Joe Sandbox Cloud Basic Analysis Report
Create Interactive Tour

Windows Analysis Report
http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh

Overview

General Information

Sample URL:http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh
Analysis ID:678966
Infos:

Detection

Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Snort IDS alert for network traffic
Antivirus detection for URL or domain

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • chrome.exe (PID: 6388 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: C139654B5C1438A95B321BB01AD63EF6)
    • chrome.exe (PID: 6652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,348518792383478243,2915957333394053278,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)
  • chrome.exe (PID: 6820 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh MD5: C139654B5C1438A95B321BB01AD63EF6)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

Timestamp:192.168.2.78.8.8.860280532034201 08/04/22-22:35:15.253148
SID:2034201
Source Port:60280
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected

Joe Sandbox Signatures

  • • AV Detection
  • • Compliance
  • • Networking
  • • System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.shAvira URL Cloud: detection malicious, Label: malware
Source: http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/2:Avira URL Cloud: Label: malware
Source: http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/2Avira URL Cloud: Label: malware
Source: http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/favicon.icoAvira URL Cloud: Label: malware
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\DictionariesJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdicJump to behavior

Networking

barindex
Source: TrafficSnort IDS: 2034201 ET TROJAN Interactsh Control Panel (DNS) 192.168.2.7:60280 -> 8.8.8.8:53
Source: unknownDNS traffic detected: queries for: clients2.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: caezcs32vtc000025v70gf8xscwyyyyyb.interact.shConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: caezcs32vtc000025v70gf8xscwyyyyyb.interact.shConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Referer: http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: History Provider Cache.0.drString found in binary or memory: http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/2
Source: History Provider Cache.0.drString found in binary or memory: http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/2:
Source: 6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drString found in binary or memory: https://accounts.google.com
Source: 6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drString found in binary or memory: https://apis.google.com
Source: 6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drString found in binary or memory: https://clients2.google.com
Source: manifest.json.0.drString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drString found in binary or memory: https://clients2.googleusercontent.com
Source: 75564a82-1747-4a47-bd57-01ef2b43664c.tmp.3.dr, 6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drString found in binary or memory: https://dns.google
Source: 6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drString found in binary or memory: https://fonts.googleapis.com
Source: 6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drString found in binary or memory: https://fonts.gstatic.com
Source: 6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drString found in binary or memory: https://ogs.google.com
Source: manifest.json.0.drString found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: manifest.json.0.drString found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drString found in binary or memory: https://ssl.gstatic.com
Source: 6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drString found in binary or memory: https://www.google.com
Source: manifest.json.0.drString found in binary or memory: https://www.google.com/
Source: 6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drString found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drString found in binary or memory: https://www.gstatic.com
Source: unknownHTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user~1\AppData\Local\Temp\fa2d6f27-1ff1-4c24-8fc4-ada232e086e3.tmpJump to behavior
Source: classification engineClassification label: mal64.win@24/65@3/6
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,348518792383478243,2915957333394053278,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,348518792383478243,2915957333394053278,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\Chrome\Application\DictionariesJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62ECAC0F-18F4.pmaJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\DictionariesJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdicJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath Interception1
Process Injection		3
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth3
Non-Application Layer Protocol		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration4
Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer1
Ingress Tool Transfer		SIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 678966 URL: http://caezcs32vtc000025v70... Startdate: 04/08/2022 Architecture: WINDOWS Score: 64 24 Snort IDS alert for network traffic 2->24 26 Antivirus detection for URL or domain 2->26 28 Antivirus / Scanner detection for submitted sample 2->28 6 chrome.exe 13 130 2->6         started        9 chrome.exe 2 2->9         started        process3 dnsIp4 14 192.168.2.1 unknown unknown 6->14 16 239.255.255.250 unknown Reserved 6->16 11 chrome.exe 11 6->11         started        process5 dnsIp6 18 accounts.google.com 142.250.185.205, 443, 49766 GOOGLEUS United States 11->18 20 clients.l.google.com 142.250.186.110, 443, 49762, 54180 GOOGLEUS United States 11->20 22 3 other IPs or domains 11->22

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh5%VirustotalBrowse
http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh100%Avira URL Cloudmalware

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://dns.google0%URL Reputationsafe
http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/2:100%Avira URL Cloudmalware
http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/2100%Avira URL Cloudmalware
http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/favicon.ico5%VirustotalBrowse
http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/favicon.ico100%Avira URL Cloudmalware

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh
46.101.25.250
truefalse
    		unknown
    accounts.google.com
    		142.250.185.205
    		truefalse
      		high
      clients.l.google.com
      		142.250.186.110
      		truefalse
        		high
        clients2.google.com
        		unknown
        		unknownfalse
          		high

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1false
            		high
            https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardfalse
              		high
              http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/favicon.icotrue
              • 5%, Virustotal, Browse
              • Avira URL Cloud: malware
              		unknown
              http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/true
                		unknown
                http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/true
                  		unknown
                  NameSourceMaliciousAntivirus DetectionReputation
                  https://www.google.com6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drfalse
                    		high
                    https://dns.google75564a82-1747-4a47-bd57-01ef2b43664c.tmp.3.dr, 6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://ogs.google.com6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drfalse
                      		high
                      http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/2:History Provider Cache.0.drtrue
                      • Avira URL Cloud: malware
                      		unknown
                      https://accounts.google.com6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drfalse
                        		high
                        https://payments.google.com/payments/v4/js/integrator.jsmanifest.json.0.drfalse
                          		high
                          https://clients2.googleusercontent.com6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drfalse
                            		high
                            http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/2History Provider Cache.0.drtrue
                            • Avira URL Cloud: malware
                            		unknown
                            https://apis.google.com6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drfalse
                              		high
                              https://sandbox.google.com/payments/v4/js/integrator.jsmanifest.json.0.drfalse
                                		high
                                https://www.google.com/manifest.json.0.drfalse
                                  		high
                                  https://clients2.google.com6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp.3.drfalse
                                    		high
                                    https://clients2.google.com/service/update2/crxmanifest.json.0.drfalse
                                      		high

                                      World Map of Contacted IPs

                                      • No. of IPs < 25%
                                      • 25% < No. of IPs < 50%
                                      • 50% < No. of IPs < 75%
                                      • 75% < No. of IPs

                                      Public IPs

                                      IPDomainCountryFlagASNASN NameMalicious
                                      239.255.255.250
                                      		unknownReserved
                                      		unknownunknownfalse
                                      46.101.25.250
                                      		caezcs32vtc000025v70gf8xscwyyyyyb.interact.shNetherlands
                                      		14061DIGITALOCEAN-ASNUSfalse
                                      142.250.186.110
                                      		clients.l.google.comUnited States
                                      		15169GOOGLEUSfalse
                                      142.250.185.205
                                      		accounts.google.comUnited States
                                      		15169GOOGLEUSfalse

                                      Private

                                      IP
                                      192.168.2.1
                                      127.0.0.1

                                      General Information

                                      Joe Sandbox Version:35.0.0 Citrine
                                      Analysis ID:678966
                                      Start date and time: 04/08/202222:34:072022-08-04 22:34:07 +02:00
                                      Joe Sandbox Product:CloudBasic
                                      Overall analysis duration:0h 4m 1s
                                      Hypervisor based Inspection enabled:false
                                      Report type:full
                                      Cookbook file name:browseurl.jbs
                                      Sample URL:http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh
                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                      Number of analysed new started processes analysed:12
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:0
                                      Technologies:
                                      • HCA enabled
                                      • EGA enabled
                                      • HDC enabled
                                      • AMSI enabled
                                      Analysis Mode:default
                                      Analysis stop reason:Timeout
                                      Detection:MAL
                                      Classification:mal64.win@24/65@3/6
                                      EGA Information:Failed
                                      HDC Information:Failed
                                      HCA Information:
                                      • Successful, ratio: 100%
                                      • Number of executed functions: 0
                                      • Number of non-executed functions: 0
                                      Cookbook Comments:
                                      • Adjust boot time
                                      • Enable AMSI
                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
                                      • Excluded IPs from analysis (whitelisted): 23.211.6.115, 142.250.185.238, 74.125.162.102, 173.194.187.73, 142.250.186.131, 80.67.82.235, 80.67.82.211, 20.54.89.106, 142.250.185.195, 52.242.101.226, 74.125.154.138, 74.125.160.38, 40.125.122.176, 20.223.24.244
                                      • Excluded domains from analysis (whitelisted): r5---sn-4g5edn6y.gvt1.com, store-images.s-microsoft.com-c.edgekey.net, clientservices.googleapis.com, a1449.dscg2.akamai.net, arc.msn.com, r4---sn-4g5e6nsk.gvt1.com, r5.sn-4g5edn6y.gvt1.com, e12564.dspb.akamaiedge.net, r1.sn-4g5ednd7.gvt1.com, rp-consumer-prod-displaycatalog-geomap.trafficmanager.net, redirector.gvt1.com, login.live.com, sls.update.microsoft.com, update.googleapis.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, www.gstatic.com, r1---sn-4g5lznes.gvt1.com, glb.sls.prod.dcat.dsp.trafficmanager.net, www.bing.com, client.wns.windows.com, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, r1---sn-4g5ednd7.gvt1.com, store-images.s-microsoft.com, r1.sn-4g5lznes.gvt1.com, r4.sn-4g5e6nsk.gvt1.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                                      • Not all processes where analyzed, report is missing behavior information
                                      • Report size getting too big, too many NtWriteVirtualMemory calls found.

                                      Simulations

                                      Behavior and APIs

                                      ⊘No simulations

                                      Joe Sandbox View / Context

                                      IPs

                                      ⊘No context

                                      Domains

                                      ⊘No context

                                      ASNs

                                      ⊘No context

                                      JA3 Fingerprints

                                      ⊘No context

                                      Dropped Files

                                      ⊘No context

                                      Created / dropped Files

                                      C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):451603
                                      Entropy (8bit):5.009711072558331
                                      Encrypted:false
                                      SSDEEP:12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
                                      MD5:A78AD14E77147E7DE3647E61964C0335
                                      SHA1:CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
                                      SHA-256:0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
                                      SHA-512:DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
                                      Malicious:false
                                      Reputation:low
                                      Preview:BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\0293fe2f-5e34-4e0c-821a-e3bc3c465911.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:SysEx File -
                                      Category:modified
                                      Size (bytes):94708
                                      Entropy (8bit):3.7461616959699664
                                      Encrypted:false
                                      SSDEEP:384:9DgPDhyo1GtRV+kzuNLrAvn93Qv5cHV4GMrrGRLTxAFhFQr6DmilSdDDjsONdLNs:FC61tWdIIAeHvFRgfHaRKT531A
                                      MD5:CDC986E36E128274511901BE09F8BD1E
                                      SHA1:0A4A27FA2F5959871F925184038BC9BA18E31F70
                                      SHA-256:A21A652A549683612C56B63D6646F5D80E91AE6AF2A482D9559678A43396D1E3
                                      SHA-512:6225AB0C05AD37D4210114810709CBC66BD634D0BB87BD3717602A57982E1914FBD3CBE849D16AC772C576BD2320ACB7E6FAA12DE04B4B89191D807AC15F0E9D
                                      Malicious:false
                                      Reputation:low
                                      Preview:.q..............*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6...*...M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....c8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\203be167-eeb3-45a6-8b5d-e65896e568d9.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):220153
                                      Entropy (8bit):6.069394049617078
                                      Encrypted:false
                                      SSDEEP:6144:CeHuyLumqHrZiSw7sd4dnO3pzAiQfgbV/njhcI8II6RN:C44mqHrZiSw7RnuDQfgxnuzIIM
                                      MD5:F3FA4B0024AEB9A1693E833807679555
                                      SHA1:9D7E58734BCD831054917288E05AF2DFDF6D6806
                                      SHA-256:AC8A4B51FA9F4BFCAE1ADD6439A9DF566103AEF424CD664272CB62A38AEC010F
                                      SHA-512:6BDCCD9EDA99720FEBAB5944B309D982D8F570497BC1F5F4AF02705FF994641941A9A55BDEB93944E0DF1BC47DF6F9357CBDF3FD9A617CAFA3FF420840A475BA
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.659677715000248e+12,"network":1.659645316e+12,"ticks":159925477.0,"uncertainty":3750318.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD5yRpyxHTvRo045wUdD0XcAAAAAAIAAAAAABBmAAAAAQAAIAAAABLbexqB/oExTFJmpcENOvX+bVETIkvlcZMf3oIBvp2bAAAAAA6AAAAAAgAAIAAAAAb9GGQ1QmHgGBymkKDudOpZA89StPbsfruaqqGAbN50MAAAALDWaloNNJZN9rwnlUq/XLN9khJ9Jz9md9VO4rX+Yg+g8mRS88Enlg3B2TpBYYNjwkAAAACddQYw45aj+S/8dGnDKvRWon1T/sv/0i6HXgLXg0I1kMUaef/c6zqkTQ7ehiG3nkSfg6dR/4o1ZLALr+MYbEZ2"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951909820208"},"plugins":{"metadata":{"adobe-flash-player":{"disp

