Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893a

Overview

General Information

Sample URL:https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893a
Analysis ID:1525462

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML title does not match URL
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • chrome.exe (PID: 1996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6788 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1944,i,14019107979205827829,11789596334717270858,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6428 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893a" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected phishing page
Source: https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893aLLM: Score: 8 Reasons: The brand 'DocuSign' is well-known and typically associated with the domain 'docusign.com'., The URL 'docsignfile.z13.web.core.windows.net' does not match the legitimate domain 'docusign.com'., The URL uses a subdomain of 'web.core.windows.net', which is a Microsoft Azure cloud service domain. This can be legitimate if used by a verified customer, but it is also commonly used in phishing attempts., The URL contains 'docsignfile', which is a partial match and could be an attempt to mimic 'DocuSign'., The presence of an input field for 'Email Address' is typical for phishing sites attempting to harvest credentials. DOM: 0.0.pages.csv
Source: https://ceo-pdf.com/&dGVzdEB0ZXN0LmNvbQ==LLM: Score: 8 Reasons: The brand 'Cloudflare' is a well-known internet security and performance company., The URL 'ceo-pdf.com' does not match the legitimate domain 'cloudflare.com'., The domain 'ceo-pdf.com' does not have any clear association with Cloudflare., The presence of a generic input field 'Verify you are human' is often used in phishing sites to appear legitimate., The URL 'ceo-pdf.com' is suspicious as it does not relate to Cloudflare's services or typical domain structure. DOM: 8.6.pages.csv
Source: https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893aHTTP Parser: Number of links: 0
Source: https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893aHTTP Parser: Base64 decoded: https://ceo-pdf.com
Source: https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893aHTTP Parser: Title: Verify Your Identity does not match URL
Source: https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893aHTTP Parser: No favicon
Source: chrome://newtab/HTTP Parser: No favicon
Source: chrome://newtab/HTTP Parser: No favicon
Source: chrome://newtab/HTTP Parser: No favicon
Source: https://ceo-pdf.com/&dGVzdEB0ZXN0LmNvbQ==HTTP Parser: No favicon
Source: https://ceo-pdf.com/&dGVzdEB0ZXN0LmNvbQ==HTTP Parser: No favicon
Source: https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893aHTTP Parser: No <meta name="author".. found
Source: https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893aHTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 27MB later: 39MB
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: global trafficDNS traffic detected: DNS query: logos-world.net
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: apis.google.com
Source: global trafficDNS traffic detected: DNS query: play.google.com
Source: global trafficDNS traffic detected: DNS query: ogs.google.com
Source: global trafficDNS traffic detected: DNS query: ceo-pdf.com
Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: challenges.cloudflare.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: classification engineClassification label: mal48.phis.win@26/27@24/185
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1944,i,14019107979205827829,11789596334717270858,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893a"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1944,i,14019107979205827829,11789596334717270858,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder		1
Process Injection		3
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder		1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Extra Window Memory Injection		1
Extra Window Memory Injection		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
logos-world.net0%VirustotalBrowse
www.google.com0%VirustotalBrowse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
a.nel.cloudflare.com
35.190.80.1
truefalse
    		unknown
    plus.l.google.com
    		142.250.185.142
    		truefalse
      		unknown
      play.google.com
      		142.250.186.46
      		truefalse
        		unknown
        www3.l.google.com
        		172.217.18.14
        		truefalse
          		unknown
          logos-world.net
          		104.26.3.6
          		truefalseunknown
          challenges.cloudflare.com
          		104.18.94.41
          		truefalse
            		unknown
            www.google.com
            		142.250.184.228
            		truefalseunknown
            ceo-pdf.com
            		104.21.48.18
            		truetrue
              		unknown
              ogs.google.com
              		unknown
              		unknownfalse
                		unknown
                apis.google.com
                		unknown
                		unknownfalse
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  chrome://newtab/false
                    		unknown
                    https://ceo-pdf.com/&dGVzdEB0ZXN0LmNvbQ==true
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      142.250.186.46
                      		play.google.comUnited States
                      		15169GOOGLEUSfalse
                      172.217.18.14
                      		www3.l.google.comUnited States
                      		15169GOOGLEUSfalse
                      104.18.94.41
                      		challenges.cloudflare.comUnited States
                      		13335CLOUDFLARENETUSfalse
                      104.26.2.6
                      		unknownUnited States
                      		13335CLOUDFLARENETUSfalse
                      104.26.3.6
                      		logos-world.netUnited States
                      		13335CLOUDFLARENETUSfalse
                      142.250.185.227
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      142.250.185.202
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      57.150.87.132
                      		unknownBelgium
                      		2686ATGS-MMD-ASUSfalse
                      172.217.23.110
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      142.250.185.142
                      		plus.l.google.comUnited States
                      		15169GOOGLEUSfalse
                      142.250.184.227
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      35.190.80.1
                      		a.nel.cloudflare.comUnited States
                      		15169GOOGLEUSfalse
                      142.250.184.228
                      		www.google.comUnited States
                      		15169GOOGLEUSfalse
                      142.250.184.195
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      104.21.48.18
                      		ceo-pdf.comUnited States
                      		13335CLOUDFLARENETUStrue
                      1.1.1.1
                      		unknownAustralia
                      		13335CLOUDFLARENETUSfalse
                      104.18.95.41
                      		unknownUnited States
                      		13335CLOUDFLARENETUSfalse
                      142.250.185.170
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      239.255.255.250
                      		unknownReserved
                      		unknownunknownfalse
                      142.250.185.131
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      142.250.185.195
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      142.250.186.142
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      64.233.184.84
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      172.217.16.195
                      		unknownUnited States
                      		15169GOOGLEUSfalse

                      Private

                      IP
                      192.168.2.16
                      192.168.2.23

                      General Information

                      Joe Sandbox version:41.0.0 Charoite
                      Analysis ID:1525462
                      Start date and time:2024-10-04 09:09:29 +02:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:defaultwindowsinteractivecookbook.jbs
                      Sample URL:https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893a
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:13
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • EGA enabled
                      Analysis Mode:stream
                      Analysis stop reason:Timeout
                      Detection:MAL
                      Classification:mal48.phis.win@26/27@24/185

