x$.'"j.....1LGmaGxQxG....~.:'.A..hd.z,.k..KO.....^.}H\|#z_.O......R..A...9..A..!.(./..."..:.Iq1.r..s..r.7r.7s..q.wr....nz..]...2..d4c..c....d....T.1...d....\....,c9k.g..Yv.#O."%...... ...t"uM..%.......j.#^.....}\c.q.i...<jy.D...C.01.2.r.....V..z.W.7b..L.S.41]..kUs.X/6..b.........(..(...K..{.^..'........`#./..B......N+p.m`...].lQ....Drg.M..Kx.^.S...........h ..$.k.'Hy.I.ze..4z.-T.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\NGH2BVFL.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	62307
Entropy (8bit):	4.865214069996938
Encrypted:	false
SSDEEP:	1536:8dJTTPMnZttsHKkOUzN2ApHCbXrHb5CDdUrSitCt:2lPYmHKkOUzN2ApHCbXrHb5CDdUrSitO
MD5:	47260A2A269CE21B1BAECACB72661DA8
SHA1:	A441D900BFFB98A3CBD101C5CFBA6D87463DF892
SHA-256:	E93354B199C93AD2FBA46B81E01737768B12B06F322B566F6E0BAF01BBE7FA4B
SHA-512:	7A9DCA5276240274DDAF14AE18C978023CF4F595CFEB21DC07CD253AE63569AC281DD37F4C97ADA66940639B02BF8FD721A8B223DEC2317D2D5D326D27BA1B36
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html> [if lt IE 9]> <html class="no-js lt-ie10 lt-ie9" lang="en"><![endif]--> [if IE 9]> <html class="no-js lt-ie10 ie9" lang="en"><![endif]--> [if gt IE 9]> ><html class="no-js" lang="en"> <![endif]--> <head> <meta http-equiv="X-UA-Compatible" content="IE=10,IE=edge,chrome=1" /> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="HandheldFriendly" content="True"> <meta name="MobileOptimized" content="320"> <title>...California Commission on Teacher Credentialing..</title> <link rel="icon" type="image/x-icon" href="/favicon.ico"> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.5/css/bootstrap.min.css" integrity="sha384-AysaV+vQoT3kOAXZkl02PThvDr8HYKPZhNT5h/CXfBThSRXQ6jW5DO2ekP5ViFdi" crossorigin="anonymous">--> <link href="/Frontend-Assembly/Telerik.Sitefinity.Frontend/assets/css/cagov.core.css?package=CTC" rel="stylesheet" type="text/css" /><link href="/

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\analytics[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	47332
Entropy (8bit):	5.518633523108405
Encrypted:	false
SSDEEP:	768:UyC36rcBLbfsl5XqYoyPndHTkoWY3SoavVVy2WiCgYUD0FEw0stZb:UyDAZfY5hVdHTwY3SoIjw0sD
MD5:	6A10EB2BB5C90414980729F4F96FFBDA
SHA1:	8BBBD5948255549E4B691B614AA3177DEA9AF1B7
SHA-256:	0F3BE44690AE9914AE3E47B7752E1BDEA316F09938E9094F99E0DE19CCD8987A
SHA-512:	5A505CBAAEEAB8961AA0DE94767F76A09B6F03E60EB0C72954B85EC0392EE1CE383D2088939A314D3175AB24B7A69390C841CFE0237C1D1C40966B43F22AE929
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};var q=function(a,b){for(var c in b)b.hasOwnProperty(c)&&(a[c]=b[c])},r=function(a){for(var b in a)if(a.hasOwnProperty(b))return!0;return!1};var t=/^(?:(?:https?\|mailto\|ftp):\|[^:/?#]*(?:[/?#]\|$))/i;var v=window,x=document,y=function(a,b){x.addEventListener?x.addEventListener(a,b,!1):x.attachEvent&&x.attachEvent("on"+a,b)};var z={},A=function(){z.TAGGING=z.TAGGING\|\|[];z.TAGGING[1]=!0};var B=/:[0-9]+$/,C=function(a,b,c){a=a.split("&");for(var d=0;d<a.length;d++){var e=a[d].split("=");if(decodeURIComponent(e[0]).replace(/\+/g," ")===b)return b=e.slice(1).join("="),c?b:decodeURIComponent(b).replace(/\+/g," ")}},F=function(a,b){b&&(b=String(b).toLowerCase());if("p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\app---oath-2-payment[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 900 x 327, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	47647
Entropy (8bit):	7.939598164080135
Encrypted:	false
SSDEEP:	768:aen1xz63G32V9gtPfM+FQ2QIbbA5OXgjtKxjIqsKK7nb64EqozLXRaUS8Z4aIqc:aen1562u+tPftFe5OUtKxjIB7nb6dPzI
MD5:	E6021A6EA93035EA14052CB716C890BB
SHA1:	CCE37E6460D498E2A3CAD4B2A1255844D20D5413
SHA-256:	A97E2EE50E0D25AB88C107D0DB11507C310F3FDE7DD9A1B69240D462DEB1D655
SHA-512:	BC6A0DEA46CBBD7209CEE9A1C7B547EBDE480C3B296F2D55746A902A2DF38111AA65CD36A0639A7ACFA275C5AF4A856BEC6D2DE8D9156BD41CB29F3403132FC3
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---oath-2-payment.png?sfvrsn=c2b551b1_6
Preview:	.PNG........IHDR.......G.............sRGB.........gAMA......a.....pHYs...%...%.IR$.....IDATx^...UE...........Q...0.E..O?......E.....IA.C.....s.....l..p....Z.f..Y.3..}.................F.w......\|.>fd.F..98888888888.s0fZ3. 4..c.1...p.......Nn.:\x......\pA.;888888888888L...N......./}Q.M.............0}.... ...E..c.1..c.gn.........q......i..._.M7.:-...UW]..rg.1a...\.3z..8.?~\|....._.I'.......L..c'....>;t..9..\|..k..1^..S...L.p..._.=.3..c...........=.Px..W...S..L-.~......u.Y.a........-.X6W:.i.6.\|....+b.SN..m.......sOh.i6W...].v..f.../..R6W..hj..o.1\|....\.\r.%a.u...+......o..m.]L..W...N..F..R'g.5..w.uW.7n.8..../....6[x.....q9...w.W..+.......Ye...:4..._.R{..{.p.}.esU.8.z......}....OP.V[m....../..2K.?(..._<...?Y....N...Xw.u....._~.0d.,..c...%......zj6W{.:..e....<.H6W5<L+3h.....Z+..:^{...w.es.8.....\|..UMZ..)..n.-.../..Bh.E6W>...o.g...&...K..?.<.....7.\|3...\|...j..K/..e......(.w.}..I...Y.8[m.Ux..c\|.m...[n.%.t.A1......U..f....~:.C

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\app---payment-continue[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 755 x 243, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	58294
Entropy (8bit):	7.976170297408307
Encrypted:	false
SSDEEP:	1536:lrEyIOYI2LpyaP9h17nj+wYHNUOAyD4az/HnHmouPma0NW5l:lkLvNfv1O9HNmyD4arHmogmrOl
MD5:	B3B15603D0CA0D3CF155B62BC0252B8D
SHA1:	A76F02915519EB151800311DD74C510D4E6282ED
SHA-256:	6D3075F21F23F513CA3397C9F4E60D9D1E2FB8AA172199BE0C5B08EFC5018F54
SHA-512:	B37B323D61844751F729F660C25088565F078AA7DB94523DA24D5FB6AEADB590D33A33A8E73682A9B5B97F717461B6EBD597F89654E0CCDAF03BDDBBB23B21C1
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---payment-continue.png?sfvrsn=d1b451b1_10
Preview:	.PNG........IHDR.....................sRGB.........gAMA......a.....pHYs...%...%.IR$....KIDATx^....E...K......A....\|&..QD.9a.......TD..HFr.9.s.......:.....\=P;=..g..kjz...k.....IM........_\|1......p8.....K/..8..!../.rt.+F._}......p8.....8.x......R..<....m.../.....~............ .....'..?..3r.}......'.Dvqqqqqqqqqq94e...q..-.!..:t.{;.....p8..C.o..v..a.2./.:.....p8...~.eX'.....p8...!.'.....p8...a.'._.Yi.z.<...L.l..K`.J^.F.T....#....9.....Y.i.{..^....\I.......U.25...B.....o.D...d...b....p8..#.N...< ..9.k.<.:/..~.C...sU.?q.........5]%C.l.....Bf...'.B.........8....x.9.....8B.d...#G.d..K%.y..c....A>M!o._...wT..zD;oI....p.\|2.[.XQ.....>:..#.EA........p8....'._....S.L%...1..P$N.!..m2~(...5.x...4rX+..k.?qa...*..&.a.kgh.....Y....!....p8.H8.w...3.8..J...%\|...(.4...7.1v.'..]q..z,.n.......A...#.....h.5h.IX..)...w.4...!.a.b...p8...'._.As..2W.6.^...(;.......;G.b.I..".s=.-....Y.....\|Z..#.Q...IJp.....T.....}.....V...}..S....p8.D8.w.b..U...d;C.%\|RYf^.:l...,%....l%

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\app---process-payment[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 461 x 115, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13959
Entropy (8bit):	7.946501784719948
Encrypted:	false
SSDEEP:	384:ys2p4zGQC/8qvxUTfRY44jgBjJdVjtFvy2Q:Kyw8qZUjhJbtJy/
MD5:	CEDDD61252AE73D8161129AD49442A80
SHA1:	21A23DFEFE462D69EDE24BA4045C9FC563C43ECA
SHA-256:	A980673BC08D7CE5D6D7C9CB2927D7914AD8298FD7F5B98306BC5D1B673541B9
SHA-512:	C00D6285974A3CF4EB36FD8B7E3F4CF01D1BC09A6139A8300E333B334BB272007AA382278BB0A6EFB655DA1773F08C685A8BF4A2A7ED778AC93EB11B90CD8236
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---process-payment.png?sfvrsn=9fb651b1_8
Preview:	.PNG........IHDR.......s.......Y.....sRGB.........gAMA......a.....pHYs...%...%.IR$...6.IDATx^........n......nE.E.ET...vwc7v`b.-..(."!e....s...s..^/_..y.^.zvg{wv>..gf..:vN..t@:..3.D.M..\s..}.t.q.E..)R.HM6.i.&.x..I.......LD..)R.H..$a..F....O>.2....)R.H."5....r...A...~Z#.,`.....l. .. .R:..M.=U.<.3,#.. ..d..XEs.Q."E..)R.N..dAyU.<..,.(..)R.H."5....zjU4.W.M.<.?...)R.H..t."..M.UES_..A..AP.M..D.B4. ...... .. (I.f..A..d..9i.h......7...8......+S......=..<.2.....A...z.6..~.....O.,I.........'.T.........W_Ur.....l.]w]{.7.\|seIm.:..K..\m..."+...[z..w+.).~...........{.G.y.2.80.6.`...........W..._..r....J+...z......v....H..>Z.kJo.......m._~.....r>G?..c.....=.....?X>.l.2...........m$.wk..'...A0>i.h.w..{.7.}..i...J3.<.-..c...O8./...2.....?O..p@e.m..k.6.._....J..,...i..63....[.....f....z..e.Yc.59.Yv.e.B.-deC.LI`.{.Z.....beg\..7.....;.UW]e.g.u.-..0...Z...;.M7.d...._.Y.`~....e.....+l.../..b.0..]w.;..........._m.....u.Q6.gO.v.).H._..M..O<.D8.wk.y.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\app---renew-pick-base-zoom[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 231 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2639
Entropy (8bit):	7.8484361079026845
Encrypted:	false
SSDEEP:	48:fsLsL/+PYIA/Cnn/doFEJWO7KUcMG+Lzq3PqWfm1GKlkvLTzVUvS3WoTs:fsLsL2CCnn/uGwOOZUgKlwLTSIDI
MD5:	DDF132DC259B58188288AD022D3AFEC6
SHA1:	8B66B8363068F4BD5C4256EBC7D73A639EA97AD9
SHA-256:	8F86BCC349FCDB38445EAAF01B5DD604B2FFA88199A103A28BE7A07DFCAEA3BD
SHA-512:	B254EB965A21AE4C7B147EFBDFB8E9DAAF77D0A0A97C33E1EF08E7FDB7C669E0F34B26B29904586E53F6423D34BB437C4E06CA1763BC7CA48812988BFEB772AC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---renew-pick-base-zoom.png?sfvrsn=ddaa51b1_12
Preview:	.PNG........IHDR.......H.............sRGB.........gAMA......a.....pHYs...%...%.IR$.....IDATx^..o...../.h...l.(.t.U.].hPt...5..ma'MP .j8...r,.m.EkY............".z.!R.e...$eJ.m..{...rtdq$...s...3..s?..0..... ..G...C..<"..P.....;...)...........o?..QNm.:.B!.Q....W.i...,r....\]......)..N6.pu...."...8....u........d..W.i...,r....\]......)..N6.pu...."...8....u........d..W.i...,r....\]......)..N6.pu...."...8....u...'....Php....4V.U.9.w..f....X]TY....'.]..NcuQe.Sp..lv..:..E.EN.]p....4V.U.9.w..f....X]TY....N,..I...,r...'..p..)...,r...'..p..)...,r...'..p..)...,r...'.Sp..$V.U.9....)..g...'.......wt..cuu....hkk.....~?......`,....p"e.n..Fw1..EY..%$fkk.!&..avv.---...XZZb..;......@wQ..1$d{{;....m4[..>..===.....x8.2..='.]....J...:{=(...E_..P.Sj....w.\|.(...2....~?%.q,i....&.......i..5$........p..}...'../...p.q..].L.d{.G.!....)F.....c~.$...}9.v.....jj...*FGGq..mc.......d...)............;j.;..:(.v.Bw.....Ci...:....OY....l.K..L.H,K}....R.....Z\.d.....YO...../..x..&

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\apply[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	60153
Entropy (8bit):	4.903641466750486
Encrypted:	false
SSDEEP:	1536:WRRTPMnZttsHKkOUzN2ApHCbXrHb5CDdUrSinZCt:APYmHKkOUzN2ApHCbXrHb5CDdUrSinZO
MD5:	1183A915CCB5FAC6C30B6D6A27B31997
SHA1:	008E34C176A675785C79EC40E6B27569F96297C6
SHA-256:	54726763D5638C2530C6B3133C1BC28B29CF45E7B0620977A4B7366DEC382F56
SHA-512:	8DDB204181DA10D650570D01290AEB33B2E7A0701DE79E58A1FC29B056420EA8C2F68986FD2BAB8854D605EF92C550CEF360AE84E4DB20A30165F718165B387B
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html> [if lt IE 9]> <html class="no-js lt-ie10 lt-ie9" lang="en"><![endif]--> [if IE 9]> <html class="no-js lt-ie10 ie9" lang="en"><![endif]--> [if gt IE 9]> ><html class="no-js" lang="en"> <![endif]--> <head> <meta http-equiv="X-UA-Compatible" content="IE=10,IE=edge,chrome=1" /> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="HandheldFriendly" content="True"> <meta name="MobileOptimized" content="320"> <title>...Apply for a New Document..</title> <link rel="icon" type="image/x-icon" href="/favicon.ico"> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.5/css/bootstrap.min.css" integrity="sha384-AysaV+vQoT3kOAXZkl02PThvDr8HYKPZhNT5h/CXfBThSRXQ6jW5DO2ekP5ViFdi" crossorigin="anonymous">--> <link href="/Frontend-Assembly/Telerik.Sitefinity.Frontend/assets/css/cagov.core.css?package=CTC" rel="stylesheet" type="text/css" /><link href="/Frontend-Assembly/Tele

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ca.gov-portal-logo-bear[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 406 x 143, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35154
Entropy (8bit):	7.984752292616689
Encrypted:	false
SSDEEP:	768:oP+xbSAwsWWIqFL1wi5hipk8sZNuzrncEDpD3kLaRFGHDz:JxAsrIqFL1lip9+knRN8aR0HDz
MD5:	B2EA1DA2DA513A759E5E9BF2AD186A88
SHA1:	728B2F70AB8FEFF8E9149D280A8E96CA8D2F5C95
SHA-256:	283DB3DD7F86EE83B58D74D1653890308CD71DF20481A9AE74DA70D2B407C71F
SHA-512:	3809F6595D5E5AB5696E4712C4D19DAC1FA20CC655D8A31F7B57F5AA5497951945AF40F283911AC3CA880348445C526631BBCF2403CC782EDD3E29B35C275887
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ca.gov/images/ca.gov-portal-logo-bear.png
Preview:	.PNG........IHDR..............V.q....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:7E248295F1D511E8AF70F9F8519E50FA" xmpMM:DocumentID="xmp.did:7E248296F1D511E8AF70F9F8519E50FA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7E248293F1D511E8AF70F9F8519E50FA" stRef:documentID="xmp.did:7E248294F1D511E8AF70F9F8519E50FA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......IDATx...\|\Wy6....>...-.vl..;..$dQ...$&!...............C.R........@i..8.@.$...'..}.m.....;......^9....I..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cagov.core[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	126898
Entropy (8bit):	5.09339470130854
Encrypted:	false
SSDEEP:	768:F0YnUV1qsBjB6wNEoxQKagZ69JCdMjCm1gXBdDf6XwUdfB/IRi6oWgycTdCdD:6k+jB6wNpXdMem2XBZmB/lvw
MD5:	E6AF953CE00AE722AE9C3404C5746FF8
SHA1:	561C904CBCE60871720C667C720C63D94D325FC9
SHA-256:	7E78E09582D5CC557B1CEE6D1460BA36BE951CC20F67FD31CC4272EAA26D0E6C
SHA-512:	37B25DC73E023D0490DDA0A60AFBCB0402D6D1B57638C8C6D3A54529B12111F23B48660B6C7A5AC9B0BBFEF6BD695C39586E4FCB153FE094393144EC9C30A2A8
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/Frontend-Assembly/Telerik.Sitefinity.Frontend/assets/css/cagov.core.css?package=CTC
Preview:	...main-content table {.. width: 100%;.. max-width: 100%;.. margin-bottom: 21px..}...main-content table>thead>tr>th, ...main-content table>tbody>tr>th,...main-content table>tfoot>tr>th, ...main-content table>thead>tr>td,...main-content table>tbody>tr>td,...main-content table>tfoot>tr>td {.. padding: 8px;.. line-height: 1.42857143;.. vertical-align: top;.. border-top: 1px solid #ddd..}...main-content table>tbody>tr:nth-child(odd)>td,.main-content table>tbody>tr:nth-child(odd)>th {.. background-color: #f9f9f9..}.....main-content table>thead>tr>th {.. vertical-align: bottom;.. border-bottom: 2px solid #ddd..}.....main-content table>caption+thead>tr:first-child>th, .main-content table>colgroup+thead>tr:first-child>th,.main-content table>thead:first-child>tr:first-child>th,.table>caption+thead>tr:first-child>td,.table>colgroup+thead>tr:first-child>td,.table>thead:first-child>tr:first-child>td {.. border-top: 0..}.....main-content table>tbody+tbody {.. bor

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cert-clear[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 140 x 140
Category:	downloaded
Size (bytes):	1722
Entropy (8bit):	7.708044722601812
Encrypted:	false
SSDEEP:	24:GoNXBnNiWWIsQs5irh6k+018i71KRg/EQ/25zOPURFDYurdffP6a1OoNYxk6:GMRnWus5MR+018G1KRgcQG7ZfKa1Oob6
MD5:	7BB724103AECDF777B3680D97D5BF06B
SHA1:	0EBCD198A5676DED99CFC6E0B622B39763756BC2
SHA-256:	0A25D1C3ABCA171D1007BED9BC2603CBBBCDA1913ED64F78EB3E921CB7685BB0
SHA-512:	3FA4629D4DF2493515042C05DBD1EE190D4FAC5BFBA9C715F68DBCF9109DB48BC4F60BF4783C3FA5731F6D7C8477EF805FEA375B738DC93ECC2B7EFC12D2A553
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/credentialing-information-library/cert-clear.gif?sfvrsn=2e0f4bb1_0
Preview:	GIF89a..........3Gd...N`y...\l.w.....@To............ix.%;Z................................................!.......,........... $.di.h..l.p,.tm.x..\|....pH,...r.l:..tJ.Z..v..z.". .(.....(8...8:....<.ah..G..gz..k\|.<..#.....i...8...s........4.h..\.......2.k..W.....4..k..V....3.z..T....x.4....L....x.0.w...L.....4..K...h.2...C....o...H. .2v".c! .;#.................Or.$..`.9....xJs...V..(.U...fd.r5../]..,.2.U.dB~.....+W..(..............\...x9)X...%...cfW.T.~j6d.$T_.r@..'.^..B.7..O...v...B.....3..I..\nEmHC.s>..5.)h0.sE...P.9XAi..`..9vA..2yY.,EG#."..U.#....[P....t.....u...RqZI.y./.wN.Ct.l_st.^P..~.:..".e..=Rw"..QY...2....r..f.tf.sz..EpT..`$..p@XM....... .h=....u.D~y,..b...Dn..w. 6.p^......D.8Zx'`..S...@$.\z..X...0.....b.-@.Ft@.(I.)0`.Sy..kdhBk".8....%.1....(\..&@....#.Y..,.....F"..R.q`.......U.h.x...$#..f./..]...Be...%'.z>.......!`^......)"/...C'...!..jB..d...z..f... d.1.......ac........3C.w....x.B.....h.(....K..pg+.../.7.....J.....l...0j....+.{,.........q!.@....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\colorscheme-oceanside[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	25241
Entropy (8bit):	4.842620426576959
Encrypted:	false
SSDEEP:	192:b0/kbgicpic4icricnicf43jdKkuSVepFl97u2ixBjM+kG27pnZe6r0:mkbz4er37oBjM+f2tno
MD5:	DEBA40D4E8BE95A685A736EBFC49822D
SHA1:	D65F6D265DABF6D788F83EB57D58DC06B86D2290
SHA-256:	D57B992702BD962F076EB0FF2DD554E36C97D1DBED90B19BB2624EA2663F56F2
SHA-512:	F900AF203CE4019B564BA6E205D8B32BC8B3D7FCAFA25F66900F0CE3EF173DCCB64AF4309D4C3646E9BF0ACEC9A66EB9FAF2F889F29DBD1B943C9979EB20831B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/Frontend-Assembly/Telerik.Sitefinity.Frontend/assets/css/colorscheme-oceanside.css?package=CTC
Preview:	body{background:#32608a url("../images/template2014/oceanside/body-background.png") repeat-y 50% 0;background:-moz-linear-gradient(left, #32608a 0, #a6c6df 50%, #32608a 100%);background:-webkit-linear-gradient(left, #32608a 0, #a6c6df 50%, #32608a 100%);background:-o-linear-gradient(left, #32608a 0, #a6c6df 50%, #32608a 100%);background:-ms-linear-gradient(left, #32608a 0, #a6c6df 50%, #32608a 100%);background:linear-gradient(to right, #32608a 0, #a6c6df 50%, #32608a 100%)}@media (max-width:767px){body{background:#32608a}}.main-content,.global-header,.global-footer{border-left:7px solid #32608a;border-right:7px solid #32608a}.primary .header-decoration{background:url("../images/template2014/oceanside/ribbon-home.png") no-repeat 66.6667% 0}.primary.two-column .header-decoration{background:url("../images/template2014/oceanside/ribbon-two-col.png") no-repeat 66.6667% 0}.primary.two-column .main-content{background:url("../images/template2014/oceanside/footer-bg.png") no-repeat 66.6667% 100

