Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://ipwho.is

Overview

General Information

Sample URL:https://ipwho.is
Analysis ID:679216
Infos:

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

No high impact signatures.

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 5680 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: C139654B5C1438A95B321BB01AD63EF6)
    • chrome.exe (PID: 6172 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,8637681438283644612,4347384113639239081,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)
  • chrome.exe (PID: 6296 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ipwho.is MD5: C139654B5C1438A95B321BB01AD63EF6)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\DictionariesJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdicJump to behavior
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: ipwho.isConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ipwho.isConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ipwho.is/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: unknownDNS traffic detected: queries for: accounts.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: 547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drString found in binary or memory: https://accounts.google.com
Source: 547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drString found in binary or memory: https://apis.google.com
Source: 547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drString found in binary or memory: https://clients2.google.com
Source: manifest.json.0.drString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drString found in binary or memory: https://clients2.googleusercontent.com
Source: 547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.dr, 1528c9a5-0afd-400f-a841-c698139e58c9.tmp.1.drString found in binary or memory: https://dns.google
Source: 547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drString found in binary or memory: https://fonts.googleapis.com
Source: 547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drString found in binary or memory: https://fonts.gstatic.com
Source: History Provider Cache.0.drString found in binary or memory: https://ipwho.is/2
Source: History Provider Cache.0.drString found in binary or memory: https://ipwho.is/2:
Source: 547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drString found in binary or memory: https://ogs.google.com
Source: manifest.json.0.drString found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: manifest.json.0.drString found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drString found in binary or memory: https://ssl.gstatic.com
Source: 547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drString found in binary or memory: https://www.google.com
Source: manifest.json.0.drString found in binary or memory: https://www.google.com/
Source: 547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drString found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drString found in binary or memory: https://www.gstatic.com
Source: unknownHTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Local\Temp\69560f39-9fc4-442c-8ef7-9c580ab4cb09.tmpJump to behavior
Source: classification engineClassification label: clean0.win@22/68@3/6
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\Chrome\Application\DictionariesJump to behavior
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,8637681438283644612,4347384113639239081,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ipwho.is
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,8637681438283644612,4347384113639239081,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62ED6CEC-1630.pmaJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\DictionariesJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdicJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath Interception1
Process Injection		3
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth3
Non-Application Layer Protocol		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration4
Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer1
Ingress Tool Transfer		SIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://ipwho.is3%VirustotalBrowse
https://ipwho.is0%Avira URL Cloudsafe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://dns.google0%URL Reputationsafe
https://ipwho.is/3%VirustotalBrowse
https://ipwho.is/20%Avira URL Cloudsafe
https://ipwho.is/2:0%Avira URL Cloudsafe
https://ipwho.is/favicon.ico0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
ipwho.is
195.201.57.90
truefalse
    		unknown
    accounts.google.com
    		142.250.185.205
    		truefalse
      		high
      clients.l.google.com
      		142.250.181.238
      		truefalse
        		high
        clients2.google.com
        		unknown
        		unknownfalse
          		high

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          https://ipwho.is/falseunknown
          https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1false
            		high
            https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardfalse
              		high
              https://ipwho.is/falseunknown
              https://ipwho.is/favicon.icofalse
              • Avira URL Cloud: safe
              		unknown

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              https://www.google.com547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drfalse
                		high
                https://dns.google547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.dr, 1528c9a5-0afd-400f-a841-c698139e58c9.tmp.1.drfalse
                • URL Reputation: safe
                		unknown
                https://ogs.google.com547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drfalse
                  		high
                  https://accounts.google.com547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drfalse
                    		high
                    https://payments.google.com/payments/v4/js/integrator.jsmanifest.json.0.drfalse
                      		high
                      https://clients2.googleusercontent.com547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drfalse
                        		high
                        https://apis.google.com547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drfalse
                          		high
                          https://ipwho.is/2History Provider Cache.0.drfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://ipwho.is/2:History Provider Cache.0.drfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://sandbox.google.com/payments/v4/js/integrator.jsmanifest.json.0.drfalse
                            		high
                            https://www.google.com/manifest.json.0.drfalse
                              		high
                              https://clients2.google.com547ae052-a339-4db3-9b63-c3dd078e8941.tmp.1.drfalse
                                		high
                                https://clients2.google.com/service/update2/crxmanifest.json.0.drfalse
                                  		high

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  142.250.181.238
                                  		clients.l.google.comUnited States
                                  		15169GOOGLEUSfalse
                                  239.255.255.250
                                  		unknownReserved
                                  		unknownunknownfalse
                                  142.250.185.205
                                  		accounts.google.comUnited States
                                  		15169GOOGLEUSfalse
                                  195.201.57.90
                                  		ipwho.isGermany
                                  		24940HETZNER-ASDEfalse