                      Warnings

                      • Exclude process from analysis (whitelisted): svchost.exe
                      • Excluded IPs from analysis (whitelisted): 142.250.185.131, 142.250.186.142, 64.233.184.84, 57.150.87.132, 34.104.35.123, 142.250.185.202, 142.250.185.170, 142.250.185.106, 172.217.23.106, 142.250.185.74, 172.217.18.106, 142.250.185.138, 216.58.212.138, 172.217.16.202, 142.250.186.138, 142.250.184.202, 142.250.185.234, 142.250.186.106, 142.250.184.234, 142.250.186.74, 216.58.206.74, 93.184.221.240
                      • Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, docsignfile.z13.web.core.windows.net, web.iad11prdstr04a.store.core.windows.net, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com
                      • Not all processes where analyzed, report is missing behavior information
                      • VT rate limit hit for: apis.google.com
                      • VT rate limit hit for: chrome://newtab/
                      • VT rate limit hit for: ogs.google.com
                      • VT rate limit hit for: play.google.com
                      • VT rate limit hit for: plus.l.google.com
                      • VT rate limit hit for: www3.l.google.com

                      LLM Input / Output

                      InputOutput
                      URL: https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893a Model: jbxai
                      {
"brand":["docuSign"],
"contains_trigger_text":true,
"trigger_text":"Verify Your Identity",
"prominent_button_name":"Next",
"text_input_field_labels":["Email Address"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}
                      URL: https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893a Model: jbxai
                      {
"phishing_score":8,
"brands":"docuSign",
"legit_domain":"docusign.com",
"classification":"wellknown",
"reasons":["The brand 'DocuSign' is well-known and typically associated with the domain 'docusign.com'.",
"The URL 'docsignfile.z13.web.core.windows.net' does not match the legitimate domain 'docusign.com'.",
"The URL uses a subdomain of 'web.core.windows.net',
 which is a Microsoft Azure cloud service domain. This can be legitimate if used by a verified customer,
 but it is also commonly used in phishing attempts.",
"The URL contains 'docsignfile',
 which is a partial match and could be an attempt to mimic 'DocuSign'.",
"The presence of an input field for 'Email Address' is typical for phishing sites attempting to harvest credentials."],
"brand_matches":[false],
"url_match":false,
"brand_input":"docuSign",
"input_fields":"Email Address"}
                      URL: https://ceo-pdf.com/&dGVzdEB0ZXN0LmNvbQ== Model: jbxai
                      {
"brand":["ceo-pdf.com"],
"contains_trigger_text":true,
"trigger_text":"ceo-pdf.com needs to review the security of your connection before proceeding.",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":true,
"has_urgent_text":false,
"has_visible_qrcode":false}
                      URL: https://ceo-pdf.com/&dGVzdEB0ZXN0LmNvbQ== Model: jbxai
                      {
"brand":["Cloudflare"],
"contains_trigger_text":true,
"trigger_text":"Verifying you are human. This may take a few seconds.",
"prominent_button_name":"Verifying...",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":true,
"has_urgent_text":false,
"has_visible_qrcode":false}
                      URL: https://ceo-pdf.com/&dGVzdEB0ZXN0LmNvbQ== Model: jbxai
                      {
"phishing_score":5,
"brands":"ceo-pdf.com",
"legit_domain":"ceo-pdf.com",
"classification":"unknown",
"reasons":["The brand name 'ceo-pdf.com' is not recognized as a well-known or known brand.",
"The URL 'ceo-pdf.com' does not match any known legitimate domain associated with a recognized brand.",
"The domain name does not contain any obvious misspellings or suspicious elements,
 but it is not associated with a known brand.",
"The lack of input fields information makes it difficult to assess the site's functionality and potential phishing intent."],
"brand_matches":[false],
"url_match":false,
"brand_input":"ceo-pdf.com",
"input_fields":"unknown"}
                      URL: https://ceo-pdf.com/&dGVzdEB0ZXN0LmNvbQ== Model: jbxai
                      {
"brand":["Cloudflare"],
"contains_trigger_text":true,
"trigger_text":"Verify you are human by completing the action below",
"prominent_button_name":"Verify you are human",
"text_input_field_labels":["Verify you are human"],
"pdf_icon_visible":false,
"has_visible_captcha":true,
"has_urgent_text":false,
"has_visible_qrcode":false}
                      URL: https://ceo-pdf.com/&dGVzdEB0ZXN0LmNvbQ== Model: jbxai
                      {
"phishing_score":8,
"brands":"Cloudflare",
"legit_domain":"cloudflare.com",
"classification":"wellknown",
"reasons":["The brand 'Cloudflare' is a well-known internet security and performance company.",
"The URL 'ceo-pdf.com' does not match the legitimate domain 'cloudflare.com'.",
"The domain 'ceo-pdf.com' does not have any clear association with Cloudflare.",
"The presence of a generic input field 'Verify you are human' is often used in phishing sites to appear legitimate.",
"The URL 'ceo-pdf.com' is suspicious as it does not relate to Cloudflare's services or typical domain structure."],
"brand_matches":[false],
"url_match":false,
"brand_input":"Cloudflare",
"input_fields":"Verify you are human"}