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\colorscheme-oceanside[2].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	141599
Entropy (8bit):	4.98880412219718
Encrypted:	false
SSDEEP:	3072:x2RjWZVR9J9hx/jfDvbvTpVBd5dx8QW6cgeqZ:wWZVR9J9hx/jfDvbvTpVBd5dx8QW6cgL
MD5:	F80746AB35BD93CC399D68FE76106893
SHA1:	C9DE14E672235694E1630567F47273EF2A96C4AD
SHA-256:	8D02C743845F0370DC92A8115AF72A8B73567E9E424DA5D7913B26AF85D83C75
SHA-512:	318BF162891B9ABACBFA26E3D2F6AB9DC2D152543DEB47B9551EE0407698F379AC290401A3B36C855CD06149E449636A0BA32DA74B564B47FF78BA9BFDD4A53E
Malicious:	false
Reputation:	low
IE Cache URL:	https://california.azureedge.net/cdt/statetemplate/6.0.1/css/colorscheme-oceanside.css
Preview:	/*.. CA State Template v6 - @version v6.0.1 - 1/31/2020 .. STYLES COMPILED FROM SOURCE (SCSS) DO NOT MODIFY /../ -----------------------------------------.. OCEANSIDE..----------------------------------------- /../ -----------------------------------------.. COLOR SCHEME GLOBALS.. /source/scss/colorscheme/global.scss..----------------------------------------- /../ ----- THEME COLORS ----- /...color-highlight, .color-p1 {.. color: #FDB81E !important;..}.....color-highlight-hover:hover, .color-highlight-hover:focus {.. color: #FDB81E !important;..}.....color-primary, .color-p2 {.. color: #046B99 !important;..}.....color-primary-hover:hover, .color-primary-hover:focus {.. color: #046B99 !important;..}.....color-standout, .color-p3 {.. color: #323A45 !important;..}.....color-standout-hover:hover, .color-standout-hover:focus {.. color: #323A45 !important;..}..../ SECONDARY THEME COLORS.*/...color-s1 {.. color: #E1F2F7 !important;..}.....color-s2 {.. color: #9FD

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\complete-recommend[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	67266
Entropy (8bit):	4.997295977821599
Encrypted:	false
SSDEEP:	1536:cRxTPMnZttsHKkOUzN2ApHCbXrHb5CDdUrSibfDRGCt:gPYmHKkOUzN2ApHCbXrHb5CDdUrSiHsO
MD5:	2080F91C408725CDFC42206136058FFB
SHA1:	5DA73F66F0DEE6A50C9FC3FAA80A152D0D9C3417
SHA-256:	3D75A0182A7B7778CDFE5F2CB528153F4277F59ADF297358355CAC6379675AC8
SHA-512:	C2B5D7ED364E057BE996CC94E4645469556D70AB7AD79C6AB69CAA2ED4BDE07B58224C2610AAA4866A8EEA3C8CFFEF1D0F71002F5847B0450F857C7DC71AFE00
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html> [if lt IE 9]> <html class="no-js lt-ie10 lt-ie9" lang="en"><![endif]--> [if IE 9]> <html class="no-js lt-ie10 ie9" lang="en"><![endif]--> [if gt IE 9]> ><html class="no-js" lang="en"> <![endif]--> <head> <meta http-equiv="X-UA-Compatible" content="IE=10,IE=edge,chrome=1" /> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="HandheldFriendly" content="True"> <meta name="MobileOptimized" content="320"> <title>...Complete Your Recommendation..</title> <link rel="icon" type="image/x-icon" href="/favicon.ico"> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.5/css/bootstrap.min.css" integrity="sha384-AysaV+vQoT3kOAXZkl02PThvDr8HYKPZhNT5h/CXfBThSRXQ6jW5DO2ekP5ViFdi" crossorigin="anonymous">--> <link href="/Frontend-Assembly/Telerik.Sitefinity.Frontend/assets/css/cagov.core.css?package=CTC" rel="stylesheet" type="text/css" /><link href="/Frontend-Assembly/

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\covid-19-commission-action-related-to-covid-19[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	66208
Entropy (8bit):	5.109135819545959
Encrypted:	false
SSDEEP:	1536:tR8TPMnZttsHKkOUzN2ApHCbXrHb5CDdUrSiJ+pagCCt:oPYmHKkOUzN2ApHCbXrHb5CDdUrSiJ+R
MD5:	4C36751850195F3C322D6FC9B944D7F6
SHA1:	FC2C5244D9BED315ACDF9FEEE1B3BA70CF40841F
SHA-256:	83DDF7B5BB55D2AFB277E857C7619713D9041182930030CEA559FC9643B68784
SHA-512:	7548E2AE7DC820D6DC0109BD89830AAD1B059835D70C19362784A82882FE50CC9A23B7F16CB98EF312EE7EF847DB323DBCD0E96A0DFC83A83E02D23ACED8BD25
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html> [if lt IE 9]> <html class="no-js lt-ie10 lt-ie9" lang="en"><![endif]--> [if IE 9]> <html class="no-js lt-ie10 ie9" lang="en"><![endif]--> [if gt IE 9]> ><html class="no-js" lang="en"> <![endif]--> <head> <meta http-equiv="X-UA-Compatible" content="IE=10,IE=edge,chrome=1" /> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="HandheldFriendly" content="True"> <meta name="MobileOptimized" content="320"> <title>...COVID-19- Commission Action Related to COVID-19..</title> <link rel="icon" type="image/x-icon" href="/favicon.ico"> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.5/css/bootstrap.min.css" integrity="sha384-AysaV+vQoT3kOAXZkl02PThvDr8HYKPZhNT5h/CXfBThSRXQ6jW5DO2ekP5ViFdi" crossorigin="anonymous">--> <link href="/Frontend-Assembly/Telerik.Sitefinity.Frontend/assets/css/cagov.core.css?package=CTC" rel="stylesheet" type="text/css" /><link href="

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ctclogotwo-(1)[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 278 x 67, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1783
Entropy (8bit):	7.791681251669548
Encrypted:	false
SSDEEP:	48:wX3p0Szgf84CC13ncUQXWF3WBSOAcGOK01dRrDJKPTre:w+n8A3ngWpWTRr1q+
MD5:	5E17243CA126687F2B225FFA0228B548
SHA1:	8BC084E654E9A5DABF3234BFED7C8283E35EA5FD
SHA-256:	6C6E80FD8AAC321E9887E82F7298A3DDF04E13B9B41253C0E72153F37525F726
SHA-512:	2994969C78F2EECE177939A6F93325CCDA38782BFDE9C79B297AF24E6CFCAAF10A5730EB17434B8E191EEA023EB85208733234128609138699E6398B6D482129
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/default-album/ctclogotwo-(1).png?sfvrsn=cd8b72b1_0
Preview:	.PNG........IHDR.......C.....n.....TPLTELiq.C_..0.C_..0.C_..0.C_.C_.C_..0.C_..0.C_..0.C_..0.C_.C_..0.C_..0.C_..0.C_..0.C_..0.......tRNS.........))88II\\q..........D...8IDATx..\.w. ..yN.sNg.;..... ..^......W.I \|..1.....B.h.......P.....9...j.K..T....u......(.3.q.C)qse3O.Cl...I.(.>.&........Fa..S.s..w.M.V.;.D...#1+..u....F.x.o}.u./7w..V../H...{...(.X.....!((.!..ie...9ku..,,..q......^..A.j5z..^.....{'..S.......j.8BX...o9..d.....0.....}9X.....7...D.(......XH`.\)....Y.C..yQ...na3Xt.H.M.....g.y.....!.fM.re..g...K.c...Dz{.....y.!.o...M.H..t....f.8.{.KH..E.& ..:./s.<y9.3i..hX.i_\.`......;#_.X^o.1?{..a}.`y...U..z..Q....X0..0E.].%...w....S.-..d..........Eb.[...(X.........q;......[hm..Y.K...b"...`.4.....w..KGO.V.l(..,bt..j9i..KRIJ...P.~.X.cm*G.SEB.X...<m.>.g....eb.H.c..m.....l..g.....D..DO.E.; .{..o..2.{L..._...-.e.K...Pyw.....T.......}.,p>..D.hH>x...c(......=...N:.N:.N:I...w.A..<\G.o.!).&.....H....?.X...2.H...........,^E....zH....l!.i...El..,zB..i...Y...`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fetch-polyfill[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Pascal source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	8543
Entropy (8bit):	5.238064281324506
Encrypted:	false
SSDEEP:	192:oQHdiEslZc0rsNYNU5mSJHqI03aej6tZoaMLQO/x5/P80+HcW:ocHslLsP5muHqI0Jj6tZcUO/x5+V
MD5:	04E3CC8A9641B3F9F9C9370F4E9B5BDD
SHA1:	9602A891F583094BB04FD407B253ABCAFFB8C8D0
SHA-256:	DE6C4FFA2BD9FD283610E28D0DB2EC48607AAB39D213A51AEF248673A0A7E980
SHA-512:	58942BCC0F39D620A475B65C1AEB4F18872F68F22C89DEC076906A0DB8BC2B7CCA9357710A7824A0FA7404FF73F41013AECA34609CAACD2187414F7BD0D490D6
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/s/player/5a096a9f/fetch-polyfill.vflset/fetch-polyfill.js
Preview:	/*.. Copyright (c) 2014-2016 GitHub, Inc... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. "Software"), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be. included in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE. LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION. OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\login-user-id-password[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 400 x 386, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	36744
Entropy (8bit):	7.96296454385474
Encrypted:	false
SSDEEP:	768:37Q5URcitxz2SKaMYZfJ+QPWRn1anOUrX4UPGRjbVDNie/9ipzUbMrbl:rQ5bitxz2S5MyR+QGnKzGRPVDkUipzyA
MD5:	F4F7EC76D49C439D1787C014B811D90F
SHA1:	576D82F76D02A1CC5764BB4B503A99404FE4F644
SHA-256:	11352DFD6161349285B79D0AFBB407D14EB87AE400899A99A1E372C20DE3AC43
SHA-512:	9690FF7DF3224B89001E684CAE7148F308E7407438D86453BCD35F6D4CF85766D03BB65C2BD6273370263BF25F010D34251B7909A67752759B7EBD194465C16C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/login-help/login-user-id-password.png?sfvrsn=1e5656b1_20
Preview:	.PNG........IHDR...............\....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....U....k,.,......... ..C.$@....$..I..........{..3...&poR...s.{z.O....Nw.U"2s./.../....l.H.7...UjJ..j../.......R.f]...d.{.}.\|'.../.../;\.=.`....%..N..k..8......4.k..6! +V..6;..8...[..\w.u..Y.lY..q..q.O.:u\@..q.]...q..I....q.'-......_..j.....Y.fI.n.d..a.q...yr..U.VI........?^n....]..l.!\|.Q......O.~....'....o.a_h...\|..a..W\!.J.....F...F.H."r.....w.}....G..<..e....?.<l+W.\Xg..8..k......%.\..+.>....!AD.!.Y....e.....3{{.^....{.....Bp.N...I..#..K..^zI6o...c..... ..^.za....g.2\|...8...<[.......W^y%..s.9GF......8p.../l..qc..B....r.L.>={;..~.....;L:w...O.8Q.......'...L....:....>..?.,..x`.NT.......b.?..\x..w& .P^~.i.h..IfG.;...l% .mD.......S.N.n.W....v.m...!...C..F>.._..+_.\|.%A.]..c.=V.[.m../....?.....X.b.....c....>:\.e....#..;.C....I% ......{.:eb.......UW]%G.yd......1...n.!...ZN..8.......U..?^...?._....2eJ.[.R\.......0`@0..../.y...:\|

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\main[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	4053
Entropy (8bit):	5.401733199652954
Encrypted:	false
SSDEEP:	96:RBJabc3cCahrQN0JxlehAJdQceRExLASPjfm6u2M8tmV+:R2bC7apiaxleh0dQJ1SLfm6u2Rm4
MD5:	8399EAE5D919815405DAECDA2A1C379E
SHA1:	AC81F99AC35067FDAE2A27EAE6DDD46DB00ECB95
SHA-256:	D42383B5324502731C01F9F7A3E006A19287ABD6035519E3DA33F9861FEF1C24
SHA-512:	C4187970DF792A8290A5F4EB32BDB2AB033C2984304B531AE7CA326F115C4E158B1F74F22252A223A1DD54489329A6A8817277E2B7B7144B04540B70D1944C75
Malicious:	false
Reputation:	low
IE Cache URL:	https://translate.googleapis.com/translate_static/js/element/main.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var c="Translate",e=this\|\|self;function f(a,m){a=a.split(".");var b=e;a[0]in b\|\|"undefined"==typeof b.execScript\|\|b.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===m?b[d]&&b[d]!==Object.prototype[d]?b=b[d]:b=b[d]={}:b[d]=m}var g=/^[\w+/_-]+[=]{0,2}$/,h=null;function k(a){return(a=a.querySelector&&a.querySelector("script[nonce]"))&&(a=a.nonce\|\|a.getAttribute("nonce"))&&g.test(a)?a:""}function l(a){return a};var n={0:c,1:"Cancel",2:"Close",3:function(a){return"Google has automatically translated this page to: "+a},4:function(a){return"Translated to: "+a},5:"Error: The server could not complete your request. Try again later.",6:"Learn more",7:function(a){return"Powered by "+a},8:c,9:"Translation in progress",10:function(a){return"Translate this page to: "+(a+" using Google Translate?")},11:function(a){return"View this page in: "+a},12:"Show original",13:"The conten

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\program-accred-sch-act[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	145650
Entropy (8bit):	4.87074524406038
Encrypted:	false
SSDEEP:	3072:wPYmHKkOUzN2ApHCbXrHb5CDdUrSiiTCKPYmHKkOUzN2ApHCbXrHb5CDdUrSiiTO:PmHKkOUzN2ApHCbXrHb5CDdUrSicC5mO
MD5:	BB0A96A90E608B230A74B619D061A081
SHA1:	95D240EB1E163FC903D872114B8301F6117ED2E5
SHA-256:	DCA71FDF0E3EC1B718545887DC713D23E2102F8E931B0988A8591EEB44392D6B
SHA-512:	0DB485489F13FE7CC4B72B7B7AA0B4AF9DAFEA3A20BA20B9B8143A0D6F36673848F40C98787B31B26B2AB0B02BDB1DD7D5D1016164DB9DC8BC2ABC175EA8B6FE
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html> [if lt IE 9]> <html class="no-js lt-ie10 lt-ie9" lang="en"><![endif]--> [if IE 9]> <html class="no-js lt-ie10 ie9" lang="en"><![endif]--> [if gt IE 9]> ><html class="no-js" lang="en"> <![endif]--> <head> <meta http-equiv="X-UA-Compatible" content="IE=10,IE=edge,chrome=1" /> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="HandheldFriendly" content="True"> <meta name="MobileOptimized" content="320"> <title>...Accreditation Schedule and Activities..</title> <link rel="icon" type="image/x-icon" href="/favicon.ico"> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.5/css/bootstrap.min.css" integrity="sha384-AysaV+vQoT3kOAXZkl02PThvDr8HYKPZhNT5h/CXfBThSRXQ6jW5DO2ekP5ViFdi" crossorigin="anonymous">--> <link href="/Frontend-Assembly/Telerik.Sitefinity.Frontend/assets/css/cagov.core.css?package=CTC" rel="stylesheet" type="text/css" /><link href="/Frontend-

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\recovery[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, frames 3
Category:	downloaded
Size (bytes):	72836
Entropy (8bit):	7.975258034864337
Encrypted:	false
SSDEEP:	1536:XIpy25Q3Fj1y8KfmAs6qAMmPwmcE6kMuBeV+DkjlG:XWy25Q3Z1y8T/QIkMuQUDkRG
MD5:	50953F36A338DC3E020DDF3BF798A0FA
SHA1:	30BB5122BFAAD8E55E6B92255BF12049E9AE28A8
SHA-256:	F75F56F1209DE4458D1322688D10EF0913C47E46523153A508BAE0E718FA508A
SHA-512:	7F4ACA4BF7065FE626950CB01F6FFF9E1DEED11347EE963A30BC6B33A32A0119208680763703AD74A3B10566594309E2A95B8EEF8DB35962E4038AB3CF884D42
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ca.gov/images/recovery.jpg
Preview:	......Exif..II*.................Ducky.......A...../http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:CC9DCBDD574B11EAA227CCE909CEAD00" xmpMM:DocumentID="xmp.did:CC9DCBDE574B11EAA227CCE909CEAD00"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CC9DCBDB574B11EAA227CCE909CEAD00" stRef:documentID="xmp.did:CC9DCBDC574B11EAA227CCE909CEAD00"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\renew[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	161
Entropy (8bit):	4.606829501135001
Encrypted:	false
SSDEEP:	3:qVZxgROOHPzi1XbZ6TBFo48fF6mAQBeMEGRoJMLgc3jAPbJV66cG:qzxUcX96TsLr5RRoJMjEjJUG
MD5:	8FC2957D10144A63C18EF67F55C5E60E
SHA1:	E371B0EF3012572FC417ADAC200D67FE77F1501F
SHA-256:	3217EEF1A11C3255F72E6E1F4CA7FC7B8F00621BF667E1DA06F6E3DB399663C1
SHA-512:	3DBEE68060EB03C9C4676E27764B6DD24AE81BE405947AA4961C9E745319D7DD8BBB7F9B80A561B11761278BAFE63AA58CB73BA92325C813D84482A48AD1D0B8
Malicious:	false
Reputation:	low
Preview:	<html><head><title>Object moved</title></head><body>..<h2>Object moved to <a href="/credentials/ctc-online-written-instructions">here</a>.</h2>..</body></html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\school-text-sm[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=0], baseline, precision 8, 350x200, frames 3
Category:	downloaded
Size (bytes):	20845
Entropy (8bit):	7.973842608178955
Encrypted:	false
SSDEEP:	384:Yi6n64Q0uPtCouLfOUnLErLHw3YaDh+F1ARds1byFgSrC3i8cpOuV4N/HJ47OxiB:Yi6n6P0Db7OUAPHw3VseRWbybrCgOuVv
MD5:	B2BBEDD3848B310750DBA540C220C42A
SHA1:	1EC95C4BEDF0C278EA0927E0455E74858EAE3BCF
SHA-256:	5D7D51267CCE78B3B4CF5A33E7AB21578019ABAF2DFD593E4C0165D5C73C931A
SHA-512:	EBF543717ADFDAE6986BC21A2693E072FA45ADDC8FFBADF088766153D94573E67D1A91C86A821DAAA2E9534A6D709E78B17869022E031B47328C5E80939AB4F2
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/site-images/school-text-sm.jpg?sfvrsn=fac046b1_6
Preview:	......Exif..II.................Ducky.......<......Adobe.d...................................................................................................................................................^........................................................................................!.1A..Q".aq.....2..BRbr#....cs$...3S%&.C.4d.DT6........................!1A.2.Qq".a....BRr#3.......b$...4.............?...7..r7........-...~....j.......U_.b.sh.......+y..MO.%.Jw.-.D.......iTz.........-%.K...dI./...!.m.0Hm..S..=.m..c...".P...oMr..j\..@.7yf.C.6.K.$h..V>.?H...kDIr.T...[`...m.........o...R....z.:U\|..]...(d\q<.S4.....d...I..............TV^.e..N_.YzB....!'.0.A,l.:..U.G.a.x.UC..?(...2.u....@..,4.....;Q...?.Uo..L>.y..E..y..r.v8..lx..j.....N..8...[..!.....j.GR...;...d..p.h\.$...@Y..yf.b....zx.9.U............[......#.._........s.e..e.:B.DX.?Y.M.:...,....M..s...q..6....x../.....5..l..d.2..g4...P.....H.....dO..+..{_.f.0Q...r9...G.QQ.<H.\..#....*.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\search-laptop-sm[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=0], baseline, precision 8, 350x200, frames 3
Category:	downloaded
Size (bytes):	19941
Entropy (8bit):	7.968236475744483
Encrypted:	false
SSDEEP:	384:G2fKgFZgs2fbTJ/FSFhJ6Do+yUTg3BFSR/9KiyQteA8kl:fCIgzFSFMVyJBRgejkl
MD5:	EDFDD60E56B542DF13375222B00E9A87
SHA1:	9774FE001D5000F0BE481AA029D2A26AB2CF57C1
SHA-256:	F1F396BA26557B931CB43829A3A4526FDB33AF2F6E9E31708068203484A7F331
SHA-512:	F6801CC58527A0885AE9017CE577E19854F8C0550B5886DDC7454AE54892F1C3C0D78FF06BAFD2770CB803B4DF612E40FFD7D6B55D064BB52B4B3FD55C7DADD9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/site-images/search-laptop-sm.jpg?sfvrsn=f4c046b1_6
Preview:	......Exif..II.................Ducky.......<......Adobe.d...................................................................................................................................................^.........................................................................................!1AQa"..q..2B...Rbr#...3$...Cc...SsD..4%..d......................!.1.QAa..q"2.BRr.............?...(".W.W7.".....C..r..P....5P...Z...;9.]0..-..).)....h....'...~..Q^.Z.S.u.6..IY'..=.....x-...zM...4..s..F............U..sWgE.N.....Ty........\|...\|^.....E.\\(..@..&.#.]..<.2....o...G...=.....rZK.?hT.9...k..w...MH:...<Ent..y..D.C.!.<.P..v.n.J..4H.e...iah<.M.\.Q,..`tJ..I..s.<.n2..5..)..+.f....Ked......J.C_.b...]..5...X...<...5..#).7?1..6.%.\|z.X.....a.4.ji..)........n.P.@....T..P*.@....T.....:...C.c..EK.$..Ft......i.Z....O...QO6...m...._4....G........?.A.ma.Pt.i#..OU1.=5.$45..T..D...:..'.4S.Lv..m..^.M.4..MD.L..$.B.M..x...\..$._..D......J..V.p.U.....m+..I.....+...Y.+.\...Zh.P)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\translateelement[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	18724
Entropy (8bit):	5.0229050341109795
Encrypted:	false
SSDEEP:	384:Z6/FpzOTH+pUwFQQFzosq6yzGy60wQHZAOcUcmMt0wGq6K:Z4FxskUwFQdcUcmMp
MD5:	DBC4C9FA52A475411EB75595DA532797
SHA1:	099407F8C66BC19CC7DA10EFB2715EAE0373C966
SHA-256:	6149F95C1EBDDE5391898E22A79821A810336F6BD74318291B4F49F23FBF0FA8
SHA-512:	81EBE7593D3856D282F9C581BA3DE18B1F3F0E42D3B912235BB36ED80CDB7FCE08CB91A0FB537CC5BB751F7FA161635B380C78FD0905E4A5B0395A30A64C9E86
Malicious:	false
Reputation:	low
IE Cache URL:	https://translate.googleapis.com/translate_static/css/translateelement.css
Preview:	/* Copyright 2020 Google Inc. All Rights Reserved. /..goog-te-banner-frame{left:0px;top:0px;height:39px;width:100%;z-index:10000001;position:fixed;border:none;border-bottom:1px solid #6b90da;margin:0;-moz-box-shadow:0 0 8px 1px #999999;-webkit-box-shadow:0 0 8px 1px #999999;box-shadow:0 0 8px 1px #999999;_position:absolute}.goog-te-menu-frame{z-index:10000002;position:fixed;border:none;-moz-box-shadow:0 3px 8px 2px #999999;-webkit-box-shadow:0 3px 8px 2px #999999;box-shadow:0 3px 8px 2px #999999;_position:absolute}.goog-te-ftab-frame{z-index:10000000;border:none;margin:0}.goog-te-gadget{font-family:arial;font-size:11px;color:#666;white-space:nowrap}.goog-te-gadget img{vertical-align:middle;border:none}.goog-te-gadget-simple{background-color:#fff;border-left:1px solid #d5d5d5;border-top:1px solid #9b9b9b;border-bottom:1px solid #e8e8e8;border-right:1px solid #d5d5d5;font-size:10pt;display:inline-block;padding-top:1px;padding-bottom:2px;cursor:pointer;zoom:1;display:inline}.goog-te-gad