                                  Private

                                  IP
                                  192.168.2.1
                                  127.0.0.1

                                  General Information

                                  Joe Sandbox Version:35.0.0 Citrine
                                  Analysis ID:679216
                                  Start date and time: 05/08/202212:16:522022-08-05 12:16:52 +02:00
                                  Joe Sandbox Product:CloudBasic
                                  Overall analysis duration:0h 4m 7s
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:browseurl.jbs
                                  Sample URL:https://ipwho.is
                                  Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                  Number of analysed new started processes analysed:10
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • HCA enabled
                                  • EGA enabled
                                  • HDC enabled
                                  • AMSI enabled
                                  Analysis Mode:default
                                  Analysis stop reason:Timeout
                                  Detection:CLEAN
                                  Classification:clean0.win@22/68@3/6
                                  EGA Information:Failed
                                  HDC Information:Failed
                                  HCA Information:
                                  • Successful, ratio: 100%
                                  • Number of executed functions: 0
                                  • Number of non-executed functions: 0
                                  Cookbook Comments:
                                  • Adjust boot time
                                  • Enable AMSI

                                  Warnings

                                  • Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, svchost.exe
                                  • Excluded IPs from analysis (whitelisted): 23.211.6.115, 142.250.185.238, 142.250.186.131, 74.125.162.102, 173.194.188.168, 142.250.185.195
                                  • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, clientservices.googleapis.com, arc.msn.com, r3---sn-4g5edns6.gvt1.com, e12564.dspb.akamaiedge.net, r1---sn-4g5ednd7.gvt1.com, licensing.mp.microsoft.com, r1.sn-4g5ednd7.gvt1.com, redirector.gvt1.com, login.live.com, store-images.s-microsoft.com, r3.sn-4g5edns6.gvt1.com, update.googleapis.com, www.gstatic.com
                                  • Not all processes where analyzed, report is missing behavior information
                                  • Report size getting too big, too many NtWriteVirtualMemory calls found.

                                  Simulations

                                  Behavior and APIs

                                  ⊘No simulations

                                  Joe Sandbox View / Context

                                  IPs

                                  ⊘No context

                                  Domains

                                  ⊘No context

                                  ASNs

                                  ⊘No context

                                  JA3 Fingerprints

                                  ⊘No context

                                  Dropped Files

                                  ⊘No context

                                  Created / dropped Files

                                  C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):451603
                                  Entropy (8bit):5.009711072558331
                                  Encrypted:false
                                  SSDEEP:12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
                                  MD5:A78AD14E77147E7DE3647E61964C0335
                                  SHA1:CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
                                  SHA-256:0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
                                  SHA-512:DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
                                  Malicious:false
                                  Reputation:low
                                  Preview:BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\568e649a-aa6a-4984-87ce-1ffe35d51d26.tmp

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:SysEx File -
                                  Category:modified
                                  Size (bytes):94708
                                  Entropy (8bit):3.7461096816151676
                                  Encrypted:false
                                  SSDEEP:384:V/WtBfQ+3oLDVcCRwNBrqvl/3uBraH76GS1rAjppxer3bGr05m03gfBxZuOH/RNO:NGGRNuvu2UeHBTbo/TifKRH1VO
                                  MD5:427828252C8E0C2F9CD0F16496D5B1E7
                                  SHA1:48FCB3A9FD787F89F38BE195C484FE23839C7826
                                  SHA-256:9F640BED15135CBC1638C79F1C97E1613A6ACDD6B2A2822DAFB20F1CCB2D9EFB
                                  SHA-512:04450823A5267957B804101282DCF0ABC58C2A362864E1D58C77544DD0142E40B681AF43488E4F2D06D14A89D1A389A5735FE7AB77478A11D64B3C82456B2CC7
                                  Malicious:false
                                  Reputation:low
                                  Preview:.q..............*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6...*...M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....c8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\721513e5-3cb6-4a2b-a984-a7c00bb96bb0.tmp

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):411035
                                  Entropy (8bit):6.013772762153574
                                  Encrypted:false
                                  SSDEEP:12288:wKIMZMjFu6OpMGxzurRDn9nfNxF4ijZVtilBY:3TtpMK0RzxxPjjt8Y
                                  MD5:77CD1FC0E4E1ACEA58C4F8B988B779C7
                                  SHA1:B2CA565DEEDFB2F1694D458090F8C7312C61F302
                                  SHA-256:5DA9FD56709C64819C64C8E636F5831816D8735CDF39FCC17383383C6E06C0EE
                                  SHA-512:0CC1124E592D2CE36FB4D62662171F80E8643D12FF02AE85BBD13E228AD276ACE1226698501E369BF314692A2C5A942CFAA13FA306F56BE0DBEBEDB6B1864645
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.659727088767341e+12,"network":1.65969469e+12,"ticks":203693049.0,"uncertainty":3644726.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABUPWY4cSyAQZRX3j8/SLmMAAAAAAIAAAAAABBmAAAAAQAAIAAAACC7lwCjByxIY/Ds1S6cdCxJW6iSr1QfjoKlVKoVEQ4EAAAAAA6AAAAAAgAAIAAAAD9PMfiGkWkdrfU+zeMpOLPS1eDxLpcgjYP2R/ndeCNxMAAAAK+RpovfP61NtB5nOpQgPMjPTyt2T1WPeru9i3yP05zNVEj0uCRDWfONruG9ricX1kAAAADB9KtQ9KY2z38GdfaF7dW2ZLcAMHOX2oEKBg8ZJG9lsuMexxChB4M8HFpyb0Bpr6axpi+zmMIXt76noTOxFzKN"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291230469541122"},"policy":{"last_statistics_update":"133042006854399