                      Created / dropped Files

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 06:09:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2673
                      Entropy (8bit):3.972541712291867
                      Encrypted:false
                      SSDEEP:
                      MD5:ACC30D73E29449701944D13ED210BAA2
                      SHA1:92DE39EC46967051052A235DB8A5273DDD9893F4
                      SHA-256:082B42FF69455BD96F74E9A7139E337EA9A2CE109F80F4CE5841EFD83A465FA3
                      SHA-512:88BF9D4F4D1A9BDE9D3A116B3E085E84782DE629539DD2028220277706CB96110944E7AAE990A41C57939D3D36DD3190593DF4A1CF70218F30DE095310F54565
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,....o.~l,...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IDY59....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY=9....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDY=9....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDY=9..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDY@9...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... -.s.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 06:09:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2675
                      Entropy (8bit):3.9913377573143802
                      Encrypted:false
                      SSDEEP:
                      MD5:780673F34F366D5666B4510AC8EFB22C
                      SHA1:29BEAEA81AC71B5ECEB6ED45F1BFDF4321762024
                      SHA-256:A67CB849E4CAF32C789CF7B69446B53F7447F1F7EB6EA911F3E30D64356FF77B
                      SHA-512:D2929DA9E0E25E735A154D4318BFCD353437258977981F943463D173D594BBAF4495EE9B0F6DED4C22A0CEC31769272FB5EA50A1FE29032654C74EBC86C06D31
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,....z`nl,...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IDY59....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY=9....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDY=9....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDY=9..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDY@9...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... -.s.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2689
                      Entropy (8bit):4.002341208311325
                      Encrypted:false
                      SSDEEP:
                      MD5:2CCDF9823E3C8077BC8689FFE5D7EB5C
                      SHA1:A673CC83A350F319F25C6775EE49139F6B5A6593
                      SHA-256:D6C8A01530C6B959E531B96019FD1006C2C9D3015EB6FBA864CC7216A1793402
                      SHA-512:A9AAC9DFF347C0C8BC22F05095E27E362E639009810CBBC61D1CB95D6D035F3057EC700B1C0250DEA1EC2DAD5411578DC73B2A3B1A294698A3E4BCFC1248E91C
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IDY59....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY=9....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDY=9....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDY=9..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... -.s.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 06:09:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2677
                      Entropy (8bit):3.9871291333803334
                      Encrypted:false
                      SSDEEP:
                      MD5:987217DBBA04F88540D8B32B2BC1486C
                      SHA1:088531EC036E4C7775E1F50B23C04D3F02D692C9
                      SHA-256:E6E80CCADD748AFA55D2D66292C1694773446359B7AA2EE33474DE7F0CEDF8DB
                      SHA-512:CD4EA080C09FB915EC6BBFD4EBA1A6215DFF1337A2991D7610A0272F6DB936BA6002E77A8EFF9FA979B69E427D86738B279D24303D48714F7DE3DE8D2D33EEF2
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,....c.hl,...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IDY59....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY=9....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDY=9....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDY=9..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDY@9...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... -.s.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 06:09:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2677
                      Entropy (8bit):3.977283161680573
                      Encrypted:false
                      SSDEEP:
                      MD5:AF34042EFB6DAF546012DDE8E10CCDBF
                      SHA1:F338F064F0281D5566DDD57E447370704A0DF70D
                      SHA-256:0DB4A32792FBF4C234AF6E818BC50096A7E07CF2A0A56E579D168A7DDD31C985
                      SHA-512:8286070CFC419A81D4604DBF0F14E1DCEAD1C9A41F77C909E7D8005E89738D63A953D100AEB6A0AB87CC100CE46DA61166F64A9F2733752B75B7254C5A815161
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,....3{tl,...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IDY59....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY=9....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDY=9....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDY=9..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDY@9...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... -.s.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 06:09:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2679
                      Entropy (8bit):3.985733223315561
                      Encrypted:false
                      SSDEEP:
                      MD5:1D8964C5AEB48D4A5795BA45BBF65BBE
                      SHA1:08CA13549FB579EF1CA8E9AEBF28C7FD10463E21
                      SHA-256:9DC7111C0207DD26033186904C8111FEF811FCB6B9165B717179B753F9662EF5
                      SHA-512:63694256695A52DE70CE3128F5F6163CBE635E1C23144ABE7A8EED6216B7F97F680D1DEC456AFCF277DF32B224EA6015584E8AD6A23D39F63D38921C8DB76C53
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,......`l,...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IDY59....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY=9....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDY=9....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDY=9..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDY@9...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... -.s.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      Chrome Cache Entry: 103

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with no line terminators
                      Category:downloaded
                      Size (bytes):16
                      Entropy (8bit):3.875
                      Encrypted:false
                      SSDEEP:
                      MD5:156DF0210BF420106CB8AFEBCB3A27D2
                      SHA1:970B5EA1194F50A291A239C58D73159FDEC1BA64
                      SHA-256:EBDD332E8562CE34374C310F84F4527D93D3F9D2AC27410F824C6647A4DF1DDB
                      SHA-512:9AE3CC4E8F274B2A5C2BAA6CE1163181C50071378BE3A782FBA8FF8D7F374E9408BCD137E5B217684DDC470244FEA8C6005AF5B96D25BA3AD086550679DF6578
                      Malicious:false
                      Reputation:unknown
                      URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAnGbQ3BwNV4WxIFDZjmzqo=?alt=proto
                      Preview:CgkKBw2Y5s6qGgA=

                      Chrome Cache Entry: 104

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
                      Category:downloaded
                      Size (bytes):15344
                      Entropy (8bit):7.984625225844861
                      Encrypted:false
                      SSDEEP:
                      MD5:5D4AEB4E5F5EF754E307D7FFAEF688BD
                      SHA1:06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
                      SHA-256:3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
                      SHA-512:7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
                      Malicious:false
                      Reputation:unknown
                      URL:https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
                      Preview:wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h|.l....A....b6........(......@e.]...*:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#*e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.*UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...*$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf*.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed.*.'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

                      Chrome Cache Entry: 106

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:SVG Scalable Vector Graphics image
                      Category:downloaded
                      Size (bytes):1660
                      Entropy (8bit):4.301517070642596
                      Encrypted:false
                      SSDEEP:
                      MD5:554640F465EB3ED903B543DAE0A1BCAC
                      SHA1:E0E6E2C8939008217EB76A3B3282CA75F3DC401A
                      SHA-256:99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
                      SHA-512:462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
                      Malicious:false
                      Reputation:unknown
                      URL:https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
                      Preview:<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

                      Chrome Cache Entry: 107

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (1279)
                      Category:dropped
                      Size (bytes):202152
                      Entropy (8bit):5.475451252598485
                      Encrypted:false
                      SSDEEP:
                      MD5:D36D84843A7A62C2FBBE0F6336670534
                      SHA1:DF36AC0062B21E6ACFAD7EBD65355EBCA6E239EF
                      SHA-256:E00C5CC92538BDC465E3A12E3B874B79DDA37D1B51D0AB5BF180E54FFABAC8AF
                      SHA-512:B1445703AD009BC2A3D8DE5308FDC9AAF2A596EA9D3BED5C0EEC1C4BD10625F608461F922A90B776CFF8605D8AF2E28A2ADCD0B0A62CD946866C786A444D4412
                      Malicious:false
                      Reputation:unknown
                      Preview:"use strict";this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x20304020, 0x1b1, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/./*. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT.*/.var ia,aaa,Ga,baa,Ja,cb,sb,Hb,Mb,Nb,Ob,Pb,Qb,Rb,Tb,Wb,eaa,faa,Yb,$b,gc,jc,lc,gaa,rc,sc,tc,zc,Gc,Hc,Kc,Mc,Oc,Qc,Lc,Tc,laa,hd,ed,jd,maa,naa,sd,rd,oaa,wd,paa,yd,qaa,zd,raa,Gd,saa,Kd,Qd,Rd,Td,Xd,Yd,Wd,$d,we,ze,He,Fe,Ie,z,Me,Pe,Te,$e,ef,yaa,zaa,Aaa,Baa,Caa,Daa,Eaa,Faa,Gaa,Haa,Iaa,Jaa,Kaa,Laa,ag,eg,Raa,Paa,pg,Vaa,wg,zg,Xaa,Yaa,Bg,Qg,bba,cba,Vg,dba,eba,hh,fba,gba,wh,xh,yh,hba,iba,Bh,kba,lba,Fh,Gh,pba,rba,sba,tba,uba,vba,wba,xba,zba,Aba,Bba,Dba,

