Joe Sandbox Cloud Basic Analysis Report
Create Interactive Tour

Windows Analysis Report
http://report.netapp.gbqofs.io

Overview

General Information

Sample URL:http://report.netapp.gbqofs.io
Analysis ID:663876
Infos:
Errors
  • URL not reachable

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

No high impact signatures.

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • chrome.exe (PID: 1716 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://report.netapp.gbqofs.io MD5: C139654B5C1438A95B321BB01AD63EF6)
    • chrome.exe (PID: 5276 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,17711745946440476103,5123843850648408868,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

  • • Networking
  • • System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: unknownDNS traffic detected: queries for: clients2.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://accounts.google.com
Source: 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://apis.google.com
Source: 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://clients2.google.com
Source: manifest.json.0.drString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://clients2.googleusercontent.com
Source: b19b6ad6-0d07-4e1e-8d09-ff02f1933da5.tmp.1.dr, 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://dns.google
Source: 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://fonts.googleapis.com
Source: 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://fonts.gstatic.com
Source: 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://ogs.google.com
Source: manifest.json.0.drString found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://play.google.com
Source: 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://redirector.gvt1.com
Source: manifest.json.0.drString found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://ssl.gstatic.com
Source: 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://www.google.com
Source: manifest.json.0.drString found in binary or memory: https://www.google.com/
Source: 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drString found in binary or memory: https://www.gstatic.com
Source: unknownHTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Local\Temp\0f4ce7e1-c0e7-4d14-b32f-d0409bffd6ec.tmpJump to behavior
Source: classification engineClassification label: unknown0.win@21/37@3/7
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://report.netapp.gbqofs.io
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,17711745946440476103,5123843850648408868,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,17711745946440476103,5123843850648408868,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62D00D78-6B4.pmaJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth3
Non-Application Layer Protocol		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration4
Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer1
Ingress Tool Transfer		SIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 663876 URL: http://report.netapp.gbqofs.io Startdate: 14/07/2022 Architecture: WINDOWS Score: 0 5 chrome.exe 12 77 2->5         started        dnsIp3 11 192.168.2.1 unknown unknown 5->11 13 239.255.255.250 unknown Reserved 5->13 8 chrome.exe 10 5->8         started        process4 dnsIp5 15 accounts.google.com 142.250.181.237, 443, 49740 GOOGLEUS United States 8->15 17 clients.l.google.com 216.58.212.142, 443, 49741, 50064 GOOGLEUS United States 8->17 19 5 other IPs or domains 8->19

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
http://report.netapp.gbqofs.io0%VirustotalBrowse
http://report.netapp.gbqofs.io0%Avira URL Cloudsafe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://dns.google0%URL Reputationsafe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
netapp-reports-662293863.us-east-1.elb.amazonaws.com
3.232.242.39
truefalse
    		high
    accounts.google.com
    		142.250.181.237
    		truefalse
      		high
      clients.l.google.com
      		216.58.212.142
      		truefalse
        		high
        clients2.google.com
        		unknown
        		unknownfalse
          		high
          report.netapp.gbqofs.io
          		unknown
          		unknownfalse
            		unknown

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardfalse
              		high
              https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1false
                		high
                NameSourceMaliciousAntivirus DetectionReputation
                https://www.google.com666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drfalse
                  		high
                  https://dns.googleb19b6ad6-0d07-4e1e-8d09-ff02f1933da5.tmp.1.dr, 666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://ogs.google.com666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drfalse
                    		high
                    https://play.google.com666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drfalse
                      		high
                      https://accounts.google.com666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drfalse
                        		high
                        https://payments.google.com/payments/v4/js/integrator.jsmanifest.json.0.drfalse
                          		high
                          https://clients2.googleusercontent.com666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drfalse
                            		high
                            https://apis.google.com666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drfalse
                              		high
                              https://sandbox.google.com/payments/v4/js/integrator.jsmanifest.json.0.drfalse
                                		high
                                https://www.google.com/manifest.json.0.drfalse
                                  		high
                                  https://clients2.google.com666182e3-f5f3-49d8-b529-781082220cfc.tmp.1.drfalse
                                    		high
                                    https://clients2.google.com/service/update2/crxmanifest.json.0.drfalse
                                      		high

                                      World Map of Contacted IPs

                                      • No. of IPs < 25%
                                      • 25% < No. of IPs < 50%
                                      • 50% < No. of IPs < 75%
                                      • 75% < No. of IPs

                                      Public IPs

                                      IPDomainCountryFlagASNASN NameMalicious
                                      142.250.181.237
                                      		accounts.google.comUnited States
                                      		15169GOOGLEUSfalse
                                      34.199.33.127
                                      		unknownUnited States
                                      		14618AMAZON-AESUSfalse
                                      239.255.255.250
                                      		unknownReserved
                                      		unknownunknownfalse
                                      216.58.212.142
                                      		clients.l.google.comUnited States
                                      		15169GOOGLEUSfalse
                                      3.232.242.39
                                      		netapp-reports-662293863.us-east-1.elb.amazonaws.comUnited States
                                      		14618AMAZON-AESUSfalse

                                      Private

                                      IP
                                      192.168.2.1
                                      127.0.0.1

                                      General Information

                                      Joe Sandbox Version:35.0.0 Citrine
                                      Analysis ID:663876
                                      Start date and time: 14/07/202214:33:502022-07-14 14:33:50 +02:00
                                      Joe Sandbox Product:CloudBasic
                                      Overall analysis duration:0h 4m 29s
                                      Hypervisor based Inspection enabled:false
                                      Report type:full
                                      Cookbook file name:browseurl.jbs
                                      Sample URL:http://report.netapp.gbqofs.io
                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                      Number of analysed new started processes analysed:14
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:0
                                      Technologies:
                                      • HCA enabled
                                      • EGA enabled
                                      • HDC enabled
                                      • AMSI enabled
                                      Analysis Mode:default
                                      Analysis stop reason:Timeout
                                      Detection:UNKNOWN
                                      Classification:unknown0.win@21/37@3/7
                                      EGA Information:Failed
                                      HDC Information:Failed
                                      HCA Information:
                                      • Successful, ratio: 100%
                                      • Number of executed functions: 0
                                      • Number of non-executed functions: 0
                                      Cookbook Comments:
                                      • Adjust boot time
                                      • Enable AMSI
                                      • URL browsing timeout or error
                                      • URL not reachable
                                      • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, svchost.exe
                                      • Excluded IPs from analysis (whitelisted): 142.250.185.206, 173.194.182.198, 172.217.16.195, 142.250.185.67, 172.217.23.99
                                      • Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, redirector.gvt1.com, r1---sn-4g5e6nss.gvt1.com, store-images.s-microsoft.com, login.live.com, r1.sn-4g5e6nss.gvt1.com, update.googleapis.com, clientservices.googleapis.com, www.gstatic.com, arc.msn.com
                                      • Not all processes where analyzed, report is missing behavior information
                                      • Report size getting too big, too many NtOpenFile calls found.
                                      • Report size getting too big, too many NtSetInformationFile calls found.
                                      • Report size getting too big, too many NtWriteVirtualMemory calls found.