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\727b003e-d754-4db9-bbd3-c892c9b1733b.tmp

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):411035
                                  Entropy (8bit):6.013772461517433
                                  Encrypted:false
                                  SSDEEP:12288:AKIMZMjFu6OpMGxzurRDn9nfNxF4ijZVtilBY:nTtpMK0RzxxPjjt8Y
                                  MD5:F0EF68AD5144749EBD17E989ADC14A02
                                  SHA1:BB423281462FA7E2516D5DA0E06F650F607DE6E2
                                  SHA-256:0BA48F922ADA6014A5B8EFB02CB0A7699F407FDCAC7D19C53490ADB3670985C1
                                  SHA-512:1ED8CF61A387E13F9393B8B1585CD193DE67F9AEDF3A54C5CCD91BE3ABDB4330BFD97EF4B5634A97FDDD907E1E9F64378DBBC5694B449D5B630FDB677966EA72
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.659727088767341e+12,"network":1.65969469e+12,"ticks":203693049.0,"uncertainty":3644726.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABUPWY4cSyAQZRX3j8/SLmMAAAAAAIAAAAAABBmAAAAAQAAIAAAACC7lwCjByxIY/Ds1S6cdCxJW6iSr1QfjoKlVKoVEQ4EAAAAAA6AAAAAAgAAIAAAAD9PMfiGkWkdrfU+zeMpOLPS1eDxLpcgjYP2R/ndeCNxMAAAAK+RpovfP61NtB5nOpQgPMjPTyt2T1WPeru9i3yP05zNVEj0uCRDWfONruG9ricX1kAAAADB9KtQ9KY2z38GdfaF7dW2ZLcAMHOX2oEKBg8ZJG9lsuMexxChB4M8HFpyb0Bpr6axpi+zmMIXt76noTOxFzKN"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245950075265799"},"policy":{"last_statistics_update":"133042006854399

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:data
                                  Category:modified
                                  Size (bytes):40
                                  Entropy (8bit):3.3041625260016576
                                  Encrypted:false
                                  SSDEEP:3:FkXYDu6cR9n:+Y66cR9
                                  MD5:7A9D405E9218ED86C7ED3BB729DAA896
                                  SHA1:E5BB69E833231B755B20E5A0C9B2392D8B923C66
                                  SHA-256:D83D002DFE4F96C43A6FBF24FC7AA739945731ABDEC2AFB53EDDCE2D2D87D6AF
                                  SHA-512:F34290BF6A4B1AA63F47436C0788FC1DAC7B970A1861EF1D1891826FD3DFD0FD484A900E23A3024C19CA93DE842BF8B5BC7A5E159362A4C3A36AE8D47C8551A7
                                  Malicious:false
                                  Reputation:low
                                  Preview:sdPC.....................8...?E."..N_.

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\0a5a885a-ccf1-4809-8c4f-0973ebdffad4.tmp

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):5018
                                  Entropy (8bit):4.964237881283214
                                  Encrypted:false
                                  SSDEEP:96:nrDM/1pSKIxIk0JCKL8dkq110bOTQVuwn:nr21pS7C4K6kqO
                                  MD5:7A73D80104E0B3ADCF969B29A3DA4570
                                  SHA1:68F1CB7B701B8C730ADB99E892B1810CA3A75886
                                  SHA-256:C539BEAB58DA75F5F7CC12E6F3746CEE55E95F093699E83D734C477F05DD28B3
                                  SHA-512:7628D162E4EE60676B2587D550750BB1AE831FC4AEAFE751DFE586E5EE76C26F5A443A138F181E2497E51144715540EF66AD1F501459696159980A147E609EEB
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13304200687470527","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245950583260338","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1538886"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\154a8ab7-1722-4cf1-bf72-de3ef723c0b8.tmp

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:very short file (no magic)
                                  Category:dropped
                                  Size (bytes):1
                                  Entropy (8bit):0.0
                                  Encrypted:false
                                  SSDEEP:3:L:L
                                  MD5:5058F1AF8388633F609CADB75A75DC9D
                                  SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                  SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                  SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                  Malicious:false
                                  Reputation:low
                                  Preview:.

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2e64867e-6c4e-4c2a-bc43-619707972b7f.tmp

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):17703
                                  Entropy (8bit):5.5771185932824565
                                  Encrypted:false
                                  SSDEEP:384:iv4tMLluiXK1kXqKf/pUZNCgVLH2HfDFrUF3svb47:iLl7K1kXqKf/pUZNCgVLH2HfJrUCb4
                                  MD5:68220385F821AE7C4027AE136FDC80A5
                                  SHA1:7599984A335D0721F175BE3BB053AF2053E00A6E
                                  SHA-256:5EFDF8485DBE673C14D354B8CB0A7152D35CDA9C565484631B314F0E950E2E73
                                  SHA-512:233E9B3547BA3ECB1DB31381B5836049317294A77D7A8C9561B0E4952BD7189C5A8F30C4CBC095CDD557F960920B161B4D943F46E798E957EF52A2A7908B7586
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13304200686037131","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\547ae052-a339-4db3-9b63-c3dd078e8941.tmp