                      Chrome Cache Entry: 108

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (3521)
                      Category:dropped
                      Size (bytes):21593
                      Entropy (8bit):5.4043969828957215
                      Encrypted:false
                      SSDEEP:
                      MD5:EF2BE4DC1F0BBEBFF9FDED6E0C05F3E3
                      SHA1:1531B7819E6BE8C3D709D5E209B33344FCF07C83
                      SHA-256:9CD8E1EBEDBFB992859F20ADC7CF68CD06D0FA1CDF843FB149B7E33D359C1704
                      SHA-512:79B739927746E6BACF438609D5600C71DE3795F27239137B95FAB7B22FA98DCEDD8EDA73419B2F58D80D5CAC9F84392CCB016C23A91618DC9F044D1087D70405
                      Malicious:false
                      Reputation:unknown
                      Preview:"use strict";this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi||{};(function(_){var window=this;.try{._.CF=function(){var a,b,c,d;return(d=BF)!=null?d:BF=Object.freeze({Zb:function(e){return _.of(_.Ee("iCzhFc"),!1)||e===-1},Ig:(a=_.fm(_.Ee("y2FhP")))!=null?a:void 0,eu:(b=_.fm(_.Ee("MUE6Ne")))!=null?b:void 0,eg:(c=_.fm(_.Ee("cfb2h")))!=null?c:void 0,Ze:_.hm(_.Ee("yFnxrf"),-1),Cu:_.lm(_.Ee("fPDxwd")).map(function(e){return _.hm(e,0)}).filter(function(e){return e>0})})};var BF;._.q("RqjULd");.var Uha=function(a){if(_.n&&_.n.performance&&_.n.performance.memory){var b=_.n.performance.memory;if(b){var c=new tG;isNaN(b.jsHeapSizeLimit)||_.uf(c,1,_.gd(Math.round(b.jsHeapSizeLimit).toString()));isNaN(b.totalJSHeapSize)||_.uf(c,2,_.gd(Math.round(b.totalJSHeapSize).toString()));isNaN(b.usedJSHeapSize)||_.uf(c,3,_.gd(Math.round(b.usedJSHeapSize).toString()));_.ul(a,tG,1,c)}}},Vha=function(a){if(uG()){var b=performance.getEntriesByType("navigation");if(b&&b.length){var c=new vG;if(b=b[0

                      Chrome Cache Entry: 109

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:PNG image data, 12 x 83, 8-bit/color RGB, non-interlaced
                      Category:dropped
                      Size (bytes):61
                      Entropy (8bit):4.035372245524405
                      Encrypted:false
                      SSDEEP:
                      MD5:C2B545B248872244EDE1FA888A9C673C
                      SHA1:0A45620F1DB2821F718CFDEA170B73B8B2629C9F
                      SHA-256:4D0034D0639AFD86FEDE9791FB70A3760AB7208BD6ECF807324880BD2A192B77
                      SHA-512:A94CDB744303398E82F97F0CCB0D8C44373BF7A60D72B553EB31D763BA2DE9E9C72F52D20F311E0A85CFC60D576E006C86AE2038F2028191083A483127E8633B
                      Malicious:false
                      Reputation:unknown
                      Preview:.PNG........IHDR.......S.....$.q.....IDAT.....$.....IEND.B`.

                      Chrome Cache Entry: 110

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (736)
                      Category:downloaded
                      Size (bytes):3516
                      Entropy (8bit):5.552055740061078
                      Encrypted:false
                      SSDEEP:
                      MD5:BDF45A6BA57F872963259DA69256A45E
                      SHA1:0F6328EA074F20F841EF27871D04F7A61ABFC580
                      SHA-256:89474426B70726A283415671A654B2B74E2C9999CAD67BCC2F072856621BC05B
                      SHA-512:F35AC64D7D4923B848145FE487BB4E7A93A29C81E6B2BEDE806691D21145B648CC968961E23CEB328AA0DC4D0D6FF2CCD128DBDCAC15461A8AA713F12479F6D7
                      Malicious:false
                      Reputation:unknown
                      URL:"https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.OlyLa8GkuaI.es5.O/ck=boq-one-google.OneGoogleWidgetUi.-thgPwNVrLw.L.B1.O/am=IEAwYGw/d=1/exm=A1yn5d,A7fCU,BVgquf,EEDORb,EFQ78c,GkRiKb,IZT63,JNoxi,KUM7Z,L1AAkb,LEikZe,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PrPYRd,QIhFr,RMhBfe,RqjULd,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,XVMNvd,Z5uLle,ZDZcre,ZfAoz,ZwDk9d,_b,_tp,aDfbSd,aW3pY,aurFic,byfTOb,e5qFLc,ebZ3mb,fKUV3e,gychg,hKSk3e,hc6Ubd,kWgXee,kjKdXe,lazG7b,lsjVmc,lwddkf,mI3LFb,mdR7q,n73qwf,ovKuLd,pjICDe,pw70Gc,s39S4,w9hDv,wmnU7d,ws9Tlc,xQtZb,xUdipf,yDVVkb,zbML3c,zr1jrb/excm=_b,_tp,appwidgetnoauthview/ed=1/wt=2/ujg=1/rs=AM-SdHsBZGUsqOLkp1tQbc4AdY2xMI9Jeg/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;wR5FRb:O1Gjze;xqZiqf:wmnU7d;yxTchf:KUM7Z;zxnPse:GkRiKb/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
                      Preview:"use strict";this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi||{};(function(_){var window=this;.try{._.q("Wt6vjf");.var Mz=function(a){this.ta=_.y(a,0,Mz.mb)};_.G(Mz,_.C);Mz.prototype.Xa=function(){return _.xl(this,1)};Mz.prototype.oc=function(a){_.Jl(this,1,a)};Mz.mb="f.bo";var Nz=function(){_.Vo.call(this)};_.G(Nz,_.Vo);Nz.prototype.ab=function(){this.Yq=!1;Oz(this);_.Vo.prototype.ab.call(this)};Nz.prototype.j=function(){Pz(this);if(this.lk)return Qz(this),!1;if(!this.js)return Rz(this),!0;this.dispatchEvent("p");if(!this.np)return Rz(this),!0;this.ao?(this.dispatchEvent("r"),Rz(this)):Qz(this);return!1};.var Sz=function(a){var b=new _.tu(a.yx);a.bq!=null&&b.j.set("authuser",a.bq);return b},Qz=function(a){a.lk=!0;var b=Sz(a),c="rt=r&f_uid="+_.Xl(a.np);_.Aq(b,(0,_.E)(a.l,a),"POST",c)};.Nz.prototype.l=function(a){a=a.target;Pz(this);if(_.Hq(a)){this.fn=0;if(this.ao)this.lk=!1,this.dispatchEvent("r");else if(this.js)this.dispatchEvent("s");else{try{var b=_.Iq(a),c=JSON.pars