                                      Simulations

                                      Behavior and APIs

                                      ⊘No simulations

                                      Joe Sandbox View / Context

                                      IPs

                                      ⊘No context

                                      Domains

                                      ⊘No context

                                      ASNs

                                      ⊘No context

                                      JA3 Fingerprints

                                      ⊘No context

                                      Dropped Files

                                      ⊘No context

                                      Created / dropped Files

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\47f65bc2-b587-4a33-954b-69e472e5cd58.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):215705
                                      Entropy (8bit):6.071032161435799
                                      Encrypted:false
                                      SSDEEP:6144:LiwnXpjdf4S61+KFCX/I+NaqfIlUOoSiuRB:Liidf4SK+u+Coa
                                      MD5:BF1972866920CD6F96DC0B53FDAC3275
                                      SHA1:38C153F2BF507842B9618519FAD8C13A3B91A540
                                      SHA-256:DA143AA3209D9AC80E6682F83E727A59AAD9E2CF7F06F38DD22C055C6FED7620
                                      SHA-512:FF7C2199CB7F3CBA0A48753A7DE3C98FEA159B79A0D1A8E73D11EE17314C18A4D11CBE8523E89D8009C7C8EB8AA168FD6B3D5FC9BB3A5AE158863CDEA05EFE11
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.657802107653178e+12,"network":1.65780211e+12,"ticks":123645899.0,"uncertainty":4157209.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245922715401452"},"plugins":{"metadata":{"adobe-flash-player":{"di

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\72be16a3-ad63-4c6d-aef7-5c4075fcf49b.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):215705
                                      Entropy (8bit):6.071032161435799
                                      Encrypted:false
                                      SSDEEP:6144:LiwnXpjdf4S61+KFCX/I+NaqfIlUOoSiuRB:Liidf4SK+u+Coa
                                      MD5:BF1972866920CD6F96DC0B53FDAC3275
                                      SHA1:38C153F2BF507842B9618519FAD8C13A3B91A540
                                      SHA-256:DA143AA3209D9AC80E6682F83E727A59AAD9E2CF7F06F38DD22C055C6FED7620
                                      SHA-512:FF7C2199CB7F3CBA0A48753A7DE3C98FEA159B79A0D1A8E73D11EE17314C18A4D11CBE8523E89D8009C7C8EB8AA168FD6B3D5FC9BB3A5AE158863CDEA05EFE11
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.657802107653178e+12,"network":1.65780211e+12,"ticks":123645899.0,"uncertainty":4157209.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245922715401452"},"plugins":{"metadata":{"adobe-flash-player":{"di

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):40
                                      Entropy (8bit):3.3041625260016576
                                      Encrypted:false
                                      SSDEEP:3:FkXwgs0oRLn:+taRLn
                                      MD5:7AE9008C2AA5ED3E5ED52743E082F5BF
                                      SHA1:CD90099842F51474494BFC490433578A89C1B539
                                      SHA-256:94E7D9BF431A0E3F0FD02F0FBA7321F43DD8B523E3D32092AFC474D3FD5ABF62
                                      SHA-512:596E66D10186ADAD552F4CF7E74CD438AD19AF4C30950D2D6EB80E9F9430CA475D12BB79423EC8D15EAF37ABE0AD1DCCAE459C356A00055A82155C24A35C6F14
                                      Malicious:false
                                      Reputation:low
                                      Preview:sdPC.....................UO..E.D.Q.o....

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\32259a8a-0463-4789-9dbc-0f7c0dd8eb2f.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):4899
                                      Entropy (8bit):4.935874613921127
                                      Encrypted:false
                                      SSDEEP:48:Yc/kKSChkliCrqAOiqTlYGlQKHoTw0Z1rf4MqM8C1Nfct/9BhUJo3KhmeSnpNGzm:n3LQGt1pIKIvB5k0JCKL8bbOTlVuHn
                                      MD5:941BB8AECA07E9E1408029B77D7F6F30
                                      SHA1:860E71411FD0EC6159EE38B7A78DED8CDB4F6CAB
                                      SHA-256:5505FBB23E678F84C13EEB4099156EB1EEC25900297D0414D7011141D6F209B7
                                      SHA-512:638FE3A4E0E9A8E9F8A8BF194804AD0839929A6916B187097AB048895272E4498BD1E4B4BEB4CF964B2E58B540037CEBD04EB4D0305810B1B8EB84F89CFABBAC
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13302275705967053","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"default_browser_infobar_last_declined":"13245924607060180","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","2042016"],"daily_recei

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\666182e3-f5f3-49d8-b529-781082220cfc.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):3473
                                      Entropy (8bit):4.884843136744451
                                      Encrypted:false
                                      SSDEEP:96:6FGX0G70GhIGpyGzRDYLiEHYDBKGzUGaCGjHGESHG/OG6mhM:6Fe0i0sIIyGzRDYLiEHYDBKSUpCQHrSP
                                      MD5:494384A177157C36E9017D1FFB39F0BF
                                      SHA1:CE5D9754A70CD84CEE77C9180DB92C69715BE105
                                      SHA-256:07CF0A5189FAD30A4AA721F4F6DA1B15100991115833EACFA1E2DC84A1B54337
                                      SHA-512:BFB80EEC0C0B5D9E487047703BE49826321A4D249422E0C81E978E6C8A310F41C7B4B8F849229BA87484FDF4831DD6A98FF994D0FDA5CE3D341CE615C15F2F1C
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607497410","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":27387},"server":"https://www.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607334226","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":34287},"server":"https://ssl.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607463627","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":31787},"server":"https://fonts.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607318875","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":23359},"server":"https://apis.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\79bfa6b6-8c68-4f78-bee4-cd8d9299dbb2.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:very short file (no magic)
                                      Category:dropped
                                      Size (bytes):1
                                      Entropy (8bit):0.0
                                      Encrypted:false
                                      SSDEEP:3:L:L
                                      MD5:5058F1AF8388633F609CADB75A75DC9D
                                      SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                      SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                      SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                      Malicious:false
                                      Reputation:low
                                      Preview:.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):38
                                      Entropy (8bit):1.8784775129881184
                                      Encrypted:false
                                      SSDEEP:3:FQxlXNQxlX:qTCT
                                      MD5:51A2CBB807F5085530DEC18E45CB8569
                                      SHA1:7AD88CD3DE5844C7FC269C4500228A630016AB5B
                                      SHA-256:1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
                                      SHA-512:B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
                                      Malicious:false
                                      Reputation:low
                                      Preview:.f.5................f.5...............