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\widgets[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	97317
Entropy (8bit):	5.182916419611687
Encrypted:	false
SSDEEP:	1536:NbUBPzpeTTHd2NqDrSUnGkBDkcDpO+JjoT7tcru8ryM25S9S/:JszST9ucKOvMwUGS/
MD5:	11A0C75A945561958F0B924DA0E67334
SHA1:	377C49DDBF2FED4859CBF0E31DD9A66146D947E3
SHA-256:	C34F5C51CEA0EE9E05108C79C404086A24B73FBECB0999654FC9116B4C4B755E
SHA-512:	47962518AB6D66F6D0705B498BCA8127DF59F85077A3D4C6B3B27CEBA0BA4BEF7DE8D52EAD9D670D6B5658F967AA5273B91F986A22CC64C212619069504B5752
Malicious:	false
Reputation:	low
IE Cache URL:	https://platform.twitter.com/widgets.js?_=1614097762362
Preview:	Function&&Function.prototype&&Function.prototype.bind&&(/(MSIE ([6789]\|10\|11))\|Trident/.test(navigator.userAgent)\|\|(window.__twttr&&window.__twttr.widgets&&window.__twttr.widgets.loaded&&window.twttr.widgets.load&&window.twttr.widgets.load(),window.__twttr&&window.__twttr.widgets&&window.__twttr.widgets.init\|\|function(t){function e(e){for(var n,i,o=e[0],s=e[1],a=0,c=[];a<o.length;a++)i=o[a],r[i]&&c.push(r[i][0]),r[i]=0;for(n in s)Object.prototype.hasOwnProperty.call(s,n)&&(t[n]=s[n]);for(u&&u(e);c.length;)c.shift()()}var n={},r={1:0};function i(e){if(n[e])return n[e].exports;var r=n[e]={i:e,l:!1,exports:{}};return t[e].call(r.exports,r,r.exports,i),r.l=!0,r.exports}i.e=function(t){var e=[],n=r[t];if(0!==n)if(n)e.push(n[2]);else{var o=new Promise(function(e,i){n=r[t]=[e,i]});e.push(n[2]=o);var s,a=document.getElementsByTagName("head")[0],u=document.createElement("script");u.charset="utf-8",u.timeout=120,i.nc&&u.setAttribute("nonce",i.nc),u.src=function(t){return i.p+"js/"+({0:"moment~ti

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\www-embed-player[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	160706
Entropy (8bit):	5.579713923527595
Encrypted:	false
SSDEEP:	1536:Oyx1wapSOb2yXa/2KPDewjwF5EluQ7nw9ZmXDURkYcRSgM12q0DjXipnYVSL7SSy:Z0aoDMfxTKUWM1xlQI93lNU235H9rJl4
MD5:	D1CA6ED4C4651D49D5B67F754D78D844
SHA1:	D21F72A1F52F6F0B77F33BBF3DD9EF1A2DEEF354
SHA-256:	A2DE1FFE42871DBD7AB4ADC416DD748B02273BD68E43255631D8E4FAD6330045
SHA-512:	5A186203397BD1B9600B65E13F8DCC703B222664669F72CDF09BF8A511B68100EAD0F0E286B93FEDA7594563B3FB50A520588BA3651A728A2F44ABD2E5199F34
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/s/player/5a096a9f/www-embed-player.vflset/www-embed-player.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var m;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var ea=ca(this);function t(a,b){if(b)a:{for(var c=ea,d=a.split("."),e=0;e<d.length-1;e++){var f=d[e];if(!(f in c))break a;c=c[f]}d=d[d.length-1];e=c[d];f=b(e);f!=e&&null!=f&&ba(c,d,{configurable:!0,writable:!0,value:f})}}.t("Symbol",function(a){function b(e){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c("jscomp_symbol_"+(e\|\|"")+"_"+d++,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\KFOmCnqEu92Fr1Mu4mxM[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20268, version 1.1
Category:	downloaded
Size (bytes):	20268
Entropy (8bit):	7.970212610239314
Encrypted:	false
SSDEEP:	384:LyfRPUY1e32pJd75q1DzPjsnouCrZsZtetWFNFfIP0cIWvdzNcrm:uJPb1em3dSPjKrZYtWntk0wvdzh
MD5:	60FA3C0614B8FB2F394FA29944C21540
SHA1:	42C8AE79841C592A26633F10EE9A26C75BCF9273
SHA-256:	C1DC87F99C7FF228806117D58F085C6C573057FA237228081802B7D8D3CF7684
SHA-512:	C921362A52F3187224849EB566E297E48842D121E88C33449A5C6C1193FD4842BBD3EF181D770ADE9707011EB6F4078947B8165FAD51C72C17F43B592439FFF4
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxM.woff
Preview:	wOFF......O,.......P........................GDEF.......G...d....GPOS................GSUB.......'......r.OS/2.......P...`t...cmap...$..........W.cvt .......T...T+...fpgm...p...5....w.`.gasp................glyf......;Q..lD..&0hdmx..H....n..... ..head..Hx...6...6.j.zhhea..H........$....hmtx..H....t......Xdloca..KD........BC%.maxp..M0... ... .(..name..MP.......t.U9.post..N ....... .m.dprep..N4.......I.f..x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R...A.J.x.l..h.a........l.m.6.1+.X....i...y....&...._..63..5....2>...x\|D...ct.Kx..H@b.3..l..#u.....L......^..4.....rP..{.......Q...JT.:Xu>..T./>...oq...........~..@.....lq../.... ..#..".&.8.H$..r...J)..jj...&..f.=.9..N9.....'F..8.4.....m...m...m.m..n..&.X..}....S.\|.....n........PHaE...J...4..MjJ.*..nW)..rn3'/.....ks5zY5c...Mgg.5..p..rR{c...p..t\.8.c=..p...X.(.......7....=.........!...H ........(.0...(.q.JT?.b..z].'T...m..vNi.....t....:P.R..H....t.........&?.:.j.51+.S.":j.SK'I.^....}S.i.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\KFOmCnqEu92Fr1Mu4mxM[2].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 19824, version 1.1
Category:	downloaded
Size (bytes):	19824
Entropy (8bit):	7.970306766642997
Encrypted:	false
SSDEEP:	384:ozNCb8EbW9Wg166uwroOp/taiap3K6MC4fsPPuzt+7NCXzS65XZELt:K4zbWcDVwt230hfs+x+Bb65X2
MD5:	BAFB105BAEB22D965C70FE52BA6B49D9
SHA1:	934014CC9BBE5883542BE756B3146C05844B254F
SHA-256:	1570F866BF6EAE82041E407280894A86AD2B8B275E01908AE156914DC693A4ED
SHA-512:	85A91773B0283E3B2400C773527542228478CC1B9E8AD8EA62435D705E98702A40BEDF26CB5B0900DD8FECC79F802B8C1839184E787D9416886DBC73DFF22A64
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxM.woff
Preview:	wOFF......Mp.......P........................GDEF.......G...d....GPOS...............hGSUB............7b..OS/2.......R...`tq#.cmap...........L....cvt .......T...T+...fpgm.......5....w.`.gasp...@............glyf...L..:+..j.....hdmx..Fx...g........head..F....6...6.j.zhhea..G........$....hmtx..G8...]......Vlloca..I.........?.#.maxp..Kt... ... ....name..K........t.U9.post..Ld....... .m.dprep..Lx.......I.f..x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R.....2.x.....[....#N..m.m.m.mfm....SP..NuM..9]..=.U..!...[........w...\|......^p....H......;...)..........;..EoDo....E.E.D...`.0.GG.aA.H.V.Mx\xA....../..d3.Eb_.J...R.^v........\^ob.}.z..k.x).v$f$..O)+.2..*....y}6`C6b.6cs...l...........!.........<..\|.\|..\|..\|..\|.\|....o....I%.4.L.SI.&C.6..!`...{...c..\.J.(.2.C....V.A..?.M<nG......v..m.;..R.C..aj.H...=..{.>.:.....}i_Y......:....o.&k..KY.2..6k....i]..{,.p}../.....VO3.o].fJ....R-TZ..;...RN..&V...C...3.?.......&..z.s&.D....r,.I...t.R..a$k..Mm..Y.U...+b.%kQ..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\ScriptResource[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	97403
Entropy (8bit):	5.37366826054711
Encrypted:	false
SSDEEP:	1536:IYE1JVoiB9JqZdXXe2pD3PgoIK6alrUdTJbFk/zkZ4HWLZoHsrOa99TwkEb7/Hph:z4KZ+u3WLZICOaLTwkE7qD1Pa7a98Hrn
MD5:	1D244CB043BE8157F0050CE9E45C9EF2
SHA1:	F16BD01623FD56D1372EA2EB55CD52A28CD883F8
SHA-256:	2359D383BF2D4AB65EBF7923BDF74CE40E4093F6E58251B395A64034B3C39772
SHA-512:	B5E18A4432083726AF300F0759DDA2B7DE79EB21D6E912EE6B2D71937B3F77CEE7494FC618582DE0337098086B6547692AD813402748494BC0D2C66AACBA5CCE
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/ScriptResource.axd?d=N_lTjHyHq3vfBLjuEvPuKPC8N78ddG3-zhp9TvM41VQ9KmMmDL4L767k0OqIHbKKdNLYGaV5jFIIF2-77BWkep1xCrgrGbO-k5_vIduc4gUH55-eLAipdV5-jhNUODvBQk8VQWvh_Q1sfEw_BrUA4MjqA97WTKop_FOIKR8k6J-6CfodCBpYtUh0qyUauoSccrjbwFP9owG0K2UC6FEzOQ2&t=ffffffffa8d168ac
Preview:	/! jQuery v1.12.1 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="1.12.1",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.ca

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\ScriptResource[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	8270
Entropy (8bit):	5.006208841630281
Encrypted:	false
SSDEEP:	192:zDdwADmtum6rPl2K/kNEZf+NEVZfau6xnhjOLh5xP5tQPqXIz:zDdwAAurrd4EZfJ9au62Lh5xPEqXIz
MD5:	4FB244EB938FA6AFA087385107EE5133
SHA1:	F754E124FF0B72332DCB26A0A6AC46C76D1DDD6E
SHA-256:	CDA66AAAC66C47585D9917FCF9E6C0F28322715CAF35B94E0F8224AB629182C4
SHA-512:	61E609DF6806A2CD53BC69B0E325D9C83E45B5B1E9E22BBA6493834249453B531853DB3C95F76C895901D3736A7EC3D3871D427C99AC0DFD5C15F88643C89CF6
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/ScriptResource.axd?d=2yZJ3Lt6i5QO_9mk6rJmb-QsLpvH6aX3NjMOdNYiHD4zX_3QuEuU5dGvf6HwXFPvlHlNNeWkOpDbRUEGjIo3DK_vceLQKBhuWBLBBClFR5PSOUZLP5qhlsxFtSsdbyurMrTnrb7xBnSTY30CNK6KmAPIQ_8_Zr1xme8vcqc7_b35eKhZdhnyAwE-U_XsaOgHbc1AgfttUiY8qPyCJ-vSCw2&t=ffffffffa8d168ac
Preview:	/! jQuery Migrate v1.2.1 \| (c) 2005, 2013 jQuery Foundation, Inc. and other contributors \| jquery.org/license /.jQuery.migrateMute === void 0 && (jQuery.migrateMute = !0), function (e, t, n) { function r(n) { var r = t.console; i[n] \|\| (i[n] = !0, e.migrateWarnings.push(n), r && r.warn && !e.migrateMute && (r.warn("JQMIGRATE: " + n), e.migrateTrace && r.trace && r.trace())) } function a(t, a, i, o) { if (Object.defineProperty) try { return Object.defineProperty(t, a, { configurable: !0, enumerable: !0, get: function () { return r(o), i }, set: function (e) { r(o), i = e } }), n } catch (s) { } e._definePropertyBroken = !0, t[a] = i } var i = {}; e.migrateWarnings = [], !e.migrateMute && t.console && t.console.log && t.console.log("JQMIGRATE: Logging is active"), e.migrateTrace === n && (e.migrateTrace = !0), e.migrateReset = function () { i = {}, e.migrateWarnings.length = 0 }, "BackCompat" === document.compatMode && r("jQuery is not compatible with Quirks Mode"); var o = e("<input/>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\app---complete-yes[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 246 x 117, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3744
Entropy (8bit):	7.860491609231964
Encrypted:	false
SSDEEP:	96:gkF//BGr28OHWbSY8ifS5yI3H9Sxs1SRgTYaxy4Vc:gkcJFbSli8yrq1Sgxy4Vc
MD5:	25CC3933E42E73AAB19DBAC4A68C8822
SHA1:	6AD5A35DC4E5B239F6765D6FB62A2C9D3A24A493
SHA-256:	50A20EA98486CE60A89A89903EC4A2E8ECC39204676C6F5AB6C522D9326FD875
SHA-512:	CC0E4FB3E8006048279D6B5596B1F49FE560B747D2542742358D01CFF24D8793E003400436E05EF2A8E0CC15CB084CA131CCC77090DD91CB9EB229BB65D1F17F
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---complete-yes.png?sfvrsn=5bb451b1_10
Preview:	.PNG........IHDR.......u.....}6......sRGB.........gAMA......a.....pHYs...%...%.IR$....5IDATx^._l.....h^..J}...K.&..TET.P.VnGmS.F...Q+..))-!).". .h....d...R.....Jqj!.<.qml.....u.,....;{g........./Rv.....3..xgp.....b.P@V.. .../.....H..;......M.....f.-....70#.. H...9......J..^..+>.@..5...........W.Y..@.y...,.. ..F.Ur.b..C^..9[J.9.]..@..X.ct_%g!6.......J.V.W....6V...W.Y......?.F..............u..nb.+y...li.......x.]....p...\...X.ct_%gK-.............>L+.l.......:+.M...X.ct_%gK+..W^.........Cl.c+....L...PL..Y.6V...W......{..c...\o.;..b;.[....T\|PlT.!....b...]........@l....b. .bA......[. vy.....X...@...V,.]^ v.b+.....;h..=c v.b+V.b.>p....r........0u..#~.)^.....&.[jO...vn...i..-.....+U..{.....L......]!-._..B3....J.Bl......'..c..,..\.];..K...q..tF.......C@..D.Ur.b.._.[.L..;.tr..q..\|....&......@..D.Ur.b..OL{......i..&..4...?....c.....z.....f.i.\O..]. ..i....7Y[..U........6..I}/wE..=Qm.zm3..<L.A.ha.*..t.<Q.-}..?.=..d..A$....z'fi...z..L\..O.@...V.T....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\app---payment-authorize-and-complete[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 959 x 454, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	33469
Entropy (8bit):	7.8328810640122954
Encrypted:	false
SSDEEP:	768:5ZNLa4aXNr1qdd1Ssq07idddfddgwX1Oalj5DxUgQrQhxE/DQteb4Z:5ZNLJpjPY1OQ5qP/stH
MD5:	5DD0200EB8BB6DD61B039C5401F9ECCF
SHA1:	747CC503921FB32267C02048AA8E823378E137AD
SHA-256:	AD991EBDF46AC0FB44BED1E91F1FA474DE0C86329B445C75D2CB455DAE34C0DB
SHA-512:	1645FD4B2800B21268D547C7097099767D379C8ACEE8BB37E29080A615D9C62FF7DD9437F0BD304D5A631E05CA3E7806BB78590363A1C512C262FF1A873A520A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---payment-authorize-and-complete.png?sfvrsn=4aaf51b1_16
Preview:	.PNG........IHDR..............R<.....sRGB.........gAMA......a.....pHYs...%...%.IR$....RIDATx^....$u...3.<....}..{g....;...^f...O.j...v..(].Xz.M........h.#...BP........Z...^.a)6e.JQ.........e....<Uq.\|>.....<.o..B...&.q...''\|(../K.N.......b........iO...~..g..Wn.9.x..o.a..W........_........~.^..m......../.D.!..Bh.%........{"..B.!..B.Zk..g.}v..k...w.E.!..B.!......B.!..Bh..E.!..B.!4.4.y.J#..B.!..B.E..b~.B.!..B......."..B.!...Jy...E.!..B.!4........^Q..O....X..^...\|.X.............E.ly!.b?[..E.....k,.q....@..l...F..2...-.5....U-..z..#....."V.\.X.o .V.L..e..X..."V..M_.q;._..B.!..Bh>.{\./B.!..B......._..B.!..BC).q1..!..B.!..R..b~.B.!..B......."..B.!...Jy...E.!..B.!4......B.!..Bh(.=...!..B.!..P.{\./B.!..B............d.~..V.w.}....U.....Z.X...B.A..B,i.. b.^&..........ebU/.x.1.....E.!..B.!4....+.[..r]..k,..o1.)...2...-.5....U-..z..#V.2...-/.X...-.X. .A..<_cy.[z.3B.!..B.!4_.=...!..B.!..P.{\./B.!..B......._..B.!..BC).q1..!..B.!..R..b~.B.!..B......."