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\2247ff5b-8682-4707-bb00-9c429f73c6da.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):220153
                                      Entropy (8bit):6.069392836816721
                                      Encrypted:false
                                      SSDEEP:6144:QeHuyLumqHrZiSw7sd4dnO3pzAiQfgbV/njhcI8II6RN:Q44mqHrZiSw7RnuDQfgxnuzIIM
                                      MD5:19222EEF05818592968D0A12BC06FC25
                                      SHA1:7D5BC415816ECDDF48D6B5EFFA8B09F445FD488E
                                      SHA-256:634A4A18B84DC8476EFEB78E8EF5B7F3E217F762089302D7381FDD3DDC245806
                                      SHA-512:4046949CCECBA7109451298DD628BC7BE669A1D1E8C1F6918657843267F6E6BEE5DD596C6894FA8EDBC5963D19E8AAFBAE8B09FAD12CE1B60254F1DC1CC74539
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.659677715000248e+12,"network":1.659645316e+12,"ticks":159925477.0,"uncertainty":3750318.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD5yRpyxHTvRo045wUdD0XcAAAAAAIAAAAAABBmAAAAAQAAIAAAABLbexqB/oExTFJmpcENOvX+bVETIkvlcZMf3oIBvp2bAAAAAA6AAAAAAgAAIAAAAAb9GGQ1QmHgGBymkKDudOpZA89StPbsfruaqqGAbN50MAAAALDWaloNNJZN9rwnlUq/XLN9khJ9Jz9md9VO4rX+Yg+g8mRS88Enlg3B2TpBYYNjwkAAAACddQYw45aj+S/8dGnDKvRWon1T/sv/0i6HXgLXg0I1kMUaef/c6zqkTQ7ehiG3nkSfg6dR/4o1ZLALr+MYbEZ2"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291229792718540"},"plugins":{"metadata":{"adobe-flash-player":{"disp

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:data
                                      Category:modified
                                      Size (bytes):40
                                      Entropy (8bit):3.254162526001658
                                      Encrypted:false
                                      SSDEEP:3:FkXJFIsz6I:+rJJ
                                      MD5:CE74DBAFA9F4B2CE737AF2E3003A3465
                                      SHA1:2F58FDA138667FA4941DE1AA201DD70EFF4AAC75
                                      SHA-256:896C9BD2EDA0D6EEA85229BA58AB7E423D179FD5567CBF0DC9B7EBC1D0539E1D
                                      SHA-512:8A377209C5DB20248067D2B8283610B58370F6EB8A8AAB1741674414AC07B124678A89A5D85AFA563D09CD526114DA0EE534BDF36A35E43D4DA7FC2D63977D51
                                      Malicious:false
                                      Reputation:low
                                      Preview:sdPC.......................@.*.L..nM._bM

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\07654715-10aa-4e5e-a246-0e1748d64e4f.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):17529
                                      Entropy (8bit):5.573915747955002
                                      Encrypted:false
                                      SSDEEP:384:AE3tdLlEOXs51kXqKf/pUZNCgVLH2HfDkrUENZ4j6:bLlVs51kXqKf/pUZNCgVLH2Hf4rUyZm6
                                      MD5:F2705570F1221A93C1AACD3586D288B2
                                      SHA1:470C860CFE6EF2FF8E7B4E96D0044F35787472F8
                                      SHA-256:0871D8FE994CB7F23E4F043FE8793C2094A61BE05596D3B8B047961F92206205
                                      SHA-512:EE47F0406E76401619F6492FF04997A2034C5E06A00FA3523E60C986460F9A4EF807820F686C5486DE366691904602EE0EFBDB0FE76401FB6C92010F4DD09925
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13304151312724065","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5fd2963c-2fe8-46da-a4d4-5dcd835a571f.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):5117
                                      Entropy (8bit):4.987451329560466
                                      Encrypted:false
                                      SSDEEP:96:nJ1TfD51pYKIv4ik0JCKL8vkp18bOTQVuwn:nHR1pYF4k4KCkp0
                                      MD5:35A1E292D454EB618484059E561404FE
                                      SHA1:0E9DBDF4E63CA44D8B8FDC5F9420C7E166901186
                                      SHA-256:C9182AB46F519D77AFB46131175B90FC6992E542AE347055A3D8578687E9C6AA
                                      SHA-512:5CB206B31C4F479431DF5CCAB3A665051A7EC2ABE0AD2DB6CB4A9641743A2DDACE8755D7828CEC5A5D541BED3E3A9AD88D26329C7414017B087706CFD1135C4A
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13304151313640492","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245952329814949","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","7355952"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\6e5150a1-a5ab-4adb-b82e-1fd84f19e8ee.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):2724
                                      Entropy (8bit):4.858441642519087
                                      Encrypted:false
                                      SSDEEP:48:YXsPMHi5s7MHgKsSMH/zs8MHIs51tFsL6zsbWsdCshDysuMHCLsKMH9swIMHlYhj:XGiQGBGFGJ12LLHDwGyGkGihj
                                      MD5:9E0C31BCE1C83C78981EB86A29E2879B
                                      SHA1:3973E5D4DA1BC0BB99B78D1DFA7BEA045C85E173
                                      SHA-256:3D1BDA968D1CFF79DBD0C4B9D2A22367E9D9B8374622CD4263BD39137D8FE584
                                      SHA-512:D196B2993F4A46AFFD38DBA59866B048221D5CF6EAB1574846D1799B748BD71B09BE28D8154B16D97AEA300C7EE13719DC2E5034EC9D8913C6A6B399BDEBC23E
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248544495618845","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":31528},"server":"https://dns.google","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248544345624305","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":26637},"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248544345531701","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":53820},"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248544345601356","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":36228},"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"exp

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\6faada00-b498-4cf3-aa7d-f6a97a529f27.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):5117
                                      Entropy (8bit):4.98665891313046
                                      Encrypted:false
                                      SSDEEP:96:nJ1TM/1pYKIv4ik0JCKL8vkp18bOTQVuwn:nHa1pYF4k4KCkp0
                                      MD5:A604739067A7B1EB18689BB5458D7993
                                      SHA1:BCBC237D2FA23016A2B75BCE1D111525F97BC439
                                      SHA-256:5F8875FF7DD2CB89FD31A61868305B805D53266A33E3CAE49BDED77AD9E5B2A0
                                      SHA-512:4DADE23ADD291C488328F982B635B6A3C359FBF8C835C6C3EEC01DE085D43BC5C4D9242600AE7CD77A887299AB7118243E5D32AA0B66E1C6AC3C680C71F26D4E
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13304151313640492","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245952329814949","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","7355952"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\733ce324-a54e-4fce-a986-00632e1d0942.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):17703
                                      Entropy (8bit):5.5761872294904435
                                      Encrypted:false
                                      SSDEEP:384:AE3tkLlEOXs51kXqKf/pUZNCgVLH2HfDkrU8NZ4s:SLlVs51kXqKf/pUZNCgVLH2Hf4rUiZf
                                      MD5:8202482A1842C251C4494951C729C8A6
                                      SHA1:C09E346D76D6F2A00E4395EA4889DED45E3E0962
                                      SHA-256:C30531AAFEF136CF1D2F617A5931A4B1603A96FD611B052AB3400E8858E6ABDA
                                      SHA-512:7C4A846384469A74154C29380988F2984FD92B2DC9AD96325A48EF0D8153E99FFA0B98A414E70F1BEB8D8D114A6A83165FEF31D91B3E025AAA9961C4CEA9B712
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13304151312724065","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\870c1f33-66d1-4036-aac4-301e8f277116.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:very short file (no magic)
                                      Category:dropped
                                      Size (bytes):1
                                      Entropy (8bit):0.0
                                      Encrypted:false
                                      SSDEEP:3:L:L
                                      MD5:5058F1AF8388633F609CADB75A75DC9D
                                      SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                      SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                      SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                      Malicious:false
                                      Reputation:low
                                      Preview:.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):38
                                      Entropy (8bit):1.8784775129881184
                                      Encrypted:false
                                      SSDEEP:3:FQxlXNQxlX:qTCT
                                      MD5:51A2CBB807F5085530DEC18E45CB8569
                                      SHA1:7AD88CD3DE5844C7FC269C4500228A630016AB5B
                                      SHA-256:1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
                                      SHA-512:B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
                                      Malicious:false
                                      Reputation:low
                                      Preview:.f.5................f.5...............

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):380
                                      Entropy (8bit):5.275300397007757
                                      Encrypted:false
                                      SSDEEP:6:b+PZ5q2PcNwi23iKKdK25+Xqx8chI+IFUtqVM+PZ7XZmwYVM+PZyovzkwOcNwi2k:b+x5vLZ5KkTXfchI3FUtl+x7X/z+xDvV
                                      MD5:E29E97EB4F675BAC302778776D41AFA9
                                      SHA1:DF068684453CF91AEC70F04D6E676F94E0C9F341
                                      SHA-256:3E9032380BB0F6A543A346602F0F7DBD2FA42B60706995DBDBB77615DEA3DAD2
                                      SHA-512:B288FA24ECFECA78C252FE8AD33F2E7C745649AE8E9D3C6BDD5A9D4B5F955C46099F9FBA45E89EFF5F1D1117692155AFD99C3FD4E68C39ECE4E88E5BED8DAB18
                                      Malicious:false
                                      Reputation:low
                                      Preview:2022/08/04-22:35:30.164 1970 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2022/08/04-22:35:30.169 1970 Recovering log #3.2022/08/04-22:35:30.170 1970 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):380
                                      Entropy (8bit):5.275300397007757
                                      Encrypted:false
                                      SSDEEP:6:b+PZ5q2PcNwi23iKKdK25+Xqx8chI+IFUtqVM+PZ7XZmwYVM+PZyovzkwOcNwi2k:b+x5vLZ5KkTXfchI3FUtl+x7X/z+xDvV
                                      MD5:E29E97EB4F675BAC302778776D41AFA9
                                      SHA1:DF068684453CF91AEC70F04D6E676F94E0C9F341
                                      SHA-256:3E9032380BB0F6A543A346602F0F7DBD2FA42B60706995DBDBB77615DEA3DAD2
                                      SHA-512:B288FA24ECFECA78C252FE8AD33F2E7C745649AE8E9D3C6BDD5A9D4B5F955C46099F9FBA45E89EFF5F1D1117692155AFD99C3FD4E68C39ECE4E88E5BED8DAB18
                                      Malicious:false
                                      Reputation:low
                                      Preview:2022/08/04-22:35:30.164 1970 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2022/08/04-22:35:30.169 1970 Recovering log #3.2022/08/04-22:35:30.170 1970 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):524
                                      Entropy (8bit):5.10617156324887
                                      Encrypted:false
                                      SSDEEP:12:ZX5Yg7Qjzcy2zs1SvT9JxiBY+VsQzu9Bk77sW193E+Gzk87:55hQvf219JxHA9SLY7sGExk87
                                      MD5:0009FE743DBB4614F4C42881022EF787
                                      SHA1:9357A36931305DB02EE5BFE7FFB6143AB90B5B65
                                      SHA-256:8E54D6EFBCE36F449D1364EAA4F4821D6FCD67B1D74F6F63C08B3803FC931623
                                      SHA-512:7146BA5F6730D53E7B35B7E665FCF47C2A6E6D4F244F39CB67D16620C422C44B2417EF16E92D5489E2E409863CF2F4B7A4B8A59E04B2C25D9D413AC391C13D4B
                                      Malicious:false
                                      Reputation:low
                                      Preview:..........."9...!caezcs32vtc000025v70gf8xscwyyyyyb..http..interact..sh*I...%.!caezcs32vtc000025v70gf8xscwyyyyyb......http......interact......sh..2.........0........2........3........5........7........8........a.........b........c.........e.........f........g........h.........i........n........p........r........s.........t..........v........w........x........y........z...:&......................................B]...Y...... .......*5http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/2.:...............J...........)2

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):2724
                                      Entropy (8bit):4.858441642519087
                                      Encrypted:false
                                      SSDEEP:48:YXsPMHi5s7MHgKsSMH/zs8MHIs51tFsL6zsbWsdCshDysuMHCLsKMH9swIMHlYhj:XGiQGBGFGJ12LLHDwGyGkGihj
                                      MD5:9E0C31BCE1C83C78981EB86A29E2879B
                                      SHA1:3973E5D4DA1BC0BB99B78D1DFA7BEA045C85E173
                                      SHA-256:3D1BDA968D1CFF79DBD0C4B9D2A22367E9D9B8374622CD4263BD39137D8FE584
                                      SHA-512:D196B2993F4A46AFFD38DBA59866B048221D5CF6EAB1574846D1799B748BD71B09BE28D8154B16D97AEA300C7EE13719DC2E5034EC9D8913C6A6B399BDEBC23E
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248544495618845","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":31528},"server":"https://dns.google","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248544345624305","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":26637},"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248544345531701","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":53820},"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248544345601356","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":36228},"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"exp