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):2693
                                  Entropy (8bit):4.871599185186076
                                  Encrypted:false
                                  SSDEEP:48:YXs2MHRzsoMHT5s0MHyKsTMHksrDys4Csb7synWsQItFsym6zs6zMHWLsZMH5YhV:+GDGTHGmGHDW1/nOIbmOGlGGhVD
                                  MD5:829D5654ADF098AD43036E24C47F2A94
                                  SHA1:506C8BA397509BA0357787950C538C1879047DF3
                                  SHA-256:4D0B852D18FCA5C1A712904CF6DB3811FB905E86D8A7508A2D42F9C8D68E2211
                                  SHA-512:D9B18E6B0AD1E8E4BECF9E84BBE30D64730CFEC2CBEAF96D5DF52E28B907B03EADF22F020FBE0A56D137A52F4F09798031BC6CA026CFA8A979A608B3445DBCAA
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248542600883925","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":40156},"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248542628822803","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":30856},"server":"https://dns.google","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248542600893104","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":25300},"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248542600872791","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":34789},"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"exp

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\57e1dbc1-8f94-4a81-bc2e-40df84e7ce45.tmp

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):17702
                                  Entropy (8bit):5.577218026703882
                                  Encrypted:false
                                  SSDEEP:384:iv4tZLluiXK1kXqKf/pUZNCgVLH2HfDFrU8svb47:vLl7K1kXqKf/pUZNCgVLH2HfJrUNbs
                                  MD5:1987455BDF3605B2B192B904E28E39A3
                                  SHA1:D646BF8E53B7C6527A43169512D2EA0621140D9C
                                  SHA-256:B4B46BE80DB71A4D556372CDCE82638B67D448EB0C852645D3D425091DB55701
                                  SHA-512:0FC75A31BFC61F5A74B9B84D68B74473B096D1C9EEB9BCBE9B88608271017D67B0B32566625E73D936E70DEBC08ABC3FD10F398C037F1D592EE4017CAAA7252A
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13304200686037131","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):38
                                  Entropy (8bit):1.8784775129881184
                                  Encrypted:false
                                  SSDEEP:3:FQxlXNQxlX:qTCT
                                  MD5:51A2CBB807F5085530DEC18E45CB8569
                                  SHA1:7AD88CD3DE5844C7FC269C4500228A630016AB5B
                                  SHA-256:1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
                                  SHA-512:B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
                                  Malicious:false
                                  Reputation:low
                                  Preview:.f.5................f.5...............

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text
                                  Category:dropped
                                  Size (bytes):374
                                  Entropy (8bit):5.189399256975481
                                  Encrypted:false
                                  SSDEEP:6:qfuzFN+q2P923iKKdK25+Xqx8chI+IFUtqV/f7ZmwYV/fgptVkwO923iKKdK25+M:Gv45KkTXfchI3FUtq/tpT5L5KkTXfchn
                                  MD5:63A97A04813932A6C5FBC3DB175BE624
                                  SHA1:7950F9CF853D95A976CC0437315864F1A44297FC
                                  SHA-256:110F4A6D81D17394C7011F5DE64BB742DEAC8FD6CA70600B6DEF0C7AF8BA3C52
                                  SHA-512:943E314FBC219007AFD954E6436D338A56D9E847E6E1DBD8944C5253ED24994F718C04BC995BD3973D11BEA61C63A1AF72A6F7D36E20DDEB823DB0FEDF0EF16E
                                  Malicious:false
                                  Reputation:low
                                  Preview:2022/08/05-12:18:11.866 1a88 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2022/08/05-12:18:11.867 1a88 Recovering log #3.2022/08/05-12:18:11.868 1a88 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text
                                  Category:dropped
                                  Size (bytes):374
                                  Entropy (8bit):5.189399256975481
                                  Encrypted:false
                                  SSDEEP:6:qfuzFN+q2P923iKKdK25+Xqx8chI+IFUtqV/f7ZmwYV/fgptVkwO923iKKdK25+M:Gv45KkTXfchI3FUtq/tpT5L5KkTXfchn
                                  MD5:63A97A04813932A6C5FBC3DB175BE624
                                  SHA1:7950F9CF853D95A976CC0437315864F1A44297FC
                                  SHA-256:110F4A6D81D17394C7011F5DE64BB742DEAC8FD6CA70600B6DEF0C7AF8BA3C52
                                  SHA-512:943E314FBC219007AFD954E6436D338A56D9E847E6E1DBD8944C5253ED24994F718C04BC995BD3973D11BEA61C63A1AF72A6F7D36E20DDEB823DB0FEDF0EF16E
                                  Malicious:false
                                  Reputation:low
                                  Preview:2022/08/05-12:18:11.866 1a88 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2022/08/05-12:18:11.867 1a88 Recovering log #3.2022/08/05-12:18:11.868 1a88 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):243
                                  Entropy (8bit):4.923984472308969
                                  Encrypted:false
                                  SSDEEP:6:HQQguMg2Smt+xP4GdbNmvcJA2sWNBk7snA0D0QUc08IlDGWb:HQoMjSJwkNmvcVsWNBk76A0wQUc8GWb
                                  MD5:EAA1B6591A005C37135A9D11D90CE31F
                                  SHA1:0554F9D6EAD53439FEA9B2835F3A1E2445CBABD1
                                  SHA-256:A1D51C5B9393966BB9A1A96B2B8CFDA17166A2CE8DBF7B1DA012AF18F42EBF8B
                                  SHA-512:28B2B1F322A69429A0701459C84BF942E6B3ACBEF751D05D28D6BDACD7DC5BF0A5D5A59856EA0BEA4FD37E4399FAC78272FE3ECE0B316EE07F192EEF60ED2898
                                  Malicious:false
                                  Reputation:low
                                  Preview:...........".....https..ipwho..is* ......https......ipwho......is..2E.......h.........i.........o........p.........s.........t........w...:..............................B9...5...... ......*.https://ipwho.is/2.:..............J............