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\app---payment-billing-info[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 754 x 497, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	112574
Entropy (8bit):	7.984153447420617
Encrypted:	false
SSDEEP:	3072:va0ZYS5dfb9u58C473SWUX9slyH5ugSO8NuacTZS:vFYS5dhu5n47sX9eFF5AZTZS
MD5:	3D68861A89CD05EAA92BBC5DEEC771F1
SHA1:	24BA1031FE2BB78370AA3EB12A74526222A7E0FC
SHA-256:	192E52FDE178567491CE8F9B2483007C71B331C22C2DBB5EB1EA6989E4154A74
SHA-512:	0280675B85D59F784FBA9490FD9CB68D22DC4226E0A3544641DFAA546443F3D6EE2D60A5E64227E4E23D99C798C2057E32BDE172220A3ADE6078BC279468C6FA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---payment-billing-info.png?sfvrsn=81b451b1_8
Preview:	.PNG........IHDR...............X.....sRGB.........gAMA......a.....pHYs...%...%.IR$.....IDATx^.]..UU...>..V..N.R...QR@..A:$.$.TR.....k`.M....{...1 .3.^.x..{..........v..R.T.J.R..]t..N.:._.~J.R.T.J.2..y........`........T.J.R.Tc(....Y~.HB~.A.d.B.P(...B..0d....;w......y..maT..)o..#<..!a.p..vX."..}).J.2nS..........].H..fJ.0<4.a.aQ.{..3._..0.G....(.(.J.Ry?..W.f..W.k...@xX..e#..5...L..m..(...f;.y.4..C..T.J.B^...B^.m...@h.";$(4...'.FA..J.R.TFE.........a....f......?d.m.z..J...B^...B^..2.1....7...N...w.!9........h..]i..g.(fT..u...#0..E....\(.J..R.."6C..._gDH0.Dh.{(...z.n..9.C...&.-.=.5......>$<B...!@.-D\;..;......g1n...P.Xx..U6ln8B....s.o....o.p.z.R.T........)..\q...~...7.."......2=...N:....../...B\|p......=.V..E..2.1.i...;%.<.....q6rn..s.\|....pd.....S.R.T..U.+b3T.+..R..Z.;..C.E.;.'..wy.%.&.p..Z.#.[...a7.t\|'V.o..er`Y.TXW.+.}........y.F#....7..cG8....pm.p......U.+.J..P.."6C....tn..m.........r...B....0......Z...Bn..K.....\|..%r`c...V2...O..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\app---payment-site-cant-be-reached[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 641 x 252, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	23191
Entropy (8bit):	7.8343604347660625
Encrypted:	false
SSDEEP:	384:iTRR573r8ixhervV0hBxUXYTVYpMIDfdnw0t2OblUOi0ZI/niMSj1oLsXeqiCE:i1Rdgmero6Xa2pMINgc0/nDSfzdE
MD5:	72B7A6356234F112A513F5CB3C7CB745
SHA1:	5ADA118FFDAA68E90FD168F4F363B64D9188D188
SHA-256:	4B80B9D4141F0FE3A26BD4D1AA90413C081E6B7D59C919CE948D180DF9009EB8
SHA-512:	1C75F8FB5633A029E0A125AD7AE63138E020C1ADCAC063E0B88E32BBF290CA61339FBE5055D893F1F437B713C2B3A2CE580AA3678DA736ED43861C1395564E46
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---payment-site-cant-be-reached.png?sfvrsn=84ac51b1_8
Preview:	.PNG........IHDR..............p~.....sRGB.........gAMA......a.....pHYs...%...%.IR$...Z,IDATx^..w.Yv.......v.e.v..n..~..].v....Y...<.... @...I.. .....H.@$...1H.BR.x..'.D....B n.=k}29qw.8.......x................. .....................i!..u#.......B...F...............O..(.4............M..@..............I........(.4.'....#.....P8h.O..'.4G......p.4...O.h......@.i<.(.4.........A.x2P<i.9..........d.x.@s........M..@..............I........(.4.'....#.....P8h.O..'.4G......p.4...O.h......@.i<.(.4.........A.x2P<i.9J.?..?\|0.........M..@..(..X{_h............I..Q.4..........<4.'.....4..HK.'...........d.x.@s....fi.........T.4...O.h..0P.,..46..........I..Q..J...'_{......:....I..Q..J...'_{......:....I..Q..J...'_{......:....I..Q.......k......SG.x2P<i.9JC.16P6.\|......~.h.O..'.4GiH#...F..=.....O.M..@..(.i.X.6...........4...O.h..F..k./.?.....O.M..@..(.i.X.6...........4...O.h..0Xbl........i<.(.4...a...`]......cE.x2P<i.9J.`.............d.x.@s....c.u].......M..@..(..%

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\app---receipt[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 948 x 487, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	50946
Entropy (8bit):	7.939751486998194
Encrypted:	false
SSDEEP:	1536:CnLbR8A+xPylxrG4Cy7c4LucmBTxDMVPLD:Q3RlGyzreW12T1Ml
MD5:	EFDFB0272C1FE16E80DA335351F6A566
SHA1:	003EF9881CDF94521CD5B6DCD0BF2E92A41F29B6
SHA-256:	24E4411AE98AA223DB38220C76195EDA15552CBFA92838BA6CBF9ED19B7B596C
SHA-512:	2FD83898E1073EFF1CE2C0E7C51C6F2B0B4CD28CE8A8B57609056DA795CA64F16B1872A57AAD48E6ACD552219F2A88D26F6119F6FC7DA1E88039E11D03A193CE
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---receipt.png?sfvrsn=feb451b1_4
Preview:	.PNG........IHDR..............B......sRGB.........gAMA......a.....pHYs...%...%.IR$....IDATx^..x.U...{.s.sO..{..sO7........8...S..b..Q.....L...L.....J.A.... ....d. . ....U.j..].........KvU..V.......7a..BQ.EQ.EQ.EQq..-EQ.EQ.EQ..K..R.EQ.EQ.EQ..6........(..(..(....-.......R.EQ.EQ.EQTG.....(..(..(........B.!..B..(..U.ZBv.K.6{Z.`..[.,......?.).!d.c.c...R.F.n.M.6..[s....X..M....([.l.m..)H..'.....U.ZB.#o=.M....tW.T...e.\q.Fy....q.F...$.p.f...Gl...&....w..G.]....yA...=u....%l..7k..wp.y...1zV.5..g...+.:vv:....q#7....G..W_}..n..-.....c...d...m2....9..@H...4..l.&..M...TS.N.x...{......<9f...}...i...\|.......5k..Ov.....m..3....l.I.p.w.....y...z.a~:+.9>#...5.n..mla.F......W.,...\|..7...a&........A..../X....z.}".9'...".#..Wih.iGp....5.Nx...O..?.K..5r....{? =~.O...t.U.....\|..y.A..qb%.Y.j...8.w.......yG...(.~..N5.v.....Z.=...Ov..Rc.eR.k..r..9r..............b....;....X..~D....Ew............=Sn..F....d...n..../.....c..._w..3...\|m>.....Cf...L......v{_{.5..`.K

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\app---recommend-return-zoom[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1768 x 240, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	41367
Entropy (8bit):	7.8517731103885895
Encrypted:	false
SSDEEP:	768:y8eZMbF5+ITJ3okqcEftIJ2+Xbw6ccJ0kzSu49F+YfX6Q:y8P7+IlQcKO865Nwt6Q
MD5:	F8456AB8BE6116403DB23EA3434494E9
SHA1:	51DE85B0E721B12EB77E5524B5F8C809CBEB3A92
SHA-256:	69362EB3C98F59F0FBE5AC1483C0389FACC488E5BE368240380A613EB0D652ED
SHA-512:	C9DA68430BB87F9A540ABD2175B5D01014CFF8370554C85BB77DADB914E35B1C84E5C6ADAADAF1B6B591F60CB1B1D5396AF733F9297643888D1A033493BBF5D0
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---recommend-return-zoom.png?sfvrsn=38b451b1_12
Preview:	.PNG........IHDR....................sRGB.........gAMA......a.....pHYs...%...%.IR$....,IDATx^.k..v....&&.L$._&..Qb,m..Z..X5...".".ZT.....JE....X.X...J+..X...v.6....L..%Q.~......x.:....7..7.so...s_s.9.cn....3~.g..7!..B.!..B.!..B.!....O~.M.t!..B.!..B.!..B.!....to....B.!..B.!..B.!...D.t!..B.!..B.!..B.!. ...B.!..B.!..B.!.........~2..B.!..B.!..B.!.p!.....B.!..B.!..B.!..B.2..A.t!..B.!..B.!..B.!\... ...B.!..B.!..B.!.....p.......!..B.!..B.!..B...(.....B.!..B.!..B.!.pe.....B.!..B.!..B.!..B.2..A.t!..B.!..B.!..B.!\... ...B.!..B.!.....g~./..c....."..._.\|...h[.B..6Q.....!..B.!..B.!<5...........?.."...}.w......my.!..Cq8H....B.!..B.!...9.]p..:.}....2!..n... ...B.!..B.!...G..o..o..W....k...o..oie...[.r.s..~.w..7....?[..B....p.....w....{..]y.!..B.!..Bx.....7....y..w..._.[.....3....?..........\..Bpn.........?.}o.....x.u......ur....o....C........o..w..^'.B...Q........e_..3>.+....C.!.......\|.d.I...B.!.....R...N....5.t.'.. ..l.............=...`.m...{...........uB.!.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\app---renewal-section[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 882 x 625, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	127661
Entropy (8bit):	7.972139779888177
Encrypted:	false
SSDEEP:	3072:1JC9R1LMTgEqjxixaFapKAwVgAVPm8dlGZwTg0Rd:XC9RjRjxi0FalwVgA/zGZwTgYd
MD5:	2921091ABE01CA7B63FA1BEE63786E67
SHA1:	B10C3A419BCF613849432275467E2F776ADBA7AF
SHA-256:	665E7F653125827092D8A54C6379721BAAD8F7C1E823A51F1915C382306518D4
SHA-512:	B10DA7BF481F85DBDE7C62A090A8A79AA587F83309111547A77941EA87FF46751DD8FE5D87FFA33746E406F184191678FB4AFB2126B24C08520DF87759542942
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---renewal-section.png?sfvrsn=7fb551b1_14
Preview:	.PNG........IHDR...r...q......4......sRGB.........gAMA......a.....pHYs...%...%.IR$.....IDATx^.]...7.e......P......... ...n.].Kq.-.........v..y..o..8..d2.L&..gn.M2c.&..x.,_..$I.$I.$I.L....$I..$I.$I.$I....r$I.$I.$I....r$I.$I.$I...n!7o.!..n$I.$I.$I.$.!..A..A..A.......+U.Wy...b...o...,.~z......f.z_).. .. .. .m.X..T..<......,E..Ra....Rr.{..wo.#...JK..A..A..q.".B.O.d....d.....64b....n.;.JK..A..A..q.".B.479.0/1..LY\.z...>.....A..A..A...b,.0'M.3z.....rw...t...WZ. .. .. .k..r.A..A..A....'.R.../...+....I_.k.W.s_.R...A..A..q.!~...q...U.../-.NT..?I.U."..e.>&.B..3A^.V-fb.B. .. .. ....#..(.....q.4.3^:.....L........do.v._( ....U..$}...../2}0)... .. .....oB..U4]... .x<.<....g.Y.Y$....n..i.c.....+..p/.g2T..........I"...e).N".."..)....-.(... .. ......B.I.'..pf..?.t......X".N/cg....Z...k.j."."..<i..Z.Q...~.....X..WW.w.Z&..&..A..A..A....]....J..Q.1..X...uI..=..o.t.vi...D<.A=q.=d.....o.7.I...x....#.. .. ..:B..9.G.,...?5..l.....;....K......yp..C-..J....2b.H..ZR...A..A..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\apply[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	60153
Entropy (8bit):	4.903641466750486
Encrypted:	false
SSDEEP:	1536:WRRTPMnZttsHKkOUzN2ApHCbXrHb5CDdUrSinZCt:APYmHKkOUzN2ApHCbXrHb5CDdUrSinZO
MD5:	1183A915CCB5FAC6C30B6D6A27B31997
SHA1:	008E34C176A675785C79EC40E6B27569F96297C6
SHA-256:	54726763D5638C2530C6B3133C1BC28B29CF45E7B0620977A4B7366DEC382F56
SHA-512:	8DDB204181DA10D650570D01290AEB33B2E7A0701DE79E58A1FC29B056420EA8C2F68986FD2BAB8854D605EF92C550CEF360AE84E4DB20A30165F718165B387B
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html> [if lt IE 9]> <html class="no-js lt-ie10 lt-ie9" lang="en"><![endif]--> [if IE 9]> <html class="no-js lt-ie10 ie9" lang="en"><![endif]--> [if gt IE 9]> ><html class="no-js" lang="en"> <![endif]--> <head> <meta http-equiv="X-UA-Compatible" content="IE=10,IE=edge,chrome=1" /> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="HandheldFriendly" content="True"> <meta name="MobileOptimized" content="320"> <title>...Apply for a New Document..</title> <link rel="icon" type="image/x-icon" href="/favicon.ico"> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.5/css/bootstrap.min.css" integrity="sha384-AysaV+vQoT3kOAXZkl02PThvDr8HYKPZhNT5h/CXfBThSRXQ6jW5DO2ekP5ViFdi" crossorigin="anonymous">--> <link href="/Frontend-Assembly/Telerik.Sitefinity.Frontend/assets/css/cagov.core.css?package=CTC" rel="stylesheet" type="text/css" /><link href="/Frontend-Assembly/Tele

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\base-credential-error[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 408 x 122, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5678
Entropy (8bit):	7.825503690362749
Encrypted:	false
SSDEEP:	96:+Pmf78xWvJVQZyr/l2THSR/sarC1udLkSzMPOLdwc6/AnHKJZzfsGX7r:+PW71JgyT8uBPdL3MEd96/MKJdv
MD5:	11F9D0B75F53A3F36EB6DEDC1596C280
SHA1:	DF6A86ADC17E5678764085AB468C9C04FD3AFA06
SHA-256:	F45A3F50E4C71D30C3ED4C25564016836EEB806C924649A0C21EA41B3477C393
SHA-512:	8E3925F0DA5804736FEEB841526F8B387C2892FF5B8BE6754504E3B0B8219BED5CAF47BAEAD6973ED758A7556A72103E056BD2A2DFA457A8C708FF0B4AA7CEC4
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/base-credential-error.png?sfvrsn=52e750b1_4
Preview:	.PNG........IHDR.......z.......Eh....sRGB.........gAMA......a.....pHYs...%...%.IR$.....IDATx^..mW]...u.....5.Cy....cD..<....7..R..O.`C...`k#...#...T.!...@)-.}Y{....6...1~s..o.9.Zg..'.9g.q.......^.\1.....@`..........,@`....B!0W.\ACCCCCkj5 0hhhhhK....4444..[.......9.:.......U' 0...T.........V......P.......Zu.....@E.N@`....h.....z....K.....:.3..=[.[R.:[.3.o~.........J......o{.c...>>.._...U'T...).'...6.L.a].......d{...5.........V.-..Y.......N...^.K~F..<7$.f..,....XZ'.........Tx.!.....].n)......)...;..:[..o.. `...j~..sC.......O...f.).f.B.jf..=..{.-k...?.r8.R..3....7ne.%f.O..O..+0.U\|X'..._.....n....^..sksJ..\| ..."..U.&..-.P.kV.+.U-...K.9......@k.C._..<.............A..no..vv..H.s.q........:...c}...a......'..,...?...#.'..v.=6 0i!.q}.b.2.>...:-.)!..>W.{.n.~.x[.......}t.2...7.6v.8......Gk#^'.....\|...0.?<.\....N...Z.....Cm.9b.'.J.....fas.'W'.a.....u...q../.j).Q=..=:.y{..2>.....@...1.....+@6A...^p..M.SBm.k..o"........9u../....]".\.*.Bm....:.../....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\bg-open-data[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=1, copyright=Jezperklauzen], baseline, precision 8, 2000x862, frames 3
Category:	downloaded
Size (bytes):	40533
Entropy (8bit):	6.105849102310249
Encrypted:	false
SSDEEP:	768:ivezlWFbqoSgIcVfFoKMrOtVkxDGC5JZKAP4Jkwfcrf1tFz:ivezlWtIcVRntVkxDG+nykrrf1vz
MD5:	D96447CB0796B152B2ACE0B0B71D4C9B
SHA1:	DBF84949A023D37A2D631F2BE950497AB386E014
SHA-256:	C441C6CE0992CE198D3727AAEAA5DC2A8EA13DB9F37698E17FA654176A552A48
SHA-512:	2E7DE19FCC97EA0EB78ACBF8BD616F04CB4F38EFDABD16C472DF61F6469163171CA74D0BFB45B7C7CA9CC8D4187D2236A3ADB1616BE714F4517A8353DC7F78DC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ca.gov/images/bg-open-data.jpg
Preview:	.....2Exif..II*.......................Jezperklauzen.......Ducky.......L......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmpMM:OriginalDocumentID="0A52A8913378C28EEFDF33CB55820053" xmpMM:DocumentID="xmp.did:B8C2285B53E011E8808BC5A78498AA02" xmpMM:InstanceID="xmp.iid:B8C2285A53E011E8808BC5A78498AA02" xmp:CreatorTool="Adobe Photoshop CS5 Windows" photoshop:AuthorsPosition="Contributor"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3ab29a98-9e28-2d4b-9ffb-d7225024de84" stRef:documentID="adobe:docid:photoshop

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\cagov.core[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	93380
Entropy (8bit):	5.211519917967857
Encrypted:	false
SSDEEP:	1536:OsQcEhCgfzAuMFpyXcXTpNyhSZcaEzKxWCp0pXxqF:u0jqKxWCL
MD5:	50582751FD203D7634DCC72DE861F011
SHA1:	F06412FE5EEFDFA9D111E3596BB05A5C8331A57B
SHA-256:	39E8FD67E255BFC6BC93624112D223487C3E0A011B403E3767F7D4D844AC7A1D
SHA-512:	39440A79358BF28FD2FFB7A3500ACF374A39DDE0CFB02FA85E5C9475F0E0E8BE5AB43E1AFD7C41D881C00323B44C25B144DF9DF1F77FAD5B6A570287C4C086A1
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/Frontend-Assembly/Telerik.Sitefinity.Frontend/assets/js/cagov.core.js?package=CTC
Preview:	/* CalTech - v0.0.1 - Oct-13-2016 /../ JS COMPILED FROM SOURCE DO NOT MODIFY */..function addGAToDownloadLinks(){if(document.getElementsByTagName)for(var a=document.getElementsByTagName("a"),b=0;b<a.length;b++)try{if("mailto:"==a[b].protocol)startListening(a[b],"mousedown",trackMailto);else if("tel:"==a[b].protocol)startListening(a[b],"mousedown",trackTelto);else if(a[b].hostname==location.host){var c=a[b].pathname+a[b].search,d=c.match(/\.(?:doc\|docx\|eps\|jpg\|png\|svg\|xls\|xlsx\|ppt\|pptx\|pdf\|zip\|txt\|vsd\|vxd\|js\|css\|rar\|exe\|wma\|mov\|avi\|wmv\|mp3)($\|\&\|\?)/);d&&startListening(a[b],"mousedown",trackExternalLinks)}else a[b].href.match(/^javascript:/)\|\|startListening(a[b],"mousedown",trackExternalLinks)}catch(e){continue}}function startListening(a,b,c){a.addEventListener?a.addEventListener(b,c,!1):a.attachEvent&&a.attachEvent("on"+b,c)}function trackMailto(a){var b=a.srcElement?a.srcElement.href:this.href,c="/mailto/"+b.substring(7);_gaq.push(["_trackPageview",c]),_gaq.push(["b._trackPageview",

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\cannabis[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=0], baseline, precision 8, 1250x600, frames 3
Category:	downloaded
Size (bytes):	65490
Entropy (8bit):	7.933834279392651
Encrypted:	false
SSDEEP:	1536:HKLqJCA7pox7gTLCXikEvxIPxuyj0IDZjyUdQs8eJahsZ5sz/Bs:q+sANoVgH2UmLDByUdQZeJmsyzy
MD5:	86D12F29E8C844E94F1CD12C0ED956A8
SHA1:	49F9A69F9607DBEFB3DF5C069485E3B0D6D40A03
SHA-256:	5BE96EFA7AA1DCAED430D819F39FFCD7EA1D6AF7299F7376BF2B0405D1162BD3
SHA-512:	88C99A90EE976ABF210DEB59B3155DBB5969014F34828FAAF3BBDC64CE16A0709AF0634B8AE11489C9D398E5875088975640097B28E39439020B6D4FC4EAF90A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ca.gov/images/cannabis.jpg
Preview:	......Exif..II*.................Ducky.......A......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:722e630d-3e8b-2948-9573-7e538b0d2501" xmpMM:DocumentID="xmp.did:6417174D574111EA9EC6A044028A4084" xmpMM:InstanceID="xmp.iid:6417174C574111EA9EC6A044028A4084" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:722e630d-3e8b-2948-9573-7e538b0d2501" stRef:documentID="xmp.did:722e630d-3e8b-2948-9573-7e538b0d2501"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\cert-apply[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 140 x 140
Category:	downloaded
Size (bytes):	1815
Entropy (8bit):	7.775518722049005
Encrypted:	false
SSDEEP:	48:rViDZaaveGPen0pRVFHWDArEtzpGmpPeYgI2:e0ueF+RVoDDvPeT1
MD5:	8628C26242EE7D6A63178788D6DB360E
SHA1:	C76555D5B3038187BFECC5D8A728F51C5BF9B3D4
SHA-256:	5F17B079ABFB11B7AD2BCD26D5C316BCD0E347A498F0AA88BAC9976A7485E2E5
SHA-512:	4EC0BCD634869602FFC9F23928190AEF61FC541B12D21C195A5BE5A8605209AC733C5CF5A91A86CBF4E995C83216C2FE444BFEEFB7A332DCADDBA9B134B9FCFA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/credentialing-information-library/cert-apply.gif?sfvrsn=800f4bb1_0
Preview:	GIF89a..........\l....N`y3Gd...w.....@To..........ix....%;Z................................................!.......,........... $.di.h..l.p,.tm.x..\|....+....#.h:....I.....s.4L..0i......8....z.3...9}.s...\|.3...........z..&...i..#Lo....Yo....o.D$..o....g..%.f...mg.).g......+.g..t..f.+.o...b..g.).w...T.ew.........&........"v..x......;....v..T+./.C.yJ. ...."...c..#D\|..n....~<...b...........J..F.......G..v...)."...O.@..]..g#hL..,.R.J.&2...Ui..^...Q.!..M...Q2..$..y.#.>.~.>.;.m....C 8..b+)>q@..h.k5^.8s.... ..9.b...@.W.h..H.`.%@..$P.nd"A=.O&.xm&6..O......V...'~.x.;.QDm.7C.U..%;:..]..9..Nx...6. ;......~Dz..Y....gF.OA.F..l.U.Z.....0...f.a... ...0.?.E.........0..'...)..;0..B`4B......L.:..W.vXwV\|o.)`..=.....$.!....wML...A.&..4(....t.%.`2..ud......!.f.Y..O.`...&...g...\q.P..h.....x.uJ..h.a>.K..M.H...y...4..........F*^....... @e...{.z..q..A..S.Z.+.u....B............j.....J..uo4.......M...,... .....k.s.Z...nQ...4/.......qpG..\..d...".?.......Q.C.c.F.41.2..'