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):5117
                                      Entropy (8bit):4.987451329560466
                                      Encrypted:false
                                      SSDEEP:96:nJ1TfD51pYKIv4ik0JCKL8vkp18bOTQVuwn:nHR1pYF4k4KCkp0
                                      MD5:35A1E292D454EB618484059E561404FE
                                      SHA1:0E9DBDF4E63CA44D8B8FDC5F9420C7E166901186
                                      SHA-256:C9182AB46F519D77AFB46131175B90FC6992E542AE347055A3D8578687E9C6AA
                                      SHA-512:5CB206B31C4F479431DF5CCAB3A665051A7EC2ABE0AD2DB6CB4A9641743A2DDACE8755D7828CEC5A5D541BED3E3A9AD88D26329C7414017B087706CFD1135C4A
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13304151313640492","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245952329814949","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","7355952"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):17703
                                      Entropy (8bit):5.5761872294904435
                                      Encrypted:false
                                      SSDEEP:384:AE3tkLlEOXs51kXqKf/pUZNCgVLH2HfDkrU8NZ4s:SLlVs51kXqKf/pUZNCgVLH2Hf4rUiZf
                                      MD5:8202482A1842C251C4494951C729C8A6
                                      SHA1:C09E346D76D6F2A00E4395EA4889DED45E3E0962
                                      SHA-256:C30531AAFEF136CF1D2F617A5931A4B1603A96FD611B052AB3400E8858E6ABDA
                                      SHA-512:7C4A846384469A74154C29380988F2984FD92B2DC9AD96325A48EF0D8153E99FFA0B98A414E70F1BEB8D8D114A6A83165FEF31D91B3E025AAA9961C4CEA9B712
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13304151312724065","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\75564a82-1747-4a47-bd57-01ef2b43664c.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):325
                                      Entropy (8bit):4.957371343316884
                                      Encrypted:false
                                      SSDEEP:6:YHpoNXR8+eq7JdV5hsDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sd7sBdLJlyH7E4f3K33y
                                      MD5:363D9EBEDB5030036B53B6B28E8A8EA5
                                      SHA1:1C7C9012156AC8295EB465BC774430A866096832
                                      SHA-256:466FE09323B709A587648157D77298132B29F7CD916CD68EF6B28A0FC5EE355B
                                      SHA-512:9C9A230BAF627B8A9856C0AC66E4EA262C304BBC2272662F4213EB617297DFE222E0CCC4FC0F22B04FAFB3125D55D774174700B381EA3FF90B8C3D11926E0238
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248544335120983","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):270336
                                      Entropy (8bit):0.0012471779557650352
                                      Encrypted:false
                                      SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                      MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                      SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                      SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                      SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                      Malicious:false
                                      Reputation:low
                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):325
                                      Entropy (8bit):4.957371343316884
                                      Encrypted:false
                                      SSDEEP:6:YHpoNXR8+eq7JdV5hsDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sd7sBdLJlyH7E4f3K33y
                                      MD5:363D9EBEDB5030036B53B6B28E8A8EA5
                                      SHA1:1C7C9012156AC8295EB465BC774430A866096832
                                      SHA-256:466FE09323B709A587648157D77298132B29F7CD916CD68EF6B28A0FC5EE355B
                                      SHA-512:9C9A230BAF627B8A9856C0AC66E4EA262C304BBC2272662F4213EB617297DFE222E0CCC4FC0F22B04FAFB3125D55D774174700B381EA3FF90B8C3D11926E0238
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248544335120983","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):16
                                      Entropy (8bit):3.2743974703476995
                                      Encrypted:false
                                      SSDEEP:3:1sjgWIV//Rv:1qIFJ
                                      MD5:6752A1D65B201C13B62EA44016EB221F
                                      SHA1:58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
                                      SHA-256:0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
                                      SHA-512:9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
                                      Malicious:false
                                      Reputation:low
                                      Preview:MANIFEST-000004.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):16
                                      Entropy (8bit):3.2743974703476995
                                      Encrypted:false
                                      SSDEEP:3:1sjgWIV//Rv:1qIFJ
                                      MD5:6752A1D65B201C13B62EA44016EB221F
                                      SHA1:58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
                                      SHA-256:0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
                                      SHA-512:9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
                                      Malicious:false
                                      Reputation:low
                                      Preview:MANIFEST-000004.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):106
                                      Entropy (8bit):3.138546519832722
                                      Encrypted:false
                                      SSDEEP:3:tbloIlrJ5ldQxl7aXVdJiG6R0RlAl:tbdlrnQxZaHIGi0R6l
                                      MD5:DE9EF0C5BCC012A3A1131988DEE272D8
                                      SHA1:FA9CCBDC969AC9E1474FCE773234B28D50951CD8
                                      SHA-256:3615498FBEF408A96BF30E01C318DAC2D5451B054998119080E7FAAC5995F590
                                      SHA-512:CEA946EBEADFE6BE65E33EDFF6C68953A84EC2E2410884E12F406CAC1E6C8A0793180433A7EF7CE097B24EA78A1FDBB4E3B3D9CDF1A827AB6FF5605DA3691724
                                      Malicious:false
                                      Reputation:low
                                      Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with no line terminators
                                      Category:dropped
                                      Size (bytes):13
                                      Entropy (8bit):2.8150724101159437
                                      Encrypted:false
                                      SSDEEP:3:Yx7:4
                                      MD5:C422F72BA41F662A919ED0B70E5C3289
                                      SHA1:AAD27C14B27F56B6E7C744A8EC5B1A7D767D7632
                                      SHA-256:02E71EB4C587FEB7EE00CE8600F97411C2774C2FC34CB95B92D5538E7F30DA59
                                      SHA-512:86010ED2B2EEBDCC5A8A076B37703669C294C6D1BFAAEA963E26A9C94B81B4C53EC765D9425E5B616159C43923F800A891F9B903659575DF02F8845521F8DC46
                                      Malicious:false
                                      Reputation:low
                                      Preview:85.0.4183.121

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):503
                                      Entropy (8bit):4.742240430473613
                                      Encrypted:false
                                      SSDEEP:12:YGGYpmvMAV9BKx1PIZUFWIZUapITEpBqMAVCWWO/NrnLAOK:YHYpmvMwOxtEUIEUapIITqMwCWWOFvAD
                                      MD5:D80ECE7E4B3741CD9CD29B89D006B864
                                      SHA1:8F0D587B78E36861ED00524ABF886FA20E14CAE4
                                      SHA-256:C8FF9ACAEA1D3B6F8483339CB40F66BC563CCA8DD87F2337F813C492B20F451B
                                      SHA-512:8A53D9618BBD1A62CD48501E5620932631C1B045612082D99429628D2BF4409AEE3FA695107E82037B5CB332111C456CF3A74235C66B61380CF1E382914F1088
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Aplica\u00e7\u00e3o atualmente indispon\u00edvel."},"craw_connect_to_network":{"message":"Ligue-se a uma rede."},"app_name":{"message":"Pagamentos via Chrome Web Store"},"app_description":{"message":"Pagamentos via Chrome Web Store"},"iap_unavailable":{"message":"Os Pagamentos na app est\u00e3o atualmente indispon\u00edveis."},"please_sign_in":{"message":"Inicie sess\u00e3o no Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:SysEx File -
                                      Category:dropped
                                      Size (bytes):94708
                                      Entropy (8bit):3.7461616959699664
                                      Encrypted:false
                                      SSDEEP:384:9DgPDhyo1GtRV+kzuNLrAvn93Qv5cHV4GMrrGRLTxAFhFQr6DmilSdDDjsONdLNs:FC61tWdIIAeHvFRgfHaRKT531A
                                      MD5:CDC986E36E128274511901BE09F8BD1E
                                      SHA1:0A4A27FA2F5959871F925184038BC9BA18E31F70
                                      SHA-256:A21A652A549683612C56B63D6646F5D80E91AE6AF2A482D9559678A43396D1E3
                                      SHA-512:6225AB0C05AD37D4210114810709CBC66BD634D0BB87BD3717602A57982E1914FBD3CBE849D16AC772C576BD2320ACB7E6FAA12DE04B4B89191D807AC15F0E9D
                                      Malicious:false
                                      Reputation:low
                                      Preview:.q..............*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6...*...M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....c8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\d6744c0b-3ba3-4a79-bf9c-9e5af8946916.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):92724
                                      Entropy (8bit):3.745461174273047
                                      Encrypted:false
                                      SSDEEP:384:zDgPDhyoBtyzuNLrAvn93Qv5cHV4GMrrGRLTxAFhFQr6DmilSdDDjsONdLNy1bKT:k61tWdIIAeHvFRgfHaRKT531h
                                      MD5:066429D7F26F7B218497E4B9EF0FC0A0
                                      SHA1:A9C870B2038309C0AA506D7525064C39E415AC40
                                      SHA-256:028DCC4D70D423CB27F4654FE1D66CE63A130E248DB9CC612BF070F59968DC91
                                      SHA-512:840593B73D2CD3D298FF3E0A32EC1EBE93F3F88E618A943EACA4C247766D44D4B642B4545F5D4EC8F3E42C4347B75CB41E776613C672A4A7F4BC2879C586E0CB
                                      Malicious:false
                                      Reputation:low
                                      Preview:0j..............*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6...*...M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....c8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\f5f5be65-2b27-4df2-9c34-0c4d707edece.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines, with no line terminators
                                      Category:dropped
                                      Size (bytes):220153
                                      Entropy (8bit):6.069394049617078
                                      Encrypted:false
                                      SSDEEP:6144:CeHuyLumqHrZiSw7sd4dnO3pzAiQfgbV/njhcI8II6RN:C44mqHrZiSw7RnuDQfgxnuzIIM
                                      MD5:F3FA4B0024AEB9A1693E833807679555
                                      SHA1:9D7E58734BCD831054917288E05AF2DFDF6D6806
                                      SHA-256:AC8A4B51FA9F4BFCAE1ADD6439A9DF566103AEF424CD664272CB62A38AEC010F
                                      SHA-512:6BDCCD9EDA99720FEBAB5944B309D982D8F570497BC1F5F4AF02705FF994641941A9A55BDEB93944E0DF1BC47DF6F9357CBDF3FD9A617CAFA3FF420840A475BA
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.659677715000248e+12,"network":1.659645316e+12,"ticks":159925477.0,"uncertainty":3750318.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD5yRpyxHTvRo045wUdD0XcAAAAAAIAAAAAABBmAAAAAQAAIAAAABLbexqB/oExTFJmpcENOvX+bVETIkvlcZMf3oIBvp2bAAAAAA6AAAAAAgAAIAAAAAb9GGQ1QmHgGBymkKDudOpZA89StPbsfruaqqGAbN50MAAAALDWaloNNJZN9rwnlUq/XLN9khJ9Jz9md9VO4rX+Yg+g8mRS88Enlg3B2TpBYYNjwkAAAACddQYw45aj+S/8dGnDKvRWon1T/sv/0i6HXgLXg0I1kMUaef/c6zqkTQ7ehiG3nkSfg6dR/4o1ZLALr+MYbEZ2"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951909820208"},"plugins":{"metadata":{"adobe-flash-player":{"disp

                                      C:\Users\user\AppData\Local\Temp\f2c59ae6-1d47-4f15-969e-3fd54cfd4489.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:very short file (no magic)
                                      Category:dropped
                                      Size (bytes):1
                                      Entropy (8bit):0.0
                                      Encrypted:false
                                      SSDEEP:3:L:L
                                      MD5:5058F1AF8388633F609CADB75A75DC9D
                                      SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                      SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                      SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                      Malicious:false
                                      Reputation:low
                                      Preview:.

                                      C:\Users\user\AppData\Local\Temp\fa2d6f27-1ff1-4c24-8fc4-ada232e086e3.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:Google Chrome extension, version 3
                                      Category:dropped
                                      Size (bytes):248531
                                      Entropy (8bit):7.963657412635355
                                      Encrypted:false
                                      SSDEEP:3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
                                      MD5:541F52E24FE1EF9F8E12377A6CCAE0C0
                                      SHA1:189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
                                      SHA-256:81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
                                      SHA-512:D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
                                      Malicious:false
                                      Reputation:low
                                      Preview:Cr24..............0.."0...*.H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.|1..n.<Fb..f..*Q1.....s..2..{*.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-*eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f|.~.c.4.E.......0..0...*.H............0.......).'..b.*$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$|..|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...|!..A..L.+.=...kP.!.1..