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):372
                                      Entropy (8bit):5.254114055246394
                                      Encrypted:false
                                      SSDEEP:6:6IH6bMq2Pwkn23iKKdK25+Xqx8chI+IFUtqV5IH4uyZmwYV5IH4u+kwOwkn23iKG:MMvYf5KkTXfchI3FUtAuy/yu+5Jf5KkI
                                      MD5:0B57C1EEB014D96C62CBCAF1BA6CBEF2
                                      SHA1:4641711650A696D05E3C9CB436D6FCFD349BFC6B
                                      SHA-256:E62979AD2D37E5CBA98F999BEC96D8FD45025A605FD71A16083765B3AB0544E7
                                      SHA-512:05502EB79058332E075F35731179A5082F1D915C30BE00D7E92725A4BD4A0B400D7C7BB7AF824271C8522D9431B515FE953ED4AF289B505DD4588556CECEAD2A
                                      Malicious:false
                                      Reputation:low
                                      Preview:2022/07/14-14:35:55.324 14a4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2022/07/14-14:35:55.326 14a4 Recovering log #3.2022/07/14-14:35:55.326 14a4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):372
                                      Entropy (8bit):5.254114055246394
                                      Encrypted:false
                                      SSDEEP:6:6IH6bMq2Pwkn23iKKdK25+Xqx8chI+IFUtqV5IH4uyZmwYV5IH4u+kwOwkn23iKG:MMvYf5KkTXfchI3FUtAuy/yu+5Jf5KkI
                                      MD5:0B57C1EEB014D96C62CBCAF1BA6CBEF2
                                      SHA1:4641711650A696D05E3C9CB436D6FCFD349BFC6B
                                      SHA-256:E62979AD2D37E5CBA98F999BEC96D8FD45025A605FD71A16083765B3AB0544E7
                                      SHA-512:05502EB79058332E075F35731179A5082F1D915C30BE00D7E92725A4BD4A0B400D7C7BB7AF824271C8522D9431B515FE953ED4AF289B505DD4588556CECEAD2A
                                      Malicious:false
                                      Reputation:low
                                      Preview:2022/07/14-14:35:55.324 14a4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2022/07/14-14:35:55.326 14a4 Recovering log #3.2022/07/14-14:35:55.326 14a4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):3473
                                      Entropy (8bit):4.884843136744451
                                      Encrypted:false
                                      SSDEEP:96:6FGX0G70GhIGpyGzRDYLiEHYDBKGzUGaCGjHGESHG/OG6mhM:6Fe0i0sIIyGzRDYLiEHYDBKSUpCQHrSP
                                      MD5:494384A177157C36E9017D1FFB39F0BF
                                      SHA1:CE5D9754A70CD84CEE77C9180DB92C69715BE105
                                      SHA-256:07CF0A5189FAD30A4AA721F4F6DA1B15100991115833EACFA1E2DC84A1B54337
                                      SHA-512:BFB80EEC0C0B5D9E487047703BE49826321A4D249422E0C81E978E6C8A310F41C7B4B8F849229BA87484FDF4831DD6A98FF994D0FDA5CE3D341CE615C15F2F1C
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607497410","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":27387},"server":"https://www.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607334226","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":34287},"server":"https://ssl.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607463627","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":31787},"server":"https://fonts.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607318875","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":23359},"server":"https://apis.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):4899
                                      Entropy (8bit):4.935874613921127
                                      Encrypted:false
                                      SSDEEP:48:Yc/kKSChkliCrqAOiqTlYGlQKHoTw0Z1rf4MqM8C1Nfct/9BhUJo3KhmeSnpNGzm:n3LQGt1pIKIvB5k0JCKL8bbOTlVuHn
                                      MD5:941BB8AECA07E9E1408029B77D7F6F30
                                      SHA1:860E71411FD0EC6159EE38B7A78DED8CDB4F6CAB
                                      SHA-256:5505FBB23E678F84C13EEB4099156EB1EEC25900297D0414D7011141D6F209B7
                                      SHA-512:638FE3A4E0E9A8E9F8A8BF194804AD0839929A6916B187097AB048895272E4498BD1E4B4BEB4CF964B2E58B540037CEBD04EB4D0305810B1B8EB84F89CFABBAC
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13302275705967053","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"default_browser_infobar_last_declined":"13245924607060180","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","2042016"],"daily_recei

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):17530
                                      Entropy (8bit):5.574550443712135
                                      Encrypted:false
                                      SSDEEP:384:aIFtyLl42Xg1kXqKf/pUZNCgVLH2HfD+rUY3ypuh44:QLlhg1kXqKf/pUZNCgVLH2HfirUwykhn
                                      MD5:D626B6DFC58AE88A0743739CFA5528A1
                                      SHA1:39B6D2C79C2C84819D63D8FF086317EB4D0DA477
                                      SHA-256:AB72554FFA3C00A70CEDDB924EDECEFB599D2552C1BF26F9484C11A3DAAF2147
                                      SHA-512:E2EB8D47B1DBEB1C61EABA60056FC0241AA74B112CE9D6CBCBD099A2D8741448B4B0B48074FB20FD89D6A4A04201CEC1368191290CDB8933EB377A14EA99EAD6
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13302275705266849","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):270336
                                      Entropy (8bit):0.0012471779557650352
                                      Encrypted:false
                                      SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                      MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                      SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                      SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                      SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                      Malicious:false
                                      Reputation:low
                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):325
                                      Entropy (8bit):4.971623449303805
                                      Encrypted:false
                                      SSDEEP:6:YHpoNXR8+eq7JdV5p7DHJShsDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdHfHYhsBdLJlyH7E4f3K33y
                                      MD5:8CA9278965B437DFC789E755E4C61B82
                                      SHA1:5776B6C90CA1D2DDC765ED673B5E6DC8E167F0D6
                                      SHA-256:A57D9231244C1FBDE58A1BF50CAD3A1E3EA28D042BFA272782B65139446E7C51
                                      SHA-512:3065FE0743AD88E02F8C8FF6CF03B832B616DD08061EAE25A5106422228D45EB999EE2CBE4E9C96D5FFC108CB817766240E27BF97E3E5C2A58081D369E2968F8
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248516514667526","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\b19b6ad6-0d07-4e1e-8d09-ff02f1933da5.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):325
                                      Entropy (8bit):4.971623449303805
                                      Encrypted:false
                                      SSDEEP:6:YHpoNXR8+eq7JdV5p7DHJShsDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdHfHYhsBdLJlyH7E4f3K33y
                                      MD5:8CA9278965B437DFC789E755E4C61B82
                                      SHA1:5776B6C90CA1D2DDC765ED673B5E6DC8E167F0D6
                                      SHA-256:A57D9231244C1FBDE58A1BF50CAD3A1E3EA28D042BFA272782B65139446E7C51
                                      SHA-512:3065FE0743AD88E02F8C8FF6CF03B832B616DD08061EAE25A5106422228D45EB999EE2CBE4E9C96D5FFC108CB817766240E27BF97E3E5C2A58081D369E2968F8
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248516514667526","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\be8ce035-097c-4fb5-8d1d-84e3c1b1b8f0.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):17530
                                      Entropy (8bit):5.574550443712135
                                      Encrypted:false
                                      SSDEEP:384:aIFtyLl42Xg1kXqKf/pUZNCgVLH2HfD+rUY3ypuh44:QLlhg1kXqKf/pUZNCgVLH2HfirUwykhn
                                      MD5:D626B6DFC58AE88A0743739CFA5528A1
                                      SHA1:39B6D2C79C2C84819D63D8FF086317EB4D0DA477
                                      SHA-256:AB72554FFA3C00A70CEDDB924EDECEFB599D2552C1BF26F9484C11A3DAAF2147
                                      SHA-512:E2EB8D47B1DBEB1C61EABA60056FC0241AA74B112CE9D6CBCBD099A2D8741448B4B0B48074FB20FD89D6A4A04201CEC1368191290CDB8933EB377A14EA99EAD6
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13302275705266849","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cb05b5e2-7979-46ef-802f-3f637cea37ad.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):17529
                                      Entropy (8bit):5.574489478895644
                                      Encrypted:false
                                      SSDEEP:384:aIFt/Ll42Xg1kXqKf/pUZNCgVLH2HfD+rUYCNypuh4a:dLlhg1kXqKf/pUZNCgVLH2HfirU9ykhJ
                                      MD5:A4810EE49958B9EE8A72E1F7A15A09B4
                                      SHA1:C5494A2E8B7AC1B2D8495B257DBCD17953A448E1
                                      SHA-256:24C1D0CE77D291E4DC84A9F9FCED120F8D5C000A5BBCAF99E7D8D0E4E67DFB74
                                      SHA-512:946C10E667B9E451D9E8788BD43ACB94A334495E4AD49BC37A61FC602F7E52BEC50463D5069F28ED01CC582ED187507F7AD38871C9673C57F3CF62967C68CF3C
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13302275705266849","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):16
                                      Entropy (8bit):3.2743974703476995
                                      Encrypted:false
                                      SSDEEP:3:1sjgWIV//Rv:1qIFJ
                                      MD5:6752A1D65B201C13B62EA44016EB221F
                                      SHA1:58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
                                      SHA-256:0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
                                      SHA-512:9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
                                      Malicious:false
                                      Reputation:low
                                      Preview:MANIFEST-000004.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):16
                                      Entropy (8bit):3.2743974703476995
                                      Encrypted:false
                                      SSDEEP:3:1sjgWIV//Rv:1qIFJ
                                      MD5:6752A1D65B201C13B62EA44016EB221F
                                      SHA1:58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
                                      SHA-256:0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
                                      SHA-512:9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
                                      Malicious:false
                                      Reputation:low
                                      Preview:MANIFEST-000004.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\f3e971d8-d556-4a62-ab9c-98489ba4b7e3.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):4899
                                      Entropy (8bit):4.935874613921127
                                      Encrypted:false
                                      SSDEEP:48:Yc/kKSChkliCrqAOiqTlYGlQKHoTw0Z1rf4MqM8C1Nfct/9BhUJo3KhmeSnpNGzm:n3LQGt1pIKIvB5k0JCKL8bbOTlVuHn
                                      MD5:941BB8AECA07E9E1408029B77D7F6F30
                                      SHA1:860E71411FD0EC6159EE38B7A78DED8CDB4F6CAB
                                      SHA-256:5505FBB23E678F84C13EEB4099156EB1EEC25900297D0414D7011141D6F209B7
                                      SHA-512:638FE3A4E0E9A8E9F8A8BF194804AD0839929A6916B187097AB048895272E4498BD1E4B4BEB4CF964B2E58B540037CEBD04EB4D0305810B1B8EB84F89CFABBAC
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13302275705967053","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"default_browser_infobar_last_declined":"13245924607060180","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","2042016"],"daily_recei