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):2693
                                  Entropy (8bit):4.871599185186076
                                  Encrypted:false
                                  SSDEEP:48:YXs2MHRzsoMHT5s0MHyKsTMHksrDys4Csb7synWsQItFsym6zs6zMHWLsZMH5YhV:+GDGTHGmGHDW1/nOIbmOGlGGhVD
                                  MD5:829D5654ADF098AD43036E24C47F2A94
                                  SHA1:506C8BA397509BA0357787950C538C1879047DF3
                                  SHA-256:4D0B852D18FCA5C1A712904CF6DB3811FB905E86D8A7508A2D42F9C8D68E2211
                                  SHA-512:D9B18E6B0AD1E8E4BECF9E84BBE30D64730CFEC2CBEAF96D5DF52E28B907B03EADF22F020FBE0A56D137A52F4F09798031BC6CA026CFA8A979A608B3445DBCAA
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248542600883925","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":40156},"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248542628822803","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":30856},"server":"https://dns.google","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248542600893104","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":25300},"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248542600872791","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":34789},"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"exp

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):5018
                                  Entropy (8bit):4.964237881283214
                                  Encrypted:false
                                  SSDEEP:96:nrDM/1pSKIxIk0JCKL8dkq110bOTQVuwn:nr21pS7C4K6kqO
                                  MD5:7A73D80104E0B3ADCF969B29A3DA4570
                                  SHA1:68F1CB7B701B8C730ADB99E892B1810CA3A75886
                                  SHA-256:C539BEAB58DA75F5F7CC12E6F3746CEE55E95F093699E83D734C477F05DD28B3
                                  SHA-512:7628D162E4EE60676B2587D550750BB1AE831FC4AEAFE751DFE586E5EE76C26F5A443A138F181E2497E51144715540EF66AD1F501459696159980A147E609EEB
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13304200687470527","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245950583260338","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1538886"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):17703
                                  Entropy (8bit):5.5771185932824565
                                  Encrypted:false
                                  SSDEEP:384:iv4tMLluiXK1kXqKf/pUZNCgVLH2HfDFrUF3svb47:iLl7K1kXqKf/pUZNCgVLH2HfJrUCb4
                                  MD5:68220385F821AE7C4027AE136FDC80A5
                                  SHA1:7599984A335D0721F175BE3BB053AF2053E00A6E
                                  SHA-256:5EFDF8485DBE673C14D354B8CB0A7152D35CDA9C565484631B314F0E950E2E73
                                  SHA-512:233E9B3547BA3ECB1DB31381B5836049317294A77D7A8C9561B0E4952BD7189C5A8F30C4CBC095CDD557F960920B161B4D943F46E798E957EF52A2A7908B7586
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13304200686037131","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\1528c9a5-0afd-400f-a841-c698139e58c9.tmp

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):325
                                  Entropy (8bit):4.956993026220225
                                  Encrypted:false
                                  SSDEEP:6:YHpoNXR8+eq7JdV5rAcJksDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdVAsBdLJlyH7E4f3K33y
                                  MD5:0C03D530AC97788D62D27B2802C34D83
                                  SHA1:20F78B6B32D98FA52846C70DF78E4E5CEF663E2D
                                  SHA-256:7941FADA9867DAAE08EBC196BAFC6952DD506842C3E7D8FB14DF9D4E402D894B
                                  SHA-512:D5905C124060997A14322D12DECE5C00C63F7174743C740C974D00E88B03F203909CC2AC972B2759E8087B0B10F6306C6E66BF853319B5AC96907F34C8456C80
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248542588505091","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):270336
                                  Entropy (8bit):0.0012471779557650352
                                  Encrypted:false
                                  SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                  MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                  SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                  SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                  SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                  Malicious:false
                                  Reputation:low
                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):325
                                  Entropy (8bit):4.956993026220225
                                  Encrypted:false
                                  SSDEEP:6:YHpoNXR8+eq7JdV5rAcJksDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdVAsBdLJlyH7E4f3K33y
                                  MD5:0C03D530AC97788D62D27B2802C34D83
                                  SHA1:20F78B6B32D98FA52846C70DF78E4E5CEF663E2D
                                  SHA-256:7941FADA9867DAAE08EBC196BAFC6952DD506842C3E7D8FB14DF9D4E402D894B
                                  SHA-512:D5905C124060997A14322D12DECE5C00C63F7174743C740C974D00E88B03F203909CC2AC972B2759E8087B0B10F6306C6E66BF853319B5AC96907F34C8456C80
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248542588505091","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text
                                  Category:dropped
                                  Size (bytes):16
                                  Entropy (8bit):3.2743974703476995
                                  Encrypted:false
                                  SSDEEP:3:1sjgWIV//Rv:1qIFJ
                                  MD5:6752A1D65B201C13B62EA44016EB221F
                                  SHA1:58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
                                  SHA-256:0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
                                  SHA-512:9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
                                  Malicious:false
                                  Reputation:low
                                  Preview:MANIFEST-000004.