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\bg\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):1293
                                      Entropy (8bit):4.132566655778463
                                      Encrypted:false
                                      SSDEEP:24:YHYpcyllEQVFc0Bh0GQVQQVEM0bRLzRd0bRLzRRpcyllNQVb26RQ0bR60L0ZWOFY:YHYpZaQLH1QKQ6xxzcxzvpZzQA6z2nhQ
                                      MD5:D7A97183BCBD5FB677AA84D464F0C564
                                      SHA1:CDBB279B864E2C0A51E0892B8714131802586506
                                      SHA-256:76EFAD74EB8256B942727C42261147EB9CCA48DA284DB3CDCE5DC6A3B4346F02
                                      SHA-512:36F0310DD06319E4A51F77E4C3D64F6276891CE6410FE2571324BB71F2FBCDA368EAC4267FF8268086BE6912E41787D0F70771755E3D49E3E8C26648EAC6EFC9
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"\u041f\u043e\u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043d\u044f\u043c\u0430 \u0434\u043e\u0441\u0442\u044a\u043f \u0434\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u0442\u043e."},"craw_connect_to_network":{"message":"\u041c\u043e\u043b\u044f, \u0441\u0432\u044a\u0440\u0436\u0435\u0442\u0435 \u0441\u0435 \u0441 \u043c\u0440\u0435\u0436\u0430."},"app_name":{"message":"\u041f\u043b\u0430\u0449\u0430\u043d\u0438\u044f \u0432 \u0443\u0435\u0431 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 \u043d\u0430 Chrome"},"app_description":{"message":"\u041f\u043b\u0430\u0449\u0430\u043d\u0438\u044f \u0432 \u0443\u0435\u0431 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 \u043d\u0430 Chrome"},"iap_unavailable":{"message":"\u041f\u043e\u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043d\u044f\u043c\u0430 \u0434\u043e\u0441\u0442\u044a\u043f \u0434\u043e \u0432\u0433\u0440\u0430\u0434\u0435\u043d\u0430\u0442\u0430 \

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\ca\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):556
                                      Entropy (8bit):4.768628082639434
                                      Encrypted:false
                                      SSDEEP:12:YGGYp73YbYHOLBiGF14gevg7p6ixuYHOPBBVC9WO/NrnLAOK:YHYp73vuLBVV17pRunVC9WOFvAOK
                                      MD5:58BA5F65ED971591D1F9D81848EE31D0
                                      SHA1:BDA3C8B74653334FC8F060CAFBCEA58DF0113AB7
                                      SHA-256:CDD91587F5AF2C865776B36A5E9A07B10D21B9D911DE0B814B7A1E94B14AE885
                                      SHA-512:BA2A6BAA3011A54E6B07E29DFD133009D66B6CFFF525DEC0024BDE55A9BED463AD130307EE64BFB4A983A11FFD6B44BD53ED38EB144083A2CBEFA8D85C4D5D41
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Ara mateix aquesta aplicaci\u00f3 no est\u00e0 disponible."},"craw_connect_to_network":{"message":"Connecteu-vos a una xarxa."},"app_name":{"message":"Sistema de pagaments de Chrome Web Store"},"app_description":{"message":"Sistema de pagaments de Chrome Web Store"},"iap_unavailable":{"message":"La funci\u00f3 Pagaments a l'aplicaci\u00f3 no est\u00e0 disponible actualment."},"please_sign_in":{"message":"Inicieu la sessi\u00f3 a Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\cs\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):550
                                      Entropy (8bit):4.905634822460801
                                      Encrypted:false
                                      SSDEEP:12:YGGYpTPklW+g5Q7wvAvPJE7ZEWJE7ZRpmJEWN20GN5Q9O/NrnLAOK:YHYpbt5SwvGJE7ZfJE7ZRpmJEEGN5WOi
                                      MD5:43161EFFA28A0DBFC67B8F7DBE1B5184
                                      SHA1:FE0A9235A59B51B7F564F14FF564344927F035B8
                                      SHA-256:3A04421DF5218E8ABD3B0E2AFE11E8338D7BDCBCD1ADB122416944B102BC9696
                                      SHA-512:FC6A391A4B37FFEE2182F29C1590E32766A1820DC58D0A70A8DD96D7ABE74B47181B24AFFF8ADAE12686CCB1B898DCDDB882EFD205C3387B5B6F3CFBE6E5BA78
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Aplikace v sou\u010dasn\u00e9 dob\u011b nen\u00ed dostupn\u00e1."},"craw_connect_to_network":{"message":"P\u0159ipojte se pros\u00edm k s\u00edti."},"app_name":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"app_description":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"iap_unavailable":{"message":"Platby v aplikaci aktu\u00e1ln\u011b nejsou k dispozici."},"please_sign_in":{"message":"P\u0159ihlaste se do Chromu."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\da\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):505
                                      Entropy (8bit):4.795529861403324
                                      Encrypted:false
                                      SSDEEP:12:YGGYpB/wHlHE3qKWEMqKWRp8KW/wU0HWO/NrnLAOK:YHYpN4lGqKAqKgp8FiHWOFvAOK
                                      MD5:31264DDBF251A95DE82D0A67FA47DB3A
                                      SHA1:3A48DC7AF26A153594C7849E1D92AAC31296459B
                                      SHA-256:EDB51898A6C73D0090D6916B7B72EBAC71E964EABB5BA7CD68E21966024F0D23
                                      SHA-512:B97D61BD71E3F0A91FF1048D2ACAD4BC092CCAF157B7A96029B6AB5AF1812B01814E3153CD894307CB13DC132523EAC22B19CADA6B97F4B81B0D1132562317B5
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Appen er ikke tilg\u00e6ngelig i \u00f8jeblikket."},"craw_connect_to_network":{"message":"Opret forbindelse til et netv\u00e6rk."},"app_name":{"message":"Betalinger i Chrome Webshop"},"app_description":{"message":"Betalinger i Chrome Webshop"},"iap_unavailable":{"message":"Betaling i appen er ikke tilg\u00e6ngelig i \u00f8jeblikket."},"please_sign_in":{"message":"Log ind p\u00e5 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\de\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):516
                                      Entropy (8bit):4.809852395188501
                                      Encrypted:false
                                      SSDEEP:12:YGGYpyBCEl9ljMRE1RRpUT6+ZMUO/NrnLAOK:YHYpQDbPpUTvTOFvAOK
                                      MD5:7639B300B40DDAF95318D2177D3265F9
                                      SHA1:BF9EFDF073231CB3FCFCA5CCCA25B079ECFC45BD
                                      SHA-256:356A9D4ADFEC484DA824E7A72059B724B1686FC90082F4A4B667630436D593B0
                                      SHA-512:70593318C6626B5D25729E8D8109D5611B95283266621BE60ADD7E60C0DD5BC43848E956C767251B7B3CCDF5A0929922DE38F90CC8632CCD0C1CCFC7D6DEFE69
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Die App ist momentan nicht verf\u00fcgbar."},"craw_connect_to_network":{"message":"Bitte stellen Sie eine Verbindung zu einem Netzwerk her."},"app_name":{"message":"Chrome Web Store-Zahlungen"},"app_description":{"message":"Chrome Web Store-Zahlungen"},"iap_unavailable":{"message":"In-App-Zahlungen sind momentan nicht m\u00f6glich."},"please_sign_in":{"message":"Bitte melden Sie sich in Chrome an."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\el\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):1236
                                      Entropy (8bit):4.338644812557597
                                      Encrypted:false
                                      SSDEEP:24:YHYpgFMjXrNW1DWgHle+T2dAplFcTpW1auWgtes9WOFvAOK:YHYpkMj7yxHw+CdAplFcifIs9nhQ
                                      MD5:3026E922B17DBEE2674FDAEE960DF584
                                      SHA1:76602B1E3449F1B67DE42FD31A581B0821BFEFF0
                                      SHA-256:876845B5A061FAB3CF2A1466E01015DC40DF8449F1CB4205F575CEBED8717BAD
                                      SHA-512:0C4DCB2589553F9F75534E6C702EBF9095665C93D213564265E39220A99B61BB112A3B20980CE0377C7E98878E3240EB87312B5ECE874382B7E9CA90A0016992
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"\u0397 \u03b5\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ae \u03c0\u03c1\u03bf\u03c2 \u03c4\u03bf \u03c0\u03b1\u03c1\u03cc\u03bd \u03b4\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03b9\u03b1\u03b8\u03ad\u03c3\u03b9\u03bc\u03b7."},"craw_connect_to_network":{"message":"\u03a3\u03c5\u03bd\u03b4\u03b5\u03b8\u03b5\u03af\u03c4\u03b5 \u03c3\u03b5 \u03ad\u03bd\u03b1 \u03b4\u03af\u03ba\u03c4\u03c5\u03bf."},"app_name":{"message":"\u03a0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03c2 \u03c3\u03c4\u03bf Chrome Web Store"},"app_description":{"message":"\u03a0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03c2 \u03c3\u03c4\u03bf Chrome Web Store"},"iap_unavailable":{"message":"\u039f\u03b9 \u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03c2 \u03b5\u03bd\u03c4\u03cc\u03c2 \u03b5\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ce\u03bd \u03b4\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b1\u03c5\u03c4\u03ae\u03bd \u03c4\u03b7 \u03c3\u03c4\u03b9\u03b3\u03bc\u03ae \u03b4\u03b9\u03b1\u03b8