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):106
                                      Entropy (8bit):3.138546519832722
                                      Encrypted:false
                                      SSDEEP:3:tbloIlrJ5ldQxl7aXVdJiG6R0RlAl:tbdlrnQxZaHIGi0R6l
                                      MD5:DE9EF0C5BCC012A3A1131988DEE272D8
                                      SHA1:FA9CCBDC969AC9E1474FCE773234B28D50951CD8
                                      SHA-256:3615498FBEF408A96BF30E01C318DAC2D5451B054998119080E7FAAC5995F590
                                      SHA-512:CEA946EBEADFE6BE65E33EDFF6C68953A84EC2E2410884E12F406CAC1E6C8A0793180433A7EF7CE097B24EA78A1FDBB4E3B3D9CDF1A827AB6FF5605DA3691724
                                      Malicious:false
                                      Reputation:low
                                      Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with no line terminators
                                      Category:dropped
                                      Size (bytes):13
                                      Entropy (8bit):2.8150724101159437
                                      Encrypted:false
                                      SSDEEP:3:Yx7:4
                                      MD5:C422F72BA41F662A919ED0B70E5C3289
                                      SHA1:AAD27C14B27F56B6E7C744A8EC5B1A7D767D7632
                                      SHA-256:02E71EB4C587FEB7EE00CE8600F97411C2774C2FC34CB95B92D5538E7F30DA59
                                      SHA-512:86010ED2B2EEBDCC5A8A076B37703669C294C6D1BFAAEA963E26A9C94B81B4C53EC765D9425E5B616159C43923F800A891F9B903659575DF02F8845521F8DC46
                                      Malicious:false
                                      Reputation:low
                                      Preview:85.0.4183.121

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):215705
                                      Entropy (8bit):6.071032161435799
                                      Encrypted:false
                                      SSDEEP:6144:LiwnXpjdf4S61+KFCX/I+NaqfIlUOoSiuRB:Liidf4SK+u+Coa
                                      MD5:BF1972866920CD6F96DC0B53FDAC3275
                                      SHA1:38C153F2BF507842B9618519FAD8C13A3B91A540
                                      SHA-256:DA143AA3209D9AC80E6682F83E727A59AAD9E2CF7F06F38DD22C055C6FED7620
                                      SHA-512:FF7C2199CB7F3CBA0A48753A7DE3C98FEA159B79A0D1A8E73D11EE17314C18A4D11CBE8523E89D8009C7C8EB8AA168FD6B3D5FC9BB3A5AE158863CDEA05EFE11
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.657802107653178e+12,"network":1.65780211e+12,"ticks":123645899.0,"uncertainty":4157209.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245922715401452"},"plugins":{"metadata":{"adobe-flash-player":{"di

                                      C:\Users\user\AppData\Local\Temp\0f4ce7e1-c0e7-4d14-b32f-d0409bffd6ec.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:Google Chrome extension, version 3
                                      Category:dropped
                                      Size (bytes):248531
                                      Entropy (8bit):7.963657412635355
                                      Encrypted:false
                                      SSDEEP:3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
                                      MD5:541F52E24FE1EF9F8E12377A6CCAE0C0
                                      SHA1:189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
                                      SHA-256:81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
                                      SHA-512:D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
                                      Malicious:false
                                      Reputation:low
                                      Preview:Cr24..............0.."0...*.H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.|1..n.<Fb..f..*Q1.....s..2..{*.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-*eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f|.~.c.4.E.......0..0...*.H............0.......).'..b.*$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$|..|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...|!..A..L.+.=...kP.!.1..

                                      C:\Users\user\AppData\Local\Temp\0f7bfa86-0dbb-446c-ba8a-ebe5c9432391.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:very short file (no magic)
                                      Category:dropped
                                      Size (bytes):1
                                      Entropy (8bit):0.0
                                      Encrypted:false
                                      SSDEEP:3:L:L
                                      MD5:5058F1AF8388633F609CADB75A75DC9D
                                      SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                      SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                      SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                      Malicious:false
                                      Reputation:low
                                      Preview:.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir1716_1216920021\0f4ce7e1-c0e7-4d14-b32f-d0409bffd6ec.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:Google Chrome extension, version 3
                                      Category:modified
                                      Size (bytes):248531
                                      Entropy (8bit):7.963657412635355
                                      Encrypted:false
                                      SSDEEP:3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
                                      MD5:541F52E24FE1EF9F8E12377A6CCAE0C0
                                      SHA1:189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
                                      SHA-256:81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
                                      SHA-512:D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
                                      Malicious:false
                                      Reputation:low
                                      Preview:Cr24..............0.."0...*.H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.|1..n.<Fb..f..*Q1.....s..2..{*.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-*eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f|.~.c.4.E.......0..0...*.H............0.......).'..b.*$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$|..|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...|!..A..L.+.=...kP.!.1..

                                      C:\Users\user\AppData\Local\Temp\scoped_dir1716_1216920021\CRX_INSTALL\_locales\bg\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):1293
                                      Entropy (8bit):4.132566655778463
                                      Encrypted:false
                                      SSDEEP:24:YHYpcyllEQVFc0Bh0GQVQQVEM0bRLzRd0bRLzRRpcyllNQVb26RQ0bR60L0ZWOFY:YHYpZaQLH1QKQ6xxzcxzvpZzQA6z2nhQ
                                      MD5:D7A97183BCBD5FB677AA84D464F0C564
                                      SHA1:CDBB279B864E2C0A51E0892B8714131802586506
                                      SHA-256:76EFAD74EB8256B942727C42261147EB9CCA48DA284DB3CDCE5DC6A3B4346F02
                                      SHA-512:36F0310DD06319E4A51F77E4C3D64F6276891CE6410FE2571324BB71F2FBCDA368EAC4267FF8268086BE6912E41787D0F70771755E3D49E3E8C26648EAC6EFC9
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"\u041f\u043e\u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043d\u044f\u043c\u0430 \u0434\u043e\u0441\u0442\u044a\u043f \u0434\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u0442\u043e."},"craw_connect_to_network":{"message":"\u041c\u043e\u043b\u044f, \u0441\u0432\u044a\u0440\u0436\u0435\u0442\u0435 \u0441\u0435 \u0441 \u043c\u0440\u0435\u0436\u0430."},"app_name":{"message":"\u041f\u043b\u0430\u0449\u0430\u043d\u0438\u044f \u0432 \u0443\u0435\u0431 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 \u043d\u0430 Chrome"},"app_description":{"message":"\u041f\u043b\u0430\u0449\u0430\u043d\u0438\u044f \u0432 \u0443\u0435\u0431 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 \u043d\u0430 Chrome"},"iap_unavailable":{"message":"\u041f\u043e\u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043d\u044f\u043c\u0430 \u0434\u043e\u0441\u0442\u044a\u043f \u0434\u043e \u0432\u0433\u0440\u0430\u0434\u0435\u043d\u0430\u0442\u0430 \