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text
                                  Category:dropped
                                  Size (bytes):16
                                  Entropy (8bit):3.2743974703476995
                                  Encrypted:false
                                  SSDEEP:3:1sjgWIV//Rv:1qIFJ
                                  MD5:6752A1D65B201C13B62EA44016EB221F
                                  SHA1:58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
                                  SHA-256:0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
                                  SHA-512:9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
                                  Malicious:false
                                  Reputation:low
                                  Preview:MANIFEST-000004.

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):106
                                  Entropy (8bit):3.138546519832722
                                  Encrypted:false
                                  SSDEEP:3:tbloIlrJ5ldQxl7aXVdJiG6R0RlAl:tbdlrnQxZaHIGi0R6l
                                  MD5:DE9EF0C5BCC012A3A1131988DEE272D8
                                  SHA1:FA9CCBDC969AC9E1474FCE773234B28D50951CD8
                                  SHA-256:3615498FBEF408A96BF30E01C318DAC2D5451B054998119080E7FAAC5995F590
                                  SHA-512:CEA946EBEADFE6BE65E33EDFF6C68953A84EC2E2410884E12F406CAC1E6C8A0793180433A7EF7CE097B24EA78A1FDBB4E3B3D9CDF1A827AB6FF5605DA3691724
                                  Malicious:false
                                  Reputation:low
                                  Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with no line terminators
                                  Category:dropped
                                  Size (bytes):13
                                  Entropy (8bit):2.8150724101159437
                                  Encrypted:false
                                  SSDEEP:3:Yx7:4
                                  MD5:C422F72BA41F662A919ED0B70E5C3289
                                  SHA1:AAD27C14B27F56B6E7C744A8EC5B1A7D767D7632
                                  SHA-256:02E71EB4C587FEB7EE00CE8600F97411C2774C2FC34CB95B92D5538E7F30DA59
                                  SHA-512:86010ED2B2EEBDCC5A8A076B37703669C294C6D1BFAAEA963E26A9C94B81B4C53EC765D9425E5B616159C43923F800A891F9B903659575DF02F8845521F8DC46
                                  Malicious:false
                                  Reputation:low
                                  Preview:85.0.4183.121

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):411035
                                  Entropy (8bit):6.013772762153574
                                  Encrypted:false
                                  SSDEEP:12288:wKIMZMjFu6OpMGxzurRDn9nfNxF4ijZVtilBY:3TtpMK0RzxxPjjt8Y
                                  MD5:77CD1FC0E4E1ACEA58C4F8B988B779C7
                                  SHA1:B2CA565DEEDFB2F1694D458090F8C7312C61F302
                                  SHA-256:5DA9FD56709C64819C64C8E636F5831816D8735CDF39FCC17383383C6E06C0EE
                                  SHA-512:0CC1124E592D2CE36FB4D62662171F80E8643D12FF02AE85BBD13E228AD276ACE1226698501E369BF314692A2C5A942CFAA13FA306F56BE0DBEBEDB6B1864645
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.659727088767341e+12,"network":1.65969469e+12,"ticks":203693049.0,"uncertainty":3644726.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABUPWY4cSyAQZRX3j8/SLmMAAAAAAIAAAAAABBmAAAAAQAAIAAAACC7lwCjByxIY/Ds1S6cdCxJW6iSr1QfjoKlVKoVEQ4EAAAAAA6AAAAAAgAAIAAAAD9PMfiGkWkdrfU+zeMpOLPS1eDxLpcgjYP2R/ndeCNxMAAAAK+RpovfP61NtB5nOpQgPMjPTyt2T1WPeru9i3yP05zNVEj0uCRDWfONruG9ricX1kAAAADB9KtQ9KY2z38GdfaF7dW2ZLcAMHOX2oEKBg8ZJG9lsuMexxChB4M8HFpyb0Bpr6axpi+zmMIXt76noTOxFzKN"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291230469541122"},"policy":{"last_statistics_update":"133042006854399

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:SysEx File -
                                  Category:dropped
                                  Size (bytes):94708
                                  Entropy (8bit):3.7461096816151676
                                  Encrypted:false
                                  SSDEEP:384:V/WtBfQ+3oLDVcCRwNBrqvl/3uBraH76GS1rAjppxer3bGr05m03gfBxZuOH/RNO:NGGRNuvu2UeHBTbo/TifKRH1VO
                                  MD5:427828252C8E0C2F9CD0F16496D5B1E7
                                  SHA1:48FCB3A9FD787F89F38BE195C484FE23839C7826
                                  SHA-256:9F640BED15135CBC1638C79F1C97E1613A6ACDD6B2A2822DAFB20F1CCB2D9EFB
                                  SHA-512:04450823A5267957B804101282DCF0ABC58C2A362864E1D58C77544DD0142E40B681AF43488E4F2D06D14A89D1A389A5735FE7AB77478A11D64B3C82456B2CC7
                                  Malicious:false
                                  Reputation:low
                                  Preview:.q..............*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6...*...M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....c8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\f297d3af-04c2-4782-83e2-a708346cd01f.tmp