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\en\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):450
                                      Entropy (8bit):4.679939707243892
                                      Encrypted:false
                                      SSDEEP:12:YGGYp4Fp0JAvpErBpUwEGFpfJAKWO/NrnLAOK:YHYpAp0J3pURKpfJzWOFvAOK
                                      MD5:DBEDF86FA9AFB3A23DBB126674F166D2
                                      SHA1:5628AFFBCF6F897B9D7FD9C17DEB9AA75036F1CC
                                      SHA-256:C0945DD5FDECAB40C45361BEC068D1996E6AE01196DCE524266D740808F753FE
                                      SHA-512:931D7BA6DA84D4BB073815540F35126F2F035A71BFE460F3CCAED25AD7C1B1792AB36CD7207B99FDDF5EAF8872250B54A8958CF5827608F0640E8AAFE11E0071
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"App currently unavailable."},"craw_connect_to_network":{"message":"Please connect to a network."},"app_name":{"message":"Chrome Web Store Payments"},"app_description":{"message":"Chrome Web Store Payments"},"iap_unavailable":{"message":"In-App Payments is currently unavailable."},"please_sign_in":{"message":"Please sign into Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\en_GB\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):450
                                      Entropy (8bit):4.679939707243892
                                      Encrypted:false
                                      SSDEEP:12:YGGYp4Fp0JAvpErBpUwEGFpfJAKWO/NrnLAOK:YHYpAp0J3pURKpfJzWOFvAOK
                                      MD5:DBEDF86FA9AFB3A23DBB126674F166D2
                                      SHA1:5628AFFBCF6F897B9D7FD9C17DEB9AA75036F1CC
                                      SHA-256:C0945DD5FDECAB40C45361BEC068D1996E6AE01196DCE524266D740808F753FE
                                      SHA-512:931D7BA6DA84D4BB073815540F35126F2F035A71BFE460F3CCAED25AD7C1B1792AB36CD7207B99FDDF5EAF8872250B54A8958CF5827608F0640E8AAFE11E0071
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"App currently unavailable."},"craw_connect_to_network":{"message":"Please connect to a network."},"app_name":{"message":"Chrome Web Store Payments"},"app_description":{"message":"Chrome Web Store Payments"},"iap_unavailable":{"message":"In-App Payments is currently unavailable."},"please_sign_in":{"message":"Please sign into Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\es\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):542
                                      Entropy (8bit):4.704430479150276
                                      Encrypted:false
                                      SSDEEP:12:YGGYpDbKEzebFcjwWtp6FPbF3QVcqHWO/NrnLAOK:YHYpqEzoFmpQymaWOFvAOK
                                      MD5:3F4B0F56C2839839FC3E3270ED4CB7B6
                                      SHA1:0D74EA655EAE3990E95BD26F6E1467EDF3EB3478
                                      SHA-256:1912EA5E0A62BBC669DC14AB5A5BD5514B0502C483EE1F27C3F8834384187079
                                      SHA-512:4E6A828FE73FC4AB03F0EE966CE7BD8061575A059E90709F908D8D91C5F4EB6A8D25BBFA100E48AD7AC94E76D3BCD3547C277B4150D515222757CC9906AD20A2
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Esta aplicaci\u00f3n no est\u00e1 disponible en este momento."},"craw_connect_to_network":{"message":"Con\u00e9ctate a una red."},"app_name":{"message":"Sistema de pagos de Chrome Web Store"},"app_description":{"message":"Sistema de pagos de Chrome Web Store"},"iap_unavailable":{"message":"Los pagos en la aplicaci\u00f3n no est\u00e1n disponibles en este momento."},"please_sign_in":{"message":"Inicia sesi\u00f3n en Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\es_419\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):510
                                      Entropy (8bit):4.719977015734499
                                      Encrypted:false
                                      SSDEEP:12:YGGYpDbKEzebFcjwWtpML4c9WO/NrnLAOK:YHYpqEzoFmpMLBWOFvAOK
                                      MD5:1FD5DAF46C4D7C4F571C263EC37B943B
                                      SHA1:A57EE5EF6861F88005C2230EA3D633A1B4CA105A
                                      SHA-256:BCC2CF06F66E9E3BB4B7887D0EE0AE4A72A6C49F4B2A578A7733B78208984417
                                      SHA-512:79C3104F1DC51B17B062803209029C8165DBD391FBE0B69BB406D7B4F92FE1898CAC30E20C2E5CFB65D643B978095626C68EAA0CFCA064354D52D52D16BF21A9
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Esta aplicaci\u00f3n no est\u00e1 disponible en este momento."},"craw_connect_to_network":{"message":"Con\u00e9ctate a una red."},"app_name":{"message":"Sistema de pagos de Chrome Web Store"},"app_description":{"message":"Sistema de pagos de Chrome Web Store"},"iap_unavailable":{"message":"En este momento, Pagos En-Apps no est\u00e1 disponible."},"please_sign_in":{"message":"Accede a Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\et\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):460
                                      Entropy (8bit):4.679279844668757
                                      Encrypted:false
                                      SSDEEP:6:YGGYpkeVeVfCb53Q67PZV6pPQpkjA5DeY68AoLRcZplNgCnGcPxYA8KoOK:YGGYpv2A77PrQPQpT/AoLRO/NrnLAOK
                                      MD5:0293A7BAE6EEE62C4067A80E262D6A2D
                                      SHA1:E76B07BD49FFBBFB6841B7335CBE7A9620714402
                                      SHA-256:D06F20D4D68D1DBB89EF7D8E405D9499CB2EB2560217CD5B4A51AB1DD50CAB44
                                      SHA-512:8BF97DA4038A9C4426A285D5FEF0953F4E7E6D0667091A39DE4D4C5B4C35FC7B6A804425DBB4B82356A93950738E4F0937DE1AD777AE75AAC9BFB97D63F771E0
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Rakendus pole praegu saadaval."},"craw_connect_to_network":{"message":"Looge \u00fchendus v\u00f5rguga."},"app_name":{"message":"Chrome'i veebipoe maksed"},"app_description":{"message":"Chrome'i veebipoe maksed"},"iap_unavailable":{"message":"Rakendusesisesed maksed ei ole praegu saadaval."},"please_sign_in":{"message":"Logige Chrome'i sisse."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\fi\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):568
                                      Entropy (8bit):4.768364810051887
                                      Encrypted:false
                                      SSDEEP:12:YGGYpQTajDRdes6KUVJ8epQTNufIRdes6K27lO/NrnLAOK:YHYpQ67esNMpQJufI7esN27lOFvAOK
                                      MD5:E5BBE7DBBE75F45BDCD49DB8C797106E
                                      SHA1:0F069D7D19768180945F0D8B67DC71262FD586A2
                                      SHA-256:BFFB2248B4C66306133FA6ECBB1541F44B3BE22CC8D9A338D690E0B1D0C85532
                                      SHA-512:F6FE20B7A3B99BDBBF6F4737C8C63FE3098F060E6791BC40ED0E95FA5F93AA55C2643766EA2BE099E42EC378CB6E4B6FE7B5F2DA56C03A6A990B94A1F872B825
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Sovellus ei ole t\u00e4ll\u00e4 hetkell\u00e4 k\u00e4ytett\u00e4viss\u00e4."},"craw_connect_to_network":{"message":"Muodosta verkkoyhteys."},"app_name":{"message":"Chrome Web Storen maksut"},"app_description":{"message":"Chrome Web Storen maksut"},"iap_unavailable":{"message":"Sovelluksen sis\u00e4iset maksut eiv\u00e4t ole t\u00e4ll\u00e4 hetkell\u00e4 k\u00e4ytett\u00e4viss\u00e4."},"please_sign_in":{"message":"Kirjaudu sis\u00e4\u00e4n Chromeen."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\fil\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):515
                                      Entropy (8bit):4.699741311937528
                                      Encrypted:false
                                      SSDEEP:12:YGGYpsiwZALE0Dw9DtpsjzAvX2xSWO/NrnLAOK:YHYpsBvpsiX2xSWOFvAOK
                                      MD5:658DAD2AF2DC3AC1567D84E8B95F68B0
                                      SHA1:EE1121215960EC5ED5F7B6BDB8E4680731EBF83D
                                      SHA-256:978BA6D814CF290016833BBAC22DC7C05C2C575B1D6429B9BB14F8C2156BCF29
                                      SHA-512:F2FB93245D80E2CB2CA1BB2B0654FE92AD9041A558850D78AF4031CB83D2AD3BF5ABCFE6BC32160D028CA3914FA69A64784858A34FA56389C08D52B316346A05
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Kasalukuyang hindi available ang app."},"craw_connect_to_network":{"message":"Mangyaring kumonekta sa isang network."},"app_name":{"message":"Mga Pagbabayad sa Chrome Web Store"},"app_description":{"message":"Mga Pagbabayad sa Chrome Web Store"},"iap_unavailable":{"message":"Kasalukuyang hindi available ang Mga Pagbabayad na In-App."},"please_sign_in":{"message":"Mangyaring mag-sign in sa Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\fr\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):562
                                      Entropy (8bit):4.717150188929866
                                      Encrypted:false
                                      SSDEEP:12:YGGYpKdgbfUSPcLf0E1UDWcLf0E1Uop6oTQpGnbgWWO/NrnLAOK:YHYpagI26Qq6QopRTQwnFWOFvAOK
                                      MD5:1E32A78526E3AC8108E73D384F17450B
                                      SHA1:BFE2E47D888BA530A27DD1BDE25C46433C2A545C
                                      SHA-256:80F6EE69F1E022812BCCC1DE1CDC53772CDF90F4E93224161B23FA607D45136A
                                      SHA-512:5504F6D440779BC96571863D60B1E175EEDDC2E65B1ABBCFCFD19123F329F2E025FBA4D49BD23E33B77FFB6061BA6645132E04D4A7DEDE77F514B2151CDDF896
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Application indisponible pour le moment."},"craw_connect_to_network":{"message":"Veuillez vous connecter \u00e0 un r\u00e9seau."},"app_name":{"message":"Paiements via le Chrome\u00a0Web\u00a0Store"},"app_description":{"message":"Paiements via le Chrome\u00a0Web\u00a0Store"},"iap_unavailable":{"message":"Les paiements via l'application ne sont pas disponibles pour le moment."},"please_sign_in":{"message":"Veuillez vous connecter \u00e0 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\hi\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):1055
                                      Entropy (8bit):4.454461505283053
                                      Encrypted:false
                                      SSDEEP:24:YHYpINcVc0KgcNZvCjK7jK6pVi8/pBKgcNkQVcRynX6XjOFvAOK:YHYpIcQvCjIjRpVVBXPsqihQ
                                      MD5:B739E3B798D3EEB8AFB3E368455A8E97
                                      SHA1:56E206DD0AC7EB7B179911BE3F7DD78059CBD4F3
                                      SHA-256:BA7A53A1398168719F2ACD58CC5FE06AB0B769ECA896D70E7208B18085B42FFA
                                      SHA-512:181A3B1275D1D17BD48EAA77805981A96E22589A38990214AF3ED029C4A37C2F05ECF747D8FCF816C2AAED6EF82403757F234D67C360A3A6E5DB6C3F59CA1A0C
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"\u0910\u092a\u094d\u0932\u093f\u0915\u0947\u0936\u0928 \u0907\u0938 \u0938\u092e\u092f \u0909\u092a\u0932\u092c\u094d\u0927 \u0928\u0939\u0940\u0902 \u0939\u0948."},"craw_connect_to_network":{"message":"\u0915\u0943\u092a\u092f\u093e \u0928\u0947\u091f\u0935\u0930\u094d\u0915 \u0938\u0947 \u0915\u0928\u0947\u0915\u094d\u091f \u0915\u0930\u0947\u0902."},"app_name":{"message":"Chrome \u0935\u0947\u092c \u0938\u094d\u091f\u094b\u0930 \u092d\u0941\u0917\u0924\u093e\u0928"},"app_description":{"message":"Chrome \u0935\u0947\u092c \u0938\u094d\u091f\u094b\u0930 \u092d\u0941\u0917\u0924\u093e\u0928"},"iap_unavailable":{"message":"\u0907\u0928-\u0910\u092a \u092d\u0941\u0917\u0924\u093e\u0928 \u0905\u092d\u0940 \u0909\u092a\u0932\u092c\u094d\u0927 \u0928\u0939\u0940\u0902 \u0939\u0948."},"please_sign_in":{"message":"\u0915\u0943\u092a\u092f\u093e Chrome \u092e\u0947\u0902 \u0938\u093e\u0907\u0928 \u0907\u0928 \u0915\u0930\u0947\u0902."},"jwt_retrieve_failed":