                                      C:\Users\user\AppData\Local\Temp\scoped_dir1716_1216920021\CRX_INSTALL\_locales\ca\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):556
                                      Entropy (8bit):4.768628082639434
                                      Encrypted:false
                                      SSDEEP:12:YGGYp73YbYHOLBiGF14gevg7p6ixuYHOPBBVC9WO/NrnLAOK:YHYp73vuLBVV17pRunVC9WOFvAOK
                                      MD5:58BA5F65ED971591D1F9D81848EE31D0
                                      SHA1:BDA3C8B74653334FC8F060CAFBCEA58DF0113AB7
                                      SHA-256:CDD91587F5AF2C865776B36A5E9A07B10D21B9D911DE0B814B7A1E94B14AE885
                                      SHA-512:BA2A6BAA3011A54E6B07E29DFD133009D66B6CFFF525DEC0024BDE55A9BED463AD130307EE64BFB4A983A11FFD6B44BD53ED38EB144083A2CBEFA8D85C4D5D41
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Ara mateix aquesta aplicaci\u00f3 no est\u00e0 disponible."},"craw_connect_to_network":{"message":"Connecteu-vos a una xarxa."},"app_name":{"message":"Sistema de pagaments de Chrome Web Store"},"app_description":{"message":"Sistema de pagaments de Chrome Web Store"},"iap_unavailable":{"message":"La funci\u00f3 Pagaments a l'aplicaci\u00f3 no est\u00e0 disponible actualment."},"please_sign_in":{"message":"Inicieu la sessi\u00f3 a Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir1716_1216920021\CRX_INSTALL\_locales\cs\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):550
                                      Entropy (8bit):4.905634822460801
                                      Encrypted:false
                                      SSDEEP:12:YGGYpTPklW+g5Q7wvAvPJE7ZEWJE7ZRpmJEWN20GN5Q9O/NrnLAOK:YHYpbt5SwvGJE7ZfJE7ZRpmJEEGN5WOi
                                      MD5:43161EFFA28A0DBFC67B8F7DBE1B5184
                                      SHA1:FE0A9235A59B51B7F564F14FF564344927F035B8
                                      SHA-256:3A04421DF5218E8ABD3B0E2AFE11E8338D7BDCBCD1ADB122416944B102BC9696
                                      SHA-512:FC6A391A4B37FFEE2182F29C1590E32766A1820DC58D0A70A8DD96D7ABE74B47181B24AFFF8ADAE12686CCB1B898DCDDB882EFD205C3387B5B6F3CFBE6E5BA78
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Aplikace v sou\u010dasn\u00e9 dob\u011b nen\u00ed dostupn\u00e1."},"craw_connect_to_network":{"message":"P\u0159ipojte se pros\u00edm k s\u00edti."},"app_name":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"app_description":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"iap_unavailable":{"message":"Platby v aplikaci aktu\u00e1ln\u011b nejsou k dispozici."},"please_sign_in":{"message":"P\u0159ihlaste se do Chromu."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir1716_1216920021\CRX_INSTALL\_locales\da\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):505
                                      Entropy (8bit):4.795529861403324
                                      Encrypted:false
                                      SSDEEP:12:YGGYpB/wHlHE3qKWEMqKWRp8KW/wU0HWO/NrnLAOK:YHYpN4lGqKAqKgp8FiHWOFvAOK
                                      MD5:31264DDBF251A95DE82D0A67FA47DB3A
                                      SHA1:3A48DC7AF26A153594C7849E1D92AAC31296459B
                                      SHA-256:EDB51898A6C73D0090D6916B7B72EBAC71E964EABB5BA7CD68E21966024F0D23
                                      SHA-512:B97D61BD71E3F0A91FF1048D2ACAD4BC092CCAF157B7A96029B6AB5AF1812B01814E3153CD894307CB13DC132523EAC22B19CADA6B97F4B81B0D1132562317B5
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Appen er ikke tilg\u00e6ngelig i \u00f8jeblikket."},"craw_connect_to_network":{"message":"Opret forbindelse til et netv\u00e6rk."},"app_name":{"message":"Betalinger i Chrome Webshop"},"app_description":{"message":"Betalinger i Chrome Webshop"},"iap_unavailable":{"message":"Betaling i appen er ikke tilg\u00e6ngelig i \u00f8jeblikket."},"please_sign_in":{"message":"Log ind p\u00e5 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir1716_1216920021\CRX_INSTALL\_locales\de\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):516
                                      Entropy (8bit):4.809852395188501
                                      Encrypted:false
                                      SSDEEP:12:YGGYpyBCEl9ljMRE1RRpUT6+ZMUO/NrnLAOK:YHYpQDbPpUTvTOFvAOK
                                      MD5:7639B300B40DDAF95318D2177D3265F9
                                      SHA1:BF9EFDF073231CB3FCFCA5CCCA25B079ECFC45BD
                                      SHA-256:356A9D4ADFEC484DA824E7A72059B724B1686FC90082F4A4B667630436D593B0
                                      SHA-512:70593318C6626B5D25729E8D8109D5611B95283266621BE60ADD7E60C0DD5BC43848E956C767251B7B3CCDF5A0929922DE38F90CC8632CCD0C1CCFC7D6DEFE69
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Die App ist momentan nicht verf\u00fcgbar."},"craw_connect_to_network":{"message":"Bitte stellen Sie eine Verbindung zu einem Netzwerk her."},"app_name":{"message":"Chrome Web Store-Zahlungen"},"app_description":{"message":"Chrome Web Store-Zahlungen"},"iap_unavailable":{"message":"In-App-Zahlungen sind momentan nicht m\u00f6glich."},"please_sign_in":{"message":"Bitte melden Sie sich in Chrome an."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir1716_1216920021\CRX_INSTALL\_locales\el\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):1236
                                      Entropy (8bit):4.338644812557597
                                      Encrypted:false
                                      SSDEEP:24:YHYpgFMjXrNW1DWgHle+T2dAplFcTpW1auWgtes9WOFvAOK:YHYpkMj7yxHw+CdAplFcifIs9nhQ
                                      MD5:3026E922B17DBEE2674FDAEE960DF584
                                      SHA1:76602B1E3449F1B67DE42FD31A581B0821BFEFF0
                                      SHA-256:876845B5A061FAB3CF2A1466E01015DC40DF8449F1CB4205F575CEBED8717BAD
                                      SHA-512:0C4DCB2589553F9F75534E6C702EBF9095665C93D213564265E39220A99B61BB112A3B20980CE0377C7E98878E3240EB87312B5ECE874382B7E9CA90A0016992
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"\u0397 \u03b5\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ae \u03c0\u03c1\u03bf\u03c2 \u03c4\u03bf \u03c0\u03b1\u03c1\u03cc\u03bd \u03b4\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03b9\u03b1\u03b8\u03ad\u03c3\u03b9\u03bc\u03b7."},"craw_connect_to_network":{"message":"\u03a3\u03c5\u03bd\u03b4\u03b5\u03b8\u03b5\u03af\u03c4\u03b5 \u03c3\u03b5 \u03ad\u03bd\u03b1 \u03b4\u03af\u03ba\u03c4\u03c5\u03bf."},"app_name":{"message":"\u03a0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03c2 \u03c3\u03c4\u03bf Chrome Web Store"},"app_description":{"message":"\u03a0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03c2 \u03c3\u03c4\u03bf Chrome Web Store"},"iap_unavailable":{"message":"\u039f\u03b9 \u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03c2 \u03b5\u03bd\u03c4\u03cc\u03c2 \u03b5\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ce\u03bd \u03b4\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b1\u03c5\u03c4\u03ae\u03bd \u03c4\u03b7 \u03c3\u03c4\u03b9\u03b3\u03bc\u03ae \u03b4\u03b9\u03b1\u03b8

