Google Docs / Google Apps Script
Named by 2 kept items in this workspace.
Search every workspace for Google Docs / Google Apps Script. It matches the name as written, so it can find other things that share it.
The items that name it 2
Legitimate Google Doc with a bound Apps Script sidebar used as delivery and reconnaissance mechanism, runs client-side without OAuth consent prompt
Abused to embed a custom malicious sidebar (DecryptPanel.html) alongside a fake 'encrypted' planning document
All technologies in this workspace.