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\hr\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):503
                                      Entropy (8bit):4.819520019697578
                                      Encrypted:false
                                      SSDEEP:12:YGGYpTOEu5TfIJPFJEPJEsxmfEWJEsxmfRpmJEzrMrQp5TfnHV5/WIWO/NrnLAOK:YHYpq7EJPkJExfJExRpmJE/LXzHV5/ji
                                      MD5:9CF848209FF50DBF68F5292B3421831C
                                      SHA1:D29880B7B15102469123D8747BF645706CE8595B
                                      SHA-256:EA1744C3CFBAA684A31A00067E8493ED114EFF3E878C797C9C55A7B122D855CD
                                      SHA-512:B784AEE4926F850F30072ABDA85E2E2E3966285F14BDF647BD2A41C5C06CAB04BC962584830E4E913896010396EAD02D90528235B9D9EDA1BDEFBFBB5333EDF5
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Aplikacija trenuta\u010dno nije dostupna."},"craw_connect_to_network":{"message":"Pove\u017eite se s mre\u017eom."},"app_name":{"message":"Pla\u0107anja u web-trgovini Chrome"},"app_description":{"message":"Pla\u0107anja u web-trgovini Chrome"},"iap_unavailable":{"message":"Pla\u0107anje u aplikaciji trenuta\u010dno nije dostupno."},"please_sign_in":{"message":"Prijavite se na Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\hu\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):612
                                      Entropy (8bit):4.865151680865773
                                      Encrypted:false
                                      SSDEEP:12:YGGYpiKQhMDCJNYygdGs61gdGs3piKQChMDZAYRO/NrnLAOK:YHYpzQhsiPgdG1gdGcpzQChsZAYOFvAD
                                      MD5:4AD92AFDE3408FBBE43B0C3C71677650
                                      SHA1:3488901077F336A3196F9AE116E36DF1674E1ACA
                                      SHA-256:61258FE04C23AE14FDC99EE846CEA71CC703990CC0F80C3934299646E86C475E
                                      SHA-512:EB945FA455DEB9D70033DC0A8AA55D1F47AA00214B70AD34D5419A54F9C05B267F96F9785139F452BEE6972376DDF13EE51C681845A2B0818172FB75BA1FD093
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Az alkalmaz\u00e1s jelenleg nem \u00e9rhet\u0151 el."},"craw_connect_to_network":{"message":"K\u00e9rj\u00fck, csatlakozzon egy h\u00e1l\u00f3zathoz."},"app_name":{"message":"Chrome Internetes \u00e1ruh\u00e1z Fizet\u00e9si rendszere"},"app_description":{"message":"Chrome Internetes \u00e1ruh\u00e1z Fizet\u00e9si rendszere"},"iap_unavailable":{"message":"Az alkalmaz\u00e1son bel\u00fcli fizet\u00e9s jelenleg nem \u00e9rhet\u0151 el."},"please_sign_in":{"message":"Jelentkezzen be a Chrome-ba."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\id\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):461
                                      Entropy (8bit):4.642271834875684
                                      Encrypted:false
                                      SSDEEP:12:YGGYpDBHAeSnLPo2sWo25pmo22C/SzFAAh+M9WO/NrnLAOK:YHYplHcFTpmzOptWOFvAOK
                                      MD5:9008516AA1D8F8C2B8ECE70B7E4963AD
                                      SHA1:EA7AD4BE77A80A4B9FB1E59A340010830E494747
                                      SHA-256:89CAB0AF2B53C6ABEB93C8C628DDCBDD286A7A2672FE03440411BB654E3A0675
                                      SHA-512:46534829417CAD54310BA90AD4545918A2E934508E0CC3467E367944E52315B1BC6500119214EABD40D641DD167C077935436135AF1C0DB1D1007AE98E6175FC
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Aplikasi tidak tersedia saat ini."},"craw_connect_to_network":{"message":"Sambungkan ke jaringan."},"app_name":{"message":"Pembayaran Chrome Webstore"},"app_description":{"message":"Pembayaran Chrome Webstore"},"iap_unavailable":{"message":"Pembayaran Dalam Aplikasi saat ini tidak tersedia."},"please_sign_in":{"message":"Harap masuk ke Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\it\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):464
                                      Entropy (8bit):4.701550173628233
                                      Encrypted:false
                                      SSDEEP:12:YGGYpmXXHEva6PIqd6WIqd3p6PqTX2zaWO/NrnLAOK:YHYpmnkvNtdRtd3pX6+WOFvAOK
                                      MD5:BB9C32BA62DDA02F9471C64B5F9CF916
                                      SHA1:9825037D5D9185C58456CDD887C77B10A41D8C84
                                      SHA-256:43A0B113D3773BA78F82BB9E42DDC46F6892D0FBBB351F94A7C105E4A146E9C1
                                      SHA-512:4D3DB91A6251F2DD9CBF97D29805A7AC23F49988966E9B686D486B4A8CEBEA33F5502E3891D5231674061127C282C745FB87FDA7467A6172851BF6925506C8CA
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"App al momento non disponibile."},"craw_connect_to_network":{"message":"Collegati a una rete."},"app_name":{"message":"Pagamenti Chrome Web Store"},"app_description":{"message":"Pagamenti Chrome Web Store"},"iap_unavailable":{"message":"La funzione Pagamenti In-App non \u00e8 al momento disponibile."},"please_sign_in":{"message":"Accedi a Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\ja\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):806
                                      Entropy (8bit):4.671841695172103
                                      Encrypted:false
                                      SSDEEP:12:YGGYpqbrR5IYstMNcXh82q8b0kOoZ46ToZ43pqbtVD2CR5IYstR0O8b0KhO/Nrnk:YHYpcFiLRMACqNpctVPieOAhOFvAOK
                                      MD5:96C8CBD161D3CE9CB1A46CB2CD0C6583
                                      SHA1:78BBFCF035B5B620E353C8E520653ADD3F4E7DB8
                                      SHA-256:81D8F1D9F72B3139BC5D9845BCF82990308FB6175D07514D8238B1E6D5D02E8A
                                      SHA-512:692468B7B44D961D8248BBC30CC11DE9F3F7E89D01A609E6CB71CAF653D8212C15DFA834C5FB6E8261FD21A25E9616861C0A3FC01DB27CBBE79C3FDE2C6549DD
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"\u30a2\u30d7\u30ea\u306f\u73fe\u5728\u3054\u5229\u7528\u3044\u305f\u3060\u3051\u307e\u305b\u3093\u3002"},"craw_connect_to_network":{"message":"\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u306b\u63a5\u7d9a\u3057\u3066\u304f\u3060\u3055\u3044\u3002"},"app_name":{"message":"Chrome \u30a6\u30a7\u30d6\u30b9\u30c8\u30a2\u6c7a\u6e08"},"app_description":{"message":"Chrome \u30a6\u30a7\u30d6\u30b9\u30c8\u30a2\u6c7a\u6e08"},"iap_unavailable":{"message":"\u30a2\u30d7\u30ea\u5185\u30da\u30a4\u30e1\u30f3\u30c8\u306f\u73fe\u5728\u3054\u5229\u7528\u3044\u305f\u3060\u3051\u307e\u305b\u3093\u3002"},"please_sign_in":{"message":"Chrome \u306b\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u304f\u3060\u3055\u3044\u3002"},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\ko\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):656
                                      Entropy (8bit):4.88216622785951
                                      Encrypted:false
                                      SSDEEP:12:YGGYpqHZMskkrcaw6cT/pb8pqHkrskeQV7wUO/NrnLAOK:YHYpsrkYcawwps5kdwUOFvAOK
                                      MD5:3CAF23A8EA2332D78B725B6C99EC3202
                                      SHA1:95C3504F55A929449EF2E3AB92014562AACD39AD
                                      SHA-256:BFE72BBC492B9018A599CB6575366696E431E6A38400E4B2ED06EAE3340D3AE5
                                      SHA-512:C000FCCB567D3590D4C401005E78C539961455BB13686296EC4FF7018BB0A4DAB2DA96FBDAA33D999C1409B5796932370219B3FF8490B671586DEBD6145519D6
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"\ud604\uc7ac \uc571\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4."},"craw_connect_to_network":{"message":"\ub124\ud2b8\uc6cc\ud06c\uc5d0 \uc5f0\uacb0\ud558\uc138\uc694."},"app_name":{"message":"Chrome \uc6f9 \uc2a4\ud1a0\uc5b4 \uacb0\uc81c"},"app_description":{"message":"Chrome \uc6f9 \uc2a4\ud1a0\uc5b4 \uacb0\uc81c"},"iap_unavailable":{"message":"\ud604\uc7ac \uc778\uc571 \uacb0\uc81c\ub97c \uc0ac\uc6a9\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4."},"please_sign_in":{"message":"Chrome\uc5d0 \ub85c\uadf8\uc778\ud558\uc138\uc694."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\lt\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):576
                                      Entropy (8bit):4.846810495221701
                                      Encrypted:false
                                      SSDEEP:12:YGGYpmEOnxwkD9AMoAYQa9AMoAYNpALveYAyO/NrnLAOK:YHYpmznayAMHcAMHQpAzeYAyOFvAOK
                                      MD5:41F2D63952202E528DBBB683B480F99C
                                      SHA1:9DD998542DBE6609299D4A5A25364A32FA7D7865
                                      SHA-256:FF7C083CD1E6134DD8263C634336EB852274BAD1BFAD18762814C42BC65309D8
                                      SHA-512:7BD2E2D4264C6BD62DF2584F3C1D3A910C5C5A28F4532F1E8F0C2235E93714EDD6074EA24960D4DEB4F9125DA81CA813F06330EFF66FA8DF1552D1DAC686441E
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Programa \u0161iuo metu negalima."},"craw_connect_to_network":{"message":"Prisijunkite prie tinklo."},"app_name":{"message":"\u201eChrome\u201c internetin\u0117s parduotuv\u0117s mok\u0117jimo sistema"},"app_description":{"message":"\u201eChrome\u201c internetin\u0117s parduotuv\u0117s mok\u0117jimo sistema"},"iap_unavailable":{"message":"Mok\u0117jimai programoje \u0161iuo metu negalimi."},"please_sign_in":{"message":"Prisijunkite prie \u201eChrome\u201c."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\lv\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):584
                                      Entropy (8bit):4.856464171821628
                                      Encrypted:false
                                      SSDEEP:12:YGGYp6nQ11155y9k5hInf6whInf3pRKbqk0R5VR8WO/NrnLAOK:YHYpp11dy9iIdIvpc2ZgWOFvAOK
                                      MD5:1D21ED2D46338636E24401F6E56E326F
                                      SHA1:24497EDB25724BC4A57823C5CD06F50DB9647DD4
                                      SHA-256:434A375C32B8A21C435511C551F740FD4D170EC528A8F4EFC3D798EA4A07B606
                                      SHA-512:10A870718CC6281EE09DE01900D303B06589D9281C5849D6105C6FCF58BFFA3855F29C6ECA3689FFE6EF304BABCF41C5700EE2D8AFE711D57CB711194366FA6A
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Lietotne pagaid\u0101m nav pieejama."},"craw_connect_to_network":{"message":"L\u016bdzu, izveidojiet savienojumu ar t\u012bklu."},"app_name":{"message":"Chrome interneta veikala maks\u0101jumu sist\u0113ma"},"app_description":{"message":"Chrome interneta veikala maks\u0101jumu sist\u0113ma"},"iap_unavailable":{"message":"Maks\u0101jumi lietotn\u0113s pa\u0161laik nav pieejami."},"please_sign_in":{"message":"L\u016bdzu, pierakstieties p\u0101rl\u016bk\u0101 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\nb\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):501
                                      Entropy (8bit):4.804937629013952
                                      Encrypted:false
                                      SSDEEP:12:YGGYpB928UZjdyE9iDCiop8682fURHWO/NrnLAOK:YHYpXK/iOiop8NFHWOFvAOK
                                      MD5:8F0168B9A546D5A99FD8A262C975C80E
                                      SHA1:B0718071BD0B7251D4459E9C87DF50C14622FBD6
                                      SHA-256:F03FA7384DF79EBA6E0274D570996030F595A3BF6B781929DD9DB6593262E41F
                                      SHA-512:A1191CDC496DDD7470BDCFAF186BB9488767159E0CA6A6242D195FA3351704DC8F8BBD03DBEE57D37BBD897C9E8D14B7325FB37D58AC80DEC0F972FF893758B8
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Appen er utilgjengelig for \u00f8yeblikket."},"craw_connect_to_network":{"message":"Du m\u00e5 koble til et nettverk."},"app_name":{"message":"Chrome Nettmarked-betalinger"},"app_description":{"message":"Chrome Nettmarked-betalinger"},"iap_unavailable":{"message":"Betaling i app er ikke tilgjengelig for \u00f8yeblikket."},"please_sign_in":{"message":"Du m\u00e5 logge p\u00e5 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\nl\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):472
                                      Entropy (8bit):4.651254944398292
                                      Encrypted:false
                                      SSDEEP:12:YGGYpqK5XUoE32GFM2GapUEn7v0WO/NrnLAOK:YHYp/XaLeLapUEgWOFvAOK
                                      MD5:E7F74DCE7B6411E4E0D95E9252CF74FA
                                      SHA1:33CC6C73C5F8D0144C0260C2E5A9BD0DB3EF6477
                                      SHA-256:3564AEF46C01602B19CC29FD8A79676C543427EDE98206D0C91B33AF0CCF3977
                                      SHA-512:B0987002F8BC4F0B0AC41A87E90BA729464BF2F34D1CC413DD3837019F5F37FD46EB9E9FDABB97F5BDCB50768ABF808AF6E7C531CD7BCA477C71990D2F13335B
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"App momenteel niet beschikbaar."},"craw_connect_to_network":{"message":"Maak verbinding met een netwerk."},"app_name":{"message":"Betalingen via Chrome Web Store"},"app_description":{"message":"Betalingen via Chrome Web Store"},"iap_unavailable":{"message":"In-app-betalingen is momenteel niet beschikbaar."},"please_sign_in":{"message":"Log in bij Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\pl\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):549
                                      Entropy (8bit):4.978056737225237
                                      Encrypted:false
                                      SSDEEP:12:YGGYpTHlBqHdqcUP5Qp0mAW5Qp0mdpm5Qp0p9JqD2WO/NrnLAOK:YHYpRMdO5bmj5bmdpm5bLJBWOFvAOK
                                      MD5:E16649D87E4CA6462192CF78EBE543EC
                                      SHA1:53097D592B13F3C1370366B25024EA72208B136A
                                      SHA-256:EB435F7460A63576CA1ECB51948E7A3AD5168D2F175AE2B5836D469672923D84
                                      SHA-512:6EC702CEC6E312CAC6F33109A57F7D83A3F073F2F9A9BD42DB0F91A36F87D800EEB978C69023B6A0E00B86ECE3E1024C269F89D038F0926619F40D075F6689DD
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Aplikacja jest obecnie niedost\u0119pna."},"craw_connect_to_network":{"message":"Po\u0142\u0105cz si\u0119 z sieci\u0105."},"app_name":{"message":"P\u0142atno\u015bci w sklepie Chrome Web Store"},"app_description":{"message":"P\u0142atno\u015bci w sklepie Chrome Web Store"},"iap_unavailable":{"message":"P\u0142atno\u015bci w ramach aplikacji s\u0105 teraz niedost\u0119pne."},"please_sign_in":{"message":"Zaloguj si\u0119 w Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\pt_BR\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):513
                                      Entropy (8bit):4.734605177119403
                                      Encrypted:false
                                      SSDEEP:12:YGGYpGAV9hv3/1PIc6WIc3paIBMMAV+KcIWO/NrnLAOK:YHYpGwLvt5R53pacHw1pWOFvAOK
                                      MD5:1F4BC8A5EFD59D61127ABEECD4B6CAE3
                                      SHA1:8647B4D2D643AE4F784ABDDC50D87A39AD02971A
                                      SHA-256:E1950CBBF056F068EA56160DDB318F3E6232BFBBE096D221C7CA6FCAACE2A8B9
                                      SHA-512:B58A95BBBC0A16B06826684198B481D2E15A7C760956721C3B538C62C902873A7856F328506457EE66311E45D7A16A4AAAC85B12853AA7EF09780189D28EB3DE
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Aplicativo indispon\u00edvel no momento."},"craw_connect_to_network":{"message":"Conecte-se a uma rede."},"app_name":{"message":"Pagamentos da Chrome Web Store"},"app_description":{"message":"Pagamentos da Chrome Web Store"},"iap_unavailable":{"message":"No momento, os Pagamentos no aplicativo n\u00e3o est\u00e3o dispon\u00edveis."},"please_sign_in":{"message":"Fa\u00e7a login no Google Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\pt_PT\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):503
                                      Entropy (8bit):4.742240430473613
                                      Encrypted:false
                                      SSDEEP:12:YGGYpmvMAV9BKx1PIZUFWIZUapITEpBqMAVCWWO/NrnLAOK:YHYpmvMwOxtEUIEUapIITqMwCWWOFvAD
                                      MD5:D80ECE7E4B3741CD9CD29B89D006B864
                                      SHA1:8F0D587B78E36861ED00524ABF886FA20E14CAE4
                                      SHA-256:C8FF9ACAEA1D3B6F8483339CB40F66BC563CCA8DD87F2337F813C492B20F451B
                                      SHA-512:8A53D9618BBD1A62CD48501E5620932631C1B045612082D99429628D2BF4409AEE3FA695107E82037B5CB332111C456CF3A74235C66B61380CF1E382914F1088
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Aplica\u00e7\u00e3o atualmente indispon\u00edvel."},"craw_connect_to_network":{"message":"Ligue-se a uma rede."},"app_name":{"message":"Pagamentos via Chrome Web Store"},"app_description":{"message":"Pagamentos via Chrome Web Store"},"iap_unavailable":{"message":"Os Pagamentos na app est\u00e3o atualmente indispon\u00edveis."},"please_sign_in":{"message":"Inicie sess\u00e3o no Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\ro\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):554
                                      Entropy (8bit):4.8596885592394505
                                      Encrypted:false
                                      SSDEEP:12:YGGYpqOHHEG7PMeH8EPJWb2r9EWJWb2r9RpmJW9FjkUhI3C7PMdWO/NrnLAOK:YHYpbnEG7PjlJBfJBRpmJmBh57PEWOFY
                                      MD5:D63E66B94A4EA2085D80E76209582FB1
                                      SHA1:4ECAC3EB64DD6253310A0776E6D42257FC290D77
                                      SHA-256:91A5AAD210C3E0241106E8821B3897EDEFEC9D85033C94DB2324FF3A5FDE5AC7
                                      SHA-512:09AC34CF286FD0730EED4F6DB3E2FD00A026D0F42DCC75AE49B045DDAD38DFA38B0FB7823ECAC8B0A9BC2A89F4EAF4BCE081779F2ECDF6CC39286045577DC5C9
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"\u00cen prezent, aplica\u021bia nu este disponibil\u0103."},"craw_connect_to_network":{"message":"Conecteaz\u0103-te la o re\u021bea."},"app_name":{"message":"Pl\u0103\u021bi prin Magazinul web Chrome"},"app_description":{"message":"Pl\u0103\u021bi prin Magazinul web Chrome"},"iap_unavailable":{"message":"Pl\u0103\u021bile \u00een aplica\u021bie nu sunt disponibile momentan."},"please_sign_in":{"message":"Conecteaz\u0103-te la Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\ru\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):1165
                                      Entropy (8bit):4.224419823550506
                                      Encrypted:false
                                      SSDEEP:24:YHYpNQVFc0BHlbZ0JRiKUG0L6RqQV9zJd0L6RqQV9zJRp00EQVqaQVFc0BRTlPzU:YHYpNQLHFQYKA6wQTz+6wQTz3paQAaQ8
                                      MD5:22F9E62ABAD82C2190A839851245A495
                                      SHA1:E7F79BD875918F0D0799DB5F45FAC6297FB66AF7
                                      SHA-256:9FC1167626C97BCBFDAFF23C6033A44252F89A501AF1DF41C43CB3A994FEB09F
                                      SHA-512:F577F2F0C344C4E4050AF025A9FB9AC78CADF7FE177F63AB9863826A9808B7FBF5D3363E3B61D7A6DB083EF5EBAC5474D710347B701640AB9C229A3E5D1F0A48
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"\u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e."},"craw_connect_to_network":{"message":"\u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u0441\u044c \u043a \u0441\u0435\u0442\u0438."},"app_name":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 Chrome"},"app_description":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 Chrome"},"iap_unavailable":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b."},"