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):411035
                                  Entropy (8bit):6.013772461517433
                                  Encrypted:false
                                  SSDEEP:12288:AKIMZMjFu6OpMGxzurRDn9nfNxF4ijZVtilBY:nTtpMK0RzxxPjjt8Y
                                  MD5:F0EF68AD5144749EBD17E989ADC14A02
                                  SHA1:BB423281462FA7E2516D5DA0E06F650F607DE6E2
                                  SHA-256:0BA48F922ADA6014A5B8EFB02CB0A7699F407FDCAC7D19C53490ADB3670985C1
                                  SHA-512:1ED8CF61A387E13F9393B8B1585CD193DE67F9AEDF3A54C5CCD91BE3ABDB4330BFD97EF4B5634A97FDDD907E1E9F64378DBBC5694B449D5B630FDB677966EA72
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.659727088767341e+12,"network":1.65969469e+12,"ticks":203693049.0,"uncertainty":3644726.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABUPWY4cSyAQZRX3j8/SLmMAAAAAAIAAAAAABBmAAAAAQAAIAAAACC7lwCjByxIY/Ds1S6cdCxJW6iSr1QfjoKlVKoVEQ4EAAAAAA6AAAAAAgAAIAAAAD9PMfiGkWkdrfU+zeMpOLPS1eDxLpcgjYP2R/ndeCNxMAAAAK+RpovfP61NtB5nOpQgPMjPTyt2T1WPeru9i3yP05zNVEj0uCRDWfONruG9ricX1kAAAADB9KtQ9KY2z38GdfaF7dW2ZLcAMHOX2oEKBg8ZJG9lsuMexxChB4M8HFpyb0Bpr6axpi+zmMIXt76noTOxFzKN"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245950075265799"},"policy":{"last_statistics_update":"133042006854399

                                  C:\Users\user\AppData\Local\Temp\69560f39-9fc4-442c-8ef7-9c580ab4cb09.tmp

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:Google Chrome extension, version 3
                                  Category:dropped
                                  Size (bytes):248531
                                  Entropy (8bit):7.963657412635355
                                  Encrypted:false
                                  SSDEEP:3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
                                  MD5:541F52E24FE1EF9F8E12377A6CCAE0C0
                                  SHA1:189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
                                  SHA-256:81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
                                  SHA-512:D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
                                  Malicious:false
                                  Reputation:low
                                  Preview:Cr24..............0.."0...*.H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.|1..n.<Fb..f..*Q1.....s..2..{*.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-*eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f|.~.c.4.E.......0..0...*.H............0.......).'..b.*$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$|..|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...|!..A..L.+.=...kP.!.1..

                                  C:\Users\user\AppData\Local\Temp\cc953c8a-ed07-4211-985b-f3fa782f5ab1.tmp

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:very short file (no magic)
                                  Category:dropped
                                  Size (bytes):1
                                  Entropy (8bit):0.0
                                  Encrypted:false
                                  SSDEEP:3:L:L
                                  MD5:5058F1AF8388633F609CADB75A75DC9D
                                  SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                  SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                  SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                  Malicious:false
                                  Reputation:low
                                  Preview:.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\69560f39-9fc4-442c-8ef7-9c580ab4cb09.tmp

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:Google Chrome extension, version 3
                                  Category:dropped
                                  Size (bytes):248531
                                  Entropy (8bit):7.963657412635355
                                  Encrypted:false
                                  SSDEEP:3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
                                  MD5:541F52E24FE1EF9F8E12377A6CCAE0C0
                                  SHA1:189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
                                  SHA-256:81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
                                  SHA-512:D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
                                  Malicious:false
                                  Reputation:low
                                  Preview:Cr24..............0.."0...*.H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.|1..n.<Fb..f..*Q1.....s..2..{*.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-*eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f|.~.c.4.E.......0..0...*.H............0.......).'..b.*$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$|..|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...|!..A..L.+.=...kP.!.1..

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\bg\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):1293
                                  Entropy (8bit):4.132566655778463
                                  Encrypted:false
                                  SSDEEP:24:YHYpcyllEQVFc0Bh0GQVQQVEM0bRLzRd0bRLzRRpcyllNQVb26RQ0bR60L0ZWOFY:YHYpZaQLH1QKQ6xxzcxzvpZzQA6z2nhQ
                                  MD5:D7A97183BCBD5FB677AA84D464F0C564
                                  SHA1:CDBB279B864E2C0A51E0892B8714131802586506
                                  SHA-256:76EFAD74EB8256B942727C42261147EB9CCA48DA284DB3CDCE5DC6A3B4346F02
                                  SHA-512:36F0310DD06319E4A51F77E4C3D64F6276891CE6410FE2571324BB71F2FBCDA368EAC4267FF8268086BE6912E41787D0F70771755E3D49E3E8C26648EAC6EFC9
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"\u041f\u043e\u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043d\u044f\u043c\u0430 \u0434\u043e\u0441\u0442\u044a\u043f \u0434\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u0442\u043e."},"craw_connect_to_network":{"message":"\u041c\u043e\u043b\u044f, \u0441\u0432\u044a\u0440\u0436\u0435\u0442\u0435 \u0441\u0435 \u0441 \u043c\u0440\u0435\u0436\u0430."},"app_name":{"message":"\u041f\u043b\u0430\u0449\u0430\u043d\u0438\u044f \u0432 \u0443\u0435\u0431 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 \u043d\u0430 Chrome"},"app_description":{"message":"\u041f\u043b\u0430\u0449\u0430\u043d\u0438\u044f \u0432 \u0443\u0435\u0431 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 \u043d\u0430 Chrome"},"iap_unavailable":{"message":"\u041f\u043e\u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043d\u044f\u043c\u0430 \u0434\u043e\u0441\u0442\u044a\u043f \u0434\u043e \u0432\u0433\u0440\u0430\u0434\u0435\u043d\u0430\u0442\u0430 \