                      Chrome Cache Entry: 111

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (1657)
                      Category:downloaded
                      Size (bytes):268020
                      Entropy (8bit):5.480844757736513
                      Encrypted:false
                      SSDEEP:
                      MD5:FCAE06CC8CC3B658FAD7F552225BDBBC
                      SHA1:13A6C39FE8F233256E645BC675C01964556DCFD5
                      SHA-256:328D49C43F4C091B6CD42FCAEE754C4D04D7082A68C88715C763992D157A9F87
                      SHA-512:9C04535D3F96A04ED47B7D3F2B53E53F8AB860CEDA84DD1B75F94DA23C538C7D4034D980C747A5A0CD2900A1B45F631B0616D1E0209B3C0D2E4E312EE35257B3
                      Malicious:false
                      Reputation:unknown
                      URL:"https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.OlyLa8GkuaI.es5.O/ck=boq-one-google.OneGoogleWidgetUi.-thgPwNVrLw.L.B1.O/am=IEAwYGw/d=1/exm=_b,_tp/excm=_b,_tp,appwidgetnoauthview/ed=1/wt=2/ujg=1/rs=AM-SdHsBZGUsqOLkp1tQbc4AdY2xMI9Jeg/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;wR5FRb:O1Gjze;xqZiqf:wmnU7d;yxTchf:KUM7Z;zxnPse:GkRiKb/m=ws9Tlc,n73qwf,GkRiKb,e5qFLc,IZT63,UUJqVe,O1Gjze,byfTOb,lsjVmc,xUdipf,OTA3Ae,A1yn5d,fKUV3e,aurFic,Ug7Xab,ZwDk9d,V3dDOb,mI3LFb,aDfbSd,O6y8ed,PrPYRd,MpJwZc,LEikZe,NwH0H,OmgaI,lazG7b,XVMNvd,L1AAkb,KUM7Z,Mlhmy,s39S4,lwddkf,gychg,w9hDv,EEDORb,RMhBfe,SdcwHb,aW3pY,pw70Gc,EFQ78c,Ulmmrd,ZfAoz,mdR7q,wmnU7d,xQtZb,JNoxi,kWgXee,MI6k7c,kjKdXe,BVgquf,QIhFr,ovKuLd,hKSk3e,yDVVkb,hc6Ubd,SpsfSb,ebZ3mb,Z5uLle,MdUzUe,ZDZcre,zbML3c,A7fCU,zr1jrb,Uas9Hd,pjICDe"
                      Preview:"use strict";_F_installCss(".KL4X6e{background:#eee;bottom:0;left:0;opacity:0;position:absolute;right:0;top:0}.TuA45b{opacity:.8}sentinel{}");.this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi||{};(function(_){var window=this;.try{._.Uz=function(a,b,c,d,e,f,g){var h=(0,_.Jd)(a.ta);_.Ac(h);a=_.ke(a,h,c,b,2,f,!0);c=d!=null?d:new c;if(g&&(typeof e!=="number"||e<0||e>a.length))throw Error();e!=void 0?a.splice(e,g,c):a.push(c);(0,_.yc)(c.ta)&2?(0,_.jl)(a,8):(0,_.jl)(a,16)};_.Wz=function(a){if(a instanceof _.Vz)return a.j;throw Error("w");};_.Xz=function(a){return new _.Vz(_.La,a[0].toLowerCase())};._.Yz=function(a,b,c,d){if(a.length===0)throw Error("w");a=a.map(function(f){return _.Wz(f)});var e=c.toLowerCase();if(a.every(function(f){return e.indexOf(f)!==0}))throw Error("ga`"+c);b.setAttribute(c,d)};_.ct.prototype.kc=_.ca(28,function(){return this.rb.length==0?null:new _.M(this.rb[0])});_.M.prototype.kc=_.ca(27,function(){return this});_.ct.prototype.Ia=_.ca(26,function(){retur