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\sk\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):548
                                      Entropy (8bit):4.850036636276313
                                      Encrypted:false
                                      SSDEEP:12:YGGYprMpsgCmIkPJE7ZEWJE7ZRpmJEtMxfAVADJ4ZAvIWO/NrnLAOK:YHYprMFCmvJE7ZfJE7ZRpmJEtMSVGKZo
                                      MD5:4BBAA10FD00AADBBA3EF6E805E8E1A62
                                      SHA1:1991901BD6A20C4A7977F09DF30C0CFF0524C504
                                      SHA-256:906C4F7FDDE15DE4C841E7910BBF14D9175E894BCB244B56E8447A5ADFA5B7AB
                                      SHA-512:3490F8826E3DB0C8B4FE7B1866DA27F6585ADF52E74392A592A60A916E8A784FF7B92B3DE8985084546D663588369D9BB03FCB25196B7F9C6DF607BEB7DEF010
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Aplik\u00e1cia moment\u00e1lne nie je dostupn\u00e1."},"craw_connect_to_network":{"message":"Pripojte sa k sieti."},"app_name":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"app_description":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"iap_unavailable":{"message":"Platby v aplik\u00e1cii moment\u00e1lne nie s\u00fa k dispoz\u00edcii."},"please_sign_in":{"message":"Prihl\u00e1ste sa do prehliada\u010da Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\_locales\sl\messages.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines
                                      Category:dropped
                                      Size (bytes):494
                                      Entropy (8bit):4.7695148367588285
                                      Encrypted:false
                                      SSDEEP:12:YGGYpTOEtyPFTEPJEsvmfEWJEsvmfRpmJEiArERfH5/4WO/NrnLAOK:YHYpqoyPRAJEs4fJEs4RpmJEi6AfH5/x
                                      MD5:F45DE58765A37FD095319D7DEB0F2FB6
                                      SHA1:B585A485C9BC1982EDF7AE0B9AC73A8E91D41CB5
                                      SHA-256:8366774AA582035BC7D949F4E28FAEC371C305D01404DF56FFF5A78B4F6ECDB7
                                      SHA-512:F86334E6E6F90961AD9C8E7DD1A4E923476249469180AC69D9DE59746FE26FAECB585898FC50310380F20CEB0971CA1EB7B55046DA75276840AEA6BAFF574E66
                                      Malicious:false
                                      Reputation:low
                                      Preview:{"craw_app_unavailable":{"message":"Aplikacija trenutno ni na voljo."},"craw_connect_to_network":{"message":"Pove\u017eite se z omre\u017ejem."},"app_name":{"message":"Pla\u010dila v spletni trgovini Chrome"},"app_description":{"message":"Pla\u010dila v spletni trgovini Chrome"},"iap_unavailable":{"message":"Pla\u010dila v aplikacijah trenutno niso na voljo."},"please_sign_in":{"message":"Prijavite se v Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\CRX_INSTALL\manifest.json

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):1098
                                      Entropy (8bit):4.919185521409901
                                      Encrypted:false
                                      SSDEEP:24:BeVvlH141v5GFqeq7x7S4dudxNfN3IFKrGQZDN4:QVNVgvLecJSR1Y8r5ZW
                                      MD5:6CA25F3EF585B63F01BCDF8635120704
                                      SHA1:00C063811E31EA5F9A00F175A71EA25E7821F621
                                      SHA-256:49D9DE983F7436BA786E6E04A5A20C10F41687AE06B266B1B6553F696719563D
                                      SHA-512:566BFD9BADBD8951EE52E5911EB68B51E86286989096D32DE6E32A2523761B0E0AFCA251EF3BEA36B5D51FB8354A5FCA567772A02C3F3B9D8DFE529609FA0430
                                      Malicious:false
                                      Reputation:low
                                      Preview:{."update_url": "https://clients2.google.com/service/update2/crx",.. "name": "__MSG_APP_NAME__",. "description": "__MSG_APP_DESCRIPTION__",. "manifest_version": 2,. "version": "1.0.0.6",. "minimum_chrome_version": "29",. "default_locale": "en",. "app": {. "background": {. "scripts": [. "craw_background.js". ]. }. },. "permissions": [. "identity",. "webview",. "https://www.google.com/",. "https://www.googleapis.com/*",. "https://payments.google.com/payments/v4/js/integrator.js",. "https://sandbox.google.com/payments/v4/js/integrator.js". ],. "oauth2": {. "auto_approve": true,. "scopes": [. "https://www.googleapis.com/auth/sierra",. "https://www.googleapis.com/auth/sierrasandbox",. "https://www.googleapis.com/auth/chromewebstore",. "https://www.googleapis.com/auth/chromewebstore.readonly". ],. "client_id": "203784468217.apps.googleusercontent.com". },. "icons": {. "16": "images/icon_16.png",. "128

                                      C:\Users\user\AppData\Local\Temp\scoped_dir6388_1401234815\fa2d6f27-1ff1-4c24-8fc4-ada232e086e3.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:Google Chrome extension, version 3
                                      Category:dropped
                                      Size (bytes):248531
                                      Entropy (8bit):7.963657412635355
                                      Encrypted:false
                                      SSDEEP:3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
                                      MD5:541F52E24FE1EF9F8E12377A6CCAE0C0
                                      SHA1:189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
                                      SHA-256:81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
                                      SHA-512:D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
                                      Malicious:false
                                      Reputation:low
                                      Preview:Cr24..............0.."0...*.H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.|1..n.<Fb..f..*Q1.....s..2..{*.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-*eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f|.~.c.4.E.......0..0...*.H............0.......).'..b.*$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$|..|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...|!..A..L.+.=...kP.!.1..

                                      Static File Info

                                      ⊘No static file info

                                      Network Behavior

                                      Download Network PCAP: filtered – full

                                      Snort IDS Alerts

                                      TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                      192.168.2.78.8.8.860280532034201 08/04/22-22:35:15.253148UDP2034201ET TROJAN Interactsh Control Panel (DNS)6028053192.168.2.78.8.8.8

                                      Network Port Distribution

                                      • Total Packets: 50
                                      • • 443 (HTTPS)
                                      • • 80 (HTTP)
                                      • • 53 (DNS)
                                      TimestampSource PortDest PortSource IPDest IP
                                      Aug 4, 2022 22:35:15.264029980 CEST49762443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:15.264096975 CEST44349762142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:15.264238119 CEST49762443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:15.267242908 CEST49762443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:15.267265081 CEST44349762142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:15.271589041 CEST4976480192.168.2.746.101.25.250
                                      Aug 4, 2022 22:35:15.272567034 CEST4976580192.168.2.746.101.25.250
                                      Aug 4, 2022 22:35:15.277997017 CEST49766443192.168.2.7142.250.185.205
                                      Aug 4, 2022 22:35:15.278029919 CEST44349766142.250.185.205192.168.2.7
                                      Aug 4, 2022 22:35:15.278425932 CEST49766443192.168.2.7142.250.185.205
                                      Aug 4, 2022 22:35:15.278455019 CEST49766443192.168.2.7142.250.185.205
                                      Aug 4, 2022 22:35:15.278461933 CEST44349766142.250.185.205192.168.2.7
                                      Aug 4, 2022 22:35:15.302278996 CEST804976446.101.25.250192.168.2.7
                                      Aug 4, 2022 22:35:15.302419901 CEST4976480192.168.2.746.101.25.250
                                      Aug 4, 2022 22:35:15.306267977 CEST4976480192.168.2.746.101.25.250
                                      Aug 4, 2022 22:35:15.321053982 CEST44349762142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:15.321449041 CEST49762443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:15.321469069 CEST44349762142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:15.321938992 CEST44349762142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:15.322037935 CEST49762443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:15.323052883 CEST44349762142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:15.323132992 CEST49762443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:15.336932898 CEST804976446.101.25.250192.168.2.7
                                      Aug 4, 2022 22:35:15.337240934 CEST804976446.101.25.250192.168.2.7
                                      Aug 4, 2022 22:35:15.338551998 CEST44349766142.250.185.205192.168.2.7
                                      Aug 4, 2022 22:35:15.339036942 CEST49766443192.168.2.7142.250.185.205
                                      Aug 4, 2022 22:35:15.339092970 CEST44349766142.250.185.205192.168.2.7
                                      Aug 4, 2022 22:35:15.340224981 CEST44349766142.250.185.205192.168.2.7
                                      Aug 4, 2022 22:35:15.340356112 CEST49766443192.168.2.7142.250.185.205
                                      Aug 4, 2022 22:35:15.454900980 CEST4976480192.168.2.746.101.25.250
                                      Aug 4, 2022 22:35:15.646301031 CEST4976480192.168.2.746.101.25.250
                                      Aug 4, 2022 22:35:15.677144051 CEST804976446.101.25.250192.168.2.7
                                      Aug 4, 2022 22:35:15.754898071 CEST4976480192.168.2.746.101.25.250
                                      Aug 4, 2022 22:35:15.777456999 CEST49762443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:15.777559042 CEST49766443192.168.2.7142.250.185.205
                                      Aug 4, 2022 22:35:15.777743101 CEST44349766142.250.185.205192.168.2.7
                                      Aug 4, 2022 22:35:15.777756929 CEST44349762142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:15.777853012 CEST49766443192.168.2.7142.250.185.205
                                      Aug 4, 2022 22:35:15.777884007 CEST44349766142.250.185.205192.168.2.7
                                      Aug 4, 2022 22:35:15.778142929 CEST49762443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:15.778158903 CEST44349762142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:15.806195021 CEST44349762142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:15.806283951 CEST44349762142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:15.806301117 CEST49762443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:15.806366920 CEST49762443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:15.810823917 CEST49762443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:15.810857058 CEST44349762142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:15.828813076 CEST44349766142.250.185.205192.168.2.7
                                      Aug 4, 2022 22:35:15.828941107 CEST49766443192.168.2.7142.250.185.205
                                      Aug 4, 2022 22:35:15.828965902 CEST44349766142.250.185.205192.168.2.7
                                      Aug 4, 2022 22:35:15.829096079 CEST44349766142.250.185.205192.168.2.7
                                      Aug 4, 2022 22:35:15.829418898 CEST49766443192.168.2.7142.250.185.205
                                      Aug 4, 2022 22:35:15.844892025 CEST49766443192.168.2.7142.250.185.205
                                      Aug 4, 2022 22:35:15.844921112 CEST44349766142.250.185.205192.168.2.7
                                      Aug 4, 2022 22:35:18.388000965 CEST4976580192.168.2.746.101.25.250
                                      Aug 4, 2022 22:35:18.419164896 CEST804976546.101.25.250192.168.2.7
                                      Aug 4, 2022 22:35:18.419332027 CEST4976580192.168.2.746.101.25.250
                                      Aug 4, 2022 22:35:29.508919001 CEST4976580192.168.2.746.101.25.250
                                      Aug 4, 2022 22:35:29.540115118 CEST804976546.101.25.250192.168.2.7
                                      Aug 4, 2022 22:35:29.540287018 CEST4976580192.168.2.746.101.25.250
                                      Aug 4, 2022 22:35:30.789098978 CEST804976446.101.25.250192.168.2.7
                                      Aug 4, 2022 22:35:30.789259911 CEST4976480192.168.2.746.101.25.250
                                      Aug 4, 2022 22:35:45.922589064 CEST804976446.101.25.250192.168.2.7
                                      Aug 4, 2022 22:35:45.922689915 CEST4976480192.168.2.746.101.25.250
                                      Aug 4, 2022 22:36:00.687055111 CEST4976480192.168.2.746.101.25.250
                                      Aug 4, 2022 22:36:00.717765093 CEST804976446.101.25.250192.168.2.7
                                      Aug 4, 2022 22:36:15.876918077 CEST804976446.101.25.250192.168.2.7
                                      Aug 4, 2022 22:36:15.877007961 CEST4976480192.168.2.746.101.25.250
                                      TimestampSource PortDest PortSource IPDest IP
                                      Aug 4, 2022 22:35:15.227775097 CEST5051953192.168.2.78.8.8.8
                                      Aug 4, 2022 22:35:15.247106075 CEST53505198.8.8.8192.168.2.7
                                      Aug 4, 2022 22:35:15.249243021 CEST5871553192.168.2.78.8.8.8
                                      Aug 4, 2022 22:35:15.253148079 CEST6028053192.168.2.78.8.8.8
                                      Aug 4, 2022 22:35:15.270376921 CEST53602808.8.8.8192.168.2.7
                                      Aug 4, 2022 22:35:15.276895046 CEST53587158.8.8.8192.168.2.7
                                      Aug 4, 2022 22:35:23.155308008 CEST54180443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:23.183228970 CEST44354180142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:23.220268011 CEST54180443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:23.246480942 CEST44354180142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:23.246545076 CEST44354180142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:23.246583939 CEST44354180142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:23.246624947 CEST44354180142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:23.248195887 CEST54180443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:23.249659061 CEST54180443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:23.316890001 CEST54180443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:23.317265987 CEST54180443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:23.349934101 CEST44354180142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:23.359947920 CEST44354180142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:23.359991074 CEST44354180142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:23.360018015 CEST44354180142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:23.421493053 CEST44354180142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:23.514899969 CEST54180443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:23.562146902 CEST54180443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:23.563172102 CEST54180443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:23.563261032 CEST54180443192.168.2.7142.250.186.110
                                      Aug 4, 2022 22:35:23.567405939 CEST44354180142.250.186.110192.168.2.7
                                      Aug 4, 2022 22:35:23.605489969 CEST54180443192.168.2.7142.250.186.110