                                      C:\Users\user\AppData\Local\Temp\scoped_dir1716_1216920021\CRX_INSTALL\_locales\en\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):450
                                      Entropy (8bit):4.679939707243892
                                      Encrypted:false
                                      SSDEEP:12:YGGYp4Fp0JAvpErBpUwEGFpfJAKWO/NrnLAOK:YHYpAp0J3pURKpfJzWOFvAOK
                                      MD5:DBEDF86FA9AFB3A23DBB126674F166D2
                                      SHA1:5628AFFBCF6F897B9D7FD9C17DEB9AA75036F1CC
                                      SHA-256:C0945DD5FDECAB40C45361BEC068D1996E6AE01196DCE524266D740808F753FE
                                      SHA-512:931D7BA6DA84D4BB073815540F35126F2F035A71BFE460F3CCAED25AD7C1B1792AB36CD7207B99FDDF5EAF8872250B54A8958CF5827608F0640E8AAFE11E0071
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"App currently unavailable."},"craw_connect_to_network":{"message":"Please connect to a network."},"app_name":{"message":"Chrome Web Store Payments"},"app_description":{"message":"Chrome Web Store Payments"},"iap_unavailable":{"message":"In-App Payments is currently unavailable."},"please_sign_in":{"message":"Please sign into Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir1716_1216920021\CRX_INSTALL\_locales\en_GB\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):450
                                      Entropy (8bit):4.679939707243892
                                      Encrypted:false
                                      SSDEEP:12:YGGYp4Fp0JAvpErBpUwEGFpfJAKWO/NrnLAOK:YHYpAp0J3pURKpfJzWOFvAOK
                                      MD5:DBEDF86FA9AFB3A23DBB126674F166D2
                                      SHA1:5628AFFBCF6F897B9D7FD9C17DEB9AA75036F1CC
                                      SHA-256:C0945DD5FDECAB40C45361BEC068D1996E6AE01196DCE524266D740808F753FE
                                      SHA-512:931D7BA6DA84D4BB073815540F35126F2F035A71BFE460F3CCAED25AD7C1B1792AB36CD7207B99FDDF5EAF8872250B54A8958CF5827608F0640E8AAFE11E0071
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"App currently unavailable."},"craw_connect_to_network":{"message":"Please connect to a network."},"app_name":{"message":"Chrome Web Store Payments"},"app_description":{"message":"Chrome Web Store Payments"},"iap_unavailable":{"message":"In-App Payments is currently unavailable."},"please_sign_in":{"message":"Please sign into Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir1716_1216920021\CRX_INSTALL\_locales\es\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):542
                                      Entropy (8bit):4.704430479150276
                                      Encrypted:false
                                      SSDEEP:12:YGGYpDbKEzebFcjwWtp6FPbF3QVcqHWO/NrnLAOK:YHYpqEzoFmpQymaWOFvAOK
                                      MD5:3F4B0F56C2839839FC3E3270ED4CB7B6
                                      SHA1:0D74EA655EAE3990E95BD26F6E1467EDF3EB3478
                                      SHA-256:1912EA5E0A62BBC669DC14AB5A5BD5514B0502C483EE1F27C3F8834384187079
                                      SHA-512:4E6A828FE73FC4AB03F0EE966CE7BD8061575A059E90709F908D8D91C5F4EB6A8D25BBFA100E48AD7AC94E76D3BCD3547C277B4150D515222757CC9906AD20A2
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Esta aplicaci\u00f3n no est\u00e1 disponible en este momento."},"craw_connect_to_network":{"message":"Con\u00e9ctate a una red."},"app_name":{"message":"Sistema de pagos de Chrome Web Store"},"app_description":{"message":"Sistema de pagos de Chrome Web Store"},"iap_unavailable":{"message":"Los pagos en la aplicaci\u00f3n no est\u00e1n disponibles en este momento."},"please_sign_in":{"message":"Inicia sesi\u00f3n en Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir1716_1216920021\CRX_INSTALL\_locales\es_419\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):510
                                      Entropy (8bit):4.719977015734499
                                      Encrypted:false
                                      SSDEEP:12:YGGYpDbKEzebFcjwWtpML4c9WO/NrnLAOK:YHYpqEzoFmpMLBWOFvAOK
                                      MD5:1FD5DAF46C4D7C4F571C263EC37B943B
                                      SHA1:A57EE5EF6861F88005C2230EA3D633A1B4CA105A
                                      SHA-256:BCC2CF06F66E9E3BB4B7887D0EE0AE4A72A6C49F4B2A578A7733B78208984417
                                      SHA-512:79C3104F1DC51B17B062803209029C8165DBD391FBE0B69BB406D7B4F92FE1898CAC30E20C2E5CFB65D643B978095626C68EAA0CFCA064354D52D52D16BF21A9
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Esta aplicaci\u00f3n no est\u00e1 disponible en este momento."},"craw_connect_to_network":{"message":"Con\u00e9ctate a una red."},"app_name":{"message":"Sistema de pagos de Chrome Web Store"},"app_description":{"message":"Sistema de pagos de Chrome Web Store"},"iap_unavailable":{"message":"En este momento, Pagos En-Apps no est\u00e1 disponible."},"please_sign_in":{"message":"Accede a Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir1716_1216920021\CRX_INSTALL\manifest.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):1098
                                      Entropy (8bit):4.919185521409901
                                      Encrypted:false
                                      SSDEEP:24:BeVvlH141v5GFqeq7x7S4dudxNfN3IFKrGQZDN4:QVNVgvLecJSR1Y8r5ZW
                                      MD5:6CA25F3EF585B63F01BCDF8635120704
                                      SHA1:00C063811E31EA5F9A00F175A71EA25E7821F621
                                      SHA-256:49D9DE983F7436BA786E6E04A5A20C10F41687AE06B266B1B6553F696719563D
                                      SHA-512:566BFD9BADBD8951EE52E5911EB68B51E86286989096D32DE6E32A2523761B0E0AFCA251EF3BEA36B5D51FB8354A5FCA567772A02C3F3B9D8DFE529609FA0430
                                      Malicious:false
                                      Reputation:low
                                      Preview:{."update_url": "https://clients2.google.com/service/update2/crx",.. "name": "__MSG_APP_NAME__",. "description": "__MSG_APP_DESCRIPTION__",. "manifest_version": 2,. "version": "1.0.0.6",. "minimum_chrome_version": "29",. "default_locale": "en",. "app": {. "background": {. "scripts": [. "craw_background.js". ]. }. },. "permissions": [. "identity",. "webview",. "https://www.google.com/",. "https://www.googleapis.com/*",. "https://payments.google.com/payments/v4/js/integrator.js",. "https://sandbox.google.com/payments/v4/js/integrator.js". ],. "oauth2": {. "auto_approve": true,. "scopes": [. "https://www.googleapis.com/auth/sierra",. "https://www.googleapis.com/auth/sierrasandbox",. "https://www.googleapis.com/auth/chromewebstore",. "https://www.googleapis.com/auth/chromewebstore.readonly". ],. "client_id": "203784468217.apps.googleusercontent.com". },. "icons": {. "16": "images/icon_16.png",. "128