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\cert-explore[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 140 x 140
Category:	downloaded
Size (bytes):	1274
Entropy (8bit):	7.641934069604529
Encrypted:	false
SSDEEP:	24:xNXBGND0trl6Bhm0OCgjd6o8nxMOj+9UFC3JYwc1jaMWe:XRGNY5eUfCS8nxO9UbnGw
MD5:	9B104E19B1F85580C290932C0A2FD3E8
SHA1:	9F9273DEA6A55667AC165FFF369EA7EA37CAB4EB
SHA-256:	EFEC605E0D60EA04C3F25EED2D3D41693C019B163BC641D3ECDD894C0A792E9B
SHA-512:	DDF79DAA074A7C0A3767FC42FDCA300A8D8FED46D5E92B8FA0EA8DCC9C86F3524001900F60492ED7ACFFD213B6BE4B5B65A91901C2559966990B772C61C66D93
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/credentialing-information-library/cert-explore.gif?sfvrsn=3d0f4bb1_0
Preview:	GIF89a..........N`yw..\l.3Gd.............@Toix..........%;Z................................................!.......,........... $.di.h..l.p,.tm.x..\|....pH,...r.l:..tJ.Z..v..z...P(..........\|.....5......t..izG\|....q....B........=.~......7.......3.........p.....+........%.......#......o.........y...........0......7.....=...O..S...l0O..O...I@.(0..Z...CO......Z...t.....I2Z..@.zL..TdR..c.q6.Y..B+...ub@..Z.Xb6E&#.T...e. #.W.~....(e....sl...zb.y.J.E`...S0.PEg..U.2.C._...Dq..a....T.d0...]BW...>7.KX._@}.t..ULK@...V.9.f$....R9.U&^.......R.!..u._[....W.".\r+"....\.=aTX.x'...~0~.&.t.+z..}}C;...)=...,...K.7.x>.....r..Fm.\..k..'.6.<.....X.O@..~q=.@]b.x..........."... .:.# .&..O..Z...&E~s..F.INQdt^...r9.T..H.H..u!%.5J1.2.I.V.U09.sXP...U\|I..S.X!.j.A@.&....]U...Q08..Vd.f..=...vN9..sr..PP:G.X....G<.].TD...F4...Yl.H.\|...>bp..cB.d.).!.8.`.z4eJ.....zj....H..:(X..........iE+].`.'..6C..0...K.....~B...h+......v.."T.........e p....m.q.<l2..Z.... ...I....`...,s...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\credentials[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	60900
Entropy (8bit):	4.925676465820805
Encrypted:	false
SSDEEP:	1536:IRgTPMnZttsHKkOUzN2ApHCbXrHb5CDdUrSi3Ct:nPYmHKkOUzN2ApHCbXrHb5CDdUrSi3Ct
MD5:	58C4920998BFCB7CA6004192977133FA
SHA1:	73C88B905F67671F67FFA719BDACF18CA1DB37DA
SHA-256:	38B9EA9DAEB5CB521B0D7B00B9C3CA5859990D6EA9EDB68508A1B1DA7B240907
SHA-512:	AA3B44B2068FCA1D95C82A0138CE6B7367C8A3DB46A150E5959A6C11379674963EF264496D244B14C73D07AA784CABAA3DCCB7F2E32927080562C5EA7A336471
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html> [if lt IE 9]> <html class="no-js lt-ie10 lt-ie9" lang="en"><![endif]--> [if IE 9]> <html class="no-js lt-ie10 ie9" lang="en"><![endif]--> [if gt IE 9]> ><html class="no-js" lang="en"> <![endif]--> <head> <meta http-equiv="X-UA-Compatible" content="IE=10,IE=edge,chrome=1" /> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="HandheldFriendly" content="True"> <meta name="MobileOptimized" content="320"> <title>...Credentialing Information..</title> <link rel="icon" type="image/x-icon" href="/favicon.ico"> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.5/css/bootstrap.min.css" integrity="sha384-AysaV+vQoT3kOAXZkl02PThvDr8HYKPZhNT5h/CXfBThSRXQ6jW5DO2ekP5ViFdi" crossorigin="anonymous">--> <link href="/Frontend-Assembly/Telerik.Sitefinity.Frontend/assets/css/cagov.core.css?package=CTC" rel="stylesheet" type="text/css" /><link href="/Frontend-Assembly/Tel

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\cse_element__en[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	281073
Entropy (8bit):	5.578320456838752
Encrypted:	false
SSDEEP:	6144:omYfWE24rn2X2H2F24rn2RtZQpdTxihyyU1SDg3u5+IJ5nV15:RYfWE24rn2X2H824rn2REpddi/Z5
MD5:	1D8BE6C3C6C224E45EF8123F5B48EA00
SHA1:	69958335AD093479E51BD665AED13AD1E9A2E785
SHA-256:	CA752586777D1F855A56EDAAF5A718B562A36A8D6B5B990F6CC7E590009BC3E9
SHA-512:	5444475A5626A28ECCADFBB639A7E7378018B02E7F05AF41BDDF5508DC7A90BD537F84B6C13AADEE8DCAD51CE0E3B8FBF1B24D3ADE1815342D4D5516914C0982
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/cse/static/element/323d4b81541ddb5b/cse_element__en.js?usqp=CAI%3D
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var f,ca=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},da="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ea=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},fa=ea(this),ja=function(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&da(c,a,{configurable:!0,writable:!0,value:b})}};.ja("Symbol",function(a){if(a)return a;var b=function(e,g){this.vq=e;da(this,"description",{configurable:!0,writable:!0,value:g})};b.prototype.toString=functi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\css[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	814
Entropy (8bit):	5.2869207505352405
Encrypted:	false
SSDEEP:	12:jFJ1JO6ZRoT6pcqFJ1JO6Z0/T6pRVhqFuNO6ZRoT6pvnnqFuNO6ZN76plBY:5JvOYsWJvOYUT6V0cOYs3cOYN7J
MD5:	AC73C4DD4438EB424C1B9A7B61A44814
SHA1:	D215794AE281A300E188901231A57B9ECBCAACC0
SHA-256:	D68B6C81C30D0AF9C37C0E8287BACA83252B299C8AC8473454077FAA06F25C41
SHA-512:	2095AAC60B7DBBE8AA0964FEA806FCEFFFE04520663CB648FE8A1B779DFE28013EC6A803F6FB003C5B7B3BA324E6F339434DAEB739F9806275A8235DA0405E4E
Malicious:	false
Reputation:	low
Preview:	@font-face {. font-family: 'Asap Condensed';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/asapcondensed/v7/pxidypY1o9NHyXh3WvSbGSggdOeMaEo.woff) format('woff');.}.@font-face {. font-family: 'Asap Condensed';. font-style: normal;. font-weight: 600;. src: url(https://fonts.gstatic.com/s/asapcondensed/v7/pxieypY1o9NHyXh3WvSbGSggdO9TTFlDim0.woff) format('woff');.}.@font-face {. font-family: 'Source Sans Pro';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j.woff) format('woff');.}.@font-face {. font-family: 'Source Sans Pro';. font-style: normal;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdo.woff) format('woff');.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\dialog_cagov-final[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2848
Entropy (8bit):	4.990288727547491
Encrypted:	false
SSDEEP:	48:ohElai7Edon+L0rmy3Whisexb4efGySJk7kEzklnkLbVkkaThlGPXgDtBfRDJyed:KEl/7EdN4rm6Whis5e+7Xv6eBfpceFEw
MD5:	61BBE6885578720E054A3FCDDBBB3134
SHA1:	698D8BC9B81F6D2D133360BE6D42E041819A34E9
SHA-256:	160AF2C78307471976805D18F55F71AEF7E6CA77094B5559ECC8C48D997C4247
SHA-512:	E0054912226FF630FBC986048307F80696988E7F5BDEC2FAA6E98F51EF6F650861B0B3ACF2BEEDFBF404B32441E3201C023B90C37D1E2E4306890A1223C08F95
Malicious:	false
Reputation:	low
IE Cache URL:	https://california.azureedge.net/cdt/CAgovPortal/offline/dialog_cagov-final.css
Preview:	.hidden {. display: none;.}..[role="alertdialog"],.[role="dialog"] {. box-sizing: border-box;. padding: 15px;. border: 1px solid #000;. background-color: #fff;. min-height: 100vh;.}..@media screen and (min-width: 640px) {. [role="alertdialog"],. [role="dialog"] {. position: absolute;. top: 2rem;. left: 50vw; /* move to the middle of the screen (assumes relative parent is the body/viewport) /. transform: translateX(-50%); / move backwards 50% of this element's width /. min-width: calc(640px - (15px 2)); /* == breakpoint - left+right margin */. min-height: auto;. box-shadow: 0 19px 38px rgba(0, 0, 0, 0.12), 0 15px 12px rgba(0, 0, 0, 0.22);. }.}...dialog_label {. text-align: center;.}...dialog_form {. margin: 15px;.}...dialog_form .label_text {. box-sizing: border-box;. padding-right: 0.5em;. display: inline-block;. font-size: 16px;. font-weight: bold;. width: 30%;. text-align: center;.}...dialog_form .label_info {. box-sizing: border-box;.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\element_main[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	249009
Entropy (8bit):	5.477400514029805
Encrypted:	false
SSDEEP:	3072:uXpL1f/XaqZ4pmoNGUkaUeH/ktyU2cfRwv+9g5LydY4SeJ/5Hn:u5n/KUef8yU2cfSvCQydBJ/5H
MD5:	92DFFCE3439552F9ACEC893F2868D717
SHA1:	5C9896BAC2ECE31D9AC9EB06F987868305BBC294
SHA-256:	86207A548361E9FCDC830F7CCA9540C7C93FF4132DDE2A72FB38D23151BD46A4
SHA-512:	ED64C2CEC4BB25119747F97370E9ACF905647820F64C80F590C52694975BAD507D1085D4460E53EE26514AA32B24B8CC187A13BD9897BC23034A34D69150ABA6
Malicious:	false
Reputation:	low
IE Cache URL:	https://translate.googleapis.com/element/TE_20201130_00/e/js/element/element_main.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var aa='" style="background-image:url(',ba="-disabled",ca="-document.getElementById('",da="/translate_a/t",ea="/translate_suggestion?client=",fa='</button></div></div></td></tr><tr id="',ha='</span></td><td class="goog-te-banner-margin"></td><td nowrap><div class="goog-te-button"><div><button id="',ia='<head><meta http-equiv="Content-Type" content="text/html; charset=UTF8"><link rel="stylesheet" type="text/css" href="',ja="Component already rendered",g="DIV",ka="Edge",la="Google Website Translator",.ma="IFRAME",na="INPUT",oa="INTERNAL_SERVER_ERROR",pa="Opera",qa="POST",ra="SPAN",sa="TEXTAREA",ta="Unable to set parent component",ua="[goog.net.IframeIo] Unable to send, already active.",va="about:invalid#zClosurez",wa="about:invalid#zSoyz",xa="absolute",ya="action",za="activedescendant",Aa="activity-form-container",Ba="alt-edited",Ca="array",Da="auto",Ea="backgroundImage",Fa="backgroundPosition

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\gov-seal[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 90 x 91, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	10365
Entropy (8bit):	7.963066270640578
Encrypted:	false
SSDEEP:	192:S7F9VOw4qxk9UbbORGqXDS9+5wUXgYRIvOWHWEM5:S7H4qxiM+557+vOvEM5
MD5:	DE78C40B3ABFB46CEA2F26492159B6F3
SHA1:	8C76FE531E9953426BE7328442C74A3D66275339
SHA-256:	BA1BC28ADE8AFC40CB8E768542850287AECF72A05B20A0452600308DD56B4595
SHA-512:	353DE7002BD702F5B55C5271B96C4F0C0369B053365072D3C0FECA728DB1C13E42389C5D9C67BE38BE0F7AE8469CE19F70D848D8AFDCA32E73C12B0FB0595830
Malicious:	false
Reputation:	low
IE Cache URL:	https://california.azureedge.net/cdt/statetemplate/global/images/gov-seal.png
Preview:	.PNG........IHDR...Z...[.............tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:AFE5FC71EE9611E9B54CA6569FADCC90" xmpMM:DocumentID="xmp.did:AFE5FC72EE9611E9B54CA6569FADCC90"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AFE5FC6FEE9611E9B54CA6569FADCC90" stRef:documentID="xmp.did:AFE5FC70EE9611E9B54CA6569FADCC90"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.....$.IDATx..].\|UE..ny=....@@iR.. .PQP)...........v...6.tD.(...$.BMH....n.....K..5 .;....}..{.7g...33.i.._9.E

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\herobg[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=0], progressive, precision 8, 1966x339, frames 3
Category:	downloaded
Size (bytes):	24116
Entropy (8bit):	7.749696817257776
Encrypted:	false
SSDEEP:	384:5H8rAgvCcgudY/c6unUpig5vJFjY5IFUecqC4OL2rc:5crAgacjdYE6uBgBDM0vC4q2o
MD5:	700F957771CD01F49017DD5979DB897E
SHA1:	73D18B6269749080764F1315676CD2008ADC9C0A
SHA-256:	C8580717E9ADD06E223BB8D72589114E7200AD028EF30F63E935C4C76512A186
SHA-512:	1A9CB2147736D54C7347BB61F0502DC0A73924CA3E6068C1869166AB31C5F521BB0AE6E398135A0BD28AA9BDB0BCCC4512E22F95292F52A5C72BD63D07AD3F23
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/ResourcePackages/CTC/assets/images/herobg.jpg
Preview:	......Exif..II*.................Ducky.......8.....+http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:DE301E23919411E6B932E8F01A20A937" xmpMM:DocumentID="xmp.did:DE301E24919411E6B932E8F01A20A937"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DE301E21919411E6B932E8F01A20A937" stRef:documentID="xmp.did:DE301E22919411E6B932E8F01A20A937"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...!Adobe.d............../...<H..^2...........................................................""""""""""................""""""""""""""""""""

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\immigrants[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=0], baseline, precision 8, 1250x600, frames 3
Category:	downloaded
Size (bytes):	52437
Entropy (8bit):	7.682291965159939
Encrypted:	false
SSDEEP:	1536:hqpKZUO0aEMG7MsLYjsCnQy4azH/Upo73fjM:hiK+wG7MsLYjJQVazH/UY34
MD5:	F64A61770EF24C6CD28D6F5784C5873B
SHA1:	AE259A4C4CD162826B74BD0ECE572E9403261CA1
SHA-256:	8F4B0279E1DBC7EDD36629DBA75FDF08E0D24FF5F776BA54734EB8D73B651CF9
SHA-512:	F350E24AAA8D1DA1EF90EDE35DEFFACDD360DEF18933F37C3FDF4725B9E552EDEF3C065AD06FE34401BC9260F651E002FB1C022245066EDCD646FF5E0A6232DD
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ca.gov/images/immigrants.jpg
Preview:	......Exif..II*.................Ducky.......A......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:722e630d-3e8b-2948-9573-7e538b0d2501" xmpMM:DocumentID="xmp.did:87096D2B574111EABDC88F6E8A50D08B" xmpMM:InstanceID="xmp.iid:87096D2A574111EABDC88F6E8A50D08B" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:722e630d-3e8b-2948-9573-7e538b0d2501" stRef:documentID="xmp.did:722e630d-3e8b-2948-9573-7e538b0d2501"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery-3.4.1.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	88145
Entropy (8bit):	5.291106244832159
Encrypted:	false
SSDEEP:	1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe
MD5:	220AFD743D9E9643852E31A135A9F3AE
SHA1:	88523924351BAC0B5D560FE0C5781E2556E7693D
SHA-256:	0925E8AD7BD971391A8B1E98BE8E87A6971919EB5B60C196485941C3C1DF089A
SHA-512:	6E722FCE1E8553BE592B1A741972C7F5B7B0CDAFCE230E9D2D587D20283482881C96660682E4095A5F14DF45A96EC193A9B222030C53B1B7BBE8312B2EAE440D
Malicious:	false
Reputation:	low
IE Cache URL:	https://code.jquery.com/jquery-3.4.1.min.js
Preview:	/! jQuery v3.4.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],E=C.document,r=Object.getPrototypeOf,s=t.slice,g=t.concat,u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery-migrate-3.1.0.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	8990
Entropy (8bit):	5.183972790029302
Encrypted:	false
SSDEEP:	96:5r3UrDAWhTAETMu3QXveMIIa8JdFFh7MyAgxr3KFBF/s++EHzDFvsiMAg:5rkrDNhTeeMIIa8J/Eg96DBs+hl8
MD5:	FB30815EC2C19CCADB318BA4E225F1FB
SHA1:	84B5946817F8C166BFA2D6F881E3462297CDF02F
SHA-256:	C9C25E5DB965F66EDD1CA79A3DB5C19191FC06E3FDF5298F9BFF2AE4EF926C17
SHA-512:	00DD08E4FDD0D608D987871CC1E1368BEB536DD7CF495401A88759E4A547FA3EF225E47DD3B80A70B19921C138E839651DC21D5C22A7C7F49B16DDE700893332
Malicious:	false
Reputation:	low
IE Cache URL:	https://code.jquery.com/jquery-migrate-3.1.0.min.js
Preview:	/! jQuery Migrate v3.1.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /."undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"function"==typeof define&&define.amd?define(["jquery"],function(e){return t(e,window)}):"object"==typeof module&&module.exports?module.exports=t(require("jquery"),window):t(jQuery,window)}(function(s,n){"use strict";function e(e){return 0<=function(e,t){for(var r=/^(\d+)\.(\d+)\.(\d+)/,n=r.exec(e)\|\|[],o=r.exec(t)\|\|[],i=1;i<=3;i++){if(+n[i]>+o[i])return 1;if(+n[i]<+o[i])return-1}return 0}(s.fn.jquery,e)}s.migrateVersion="3.1.0",n.console&&n.console.log&&(s&&e("3.0.0")\|\|n.console.log("JQMIGRATE: jQuery 3.0.0+ REQUIRED"),s.migrateWarnings&&n.console.log("JQMIGRATE: Migrate plugin loaded multiple times"),n.console.log("JQMIGRATE: Migrate is installed"+(s.migrateMute?"":" with logging active")+", version "+s.migrateVersion));var r={};function u(e){var t=n.console;r[e]\|\|(r[e]=!0,s.migrateWarnings.push(e),t&&t.warn&&!s.mi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\l9Z4R4oM2tU44QRmk9iDyTxeZNIPreXiQsUQR_P65Us[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	20940
Entropy (8bit):	5.589810981531543
Encrypted:	false
SSDEEP:	384:gGHbn4M16HqVjP34JCVoBR/9eOWDkbQ/2NR/yMFjupWHowiSLTXmkm:/P1sy34J9Fiki2OfUA
MD5:	5C298CF4AAB1B28F96A027AEDFA2225E
SHA1:	7D6D617275514FE925A39054B69DC7BBB04D32EB
SHA-256:	97D678478A0CDAD538E1046693D883C93C5E64D20FADE5E242C51047F3FAE54B
SHA-512:	4493A7D57634A1C22DAE1DBCEC078871A01D343C9338DC5800CD6825E83DB10D340C777E23063ECB09272DC90635C0B60D11EA55C485814E2FFC4BD7CBA8ED80
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/js/bg/l9Z4R4oM2tU44QRmk9iDyTxeZNIPreXiQsUQR_P65Us.js
Preview:	(function(){var w=this\|\|self,B=function(m,g){if(m=(g=null,w).trustedTypes,!m\|\|!m.createPolicy)return g;try{g=m.createPolicy("bg",{createHTML:R,createScript:R,createScriptURL:R})}catch(L){w.console&&w.console.error(L.message)}return g},R=function(m){return m};(0,eval)(function(m,g){return(g=B())&&1===m.eval(g.createScript("1"))?function(L){return g.createScript(L)}:function(L){return""+L}}(w)(Array(7824*Math.random()\|0).join("\n")+'(function(){var d=function(m,g){return(g=typeof m,"object")==g&&null!=m\|\|"function"==g},E={},H,m0=function(m,g){function L(){}(L.prototype=g.prototype,m.X=g.prototype,m.prototype=new L,m).prototype.constructor=m,m.zf=function(R,W,w){for(var B=Array(arguments.length-2),U=2;U<arguments.length;U++)B[U-2]=arguments[U];return g.prototype[W].apply(R,B)}},k=this\|\|self,gU=function(){},L3=function(m){return m},Q={},wU=function(m,g){if((m=null,g=k.trustedTypes,!g)\|\|!g.createPolicy)return m;try{m=g.createPolicy("bg",{createHTML:L3,createScript:L3,createScriptURL:L3})}ca