                      Chrome Cache Entry: 112

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:HTML document, ASCII text, with very long lines (20800)
                      Category:downloaded
                      Size (bytes):51470
                      Entropy (8bit):5.68330152757968
                      Encrypted:false
                      SSDEEP:
                      MD5:2B8341AD512915332A1690402757F669
                      SHA1:6F9980265EFF3BD2F78B52EF5FC2378A67DCE160
                      SHA-256:C576BB37FB8E1CEA87A47C8CA3D09C27444F84D381EFACEAAF49FC83EEC67B31
                      SHA-512:17F3A57335C1AE0F0A7FB4A9F1EF8F1AD09F5ECBE675483F48B1CDC2ADFBADBAE39422DD5FAE8E2A65B74922D8D4F277A4D0B0F3B43AB7BFF4BB2389006EA3F3
                      Malicious:false
                      Reputation:unknown
                      URL:https://ogs.google.com/widget/app/so?eom=1&awwd=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=app&pid=1&spid=243&hl=en
                      Preview:<!doctype html><html lang="en" dir="ltr"><head><base href="https://ogs.google.com/"><link rel="preconnect" href="//www.gstatic.com"><meta name="referrer" content="origin"><link rel="canonical" href="https://ogs.google.com/widget/app/so"><link rel="preconnect" href="https://www.gstatic.com"><link rel="preconnect" href="https://ssl.gstatic.com"><script data-id="_gd" nonce="ZyFjy-R6wU0tLXpFlzBLAA">window.WIZ_global_data = {"DpimGf":false,"EP1ykd":["/_/*"],"FdrFJe":"-9094713735070670739","Im6cmf":"/_/OneGoogleWidgetUi","LVIXXb":1,"LoQv7e":true,"MT7f9b":[],"MUE6Ne":"OneGoogleWidgetUi","NrSucd":false,"OwAJ6e":false,"QrtxK":"","S06Grb":"","S6lZl":128566913,"TSDtV":"%.@.[[null,[[45459555,null,false,null,null,null,\"Imeoqb\"]],\"CAMSEh0X2eicEJbkAfaumhAKs5wNCg\\u003d\\u003d\"]]]","Vvafkd":false,"Yllh3e":"%.@.1728025868321695,151689576,471371709]","ZwjLXe":243,"cfb2h":"boq_onegooglehttpserver_20240929.01_p0","eptZe":"/_/OneGoogleWidgetUi/","fPDxwd":[48691166,48802160,97517168,97684531],"gGcLoe":f

                      Chrome Cache Entry: 113

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text
                      Category:downloaded
                      Size (bytes):19
                      Entropy (8bit):3.6818808028034042
                      Encrypted:false
                      SSDEEP:
                      MD5:9FAE2B6737B98261777262B14B586F28
                      SHA1:79C894898B2CED39335EB0003C18B27AA8C6DDCD
                      SHA-256:F55F6B26E77DF6647E544AE5B45892DCEA380B7A6D2BFAA1E023EA112CE81E73
                      SHA-512:29CB8E5462B15488B0C6D5FC1673E273FB47841E9C76A4AA5415CA93CEA31B87052BBA511680F2BC9E6543A29F1BBFBA9D06FCC08F5C65BEB115EE7A9E5EFF36
                      Malicious:false
                      Reputation:unknown
                      URL:https://www.google.com/async/ddljson?async=ntp:2
                      Preview:)]}'.{"ddljson":{}}

                      Chrome Cache Entry: 81

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:PNG image data, 106 x 5326, 8-bit/color RGBA, non-interlaced
                      Category:dropped
                      Size (bytes):140703
                      Entropy (8bit):7.983127067940613
                      Encrypted:false
                      SSDEEP:
                      MD5:EB7895BA582FA7CBA9531AB42D9ED8C2
                      SHA1:740B43A2997F24D6859896BB46541BA2CE208F8A
                      SHA-256:4966326CB66EBA65E26B589887981530EEB795373529563244F4F29F18CAB78F
                      SHA-512:B405FE99FFF3F9FBBC2849F4DEAC45CB3CD252A66E7F11FB20ED16E93AA0D63C752569BF42961910ADEBF0915388725FDBA531283C9FC963B7B4221E066A357F
                      Malicious:false
                      Reputation:unknown
                      Preview:.PNG........IHDR...j.........E=/...%fIDATx......... ..6.T1.............=.Ir....fn.....Cl.b..Bl.m.f!..[.N....M...}......^..E.AF.U@.}P.@..;y|.......m.\f....c*2@;."+e.7=0....}.V..5s..>,..........Y..5....:5|...Z.%2..'L..>.S1I.....`1..%1?f..t ....C..c..`...Gx...V.P%.....G?].d|.Gq9~FV.P%...X.=%.g.x.Y...X..I^.x.P.....6R.....y..`]l.3.FX..<B..6.3I?l..y....]^......F4t.....t..jh.&..Y.P..h..I.#P....9$.....EOI.zb..fGU.*f..j>t..J..=5../f..(...Ks.),..&TB....DU.f......9.....\.$..3f.!..C.Q.2b.'......f..@...*..3T&_!J...:W\.E.....~e1C....4..v..9.8..+..Yc..C.-..G..UW..<.(.9b.*.n...u.\w.[mE...&.........e......B.R.......n...:.j5.*l.y....5.p..,.`.U..k.pN8.k.e.]..5...f.Wx.u..!..iF%..jEM3.>..^.k........+.......v...R$i.W...w.u......DJ3*..<.G...K..n.TE.BM......>...&)....#....[....{..?+./.....{.m1#..sF.F..E0~<.?.u...k..(..F..U..,.....%...L...^l.....6.J%....[o..B.z].al.P?..=.6rd...+..O4.v...`.....L:.f...Zc.o.&..Z.hNm.6...vI..12f..."iT.......%......jx..;M.

                      Chrome Cache Entry: 82

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
                      Category:dropped
                      Size (bytes):61
                      Entropy (8bit):3.990210155325004
                      Encrypted:false
                      SSDEEP:
                      MD5:9246CCA8FC3C00F50035F28E9F6B7F7D
                      SHA1:3AA538440F70873B574F40CD793060F53EC17A5D
                      SHA-256:C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
                      SHA-512:A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
                      Malicious:false
                      Reputation:unknown
                      Preview:.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

                      Chrome Cache Entry: 84

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:HTML document, ASCII text
                      Category:downloaded
                      Size (bytes):3263
                      Entropy (8bit):4.87156115787977
                      Encrypted:false
                      SSDEEP:
                      MD5:3210F10D14D925729EC3AA7D787A1072
                      SHA1:CF31C4CA588B43031088858AFFB334E560421D53
                      SHA-256:427E131CB609D6D0D5E5A03598B112438F73C9D52461DEBA458D61D3350D8F20
                      SHA-512:E4A25DEB683B4143B646871C59B53559F2282620C5C99EF23439DF708A287FA5191EF22F9EA3E898BAE743E4AE52018CA25133484AA61A71F606B4125E66D973
                      Malicious:false
                      Reputation:unknown
                      URL:https://docsignfile.z13.web.core.windows.net/favicon.ico
                      Preview:<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Verify Your Identity</title>. <style>. body { . font-family: "Segoe UI", sans-serif; . background-color: #f4f4f4; . display: flex; . justify-content: center; . align-items: center; . height: 100vh; . margin: 0;. color: #333; . } . .container { . background-color: white; . border: 1px solid #ccc; . border-radius: 5px; . padding: 20px; . width: 90%; . max-width: 350px; . box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); . text-align: center; . } . .container img { . width: 80px; . margin-bottom: 15px; . } . .container h2 { . font-size: 20px; . color: #333; . margin-bottom: 15px; . } . .container p { . color: #666; . margin-bottom: 10px; . font-size: 14px;. } . .container input[type="email"] { . w