                                      Static File Info

                                      ⊘No static file info

                                      Network Behavior

                                      Download Network PCAP: filtered – full

                                      Network Port Distribution

                                      • Total Packets: 52
                                      • • 443 (HTTPS)
                                      • • 80 (HTTP)
                                      • • 53 (DNS)
                                      TimestampSource PortDest PortSource IPDest IP
                                      Jul 14, 2022 14:35:08.282058001 CEST4973880192.168.2.43.232.242.39
                                      Jul 14, 2022 14:35:08.283328056 CEST4973980192.168.2.43.232.242.39
                                      Jul 14, 2022 14:35:08.285747051 CEST49740443192.168.2.4142.250.181.237
                                      Jul 14, 2022 14:35:08.285790920 CEST44349740142.250.181.237192.168.2.4
                                      Jul 14, 2022 14:35:08.285875082 CEST49740443192.168.2.4142.250.181.237
                                      Jul 14, 2022 14:35:08.286305904 CEST49740443192.168.2.4142.250.181.237
                                      Jul 14, 2022 14:35:08.286320925 CEST44349740142.250.181.237192.168.2.4
                                      Jul 14, 2022 14:35:08.287163973 CEST49741443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:08.287249088 CEST44349741216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:08.287368059 CEST49741443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:08.287596941 CEST49741443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:08.287635088 CEST44349741216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:08.338823080 CEST44349740142.250.181.237192.168.2.4
                                      Jul 14, 2022 14:35:08.339267015 CEST49740443192.168.2.4142.250.181.237
                                      Jul 14, 2022 14:35:08.339308023 CEST44349740142.250.181.237192.168.2.4
                                      Jul 14, 2022 14:35:08.340969086 CEST44349741216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:08.341079950 CEST44349740142.250.181.237192.168.2.4
                                      Jul 14, 2022 14:35:08.341186047 CEST49740443192.168.2.4142.250.181.237
                                      Jul 14, 2022 14:35:08.341337919 CEST49741443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:08.341361046 CEST44349741216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:08.341967106 CEST44349741216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:08.342052937 CEST49741443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:08.343400002 CEST44349741216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:08.343485117 CEST49741443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:08.491806030 CEST4974280192.168.2.43.232.242.39
                                      Jul 14, 2022 14:35:08.560561895 CEST49740443192.168.2.4142.250.181.237
                                      Jul 14, 2022 14:35:08.560723066 CEST44349740142.250.181.237192.168.2.4
                                      Jul 14, 2022 14:35:08.561021090 CEST49741443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:08.561193943 CEST44349741216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:08.561376095 CEST49740443192.168.2.4142.250.181.237
                                      Jul 14, 2022 14:35:08.561398983 CEST44349740142.250.181.237192.168.2.4
                                      Jul 14, 2022 14:35:08.561458111 CEST49741443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:08.561470032 CEST44349741216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:08.592015028 CEST44349741216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:08.592112064 CEST49741443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:08.592133999 CEST44349741216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:08.592164040 CEST44349741216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:08.592222929 CEST49741443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:08.608279943 CEST49741443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:08.608325005 CEST44349741216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:08.616679907 CEST44349740142.250.181.237192.168.2.4
                                      Jul 14, 2022 14:35:08.616766930 CEST49740443192.168.2.4142.250.181.237
                                      Jul 14, 2022 14:35:08.616787910 CEST44349740142.250.181.237192.168.2.4
                                      Jul 14, 2022 14:35:08.617649078 CEST44349740142.250.181.237192.168.2.4
                                      Jul 14, 2022 14:35:08.617733002 CEST49740443192.168.2.4142.250.181.237
                                      Jul 14, 2022 14:35:08.624663115 CEST49740443192.168.2.4142.250.181.237
                                      Jul 14, 2022 14:35:08.624696016 CEST44349740142.250.181.237192.168.2.4
                                      Jul 14, 2022 14:35:11.297585964 CEST4973980192.168.2.43.232.242.39
                                      Jul 14, 2022 14:35:11.379260063 CEST4973880192.168.2.43.232.242.39
                                      Jul 14, 2022 14:35:11.497632980 CEST4974280192.168.2.43.232.242.39
                                      Jul 14, 2022 14:35:17.297754049 CEST4973980192.168.2.43.232.242.39
                                      Jul 14, 2022 14:35:17.479068995 CEST4973880192.168.2.43.232.242.39
                                      Jul 14, 2022 14:35:17.497795105 CEST4974280192.168.2.43.232.242.39
                                      Jul 14, 2022 14:35:29.326930046 CEST4978180192.168.2.434.199.33.127
                                      Jul 14, 2022 14:35:29.503837109 CEST4978280192.168.2.434.199.33.127
                                      Jul 14, 2022 14:35:29.583226919 CEST4978380192.168.2.434.199.33.127
                                      Jul 14, 2022 14:35:32.399605036 CEST4978180192.168.2.434.199.33.127
                                      Jul 14, 2022 14:35:32.580571890 CEST4978280192.168.2.434.199.33.127
                                      Jul 14, 2022 14:35:32.599638939 CEST4978380192.168.2.434.199.33.127
                                      Jul 14, 2022 14:35:38.400037050 CEST4978180192.168.2.434.199.33.127
                                      Jul 14, 2022 14:35:38.581160069 CEST4978280192.168.2.434.199.33.127
                                      Jul 14, 2022 14:35:38.600081921 CEST4978380192.168.2.434.199.33.127
                                      TimestampSource PortDest PortSource IPDest IP
                                      Jul 14, 2022 14:35:08.244242907 CEST6050653192.168.2.48.8.8.8
                                      Jul 14, 2022 14:35:08.244291067 CEST6427753192.168.2.48.8.8.8
                                      Jul 14, 2022 14:35:08.251260996 CEST5607653192.168.2.48.8.8.8
                                      Jul 14, 2022 14:35:08.265080929 CEST53642778.8.8.8192.168.2.4
                                      Jul 14, 2022 14:35:08.270673037 CEST53560768.8.8.8192.168.2.4
                                      Jul 14, 2022 14:35:08.273082972 CEST53605068.8.8.8192.168.2.4
                                      Jul 14, 2022 14:35:54.795267105 CEST50064443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:54.821224928 CEST44350064216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:54.821757078 CEST50064443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:54.847543001 CEST44350064216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:54.847589016 CEST44350064216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:54.847614050 CEST44350064216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:54.847640038 CEST44350064216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:54.848097086 CEST50064443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:54.849946976 CEST50064443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:55.090699911 CEST50064443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:55.091195107 CEST50064443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:55.124169111 CEST44350064216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:55.125338078 CEST50064443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:55.134912014 CEST44350064216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:55.135617018 CEST44350064216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:55.135957003 CEST44350064216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:55.135973930 CEST44350064216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:55.136233091 CEST50064443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:55.168972969 CEST50064443192.168.2.4216.58.212.142
                                      Jul 14, 2022 14:35:55.187083960 CEST44350064216.58.212.142192.168.2.4
                                      Jul 14, 2022 14:35:55.192198992 CEST50064443192.168.2.4216.58.212.142