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\siteanalyze_77584[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	23090
Entropy (8bit):	5.311576145731177
Encrypted:	false
SSDEEP:	384:3VEAGjxGSXe1Az+r/8fmFt6SMenHClbHbWswpEYLg6ANMLWYMRpidUiyhaNfFg:3VERIIy/vFh/dLhMYMRpidUiKaDg
MD5:	8AC5E5917A0203FB56FF6331898DFCD2
SHA1:	2F5DC471E013D681CB3A149E6FC73BEC3E1B1A36
SHA-256:	250674869DF0ABFFCE8A4A001692C2C435EF9A74A3658BE2BC733A533D67A8EE
SHA-512:	2DCA81FC54A6A76D4AD25589AED7A67A1C1DAFA2CD5453FB0CE176C63C60F4C32F11382996067CA6E49A2AF1522D9C63AF18EE76A9BE23E931EE9CCE36394E14
Malicious:	false
Reputation:	low
IE Cache URL:	https://siteimproveanalytics.com/js/siteanalyze_77584.js
Preview:	if(_sz&&_sz.core&&_sz.core._isloaded!=null){if(_sz.core.warn){_sz.core.warn("Script requested to load and execute again, this is not desirable and will be blocked")}}else{var _sz=_sz\|\|[];_sz.push(["accountid",77584]);_sz.push(["region","r1"]);_sz.push(["heatmap",{matches:{permanent:["https://cdt.ca.gov"],include:[],exclude:[]}}]);var _sz=_sz\|\|[];(function(l,b,h,j){var a={curr:window.location.href,ref:b.referrer,esc:function(d){return encodeURIComponent(new String(d).replace(/(\r?\n)+/g," ").replace(/\s+/g," ").replace(/^\s+\|\s+$/,""))},empty:function(d){return(d==j\|\|d==null\|\|d=="")},tag:function(d){return(b.getElementsByTagName)?b.getElementsByTagName(d):[]},id:function(d){return(b.getElementById)?b.getElementById(d):false},clone:function(p){var m={};for(var d in p){if(p.hasOwnProperty(d)){m[d]=p[d]}}return m},rnd:function(){return Math.floor(Math.random()*100000)},txt:function(d){return(d.textContent)?d.textContent:d.innerText},uuid:function(){var d=function(){return(((1+Math.random()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\6D19FjzPJgc[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	51305
Entropy (8bit):	5.826099643553244
Encrypted:	false
SSDEEP:	768:aeK2qiTNv0woZp6DEpPPJdqN/0WnQ7nKO+pwG0N9rBwLqmBt:pafHXWQ7Sw3JSqmBt
MD5:	B7B6B83B43C9E1901BC76D3C01FB9086
SHA1:	70ED6D95E2A4F53FA4C269E37AE21749206DD8A5
SHA-256:	FD376D9A914445B34082DB985212D4C722C8600431E01DB1C47F54DF7B37320A
SHA-512:	384ED56915D56E04A22ACBDC3B0C45C99D2F2806B605C6CB6A066A908D729F1E838024C154B21B3F97ED8D6E39FE774EFE45F547B4812D3823134D53B6521461
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html><html lang="en" dir="ltr" data-cast-api-enabled="true"><head><meta name="viewport" content="width=device-width, initial-scale=1"><style name="www-roboto" nonce="8n/cnPlak/aH0RNMB56nfA">@font-face{font-family:'Roboto';font-style:normal;font-weight:400;src:url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxM.woff)format('woff');}</style><script name="www-roboto" nonce="8n/cnPlak/aH0RNMB56nfA">if (document.fonts && document.fonts.load) {document.fonts.load("400 10pt Roboto", "E"); document.fonts.load("500 10pt Roboto", "E");}</script><link rel="stylesheet" href="/s/player/5a096a9f/www-player.css" name="www-player" nonce="8n/cnPlak/aH0RNMB56nfA"><style nonce="8n/cnPlak/aH0RNMB56nfA">html {overflow: hidden;}body {font: 12px Roboto, Arial, sans-serif; background-color: #000; color: #fff; height: 100%; width: 100%; overflow: hidden; position: absolute; margin: 0; padding: 0;}#player {width: 100%; height: 100%;}h1 {text-align: center; color: #fff;}h3 {margin-top: 6px; margi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\KFOkCnqEu92Fr1Mu51xIIzQ[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 21952, version 1.1
Category:	downloaded
Size (bytes):	21952
Entropy (8bit):	7.970421989516302
Encrypted:	false
SSDEEP:	384:LANJRPUW1egrkV1qAeQjd3pHH7fS3SIHwip3fzp7IYMa8/h3ELZ2owoRE1F:LAN/Pl1egR7QjRp+3SIHwcLpMYC/h+9U
MD5:	FE65B8335EE19DD944289F9ED3178C78
SHA1:	E9E842D5ED5321DDD719599057E9F8643B2AD539
SHA-256:	80815EFE3BD9317C666DF0F2E6D701335E178954F64EB1E99103FEA81C2AA137
SHA-512:	6E7995EDEBAEF0218C921F5485CDA2B1FDCCFDC9ED5CF988AA005096BB64BC844CFA9F3CE081CFB5A8C896492BD5D70CA2B4D7B71EE9A9EE801A721F9F45B087
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzQ.woff
Preview:	wOFF......U........\|........................GDEF.......G...d....GPOS................GSUB.......'......r.OS/2.......O...`t..Rcmap...$..........W.cvt .......R...R..-.fpgm...p...4....s...gasp................glyf......A...q^...Phdmx..N....m........head..O....6...6...ehhea..O8..."...$....hmtx..O\...v.....}?.loca..Q.........E.'.maxp..S.... ... .(..name..S...........:.post..T........ .a.dprep..T........D..].x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R...A.J.x.l..h.a........l.m.6.1+.X....i...y....&...._..63..5....2>...x\|D...ct.Kx..H@b.3..l..#u.....L......^..4.....rP..{.......Q...JT.:Xu>..T./>...oq...........~..@.....lq../.... ..#..".&.8.H$..r...J)..jj...&..f.=.9..N9.....'F..8.4.....m...m...m.m..n..&.X..}....S.\|.....n........PHaE...J...4..MjJ.*..nW)..rn3'/.....ks5zY5c...Mgg.5..p..rR{c...p..t\.8.c=..p...X.(.......7....=.........!...H ........(.0...(.q.JT?.b..z].'T...m..vNi.....t....:P.R..H....t.........&?.:.j.51+.S.":j.SK'I.^....}S.i.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20464, version 1.1
Category:	downloaded
Size (bytes):	20464
Entropy (8bit):	7.969622511404751
Encrypted:	false
SSDEEP:	384:edA/1eSg82dg1kGeF2BFDEE+/adkuouo34TjkWqTExYOYg/c1iuHotcO:ey/1eSnLkGeWFQECadcLIc/TEfYr1RO
MD5:	87284894879F5B1C229CB49C8FF6DECC
SHA1:	FB1BD3BAF122D5D350EB387F0536C20DA71F09DF
SHA-256:	BA98F991D002C6BFAAF7B874652FFDCDE9261A86925DB87DF3ED2861EA080ADF
SHA-512:	663BA95BBBC6F7E65D7B1293E4A044C9111438A03B16664FC38A2B2F2C1A4CE96991C847B36691388AB322525A83DB2724CB4D1B9BF0440727F0B5CA7073AB8C
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc-.woff
Preview:	wOFF......O........D........................GDEF.......G...d....GPOS.............~..GSUB.......'......r.OS/2.......Q...`t...cmap...\..........W.cvt ...T...\...\1..Kfpgm.......2......$.gasp................glyf......;...l..(.4hdmx..H....l....."..head..I<...6...6...rhhea..It.......$....hmtx..I....x.....gO.loca..L........._.C\|maxp..M.... ... .(..name..N...........:.post..N........ .m.dprep..O........S...)x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R...A.J.x....dK...{....?..F?.\|.~.m...ms.{.Z..;......U.]7s......\.=D.=.7...>....x...D..O\|.U:...\|o..3.x.j.r"B.............../.)x$.'"j.....1LGmaGxQxG....~.:'.A..hd.z,.k..KO.....^.}H\|#z_.O......R..A...9..A..!.(./..."..:.Iq1.r..s..r.7r.7s..q.wr....nz..]...2..d4c..c....d....T.1...d....\....,c9k.g..Yv.#O."%...... ...t"uM..%.......j.#^.....}\c.q.i...<jy.D...C.01.2.r.....V..z.W.7b..L.S.41]..kUs.X/6..b.........(..(...K..{.^..'........`#./..B......N+p.m`...].lQ....Drg.M..Kx.^.S.*..........h ..$.k.'Hy.I.ze..4z.-T.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ad_status[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	4.142295219190901
Encrypted:	false
SSDEEP:	3:lZOwFQvn:lQw6n
MD5:	1FA71744DB23D0F8DF9CCE6719DEFCB7
SHA1:	E4BE9B7136697942A036F97CF26EBAF703AD2067
SHA-256:	EED0DC1FDB5D97ED188AE16FD5E1024A5BB744AF47340346BE2146300A6C54B9
SHA-512:	17FA262901B608368EB4B70910DA67E1F11B9CFB2C9DC81844F55BEE1DB3EC11F704D81AB20F2DDA973378F9C0DF56EAAD8111F34B92E4161A4D194BA902F82F
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.doubleclick.net/instream/ad_status.js
Preview:	window.google_ad_status = 1;.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\app---dislosure-pfq-zoom[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1891 x 405, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	42106
Entropy (8bit):	7.651282126924282
Encrypted:	false
SSDEEP:	768:xZAzkXigmeGXILmdY/t5NYjiG4LYoDofDri9ew/:jA8m1Yx/jNLhEfbr6F/
MD5:	3421AE7ECA7AA763927499A9A0B00FC8
SHA1:	B75940DA0B4084941F710FFD3DB6B572A9128FBD
SHA-256:	08C7387EAD970FA28812478768CEE10108A3119C8EE9667645C63083CAF49812
SHA-512:	B1D1FDDE1FB3910AF5664577DA1E06C781A69BF880AF851BF74512853485EF2B761E9F6797A8CEF3638759593CF61B537BB0590C425A65CC03CD95DDA3ACF7FF
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---dislosure-pfq-zoom.png?sfvrsn=93b351b1_20
Preview:	.PNG........IHDR...c..........Z.....sRGB.........gAMA......a.....pHYs...%...%.IR$.....IDATx^..O.m[...Jh..0..J.....R.{...OA4....^..4...J.ab....C..M.q.. ...1....7........e!...#Q[.<....s..o.9.......I....s..g...}~.o....-!..B.!..B.!..B.!...D..?.goY.%..B.!..B.!..B.!....[..o.y..............s...............m.~..c...~..B.!..B.!..B.!..B.1.c.!..B.!..B.!..B.!.1.c.!..B.!..B.!..B.!.v1...........0V...n...X............b,..........\.............p.,..........................W.b,..........\.............p.,....................}_>..w[...........2.^...O.o{........./.?...w[....../.x..vX...........pMg/.j!...j.....................O.z..~.n.7>.....i.5.9}.............".g...\|...W.\|{.VQ.....o.EZ}BV.]...G.=..c..^X.....?~x..TN.]..}g.t.T......r.,....Q...........x.........'..*.......?_..r....r.,..R..0..3...-.......oG1.c............"...(..N/..S.^.U9.ES/..?......n.b..'u1...m~R...z...[..v.C...b....u.............t......^..c-dj.T....O.j...Q$.L]..b..!.g....bl.;?)+.@[..\owY.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\app---renew-pick-base-field-missing-zoom[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 230 x 70, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2023
Entropy (8bit):	7.761070904389042
Encrypted:	false
SSDEEP:	48:rWDB7V8V8V8V8V8V8V8V8V8V8VvW0gMtus2nMOcBUahzOvuPy53V0pv2pkNwHAf/:rWDjWWWWWWWWWWuTKus2+yuzOd53Yo0B
MD5:	DB34659B5FA3C57C34934E96D157AE57
SHA1:	AC8C2AF9E3F15A0188A5B2A6089D669D8675800E
SHA-256:	9227348CD1A8950458BC831C3F1304813B0FE6256BFE3B2671E059044B4DFAD4
SHA-512:	B74AF8DB09E722A37C363D608632592813EDEE8E1EF1322D8FB41B76830F0F462ADA7D65A018715FACCDF77EF3FD34D475DB403E993B40C430A3D59C74EA47BC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---renew-pick-base-field-missing-zoom.png?sfvrsn=d5751b1_6
Preview:	.PNG........IHDR.......F......v.U....sRGB.........gAMA......a.....pHYs...%...%.IR$....\|IDATx^...N.W..qZ.U...D....Q.(...cTQT.R.MS!5BM.M....$...-(J.....&6.V-..7.o....}<.1..c..9.e..o.Z^Ys"2X..?......SD.Ew.H.j.vww....E$.. ...Va...:...Va...:...Va...:...Va...:...Va...:...Va...:...Va...:...Va...:...Va...:...Va...:...Va...:....v........E.U."y...E.U.Er~...u%[.....(Xd.......Z.[.Y.,.Pl}.uh-...,..X(..d.:...Va...,.[_.c.Z.~.0."4..y....Z.[.Y......X...*...,t...:...Va.Eh`..$=.....(B...'...E..]).....C.$;.J.=}...w.=........i.........X.<I.u.....3O.rbb"...G....;w\.Tr.r..i'4..y.....f.....[^^...Y.q>z.....Eg.......:O.c..07G.h...'.1?.<..;...]..m...k~..O.D...<..;5.q.>.........z^........J..........noo/.....'O...w.o...w"4..y..x#4...vTt.I...GGN._J.?Mk.o724...i\...>....O..d..uu.U......w........^.zU....={.......b.kr.VB...'....0..W.;.y4...v[\|~\|..>:r.6/~....AH........6.~......:..1......:...s!d\......=.......5._..._..]..]N.q.r.J....<.........2\..........p;]..i .....U.g.r...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\app---web-selected-next[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1080 x 280, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	50112
Entropy (8bit):	7.933284775948162
Encrypted:	false
SSDEEP:	1536:Qmt4sKAuvUgL8c0kakcYbP42ggPAzt0j4Ep:lSsKRLz0kakVbPlPAdk
MD5:	DE63DFB8EC40E62F87378BC446407864
SHA1:	87B23D2EA91186B2D2EF9BE44BC85321B64EF391
SHA-256:	379ADCA87FDA4E83720978DE99E3C40983E4F332FFC26075344293C686D4138E
SHA-512:	A597D0FC4018BA0CA254C6CB6B582B418BEE4C3808973E36748827EAD445C8ECC45A68F72B9510DECEA5F796504A62155EC7BEF7F6F3BC4AE2D23D8EC9BB94C7
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/cert-images/ctc-online-help/apps-payments/app---web-selected-next.png?sfvrsn=226f51b1_8
Preview:	.PNG........IHDR...8...........F.....sRGB.........gAMA......a.....pHYs...%...%.IR$....UIDATx^...U.....yN..c.,.2.C......$c.(..9..B..yL.y......]..n..........}............I\|..p..d2.L&..d2.L&+.&.C&..d2.L&..d2Y.7..2.L&..d2.L&....e..D"!..d2.L&..d2.LV...!..d2.L&..d2......!..B.!..B.Q.i.....3f....Y&..d2.L&..d2....Q..V.Z..p.!..B.!..B.d.\|....8.....L&..d2.L&..d..g.Q...8.,X ..d2.L&..d2.LV.......8..g....d2.L&..d2.L&+P..-p.!..B.!..B.T.....8j=P....._..I..X...."V..}m..?..B.!..B.!...J..7.w..?..%..f..nM.-..j[..-..q....9.ti..B.!..B.._g...=O........829-(vD.J.b;.P.^..l..B.!..B.!....R..~e.....%2.k+}.m}........B.!..B.!.....8.."t..%0.k+}.mS.....2]Z!..B.!..B...!..B.!..B.B..8JW...W...........{Y.I..B.!..B.!.;V..Q..m..m...>.....Zw.....K.V1.6....}`.V.o.D...B.!..B.!.z...8J^...h..=.Z.k..'a..;.Xb.R........E.W..[...w.....m...Y.~.I..B.!..B.!.;.........[...v.....A*.(.]+X./.S.?../...O.9..q@e+q.=..+....6<..%v.8lw..O[.X..p..}..E...B.!..B.!.z..8..Xb...."{....?e.%.=.z..9,..U'.v..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\cagov.core[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	472714
Entropy (8bit):	5.050629481771825
Encrypted:	false
SSDEEP:	6144:4t4zYYI0TxIYTSJFgrM/gf375H+sx1tpHvZBF1fbDbHt:oFgrM/gf375H+sx1tpHvZBF1fbDbHt
MD5:	343D47D46844A3583C6C7CFC706F9500
SHA1:	91A02DEC7D1EAE38A8F6C24B68D67049BA91E916
SHA-256:	A7E2D26BBBF00BF1B39F09AA20F37BB348427F3883B710017DAEF73795F66E89
SHA-512:	1ED054BEF114DF8054AC5A576D7BF7C7302AFB32B1223661B2E01AA14CD86DC236DD7D8A3E077698385ECA99D4930449CCD70F90B8E833DA37E5D695F5FF105E
Malicious:	false
Reputation:	low
IE Cache URL:	https://california.azureedge.net/cdt/statetemplate/6.0.1/css/cagov.core.css
Preview:	/*.. CA State Template v6 - @version v6.0.1 - 1/31/2020 .. STYLES COMPILED FROM SOURCE (SCSS) DO NOT MODIFY /../ -----------------------------------------.. BOOTSTRAP v4.4.1 - /source/scss/bootstrap/ .. https://getbootstrap.com/..----------------------------------------- */..:root {.. --blue: #007bff;.. --indigo: #6610f2;.. --purple: #6f42c1;.. --pink: #e83e8c;.. --red: #dc3545;.. --orange: #fd7e14;.. --yellow: #ffc107;.. --green: #28a745;.. --teal: #20c997;.. --cyan: #17a2b8;.. --white: #fff;.. --gray: #6c757d;.. --gray-dark: #343a40;.. --primary: #007bff;.. --secondary: #6c757d;.. --success: #28a745;.. --info: #17a2b8;.. --warning: #ffc107;.. --danger: #dc3545;.. --light: #f8f9fa;.. --dark: #343a40;.. --breakpoint-xs: 0;.. --breakpoint-sm: 576px;.. --breakpoint-md: 768px;.. --breakpoint-lg: 992px;.. --breakpoint-xl: 1200px;.. --font-family-sans-serif: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sa

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\cagovapplets[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	123797
Entropy (8bit):	4.507709514963749
Encrypted:	false
SSDEEP:	768:f3wV8IVaueWN7coP91Id5uFx91rl/SHujluqA:fAV8I4ueA7coP91IfuFx3rl/Sql8
MD5:	ED26DDE7460B2A5CF3F53C8DA8FB7100
SHA1:	4F8E4D54FD23D41ACFECD15EE19531A585CC7AE4
SHA-256:	000B02D25B5D348E5AF563167A3673D394D8C8C9CD321967453E9BB36646136A
SHA-512:	6BF5B71C4F51CA08D1E1C8568F9C0DCF428A8D476C17E85301D6C536B5160B34F7CCC9947B711ACABC8BF6BB385FD883435B8A8D11F428EBADE6C3D6C9C3919C
Malicious:	false
Reputation:	low
IE Cache URL:	https://california.azureedge.net/cdt/CAgovPortal/js/cagovapplets.js
Preview:	var apiLocation = "https://api.stateentityprofile.ca.gov/";....//var imageUrlPrefix = "https://california.azureedge.net/cdt/CAgovPortal/images/Uploads";..var imageUrlPrefix = "https://stateentityprofile.ca.gov/Uploads";....// Holders of API Data - Home page..//var homepageImageResults = [];..var homepageServiceResults = [];....// Holders of API Data - Service Details page..var serviceDetailsResults = [];..var relatedServicesResults = [];..var serviceLocationsResults = [];..var serviceFaqResults = [];....// Holders of API Data - Agency Details page..var agencyDetailsResults = [];..var agencyServicesResults = [];..var agencyFaqResults = [];....// Holders of API Data - Google Embed on Service and Agency Detail Pages..var serviceRelatedLinks = [];....// Holders of API Data - Agency Alphabetic Listing Page..var alphaListingResults = [];....// Holders of API Data - Service Search Page..var serviceSearchResults = [];....// Holders of API Data - Agency Search Page..var agencySearchResults = []

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\cert-complete[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 140 x 140
Category:	downloaded
Size (bytes):	1620
Entropy (8bit):	7.700298347392052
Encrypted:	false
SSDEEP:	48:9lRFRAnlbzxxpdAw4WqlhaOXHI8ySHGOB66XP:FFcbFK9XnxGbC
MD5:	8A1C3ECADA2DFC50A7AB03E952D06CFE
SHA1:	07F483EB4C93FC06395213123D6FE39CBFA9C52D
SHA-256:	C8792F9EB69F86B2425013227E10FABB3309A17632AEAE655383AC0E59525E0F
SHA-512:	9E5DD497A579AC67387C481F51DDCDB698322A6CA5AA478ECF1124D150B4BE2E56665B0E4E29B95C8F0010AA7E8543C6F7F4DC5AC8F3EFCE2F0F4A72B080225C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/credentialing-information-library/cert-complete.gif?sfvrsn=440f4bb1_0
Preview:	GIF89a.......\l.......3Gd......w..N`y....@To......ix....%;Z................................................!.......,........... $.di.h..l.p,.tm.x..\|....pH,...r.l:..tJ.Z..v..z..xL....#B.n..pvaUh#Xm.k.f..xq.qz-..........'.....s%.....w%......'....'..................."....#...................s......."..."...z....,..............}.....y.].+.....ZY.......3j.X....C..I.c..$S..\i...0cfly..8k.4a3...v....hL.$..]J....L.nt.K$U,.F^....!...6.,God.X5.Q..~!..E.....p....-F.i P.h.........E.......N..x.%O.Lv.U....h..D.....l.....b.M....9...X.2......r.............9.P......=..}....f....Ew..k.{. .- .3..e..8.?.c.O.E....&....GK})..S.i3@%V5.1(.T.....1@u...@...D...<...#b...)......(...c.Rn..v.I...J..".6.'SyC.bc...8M.R!..-&.@@..`.Q@...s.II.0.Y.3,...Z.h&.=-.Cr<.@.x..\|...x.G.Qy...i(...k&.(.P].._".x.4..H..'I.h..r.....*O......N.M...i....[.t.C.......}...0(....$''.Je..}/^.Gs..a...D!...-d...X6..d...DO.........Q.4...:9/....H.".........b..I.T...\..}.!sB..1!...SlE...R.Ep...*`\...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\cert-renew[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 140 x 140
Category:	downloaded
Size (bytes):	1152
Entropy (8bit):	7.5825552248767965
Encrypted:	false
SSDEEP:	24:YGXqolNXB5EngF4K62J1Q4X1nsulUT9DOUJVxgRpK3/ec:PqcR5N4iHX1nTd+Vxabc
MD5:	6922294C39D3BB15955EE9D4AA7B2979
SHA1:	D9F58AAC275A6E31EEDB718C45DAF7D042EB4A10
SHA-256:	5176B07C85AD1110066FF695171E50F17EF10678B465A90BA446464668543984
SHA-512:	0726AB0E16ADBB5C2AB41B7C9C4FEC26458F55828CCED9AF368B0001553CA051E54CFA17B71E06B28F505C68DBF94462DE5B3084FBBF4DA0202FD0D27B40E0CA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/credentialing-information-library/cert-renew.gif?sfvrsn=5b0f4bb1_0
Preview:	GIF89a.............3Gd...@ToN`y\l.......w............ix.%;Z................................................!.......,........... $.di.h..l.p,.tm.x..\|....pH,...r.l:..tJ.Z..v..z.,@A.....A......F.....sp..@.{p....[..w.Y.....W.....S...x.Q.....P.....K...........H..c.F..j.D..q.9..........1.......i~.,.......'...........................6......k..5.p.a.S..8pH.Y.?..V.(kM...C...&.<."/..,.R$.-C&4..e..\..y..6{6..ThC.yN..8.....0P....`..$@.I..X....HQk.._.1@.g"E...H....o..H.+"Y....J2R..a.S.IA./x.....Q..fF..Ko.R9_U...s.....,mZ..QT....@.8.A~.._....Y%.N...u..R.O3r8k...G....v......2...#....\|.....z...%x.#@...mp.._Gou.......&....s.........C.5.c..... .3....-xh....h.(...".A.<:.."./..#..lH#>7.`....b..b3!....D..Qd.?0yM.[.'O.@.............\|..~`l.Nz8X).~Y..c.O........8..)E..\..y.q..0A...YH9..j.......:}6...@07c.xJJ...,..X.TJD...V..v..&>.MAf<.....P....Gx.....%..K..D..1..A...,@.&.l.........................L..P`A,`.?.5..Q....?f&.Cp....{....@..x....+q.5.lUo..4.pH."..F.. .....pE.V