                      Chrome Cache Entry: 85

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (3315)
                      Category:downloaded
                      Size (bytes):3320
                      Entropy (8bit):5.849597398753588
                      Encrypted:false
                      SSDEEP:
                      MD5:286DB0D1D5C4E47D35E3C9D779F9F9A6
                      SHA1:0D802BAA37718A9F5D49D4EB9219D2596A6285C5
                      SHA-256:F36439DEB99892324E425E62E5568D7C0F8FE3628900650322F14A6A7B94A075
                      SHA-512:093BC5732FCFBD72EB4347141FDA2EC6E5E8A3C5BE41BEDDFD475B30F8E19AB5558A6CC03602C5579561ADF2CF69CC840947831B70F8B3DE19B125B6901E6FF6
                      Malicious:false
                      Reputation:unknown
                      URL:https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
                      Preview:)]}'.["",["blue ridge parkway closed indefinitely","rsd black friday 2024","dow jones stock markets","bg3 console mods ps5","san francisco 49ers","throne liberty amitoi house","2025 ford expedition platinum","bay area heat wave temperatures"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CggvbS8wNnJueRINRm9vdGJhbGwgdGVhbTLWDWRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRUFBQUFBbUNBTUFBQUJER20yckFBQUE4MUJNVkVYLy8vK3FBQUFBQUFDdEFBQnpBQUN3QUFCZUFBQzBuMkY2QUFDakFBRGQzZDJ6QUFCeWVIajM5L2U2b0dIOC9Qemg1dWE3cFdTb3FLaVNBQUNNQUFEUzB0S3VWalJtYkd6cTZ1cUFnSURLeXNwZ1dEVzFjRVJ5VkZRWEZ4ZDRaajZFQUFDckZ3NmlpMVN0Unl0VUFBQ3ZaajVFUkVTQ2IwT05qWTJzTnlLYkFBQzB0TFNlbnA1ZlgxODFOamNQRVJVb0poTkJQQ05XVGkrNGtsbTRnayt6WVR1eGxWb1lGd3dqSXlNa0lCT3RLUm1ubFZzMExoeUNlSGhxQUFCNGJHeFdGUlZoT3pzaE5qWkZUazVUSlNWUVcxdGdKQ1J

                      Chrome Cache Entry: 86

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text
                      Category:downloaded
                      Size (bytes):29
                      Entropy (8bit):3.9353986674667634
                      Encrypted:false
                      SSDEEP:
                      MD5:6FED308183D5DFC421602548615204AF
                      SHA1:0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
                      SHA-256:4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
                      SHA-512:A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
                      Malicious:false
                      Reputation:unknown
                      URL:https://www.google.com/async/newtab_promos
                      Preview:)]}'.{"update":{"promos":{}}}

                      Chrome Cache Entry: 87

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (768)
                      Category:dropped
                      Size (bytes):1425
                      Entropy (8bit):5.352015286891893
                      Encrypted:false
                      SSDEEP:
                      MD5:F989AA4A304254FE7C53F1A299D3E3C7
                      SHA1:0A6BBF0E3C59855D6CBE269B3AD991C8848F4288
                      SHA-256:47F3A84A8B30F8380C7DDB46F5F753174626C6A7D1A17F482C202F457397E393
                      SHA-512:3DD76D30ABDA12DB3F85BC6DFDE67243C8BD3C818D0F3BAC5C9E9D4E7B39454C2F178844F70286B643F3BBCCB73954E1612428B4DAA89745B0FDCDF83FE9BF49
                      Malicious:false
                      Reputation:unknown
                      Preview:"use strict";this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi||{};(function(_){var window=this;.try{._.q("P6sQOc");.var rpa=!!(_.Bi[0]>>26&1);var spa=function(a,b,c,d,e){this.o=a;this.N=b;this.v=c;this.O=d;this.ha=e;this.j=0;this.l=QY(this)},tpa=function(a){var b={};_.Ea(a.Lq(),function(e){b[e]=!0});var c=a.Dq(),d=a.Fq();return new spa(a.Eq(),c.j()*1E3,a.yq(),d.j()*1E3,b)},QY=function(a){return Math.random()*Math.min(a.N*Math.pow(a.v,a.j),a.O)},RY=function(a,b){return a.j>=a.o?!1:b!=null?!!a.ha[b]:!0};var SY=function(a){_.S.call(this,a.oa);this.l=a.service.Zr;this.o=a.service.metadata;a=a.service.hE;this.fetch=a.fetch.bind(a)};_.G(SY,_.S);SY.W=function(){return{service:{Zr:_.OY,metadata:_.KY,hE:_.FW}}};SY.prototype.j=function(a,b){if(this.o.getType(a.wb())!==1)return _.vp(a);var c=this.l.Gr;(c=c?tpa(c):null)&&RY(c)?(b=TY(this,a,b,c),a=new _.up(a,b,2)):a=_.vp(a);return a};.var TY=function(a,b,c,d){return c.then(function(e){return e},function(e){if(rpa)if(e instanceof _.yf){

                      Chrome Cache Entry: 88

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (5162), with no line terminators
                      Category:downloaded
                      Size (bytes):5162
                      Entropy (8bit):5.3533581296433415
                      Encrypted:false
                      SSDEEP:
                      MD5:6776548F23C2A44FBD3C7343F0CB43E1
                      SHA1:1E6871D4196BB00F0D161D5DC8872A8D940CEC30
                      SHA-256:DDFC74A717ADCA6E6DB1BCF58D64FF7205F52BA4B61617A0137045088622C86E
                      SHA-512:947B3AC76BC7B6DF6FD1C4AEA94E79D1E168E3B15BB4DC2A497E3DAFF60DAA58A490C89BA11A10910BB4B21C79A56CEAEDFFAE32A77D39E245422BE874BF7CF1
                      Malicious:false
                      Reputation:unknown
                      URL:"https://www.gstatic.com/og/_/ss/k=og.qtm.fSHv1dvvroY.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTsVA9_hKyGtH1-UzkVaxmvYQjNv7Q"
                      Preview:.gb_Q{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ka{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_La{fill:#f9ab00}.gb_F .gb_La{fill:#fdd663}.gb_Ma>.gb_La{fill:#d93025}.gb_F .gb_Ma>.gb_La{fill:#f28b82}.gb_Ma>.gb_Na{fill:white}.gb_Na,.gb_F .gb_Ma>.gb_Na{fill:#202124}.gb_Oa{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