                                      DNS Queries

                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                      Jul 14, 2022 14:35:08.244242907 CEST192.168.2.48.8.8.80xa693Standard query (0)clients2.google.comA (IP address)IN (0x0001)
                                      Jul 14, 2022 14:35:08.244291067 CEST192.168.2.48.8.8.80xe41cStandard query (0)report.netapp.gbqofs.ioA (IP address)IN (0x0001)
                                      Jul 14, 2022 14:35:08.251260996 CEST192.168.2.48.8.8.80x34afStandard query (0)accounts.google.comA (IP address)IN (0x0001)

                                      DNS Answers

                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                      Jul 14, 2022 14:35:08.265080929 CEST8.8.8.8192.168.2.40xe41cNo error (0)report.netapp.gbqofs.ionetapp-reports-662293863.us-east-1.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)
                                      Jul 14, 2022 14:35:08.265080929 CEST8.8.8.8192.168.2.40xe41cNo error (0)netapp-reports-662293863.us-east-1.elb.amazonaws.com3.232.242.39A (IP address)IN (0x0001)
                                      Jul 14, 2022 14:35:08.265080929 CEST8.8.8.8192.168.2.40xe41cNo error (0)netapp-reports-662293863.us-east-1.elb.amazonaws.com34.199.33.127A (IP address)IN (0x0001)
                                      Jul 14, 2022 14:35:08.270673037 CEST8.8.8.8192.168.2.40x34afNo error (0)accounts.google.com142.250.181.237A (IP address)IN (0x0001)
                                      Jul 14, 2022 14:35:08.273082972 CEST8.8.8.8192.168.2.40xa693No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)
                                      Jul 14, 2022 14:35:08.273082972 CEST8.8.8.8192.168.2.40xa693No error (0)clients.l.google.com216.58.212.142A (IP address)IN (0x0001)

                                      HTTP Request Dependency Graph

                                      • accounts.google.com
                                      • clients2.google.com

                                      HTTPS Proxied Packets

                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                      0192.168.2.449740142.250.181.237443C:\Program Files\Google\Chrome\Application\chrome.exe
                                      TimestampkBytes transferredDirectionData
                                      2022-07-14 12:35:08 UTC0OUTPOST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1
                                      Host: accounts.google.com
                                      Connection: keep-alive
                                      Content-Length: 1
                                      Origin: https://www.google.com
                                      Content-Type: application/x-www-form-urlencoded
                                      Sec-Fetch-Site: none
                                      Sec-Fetch-Mode: no-cors
                                      Sec-Fetch-Dest: empty
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
                                      Accept-Encoding: gzip, deflate, br
                                      Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                                      2022-07-14 12:35:08 UTC0OUTData Raw: 20
                                      Data Ascii:
                                      2022-07-14 12:35:08 UTC2INHTTP/1.1 200 OK
                                      Content-Type: application/json; charset=utf-8
                                      Access-Control-Allow-Origin: https://www.google.com
                                      Access-Control-Allow-Credentials: true
                                      X-Content-Type-Options: nosniff
                                      Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                      Pragma: no-cache
                                      Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                      Date: Thu, 14 Jul 2022 12:35:08 GMT
                                      Strict-Transport-Security: max-age=31536000; includeSubDomains
                                      Cross-Origin-Opener-Policy: same-origin
                                      Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport
                                      Content-Security-Policy: script-src 'report-sample' 'nonce-2EZAQlCLMnPuaFDSdQRvTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self'
                                      Content-Security-Policy: script-src 'nonce-2EZAQlCLMnPuaFDSdQRvTA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport
                                      Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
                                      Server: ESF
                                      X-XSS-Protection: 0
                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                      Accept-Ranges: none
                                      Vary: Accept-Encoding
                                      Connection: close
                                      Transfer-Encoding: chunked
                                      2022-07-14 12:35:08 UTC4INData Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a
                                      Data Ascii: 11["gaia.l.a.r",[]]
                                      2022-07-14 12:35:08 UTC4INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                      1192.168.2.449741216.58.212.142443C:\Program Files\Google\Chrome\Application\chrome.exe
                                      TimestampkBytes transferredDirectionData
                                      2022-07-14 12:35:08 UTC0OUTGET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1
                                      Host: clients2.google.com
                                      Connection: keep-alive
                                      X-Goog-Update-Interactivity: fg
                                      X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm
                                      X-Goog-Update-Updater: chromecrx-85.0.4183.121
                                      Sec-Fetch-Site: none
                                      Sec-Fetch-Mode: no-cors
                                      Sec-Fetch-Dest: empty
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
                                      Accept-Encoding: gzip, deflate, br
                                      Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                                      2022-07-14 12:35:08 UTC1INHTTP/1.1 200 OK
                                      Content-Security-Policy: script-src 'report-sample' 'nonce-TvKgILFK7ylX_-0M5GHtmw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
                                      Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                      Pragma: no-cache
                                      Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                      Date: Thu, 14 Jul 2022 12:35:08 GMT
                                      Content-Type: text/xml; charset=UTF-8
                                      X-Daynum: 5673
                                      X-Daystart: 20108
                                      X-Content-Type-Options: nosniff
                                      X-Frame-Options: SAMEORIGIN
                                      X-XSS-Protection: 1; mode=block
                                      Server: GSE
                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                      Accept-Ranges: none
                                      Vary: Accept-Encoding
                                      Connection: close
                                      Transfer-Encoding: chunked
                                      2022-07-14 12:35:08 UTC2INData Raw: 33 31 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 37 33 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 30 31 30 38 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22
                                      Data Ascii: 31b<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5673" elapsed_seconds="20108"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
                                      2022-07-14 12:35:08 UTC2INData Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61
                                      Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
                                      2022-07-14 12:35:08 UTC2INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Statistics

                                      CPU Usage

                                      0204060s020406080100

                                      Click to jump to process

                                      Memory Usage

                                      0204060s0.0020406080MB

                                      Click to jump to process

                                      High Level Behavior Distribution

                                      • • File
                                      • • Registry

                                      Click to dive into process behavior distribution

                                      Behavior

                                      Click to jump to process

                                      System Behavior

                                      General

                                      Target ID:0
                                      Start time:14:35:03
                                      Start date:14/07/2022
                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      Wow64 process (32bit):false
                                      Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://report.netapp.gbqofs.io
                                      Imagebase:0x7ff7964c0000
                                      File size:2150896 bytes
                                      MD5 hash:C139654B5C1438A95B321BB01AD63EF6
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:low
                                      Show Windows behavior

                                      File Activities

                                      Show Windows behavior

                                      Section Activities

                                      Show Windows behavior

                                      Registry Activities

                                      Show Windows behavior

                                      COM Activities

                                      Show Windows behavior

                                      Mutex Activities

                                      Show Windows behavior

                                      Process Activities

                                      Show Windows behavior

                                      Thread Activities

                                      Show Windows behavior

                                      Memory Activities

                                      Show Windows behavior

                                      System Activities

                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      Show Windows behavior

                                      Windows UI Activities

                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                                      General

                                      Target ID:1
                                      Start time:14:35:05
                                      Start date:14/07/2022
                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      Wow64 process (32bit):false
                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,17711745946440476103,5123843850648408868,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
                                      Imagebase:0x7ff7964c0000
                                      File size:2150896 bytes
                                      MD5 hash:C139654B5C1438A95B321BB01AD63EF6
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:low
                                      Show Windows behavior

                                      File Activities

                                      Show Windows behavior

                                      Section Activities

                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      Show Windows behavior

                                      Thread Activities

                                      Show Windows behavior

                                      Memory Activities

                                      Show Windows behavior

                                      System Activities

                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                                      Disassembly

                                      ⊘No disassembly