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\clear-credential[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	66309
Entropy (8bit):	4.917008693890281
Encrypted:	false
SSDEEP:	1536:QR2TPMnZttsHKkOUzN2ApHCbXrHb5CDdUrSipW3iCt:7PYmHKkOUzN2ApHCbXrHb5CDdUrSipW1
MD5:	4EEB5DEC2D09A9CF96EB20835B5B367E
SHA1:	45B8547ACCC4C59CEE3C646AFA3AB786A4A305C9
SHA-256:	DC90F8E8660DDC896E4A501469BEFFCE4E7B6BBB95D404F2D73CBE37BF1797D4
SHA-512:	09B20DC537120980A05716ADED7ED547690B5090E8E594CC885CF9A3A6747C0D91E41AD4050E0492C62F250372E43B43F851D402EE3804FC80CC65D537237577
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html> [if lt IE 9]> <html class="no-js lt-ie10 lt-ie9" lang="en"><![endif]--> [if IE 9]> <html class="no-js lt-ie10 ie9" lang="en"><![endif]--> [if gt IE 9]> ><html class="no-js" lang="en"> <![endif]--> <head> <meta http-equiv="X-UA-Compatible" content="IE=10,IE=edge,chrome=1" /> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="HandheldFriendly" content="True"> <meta name="MobileOptimized" content="320"> <title>...Clear Your Credential..</title> <link rel="icon" type="image/x-icon" href="/favicon.ico"> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.5/css/bootstrap.min.css" integrity="sha384-AysaV+vQoT3kOAXZkl02PThvDr8HYKPZhNT5h/CXfBThSRXQ6jW5DO2ekP5ViFdi" crossorigin="anonymous">--> <link href="/Frontend-Assembly/Telerik.Sitefinity.Frontend/assets/css/cagov.core.css?package=CTC" rel="stylesheet" type="text/css" /><link href="/Frontend-Assembly/Telerik

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\clear[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1018
Entropy (8bit):	6.094138866101745
Encrypted:	false
SSDEEP:	24:6y1hpunQWwjx82lY2T3gV10/+yJ3VQN948GiFF7waYaq:6witNn2cCJ3R8tXYx
MD5:	2DF778BF2E22D52FE849BABB330EC977
SHA1:	0F833F030BB43F282473BDDD3A33B5F8CBA7A845
SHA-256:	329D1A750114920332EADC55C129957D9DBE5A1B25745E2F7E0ED4FAD75E04CD
SHA-512:	9CB103E634A832271D2FE840A5AF3107CDB2E92290810B65692A805C29DCDC11C86B773CBF38F0F0E202EC9D0E76C125EA93F96B63521571F57C03568E7F747B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/cse/static/css/v2/clear.png
Preview:	.PNG........IHDR..............2.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:29EC528B41B211E1979DCD8193D1E756" xmpMM:DocumentID="xmp.did:29EC528C41B211E1979DCD8193D1E756"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:29EC528941B211E1979DCD8193D1E756" stRef:documentID="xmp.did:29EC528A41B211E1979DCD8193D1E756"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.VA....nIDATx.bLKKK```..b.Y.f]`@.@9. ........@.P.tE .~F4.. ..jQ......U.W.r.#......8L.D..&.3L.. .Pw9B..A.RX..p.@S\..`...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\css[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	711
Entropy (8bit):	5.12089171292259
Encrypted:	false
SSDEEP:	12:jF/iY3Q6ZRoT6pixuAhFqF/iO6ZRoT6pixuGEqF/iO6ZX6pixuXJqF/iO6ZN76pP:5/iY3QYsNxh+/iOYsNxDv/iOYXNxd/iI
MD5:	2C3DF7E3BDD7CE509F3EB308E1D19F5D
SHA1:	B7223E03263568D86A044077E3421E83DED6F1A8
SHA-256:	C0CEA2C404C68455A87A247901A23E712670BDD4AA7549BAD3B0C3F8EED1CA3F
SHA-512:	0E7101817441B23F0347502989CE542F67BB88FE57738ED1B1AD3982C618DB981F8B7DC33356EAE9D3B02B546D5733CD14BEC80F17F4640F4722D0E5FF13B547
Malicious:	false
Reputation:	low
Preview:	@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzQ.woff) format('woff');.}.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxM.woff) format('woff');.}.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 500;. src: url(https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc-.woff) format('woff');.}.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc-.woff) format('woff');.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\default+en[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	41474
Entropy (8bit):	4.965737845904213
Encrypted:	false
SSDEEP:	768:oiIcKPgZ/WFOemQFc/3GBLQ06eMYdaO4Mawgm0s+Rb4FhFQ7sfr3lyFcVZJpfXRf:v3WwemQI32LQ06eMYdaO4Madm0s+J4HL
MD5:	2314913C68B0EBD7F25A9FAE8774CBAB
SHA1:	D272D64D3EFF37613D96480460DFC2F74A6BAA61
SHA-256:	4C1355D27B14881A055E00A4A2AFA4608B452C9780AC5C61E1B8F9FD55FA3E1E
SHA-512:	969B0366D0D44D8C3A9EF2956735C89104B7CCDAE5756130F1E444BEE77984E3D42681E21BC88E1F4F80206DF0EEDC60909917B5129F313D381D28E4068A3432
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/cse/static/element/323d4b81541ddb5b/default+en.css
Preview:	/** Copyright 2005 Google Inc. All rights reserved. /../ the GSearchControl CSS Classes. * .gsc-control: the primary class of the control. /..gsc-control {. width: 300px;.}...gsc-control div {. position: static;.}../ Slight reset to make the preview have ample padding. /..gsc-control-cse {. padding: 1em;.}...gsc-control-cse,..gsc-control-cse .gsc-table-result {. width: auto;. font-family: Arial, sans-serif;. font-size: 13px;.}...gsc-control-wrapper-cse {. width: 100%;.}../ control inputs. * .gsc-search-box: the container that hosts the text input area. * .gsc-input: the text input area. * .gsc-keeper: the save link below savable results. /.form.gsc-search-box {. font-size: 13px;. margin-top: 0;. margin-right: 0;. margin-bottom: 4px;. margin-left: 0;. width: 100%;.}../. * This table contains the input element as well as the search button. * Note that the search button column is fixed width, designed to hold the. * button div's background image. */.table.gsc-search-b

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\default[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	4495
Entropy (8bit):	4.948267052980108
Encrypted:	false
SSDEEP:	48:jeePUJMC95SxaO5Sx5QGascw6sU99YENvWoGmuwY6kcPhsMPoBAijzln0TqfTlhL:7LyC7C5CsKNuof3PhsMPBijZnHfRUXM
MD5:	C14E45E189F801818B14F1315605A632
SHA1:	DD7E7FB9D156B343BEEF0155B41DA1C847D69E41
SHA-256:	DCEC22BBCB68119D6C7D6D5E088FB82183A9826D0C9E3403F1386FD837F06A89
SHA-512:	7312D1E49927990CD81CD62C953AC7566C85007350250403ABE3A2A9635AFA516B3511E85477DD5189741FCCB7D0200C8DD24074AAD9938E5D4484BBDEEE59AC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/cse/static/style/look/v4/default.css
Preview:	/*. Default Theme, v4.. . /../* Selector for entire element. /..gsc-control-cse {. background-color: #fff;. border: 1px solid #fff;.}...gsc-control-cse .gsc-table-result {. width: auto;.}...gsc-resultsHeader {. border: block;.}../ Search input /..gsc-input {. font-size: 16px;.}../ Hide clear input X added by MSIE. /..gsc-input::-ms-clear {. display: none;. height: 0;. width: 0;.}...gsc-input-box {. border: 1px solid #dfe1e5;. background: #fff;.}...gsc-search-box .gsc-input>input:focus,..gsc-input-box-focus {. border: 1px solid #4d90fe;. box-shadow: inset 0 1px 2px rgba(0, 0, 0, .3);. outline: none;.}../ Search button */..gsc-search-button-v2 {. font-size: 0;. padding: 6px 27px;. width: auto;. vertical-align: middle;.. border: 1px solid #666;. border-radius: 2px;.. border-color: #3079ed;. background-color: #4d90fe;. background-image: linear-gradient(top, #4d90fe, #4787ed);.}...gsc-search-button-v2:hover {. border-color: #2f5bb7;. background-color: #357

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\embed[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	30106
Entropy (8bit):	5.531908965857142
Encrypted:	false
SSDEEP:	384:ibvnf8qYRgyq+e84VeljyV7r4GoxGU7ysTMlC9Ai2HET9zo9vBnePelaD7TRW6WB:16+14VesZr1HCRreQK9mI67Oytps
MD5:	4A12062830AC0F8F56004D33BF1302CC
SHA1:	5BF3E0F00E98FE8E0B343E582F6DDDAAAF066E1F
SHA-256:	88876F6627EED8149D59D1C99B86EC067ACB99904D2BE968045C4ECF3440306D
SHA-512:	E56F1E66192E2E4E542EC7F167DA249F2873274971B352C6CA1320ACFB60D138AA5F8EF08BE5E19211BEE787C43F2B2A0FC535F00686D5317BFE87C008396834
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/s/player/5a096a9f/player_ias.vflset/en_US/embed.js
Preview:	(function(g){var window=this;var P2=function(a,b){g.kf(a.i,8b+2);var c=a.i.end();a.u.push(c);a.l+=c.length;c.push(a.l);return c},Q2=function(a,b){var c=b.pop();.for(c=a.l+a.i.length()-c;127<c;)b.push(c&127\|128),c>>>=7,a.l++;b.push(c);a.l++},oGa=function(a,b,c){null!=c&&(g.kf(a.i,8b+1),a=a.i,b=c>>>0,c=Math.floor((c-b)/4294967296)>>>0,g.vf=b,g.wf=c,g.lf(a,g.vf),g.lf(a,g.wf))},R2=function(a,b,c){null!=c&&(g.kf(a.i,8b),a.i.i.push(c?1:0))},S2=function(a,b,c){if(null!=c){b=P2(a,b);.for(var d=a.i,e=0;e<c.length;e++){var f=c.charCodeAt(e);if(128>f)d.i.push(f);else if(2048>f)d.i.push(f>>6\|192),d.i.push(f&63\|128);else if(65536>f)if(55296<=f&&56319>=f&&e+1<c.length){var h=c.charCodeAt(e+1);56320<=h&&57343>=h&&(f=1024(f-55296)+h-56320+65536,d.i.push(f>>18\|240),d.i.push(f>>12&63\|128),d.i.push(f>>6&63\|128),d.i.push(f&63\|128),e++)}else d.i.push(f>>12\|224),d.i.push(f>>6&63\|128),d.i.push(f&63\|128)}Q2(a,b)}},T2=function(a,b,c,d){null!=c&&(b=P2(a,b),d(c,a),Q2(a,b))},U2=function(a,b,c,d){if(null!=.c)f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\extend[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	modified
Size (bytes):	63688
Entropy (8bit):	4.930561804612365
Encrypted:	false
SSDEEP:	1536:NRNTPMnZttsHKkOUzN2ApHCbXrHb5CDdUrSiOCt:9PYmHKkOUzN2ApHCbXrHb5CDdUrSiOCt
MD5:	B2397A19AB054BACCA557744A1536A69
SHA1:	846D897CE88CD95FAAE888C32C1F3629EDA7211A
SHA-256:	46EB05187FE4AB442229858A06FF469548ECB8DB81B13A021A9BD1FB4F4F7D53
SHA-512:	A2C81F212F7DA9B003BDE4475CD32A6A8B4DD3359A426B4889D5613856394706C151B74EFB1A17DEAB76160FDDAC75C53D4F99279DA18878427C7C02BFE7F3B8
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html> [if lt IE 9]> <html class="no-js lt-ie10 lt-ie9" lang="en"><![endif]--> [if IE 9]> <html class="no-js lt-ie10 ie9" lang="en"><![endif]--> [if gt IE 9]> ><html class="no-js" lang="en"> <![endif]--> <head> <meta http-equiv="X-UA-Compatible" content="IE=10,IE=edge,chrome=1" /> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="HandheldFriendly" content="True"> <meta name="MobileOptimized" content="320"> <title>...Extensions by Appeal..</title> <link rel="icon" type="image/x-icon" href="/favicon.ico"> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.5/css/bootstrap.min.css" integrity="sha384-AysaV+vQoT3kOAXZkl02PThvDr8HYKPZhNT5h/CXfBThSRXQ6jW5DO2ekP5ViFdi" crossorigin="anonymous">--> <link href="/Frontend-Assembly/Telerik.Sitefinity.Frontend/assets/css/cagov.core.css?package=CTC" rel="stylesheet" type="text/css" /><link href="/Frontend-Assembly/Telerik.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\f[1].txt Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	10419
Entropy (8bit):	5.441884823022393
Encrypted:	false
SSDEEP:	192:OCAUAOnGU93NpigmiEcUTvuULNiSk+R/L1NBxjbO1E1wvbvwetvjvI2Fv3vkihv3:zAEj3Npini1UTvuGNnkLwepzI2hfki13
MD5:	1454AB5A63A52F9B1A0C131595112BC6
SHA1:	9A671E772A295B896C7FA1D253C6A35698B3AA6F
SHA-256:	338279EAED9B34151970F701033C8861E9EAF3E9BC7AB9AA9022159829B91720
SHA-512:	20DA012CAC5F614BD1C62C46B18C97B462E1482C514007FF4760E911EE56E30C29AF078A15822C2A98F933F57A06E5BE89320F99D67AF043B78C4ED34C9541A1
Malicious:	false
Reputation:	low
IE Cache URL:	https://cse.google.com/cse.js?cx=001779225245372747843:mdsmtl_vi1a
Preview:	(function(opts_){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var f=this\|\|self,g=/^[\w+/_-]+[=]{0,2}$/,k=null,l=function(a){return(a=a.querySelector&&a.querySelector("script[nonce]"))&&(a=a.nonce\|\|a.getAttribute("nonce"))&&g.test(a)?a:""},m=function(a,b){function c(){}c.prototype=b.prototype;a.prototype=new c;a.prototype.constructor=a},n=function(a){return a};var p=function(a){if(Error.captureStackTrace)Error.captureStackTrace(this,p);else{var b=Error().stack;b&&(this.stack=b)}a&&(this.message=String(a))};m(p,Error);p.prototype.name="CustomError";var r=function(a,b){a=a.split("%s");for(var c="",e=a.length-1,d=0;d<e;d++)c+=a[d]+(d<b.length?b[d]:"%s");p.call(this,c+a[e])};m(r,p);r.prototype.name="AssertionError";var t=function(a,b,c){if(!a){var e="Assertion failed";if(b){e+=": "+b;var d=Array.prototype.slice.call(arguments,2)}throw new r(""+e,d\|\|[]);}},u=function(a,b){throw new r("Failure"+(a?": "+a:""),Array.prototype.slice.call(arguments,1));};var

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\functions[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	9790
Entropy (8bit):	4.502228358255469
Encrypted:	false
SSDEEP:	96:cy+qCy0HvuDVGijaHvbDmeX0wBwbqbg4oxi4g7FBZj7N2ffAaKazQIpyP:3Q44JAqZj7knA5ZI4P
MD5:	9DCF0D122FDB1A1459B68A105147ED72
SHA1:	355EDC694C892C35FF86E43D640B03D2811EB3AB
SHA-256:	BFEAE78F9B468A52EFBCF939B9064CA42481F764938298216659D83AB5FA3D31
SHA-512:	1F47B93CA8406EF700E3F70B6E8EBD068F11275601CA990DD5ED1B1ABD2177D7F964F3D2CCC7F82476508D70376318563781556165D02275745BAA4F430DEE18
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/Frontend-Assembly/Telerik.Sitefinity.Frontend/assets/js/functions.js?package=CTC
Preview:	$(document).ready(function(){...... / Click Navigation /.. $(".main-nav").clickMenu({ menutype:"mega", landings:true });.. .. if($('.js-accordion').length > 0){.. var hash = window.location.hash;.... if(hash.length){.. $(hash).data('accordion-opened', 'true');.. console.log(hash);.. setTimeout(function(){ $('.js-accordion').accordion(); }, 1000);.. } else {.. $('.js-accordion').accordion();.. } .... $('.accordion-list.first-open').each(function(){.. $(this).find('> a:first-child').next('button').trigger('click');.. });.. }.. .. /* Accordion Expanded /.. $('.accordion-expanded').find('.accordion-list__panel').attr('aria-hidden','false');.. $('.accordion-expanded').find('.accordion-list__header').attr('aria-expanded','true');.. /*/.... $('.toggle-menu').on('click', function(){.. var headSearch = $('#head-search');.. if(headSearch.has

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\gavin-newsom[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 188 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2783
Entropy (8bit):	7.886412807100161
Encrypted:	false
SSDEEP:	48:MmOP874v0Wvxu78HBhBbIYJBEa/NSViVmQRD/yQNdRl/BZb8ec/aH9O+8StGEOoI:PLQ0H78H7BUYJBEWN4fQRD//JLc/G9Of
MD5:	34977DF94C647954E1E13BA189D77421
SHA1:	561656FCC5BE2FACA97A998A1278A2F344270636
SHA-256:	009F9E7213FF11AE035FAD6EFFDC8C75FBCE4012974DFD46B1F9BF684EF9E359
SHA-512:	37FE5010612F17BA799F050BCAFFC1AE7334DA79F204065F79410AE303E43275D9B8822E612F6888F37D0E26F47619CA94D1182EBABBC048551C568CA525DC3B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/default-album/gavin-newsom.png
Preview:	.PNG........IHDR.......0......;......pHYs...........~.....IDATx..\_h.G..)BQTr..>.[iA.6p....]P.B}.....p.DAX$...B.7.K.t!..5B.E.M`UTDn0..M....P.mj..ud.3...3.7...{o....K...s.9sf.....22........8e......G.Rv..m)...-._>e. 4O.......`.7Di..+.5...........V...{.@S..p..O..<.M...x~......B.k.:.......O...A.i..z\|.@....~#e{....>8..y#~.............1..Ro.yK...+.....U./cM....J.}....>..x4.O1........p.8...3....U..<.......#../..;.......7..-.S.f....EE.s....Gx........7...._.6..t.w....^.zO)..t../.........O._.6.H.1^.........U..=^p...].ZP.w.sO..R3ht..rm.s"...7+...yQ.....g..E..(.2..u..^..T..z..\.B....)...r.x..SF....:....[........a....J...8.?).`].x....O..[b.E.o...6..k..(>6...e0..]O..32XB..]3.j...tVE.a...M.......~L.k..X....J...,z.r..~\.R.0............_..........".a..7....Q..W.C...[......\|_._......]......>%u?..S.a...<vx.......%....W.6...@..../.2..&...g..2..InExY..#".;.P^.6......I....O..A.\|..\|D.]f@......oH...=...... ..%Iq.J...~........a._.^..<"u.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\gtm[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	86222
Entropy (8bit):	5.530412483987929
Encrypted:	false
SSDEEP:	1536:KJO/XKYJk/07x6f52a//4vR/K8tDgcZsuk1G9yKPiQwGXrL/f2G7p+4BuW:Kc/XFm/0Na/gvg3uMsfAW
MD5:	EAE3D8462835C5D706089895BE0DC6B6
SHA1:	3085F2A935D1B67677EEE439CA2A84093A48BC3A
SHA-256:	26E2B1CF5BA1BDB810D45F116E2777923DF0CA12D908A99DA6B3FE11A96D2032
SHA-512:	69E974324F18E395DF21E7F3ECFA7B9910211FC845F6C25BE4F020A91811F7E4E1A7585998D5170EAEE8552D2F22119530C1A1D9C4F1B087860304377D3E9243
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.googletagmanager.com/gtm.js?id=GTM-PZGPNNV
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(w,g){w[g]=w[g]\|\|{};w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');(function(){..var data = {."resource": {. "version":"3",. . "macros":[{. "function":"__e". },{. "function":"__jsm",. "vtp_javascript":["template","(function(){var d=\"UA-3419582-2\",b=\"_\"+d+\"_originalSendTask\";return function(c){window[b]=window[b]\|\|c.get(\"sendHitTask\");c.set(\"sendHitTask\",function(a){var c=a.get(\"hitPayload\"),e=new RegExp(a.get(\"trackingId\"),\"gi\");window[b](a);a.set(\"hitPayload\",c.replace(e,d),!0);window[b](a)})}})();"]. },{. "function":"__aev",. "vtp_setDefaultValue":false,. "vtp_varType":"TEXT". },{. "function":"__aev",. "vtp_setDefaultValue":false,. "vtp_varType":"URL",. "vtp_component":"URL". },{. "function":"__gas",. "vtp_cookieDomain":"auto",. "vtp_doubleClick":false,. "vtp_setTrackerName":false,. "vtp_useDebugV