                      Chrome Cache Entry: 92

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (1885)
                      Category:downloaded
                      Size (bytes):126135
                      Entropy (8bit):5.498654960721984
                      Encrypted:false
                      SSDEEP:
                      MD5:C299A572DF117831926BC3A0A25BA255
                      SHA1:673F2AC4C7A41AB95FB14E2687666E81BC731E95
                      SHA-256:F847294692483E4B7666C0F98CBE2BD03B86AE27B721CAE332FEB26223DDE9FC
                      SHA-512:B418A87A350DBC0DEF9FAF3BE4B910CB21AE6FFFC6749EECEA486E3EB603F5AF92F70B936C3D440009482EDE572EE9736422CF89DCDD2B758DFA829216049179
                      Malicious:false
                      Reputation:unknown
                      URL:"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SpvAvsXfWWo.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-MoqWi0fF1M09Ccs-6QfulXvxfdg/cb=gapi.loaded_0"
                      Preview:gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x800000, ]);.var ba,fa,ha,na,oa,sa,ua,wa;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};fa=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=ha(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&fa(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

                      Chrome Cache Entry: 93

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (47261)
                      Category:dropped
                      Size (bytes):47262
                      Entropy (8bit):5.3974731018213795
                      Encrypted:false
                      SSDEEP:
                      MD5:E07E7ED6F75A7D48B3DF3C153EB687EB
                      SHA1:4601D83C67CC128D1E75D3E035FB8A3BDFA1EE34
                      SHA-256:96BD1C81D59D6AC2EC9F8EBE4937A315E85443667C5728A7CD9053848DD8D3D7
                      SHA-512:A0BAF8B8DF121DC9563C5C2E7B6EEE00923A1E684A6C57E3F2A4C73E0D6DD59D7E9952DF5E3CFFFB08195C8475B6ED261769AFB5581F4AB0C0A4CC342EC577C9
                      Malicious:false
                      Reputation:unknown
                      Preview:"use strict";(function(){function Vt(e,r,a,o,c,l,g){try{var f=e[l](g),p=f.value}catch(s){a(s);return}f.done?r(p):Promise.resolve(p).then(o,c)}function Wt(e){return function(){var r=this,a=arguments;return new Promise(function(o,c){var l=e.apply(r,a);function g(p){Vt(l,o,c,g,f,"next",p)}function f(p){Vt(l,o,c,g,f,"throw",p)}g(void 0)})}}function U(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):U(e,r)}function Me(e,r,a){return r in e?Object.defineProperty(e,r,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[r]=a,e}function Fe(e){for(var r=1;r<arguments.length;r++){var a=arguments[r]!=null?arguments[r]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){Me(e,c,a[c])})}return e}function Rr(e,r){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

                      Chrome Cache Entry: 94

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (65531)
                      Category:downloaded
                      Size (bytes):133782
                      Entropy (8bit):5.4349899377931745
                      Encrypted:false
                      SSDEEP:
                      MD5:474AC12DD57212F132414789629816D0
                      SHA1:69D08C45E483CB189F024FD5202E00D1B3D9CC88
                      SHA-256:DF33EE70B0C63225875397007CF2C3D1CF47DFACF40AA9F3FD971CBC8BCA51C6
                      SHA-512:1C2AFB086E3AF51495B16E354CA76BEE2B2F8AA49BEADDDD1BFC1B919C2F52F8D5CEBF442ED5EFC0E960DA69F4D82B547B5AEB64102C478F87A81834ADD26549
                      Malicious:false
                      Reputation:unknown
                      URL:https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
                      Preview:)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Fa gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Kc gb_R\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Kc gb_Nc gb_R\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

                      Chrome Cache Entry: 98

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (2287)
                      Category:downloaded
                      Size (bytes):173807
                      Entropy (8bit):5.555242517438392
                      Encrypted:false
                      SSDEEP:
                      MD5:32B97D1B609BF3ED3A514D5538D4D343
                      SHA1:1330F2A2531216E5684F374ABD91C3275852AB63
                      SHA-256:FF81D74D3CFA8FAF2F62E7E65B199280B896779F7DEA578BF511E3CB5C885AF5
                      SHA-512:50DC477E59730936053AF632D95FD32A4AD0763DF27F41E18D046E8F92C8A8E333886E5A65F7587DD4A10914C83C322A9D9ACA7AC8DA0B98E81C7B61FECE434A
                      Malicious:false
                      Reputation:unknown
                      URL:"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.eBPYdy5TlKU.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvCjRZ-bRAiOPLLf0QdNwYcTlfNSg"
                      Preview:this.gbar_=this.gbar_||{};(function(_){var window=this;.try{._.jj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var kj,lj,nj,qj,tj,sj,mj,rj;kj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};lj=function(){_.Ka()};nj=function(){mj===void 0&&(mj=typeof WeakMap==="function"?kj(WeakMap):null);return mj};qj=function(a,b){(_.oj||(_.oj=new mj)).set(a,b);(_.pj||(_.pj=new mj)).set(b,a)};.tj=function(a){if(rj===void 0){const b=new sj([],{});rj=Array.prototype.concat.call([],b).length===1}rj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.uj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Nc};_.vj=function(a,b){a=(2&b?a|2:a&-3)|32;return a&=-2049};_.wj=function(a,b){a===0&&(a=_.vj(a,b));return a|1};_.xj=function(a){return!!(2&a)&&!!(4&a)||!!(2048&a)};_.yj=function(a,b,c){32&b&&c||(a&=-33);return a};._.Cj=function(a,b,c,d,e,f,g){const h=a.ha;var k=!!(2&b);e=k?

                      Static File Info

                      ⊘No static file info