                                      DNS Queries

                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                      Aug 4, 2022 22:35:15.227775097 CEST192.168.2.78.8.8.80xcbb9Standard query (0)clients2.google.comA (IP address)IN (0x0001)
                                      Aug 4, 2022 22:35:15.249243021 CEST192.168.2.78.8.8.80x9878Standard query (0)accounts.google.comA (IP address)IN (0x0001)
                                      Aug 4, 2022 22:35:15.253148079 CEST192.168.2.78.8.8.80xcd9eStandard query (0)caezcs32vtc000025v70gf8xscwyyyyyb.interact.shA (IP address)IN (0x0001)

                                      DNS Answers

                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                      Aug 4, 2022 22:35:15.247106075 CEST8.8.8.8192.168.2.70xcbb9No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)
                                      Aug 4, 2022 22:35:15.247106075 CEST8.8.8.8192.168.2.70xcbb9No error (0)clients.l.google.com142.250.186.110A (IP address)IN (0x0001)
                                      Aug 4, 2022 22:35:15.270376921 CEST8.8.8.8192.168.2.70xcd9eNo error (0)caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh46.101.25.250A (IP address)IN (0x0001)
                                      Aug 4, 2022 22:35:15.276895046 CEST8.8.8.8192.168.2.70x9878No error (0)accounts.google.com142.250.185.205A (IP address)IN (0x0001)

                                      HTTP Request Dependency Graph

                                      • accounts.google.com
                                      • clients2.google.com
                                      • caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh

                                      HTTP Packets

                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                      0192.168.2.749766142.250.185.205443C:\Program Files\Google\Chrome\Application\chrome.exe
                                      TimestampkBytes transferredDirectionData


                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                      1192.168.2.749762142.250.186.110443C:\Program Files\Google\Chrome\Application\chrome.exe
                                      TimestampkBytes transferredDirectionData


                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                      2192.168.2.74976446.101.25.25080C:\Program Files\Google\Chrome\Application\chrome.exe
                                      TimestampkBytes transferredDirectionData
                                      Aug 4, 2022 22:35:15.306267977 CEST1015OUTGET / HTTP/1.1
                                      Host: caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh
                                      Connection: keep-alive
                                      Upgrade-Insecure-Requests: 1
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
                                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
                                      Accept-Encoding: gzip, deflate
                                      Accept-Language: en-US,en;q=0.9
                                      Aug 4, 2022 22:35:15.337240934 CEST1022INHTTP/1.1 200 OK
                                      Content-Type: text/html; charset=utf-8
                                      Server: interact.sh
                                      X-Interactsh-Version: 1.0.6-dev
                                      Date: Thu, 04 Aug 2022 20:35:15 GMT
                                      Content-Length: 72
                                      Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 62 79 79 79 79 79 77 63 73 78 38 66 67 30 37 76 35 32 30 30 30 30 63 74 76 32 33 73 63 7a 65 61 63 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                      Data Ascii: <html><head></head><body>byyyyywcsx8fg07v520000ctv23sczeac</body></html>
                                      Aug 4, 2022 22:35:15.646301031 CEST1034OUTGET /favicon.ico HTTP/1.1
                                      Host: caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh
                                      Connection: keep-alive
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
                                      Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8
                                      Referer: http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh/
                                      Accept-Encoding: gzip, deflate
                                      Accept-Language: en-US,en;q=0.9
                                      Aug 4, 2022 22:35:15.677144051 CEST1034INHTTP/1.1 200 OK
                                      Content-Type: text/html; charset=utf-8
                                      Server: interact.sh
                                      X-Interactsh-Version: 1.0.6-dev
                                      Date: Thu, 04 Aug 2022 20:35:15 GMT
                                      Content-Length: 72
                                      Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 62 79 79 79 79 79 77 63 73 78 38 66 67 30 37 76 35 32 30 30 30 30 63 74 76 32 33 73 63 7a 65 61 63 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                      Data Ascii: <html><head></head><body>byyyyywcsx8fg07v520000ctv23sczeac</body></html>
                                      Aug 4, 2022 22:36:00.687055111 CEST2112OUTData Raw: 00
                                      Data Ascii:


                                      HTTPS Proxied Packets

                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                      0192.168.2.749766142.250.185.205443C:\Program Files\Google\Chrome\Application\chrome.exe
                                      TimestampkBytes transferredDirectionData
                                      2022-08-04 20:35:15 UTC0OUTPOST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1
                                      Host: accounts.google.com
                                      Connection: keep-alive
                                      Content-Length: 1
                                      Origin: https://www.google.com
                                      Content-Type: application/x-www-form-urlencoded
                                      Sec-Fetch-Site: none
                                      Sec-Fetch-Mode: no-cors
                                      Sec-Fetch-Dest: empty
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
                                      Accept-Encoding: gzip, deflate, br
                                      Accept-Language: en-US,en;q=0.9
                                      2022-08-04 20:35:15 UTC0OUTData Raw: 20
                                      Data Ascii:
                                      2022-08-04 20:35:15 UTC2INHTTP/1.1 200 OK
                                      Content-Type: application/json; charset=utf-8
                                      Access-Control-Allow-Origin: https://www.google.com
                                      Access-Control-Allow-Credentials: true
                                      X-Content-Type-Options: nosniff
                                      Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                      Pragma: no-cache
                                      Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                      Date: Thu, 04 Aug 2022 20:35:15 GMT
                                      Strict-Transport-Security: max-age=31536000; includeSubDomains
                                      Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]}
                                      Content-Security-Policy: script-src 'report-sample' 'nonce-TmlJ2kRCmv4lGkwP1fVY-g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self'
                                      Content-Security-Policy: script-src 'nonce-TmlJ2kRCmv4lGkwP1fVY-g' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport
                                      Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport
                                      Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
                                      Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp"
                                      Server: ESF
                                      X-XSS-Protection: 0
                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                      Accept-Ranges: none
                                      Vary: Accept-Encoding
                                      Connection: close
                                      Transfer-Encoding: chunked
                                      2022-08-04 20:35:15 UTC4INData Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a
                                      Data Ascii: 11["gaia.l.a.r",[]]
                                      2022-08-04 20:35:15 UTC4INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                      1192.168.2.749762142.250.186.110443C:\Program Files\Google\Chrome\Application\chrome.exe
                                      TimestampkBytes transferredDirectionData
                                      2022-08-04 20:35:15 UTC0OUTGET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1
                                      Host: clients2.google.com
                                      Connection: keep-alive
                                      X-Goog-Update-Interactivity: fg
                                      X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm
                                      X-Goog-Update-Updater: chromecrx-85.0.4183.121
                                      Sec-Fetch-Site: none
                                      Sec-Fetch-Mode: no-cors
                                      Sec-Fetch-Dest: empty
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
                                      Accept-Encoding: gzip, deflate, br
                                      Accept-Language: en-US,en;q=0.9
                                      2022-08-04 20:35:15 UTC1INHTTP/1.1 200 OK
                                      Content-Security-Policy: script-src 'report-sample' 'nonce-RUhYvr0fkTnRFRCJVjaH6w' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
                                      Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                      Pragma: no-cache
                                      Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                      Date: Thu, 04 Aug 2022 20:35:15 GMT
                                      Content-Type: text/xml; charset=UTF-8
                                      X-Daynum: 5694
                                      X-Daystart: 48915
                                      X-Content-Type-Options: nosniff
                                      X-Frame-Options: SAMEORIGIN
                                      X-XSS-Protection: 1; mode=block
                                      Server: GSE
                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                      Accept-Ranges: none
                                      Vary: Accept-Encoding
                                      Connection: close
                                      Transfer-Encoding: chunked
                                      2022-08-04 20:35:15 UTC2INData Raw: 33 31 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 39 34 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 38 39 31 35 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22
                                      Data Ascii: 31b<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5694" elapsed_seconds="48915"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
                                      2022-08-04 20:35:15 UTC2INData Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61
                                      Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
                                      2022-08-04 20:35:15 UTC2INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Statistics

                                      CPU Usage

                                      0204060s020406080100

                                      Click to jump to process

                                      Memory Usage

                                      0204060s0.0020406080MB

                                      Click to jump to process

                                      High Level Behavior Distribution

                                      • • File
                                      • • Registry

                                      Click to dive into process behavior distribution

                                      Behavior

                                      Click to jump to process

                                      System Behavior

                                      General

                                      Target ID:0
                                      Start time:22:35:10
                                      Start date:04/08/2022
                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      Wow64 process (32bit):false
                                      Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
                                      Imagebase:0x7ff6a37e0000
                                      File size:2150896 bytes
                                      MD5 hash:C139654B5C1438A95B321BB01AD63EF6
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:low
                                      Show Windows behavior

                                      File Activities

                                      Show Windows behavior

                                      Section Activities

                                      Show Windows behavior

                                      Registry Activities

                                      Show Windows behavior

                                      COM Activities

                                      Show Windows behavior

                                      Mutex Activities

                                      Show Windows behavior

                                      Process Activities

                                      Show Windows behavior

                                      Thread Activities

                                      Show Windows behavior

                                      Memory Activities

                                      Show Windows behavior

                                      System Activities

                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      Show Windows behavior

                                      Windows UI Activities

                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                                      General

                                      Target ID:3
                                      Start time:22:35:12
                                      Start date:04/08/2022
                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      Wow64 process (32bit):false
                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,348518792383478243,2915957333394053278,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8
                                      Imagebase:0x7ff6a37e0000
                                      File size:2150896 bytes
                                      MD5 hash:C139654B5C1438A95B321BB01AD63EF6
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:low
                                      Show Windows behavior

                                      File Activities

                                      Show Windows behavior

                                      Section Activities

                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      Show Windows behavior

                                      Thread Activities

                                      Show Windows behavior

                                      Memory Activities

                                      Show Windows behavior

                                      System Activities

                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                                      General

                                      Target ID:4
                                      Start time:22:35:13
                                      Start date:04/08/2022
                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      Wow64 process (32bit):false
                                      Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" "http://caezcs32vtc000025v70gf8xscwyyyyyb.interact.sh
                                      Imagebase:0x7ff6a37e0000
                                      File size:2150896 bytes
                                      MD5 hash:C139654B5C1438A95B321BB01AD63EF6
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:low
                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      Show Windows behavior

                                      Section Activities

                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                      Show Windows behavior

                                      Thread Activities

                                      Show Windows behavior

                                      Memory Activities

                                      Show Windows behavior

                                      System Activities

                                      Windows UI Activities

                                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                                      Disassembly

                                      ⊘No disassembly