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\logoone-(1)[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 88 x 64, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1214
Entropy (8bit):	7.680912965401732
Encrypted:	false
SSDEEP:	24:BIhJYUsqJCZJanJx/sm7jBQ5/d8MC19apE:BIEAcJan3zxyd8MC1Ia
MD5:	3DDAD31CE589AEDF4653A884891F4E35
SHA1:	3673542712B1F8D82C9C624159BE1F4BD15C4CC0
SHA-256:	1D4674CA84F6CB154146184FF5EE68CE72DEE8529C4768B5A387C2279CDA7487
SHA-512:	EA78F50233D9CD98D21E618B53134E2AA2999D8858CAD3440262AF8A3F2E8E184230C598549A0D44E5EBCB2B6405B31A19E6BB14DF84B40A467341B15E58B0EE
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/images/default-source/default-album/logoone-(1).png?sfvrsn=c28b72b1_0
Preview:	.PNG........IHDR...X...@.......@....cPLTELiq..1..1..1.B_..1..1..1..1..1..1.B_.B_..1..1..1..1.B_.B_..1..1.B_.B_.B_.B_.B_.B_.B_.B_.B_.B_..1.B_.=.u....tRNS...@....$.c...1.P.$x.cP..1...@x........IDATx.X..0.e..E\P....4I.Be..o..S8IN.V.?..LSXZ_.?.f..oK4.X_.h.?......Gn...6....-[z.....Y...b.79..N...c...<LnN.I...[.C...D.T.0.`....)`. n..6...0..b.BrN..+..<.%...3.....k.......W.`.B...}..N:k..+.)\..N..KM...N.2Q.p)....K.A&..,..q................>....k.n.>6's`..'.v.0...ln.......s.n..n...`.l.C........-L.do..X..k!....9...Q.q..j`}..Q...s{=.x>jY.q.2..U....(....qvU..k.D\|X.P"..._+..Q8%1.$.7`......f;V...UT"I...Sm.d'..h...7.W..*.;...\.d..UBv.I...Y....g..v..x.kw..\|........a..Lh.'...3{Y.{.v?........$_.>...].........O.l./.>..m..".6.7J.L.G.O.d..^......p}....f.>.....O.A..m...'...N..KoY..L.-..(...)^.....a.Z..4...,4.E&(..CE.XJkD#.z.qH..e..9....R.....<..4.>..e.....k#...DPFUl.b9..I..;..5).(7...8..z..\.J1.+<. .......'.h<.a..._.#.9.>.s%.....RL`.......yb..E..t.%...\|3.Ip.....y..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\plugins[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	downloaded
Size (bytes):	707242
Entropy (8bit):	5.063270786370052
Encrypted:	false
SSDEEP:	6144:vJyqEPbEq6ha4UqHA5qH50j7mQoR5+n9aNuUhou1eaI7QEI4IawGpIa1URoGtpoE:Rj50CRVou1eaIS9ajeRx8bVUv
MD5:	BA01FF5557E1BECC5B91ACD089E42112
SHA1:	B4D2F073B4FD0A58CE8914F197B4E8CBEBCEA27A
SHA-256:	F05F783C35137C2E8E81E3D6A5D067636EF2F8C4AC7F4DFEC7057F34384B99D9
SHA-512:	5F787AFC2952C39C9078362CCBD8712F79C42F4566E6CC01B3BF5654EA3D28F0D699B999EC289500E3D1AE46BE7213380DC52CC40BBD1463AF7DDC40640E8E18
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ctc.ca.gov/Frontend-Assembly/Telerik.Sitefinity.Frontend/assets/js/plugins.js?package=CTC
Preview:	// ------------ Accordion Plugin ------------ //....$(document).ready(function($){.... 'use strict';.... var defaultConfig = {.. headersSelector: '.js-accordion__header',.. panelsSelector: '.js-accordion__panel',.. buttonsSelector: 'button.js-accordion__header',.. button: $('<button></button>', {.. class: 'js-accordion__header',.. type: 'button'.. }),.. buttonSuffixId: '_tab',.. multiselectable: true,.. prefixClass: 'accordion',.. headerSuffixClass: '__title',.. buttonSuffixClass: '__header',.. panelSuffixClass: '__panel',.. direction: 'ltr'.. };.... var Accordion = function ($el, options) {.. this.options = $.extend({}, defaultConfig, options);.... this.$wrapper = $el;.. this.$panels = $(this.options.panelsSelector, this.$wrapper);.... this.initAttributes();.. this.initEvents();.. };.... Accordion.prototype.initAttributes = function () {.. this.$wrapper.attr({.. 'role': 'tablist',.. 'aria-multiselectable':

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 17:28:58.548635006 CET	49720	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:58.548635960 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:58.765954971 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:58.766010046 CET	443	49720	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:58.766067028 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:58.766105890 CET	49720	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:58.773704052 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:58.773745060 CET	49720	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:58.990297079 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:58.990341902 CET	443	49720	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:58.991844893 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:58.991882086 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:58.991904974 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:58.991930008 CET	443	49720	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:58.991950989 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:58.991955042 CET	443	49720	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:58.991982937 CET	443	49720	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:58.992002964 CET	443	49720	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:58.992011070 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:58.992022038 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:58.992026091 CET	49720	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:58.992078066 CET	49720	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:58.992098093 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.036874056 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.043198109 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.043612957 CET	49720	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.252964973 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.253779888 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.253892899 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.259334087 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.259835958 CET	443	49720	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.260737896 CET	443	49720	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.260843992 CET	49720	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.276191950 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.276257038 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.276273966 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.276299953 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.276309967 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.276350021 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.276354074 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.276395082 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.276401997 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.276436090 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.276449919 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.276477098 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.276489019 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.276516914 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.276535034 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.276557922 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.276561022 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.276590109 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.276598930 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.276633024 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.276648045 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.276684046 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.276691914 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.276729107 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.471086025 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.471273899 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.495663881 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.495711088 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.495738983 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.495763063 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.495784998 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.495812893 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.495815992 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.495835066 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.495867014 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.495893002 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.658536911 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.659372091 CET	49720	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.661727905 CET	49722	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.664686918 CET	49723	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.666663885 CET	49724	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.668848038 CET	49725	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.875093937 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.875591993 CET	443	49720	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.877526999 CET	443	49722	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.877748013 CET	49722	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.878345013 CET	49722	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.879054070 CET	443	49723	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.879168987 CET	49723	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.879663944 CET	49723	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.883388042 CET	443	49724	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.883517027 CET	49724	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.884411097 CET	49724	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.885530949 CET	443	49725	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.885677099 CET	49725	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.886517048 CET	49725	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.889704943 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.889740944 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.889760017 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.889776945 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.889796019 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.889812946 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.889816999 CET	49719	443	192.168.2.4	134.186.81.178
Feb 23, 2021 17:28:59.889830112 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.889849901 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.889869928 CET	443	49719	134.186.81.178	192.168.2.4
Feb 23, 2021 17:28:59.889878035 CET	49719	443	192.168.2.4	134.186.81.178

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 17:28:49.513304949 CET	51025	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:28:49.564703941 CET	53	51025	8.8.8.8	192.168.2.4
Feb 23, 2021 17:28:50.658857107 CET	61516	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:28:50.710473061 CET	53	61516	8.8.8.8	192.168.2.4
Feb 23, 2021 17:28:51.836340904 CET	49182	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:28:51.885101080 CET	53	49182	8.8.8.8	192.168.2.4
Feb 23, 2021 17:28:53.008677959 CET	59920	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:28:53.074289083 CET	53	59920	8.8.8.8	192.168.2.4
Feb 23, 2021 17:28:54.413618088 CET	57458	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:28:54.464019060 CET	53	57458	8.8.8.8	192.168.2.4
Feb 23, 2021 17:28:55.537307978 CET	50579	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:28:55.590353966 CET	53	50579	8.8.8.8	192.168.2.4
Feb 23, 2021 17:28:56.565433025 CET	51703	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:28:56.614168882 CET	53	51703	8.8.8.8	192.168.2.4
Feb 23, 2021 17:28:57.063901901 CET	65248	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:28:57.122289896 CET	53	65248	8.8.8.8	192.168.2.4
Feb 23, 2021 17:28:58.211007118 CET	53723	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:28:58.259805918 CET	53	53723	8.8.8.8	192.168.2.4
Feb 23, 2021 17:28:58.316797018 CET	64646	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:28:58.534461975 CET	53	64646	8.8.8.8	192.168.2.4
Feb 23, 2021 17:28:59.321738958 CET	65298	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:28:59.373229980 CET	53	65298	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:00.618011951 CET	59123	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:00.683532000 CET	53	59123	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:01.244674921 CET	54531	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:01.296180964 CET	53	54531	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:01.340329885 CET	49714	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:01.407497883 CET	53	49714	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:15.663341999 CET	58028	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:15.720452070 CET	53	58028	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:21.167181969 CET	53097	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:21.219360113 CET	53	53097	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:21.615062952 CET	49257	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:21.836616993 CET	53	49257	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:22.158756971 CET	62389	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:22.206291914 CET	49910	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:22.213031054 CET	53	62389	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:22.215945959 CET	55854	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:22.269287109 CET	53	55854	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:22.301199913 CET	53	49910	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:22.307810068 CET	64549	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:22.329907894 CET	63153	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:22.338470936 CET	52991	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:22.350115061 CET	53700	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:22.361597061 CET	53	64549	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:22.389758110 CET	53	52991	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:22.398269892 CET	53	63153	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:22.421304941 CET	53	53700	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:22.980649948 CET	51726	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:23.033066034 CET	53	51726	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:23.530205965 CET	56794	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:23.579638004 CET	53	56794	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:23.727344036 CET	56534	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:23.797981024 CET	56627	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:23.860553026 CET	53	56627	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:23.906455994 CET	56621	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:23.927057981 CET	63116	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:23.948301077 CET	53	56534	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:23.954953909 CET	53	56621	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:23.992384911 CET	53	63116	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:24.171528101 CET	64078	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:24.342837095 CET	64801	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:24.410021067 CET	53	64801	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:24.417655945 CET	53	64078	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:24.479609013 CET	61721	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:24.538767099 CET	53	61721	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:25.397217989 CET	51255	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:25.458719969 CET	53	51255	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:25.727467060 CET	61522	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:25.948427916 CET	53	61522	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:27.082216978 CET	52337	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:27.145207882 CET	53	52337	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:27.798638105 CET	55046	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:27.855824947 CET	53	55046	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:28.178342104 CET	52337	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:28.238302946 CET	53	52337	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:28.802264929 CET	55046	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:28.851074934 CET	53	55046	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:29.177655935 CET	52337	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:29.237658978 CET	53	52337	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:29.817476988 CET	55046	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:29.875519037 CET	53	55046	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:29.882164955 CET	49612	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:29.930984020 CET	53	49612	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:31.527338028 CET	52337	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:31.591351032 CET	53	52337	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:32.157933950 CET	55046	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:32.215681076 CET	53	55046	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:35.541281939 CET	52337	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:35.601336002 CET	53	52337	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:35.675038099 CET	49285	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:35.723720074 CET	53	49285	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:36.162075043 CET	55046	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:36.219084978 CET	53	55046	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:36.602813005 CET	50601	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:36.661648035 CET	53	50601	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:37.763238907 CET	60875	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:37.814539909 CET	53	60875	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:39.017512083 CET	56448	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:39.027295113 CET	59172	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:39.074728966 CET	53	56448	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:39.075984955 CET	53	59172	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:39.121946096 CET	62420	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:39.199486017 CET	53	62420	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:40.281750917 CET	60579	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:40.332142115 CET	53	60579	8.8.8.8	192.168.2.4
Feb 23, 2021 17:29:44.819390059 CET	50183	53	192.168.2.4	8.8.8.8
Feb 23, 2021 17:29:44.879724979 CET	53	50183	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 23, 2021 17:28:58.316797018 CET	192.168.2.4	8.8.8.8	0x89e6	Standard query (0)	www.ctc.ca.gov	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:15.663341999 CET	192.168.2.4	8.8.8.8	0x2a44	Standard query (0)	www.ctc.ca.gov	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:21.615062952 CET	192.168.2.4	8.8.8.8	0xda7a	Standard query (0)	www.ca.gov	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:22.215945959 CET	192.168.2.4	8.8.8.8	0xed0	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:22.307810068 CET	192.168.2.4	8.8.8.8	0x6cd5	Standard query (0)	platform.twitter.com	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:22.980649948 CET	192.168.2.4	8.8.8.8	0x5966	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:23.727344036 CET	192.168.2.4	8.8.8.8	0x2196	Standard query (0)	data.ca.gov	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:23.797981024 CET	192.168.2.4	8.8.8.8	0x8b56	Standard query (0)	siteimproveanalytics.com	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:24.171528101 CET	192.168.2.4	8.8.8.8	0x86b8	Standard query (0)	api.stateentityprofile.ca.gov	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:24.342837095 CET	192.168.2.4	8.8.8.8	0x7695	Standard query (0)	77584.global.siteimproveanalytics.io	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:25.727467060 CET	192.168.2.4	8.8.8.8	0xa06e	Standard query (0)	stateentityprofile.ca.gov	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:36.602813005 CET	192.168.2.4	8.8.8.8	0xc8ff	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:39.017512083 CET	192.168.2.4	8.8.8.8	0x3d06	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:39.121946096 CET	192.168.2.4	8.8.8.8	0x4eb5	Standard query (0)	static.doubleclick.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 23, 2021 17:28:58.534461975 CET	8.8.8.8	192.168.2.4	0x89e6	No error (0)	www.ctc.ca.gov	ctc.ca.gov		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:28:58.534461975 CET	8.8.8.8	192.168.2.4	0x89e6	No error (0)	ctc.ca.gov		134.186.81.178	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:15.720452070 CET	8.8.8.8	192.168.2.4	0x2a44	No error (0)	www.ctc.ca.gov	ctc.ca.gov		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:29:15.720452070 CET	8.8.8.8	192.168.2.4	0x2a44	No error (0)	ctc.ca.gov		134.186.81.178	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:21.836616993 CET	8.8.8.8	192.168.2.4	0xda7a	No error (0)	www.ca.gov	www.ca.gov.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:29:22.269287109 CET	8.8.8.8	192.168.2.4	0xed0	No error (0)	code.jquery.com	cds.s5x3j6q5.hwcdn.net		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:29:22.361597061 CET	8.8.8.8	192.168.2.4	0x6cd5	No error (0)	platform.twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:29:22.361597061 CET	8.8.8.8	192.168.2.4	0x6cd5	No error (0)	platform.twitter.map.fastly.net		151.101.12.157	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:23.033066034 CET	8.8.8.8	192.168.2.4	0x5966	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:29:23.033066034 CET	8.8.8.8	192.168.2.4	0x5966	No error (0)	stats.l.doubleclick.net		74.125.206.155	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:23.033066034 CET	8.8.8.8	192.168.2.4	0x5966	No error (0)	stats.l.doubleclick.net		74.125.206.157	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:23.033066034 CET	8.8.8.8	192.168.2.4	0x5966	No error (0)	stats.l.doubleclick.net		74.125.206.156	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:23.033066034 CET	8.8.8.8	192.168.2.4	0x5966	No error (0)	stats.l.doubleclick.net		74.125.206.154	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:23.860553026 CET	8.8.8.8	192.168.2.4	0x8b56	No error (0)	siteimproveanalytics.com		172.64.130.35	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:23.860553026 CET	8.8.8.8	192.168.2.4	0x8b56	No error (0)	siteimproveanalytics.com		172.64.131.35	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:23.948301077 CET	8.8.8.8	192.168.2.4	0x2196	No error (0)	data.ca.gov	caprod.ogopendata.com		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:29:23.948301077 CET	8.8.8.8	192.168.2.4	0x2196	No error (0)	caprod.ogopendata.com		104.19.218.112	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:23.948301077 CET	8.8.8.8	192.168.2.4	0x2196	No error (0)	caprod.ogopendata.com		104.19.219.112	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:24.410021067 CET	8.8.8.8	192.168.2.4	0x7695	No error (0)	77584.global.siteimproveanalytics.io	eu-central-1.global.siteimproveanalytics.io		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:29:24.410021067 CET	8.8.8.8	192.168.2.4	0x7695	No error (0)	eu-central-1.global.siteimproveanalytics.io	ana-cf-col-elb-78-567119012.eu-central-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:29:24.410021067 CET	8.8.8.8	192.168.2.4	0x7695	No error (0)	ana-cf-col-elb-78-567119012.eu-central-1.elb.amazonaws.com		3.125.230.89	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:24.410021067 CET	8.8.8.8	192.168.2.4	0x7695	No error (0)	ana-cf-col-elb-78-567119012.eu-central-1.elb.amazonaws.com		18.195.246.59	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:24.417655945 CET	8.8.8.8	192.168.2.4	0x86b8	No error (0)	api.stateentityprofile.ca.gov	FD-CDT-SHRD-P001.azurefd.net		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:29:24.417655945 CET	8.8.8.8	192.168.2.4	0x86b8	No error (0)	FD-CDT-SHRD-P001.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:29:25.948427916 CET	8.8.8.8	192.168.2.4	0xa06e	No error (0)	stateentityprofile.ca.gov	FD-CDT-SHRD-P001.azurefd.net		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:29:25.948427916 CET	8.8.8.8	192.168.2.4	0xa06e	No error (0)	FD-CDT-SHRD-P001.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:29:36.661648035 CET	8.8.8.8	192.168.2.4	0xc8ff	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:29:39.074728966 CET	8.8.8.8	192.168.2.4	0x3d06	No error (0)	googleads.g.doubleclick.net		142.250.186.162	A (IP address)	IN (0x0001)
Feb 23, 2021 17:29:39.199486017 CET	8.8.8.8	192.168.2.4	0x4eb5	No error (0)	static.doubleclick.net	static-doubleclick-net.l.google.com		CNAME (Canonical name)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Feb 23, 2021 17:28:58.991904974 CET	134.186.81.178	443	192.168.2.4	49719	CN=*.ctc.ca.gov, O=Commission on Teacher Credentialing, L=Sacramento, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Dec 03 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020 Fri Nov 10 01:00:00 CET 2006	Tue Dec 21 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Feb 23, 2021 17:28:58.991982937 CET	134.186.81.178	443	192.168.2.4	49720	CN=*.ctc.ca.gov, O=Commission on Teacher Credentialing, L=Sacramento, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Dec 03 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020 Fri Nov 10 01:00:00 CET 2006	Tue Dec 21 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Feb 23, 2021 17:29:16.164345980 CET	134.186.81.178	443	192.168.2.4	49734	CN=*.ctc.ca.gov, O=Commission on Teacher Credentialing, L=Sacramento, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Dec 03 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020 Fri Nov 10 01:00:00 CET 2006	Tue Dec 21 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Feb 23, 2021 17:29:22.501301050 CET	151.101.12.157	443	192.168.2.4	49748	CN=platform.twitter.com, OU=Twitter Security, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 13 02:00:00 CEST 2020 Tue Oct 22 14:00:00 CEST 2013	Wed Aug 18 14:00:00 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:22.501301050 CET	151.101.12.157	443	192.168.2.4	49748	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:22.511794090 CET	151.101.12.157	443	192.168.2.4	49749	CN=platform.twitter.com, OU=Twitter Security, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 13 02:00:00 CEST 2020 Tue Oct 22 14:00:00 CEST 2013	Wed Aug 18 14:00:00 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:22.511794090 CET	151.101.12.157	443	192.168.2.4	49749	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:23.142874002 CET	74.125.206.155	443	192.168.2.4	49756	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 26 10:00:56 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Apr 20 11:00:55 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:23.142874002 CET	74.125.206.155	443	192.168.2.4	49756	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:23.142996073 CET	74.125.206.155	443	192.168.2.4	49757	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 26 10:00:56 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Apr 20 11:00:55 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:23.142996073 CET	74.125.206.155	443	192.168.2.4	49757	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:23.949145079 CET	172.64.130.35	443	192.168.2.4	49759	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Thu Aug 06 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Fri Aug 06 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:23.949145079 CET	172.64.130.35	443	192.168.2.4	49759	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:23.950515985 CET	172.64.130.35	443	192.168.2.4	49760	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Thu Aug 06 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Fri Aug 06 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:23.950515985 CET	172.64.130.35	443	192.168.2.4	49760	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:24.055243015 CET	104.19.218.112	443	192.168.2.4	49762	CN=data.ca.gov, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Jul 01 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Jul 01 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:24.055243015 CET	104.19.218.112	443	192.168.2.4	49762	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:24.055445910 CET	104.19.218.112	443	192.168.2.4	49761	CN=data.ca.gov, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Jul 01 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Jul 01 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:24.055445910 CET	104.19.218.112	443	192.168.2.4	49761	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:24.503278017 CET	3.125.230.89	443	192.168.2.4	49768	CN=.global.siteimproveanalytics.io, O=Siteimprove A/S, L=Kbenhavn, C=DK CN=.global.siteimproveanalytics.io, O=Siteimprove A/S, L=Kbenhavn, C=DK CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Mar 30 02:00:00 CEST 2020 Mon Mar 30 02:00:00 CEST 2020 Fri Nov 10 01:00:00 CET 2006 Fri Mar 08 13:00:00 CET 2013	Mon Apr 04 14:00:00 CEST 2022 Mon Apr 04 14:00:00 CEST 2022 Mon Nov 10 01:00:00 CET 2031 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=*.global.siteimproveanalytics.io, O=Siteimprove A/S, L=Kbenhavn, C=DK	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	Mon Mar 30 02:00:00 CEST 2020	Mon Apr 04 14:00:00 CEST 2022
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
Feb 23, 2021 17:29:24.504734039 CET	3.125.230.89	443	192.168.2.4	49769	CN=.global.siteimproveanalytics.io, O=Siteimprove A/S, L=Kbenhavn, C=DK CN=.global.siteimproveanalytics.io, O=Siteimprove A/S, L=Kbenhavn, C=DK CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Mar 30 02:00:00 CEST 2020 Mon Mar 30 02:00:00 CEST 2020 Fri Nov 10 01:00:00 CET 2006 Fri Mar 08 13:00:00 CET 2013	Mon Apr 04 14:00:00 CEST 2022 Mon Apr 04 14:00:00 CEST 2022 Mon Nov 10 01:00:00 CET 2031 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=*.global.siteimproveanalytics.io, O=Siteimprove A/S, L=Kbenhavn, C=DK	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	Mon Mar 30 02:00:00 CEST 2020	Mon Apr 04 14:00:00 CEST 2022
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
Feb 23, 2021 17:29:39.189321995 CET	142.250.186.162	443	192.168.2.4	49789	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 26 10:00:56 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Apr 20 11:00:55 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:39.189321995 CET	142.250.186.162	443	192.168.2.4	49789	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:39.198460102 CET	142.250.186.162	443	192.168.2.4	49790	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 26 10:00:56 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Apr 20 11:00:55 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:29:39.198460102 CET	142.250.186.162	443	192.168.2.4	49790	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 4980 Parent PID: 800

General

Start time:	17:28:55
Start date:	23/02/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff74eed0000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: iexplore.exe PID: 3124 Parent PID: 4980

General

Start time:	17:28:55
Start date:	23/02/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4980 CREDAT:17410 /prefetch:2
Imagebase:	0x1020000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report https://www.ctc.ca.gov/educator-prep/program-accred-sch-act

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Compliance:

Networking:

System Summary:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 4980 Parent PID: 800

General

Analysis Process: iexplore.exe PID: 3124 Parent PID: 4980

General

Disassembly