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\ca\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):556
                                  Entropy (8bit):4.768628082639434
                                  Encrypted:false
                                  SSDEEP:12:YGGYp73YbYHOLBiGF14gevg7p6ixuYHOPBBVC9WO/NrnLAOK:YHYp73vuLBVV17pRunVC9WOFvAOK
                                  MD5:58BA5F65ED971591D1F9D81848EE31D0
                                  SHA1:BDA3C8B74653334FC8F060CAFBCEA58DF0113AB7
                                  SHA-256:CDD91587F5AF2C865776B36A5E9A07B10D21B9D911DE0B814B7A1E94B14AE885
                                  SHA-512:BA2A6BAA3011A54E6B07E29DFD133009D66B6CFFF525DEC0024BDE55A9BED463AD130307EE64BFB4A983A11FFD6B44BD53ED38EB144083A2CBEFA8D85C4D5D41
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Ara mateix aquesta aplicaci\u00f3 no est\u00e0 disponible."},"craw_connect_to_network":{"message":"Connecteu-vos a una xarxa."},"app_name":{"message":"Sistema de pagaments de Chrome Web Store"},"app_description":{"message":"Sistema de pagaments de Chrome Web Store"},"iap_unavailable":{"message":"La funci\u00f3 Pagaments a l'aplicaci\u00f3 no est\u00e0 disponible actualment."},"please_sign_in":{"message":"Inicieu la sessi\u00f3 a Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\cs\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):550
                                  Entropy (8bit):4.905634822460801
                                  Encrypted:false
                                  SSDEEP:12:YGGYpTPklW+g5Q7wvAvPJE7ZEWJE7ZRpmJEWN20GN5Q9O/NrnLAOK:YHYpbt5SwvGJE7ZfJE7ZRpmJEEGN5WOi
                                  MD5:43161EFFA28A0DBFC67B8F7DBE1B5184
                                  SHA1:FE0A9235A59B51B7F564F14FF564344927F035B8
                                  SHA-256:3A04421DF5218E8ABD3B0E2AFE11E8338D7BDCBCD1ADB122416944B102BC9696
                                  SHA-512:FC6A391A4B37FFEE2182F29C1590E32766A1820DC58D0A70A8DD96D7ABE74B47181B24AFFF8ADAE12686CCB1B898DCDDB882EFD205C3387B5B6F3CFBE6E5BA78
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Aplikace v sou\u010dasn\u00e9 dob\u011b nen\u00ed dostupn\u00e1."},"craw_connect_to_network":{"message":"P\u0159ipojte se pros\u00edm k s\u00edti."},"app_name":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"app_description":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"iap_unavailable":{"message":"Platby v aplikaci aktu\u00e1ln\u011b nejsou k dispozici."},"please_sign_in":{"message":"P\u0159ihlaste se do Chromu."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\da\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):505
                                  Entropy (8bit):4.795529861403324
                                  Encrypted:false
                                  SSDEEP:12:YGGYpB/wHlHE3qKWEMqKWRp8KW/wU0HWO/NrnLAOK:YHYpN4lGqKAqKgp8FiHWOFvAOK
                                  MD5:31264DDBF251A95DE82D0A67FA47DB3A
                                  SHA1:3A48DC7AF26A153594C7849E1D92AAC31296459B
                                  SHA-256:EDB51898A6C73D0090D6916B7B72EBAC71E964EABB5BA7CD68E21966024F0D23
                                  SHA-512:B97D61BD71E3F0A91FF1048D2ACAD4BC092CCAF157B7A96029B6AB5AF1812B01814E3153CD894307CB13DC132523EAC22B19CADA6B97F4B81B0D1132562317B5
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Appen er ikke tilg\u00e6ngelig i \u00f8jeblikket."},"craw_connect_to_network":{"message":"Opret forbindelse til et netv\u00e6rk."},"app_name":{"message":"Betalinger i Chrome Webshop"},"app_description":{"message":"Betalinger i Chrome Webshop"},"iap_unavailable":{"message":"Betaling i appen er ikke tilg\u00e6ngelig i \u00f8jeblikket."},"please_sign_in":{"message":"Log ind p\u00e5 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\de\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):516
                                  Entropy (8bit):4.809852395188501
                                  Encrypted:false
                                  SSDEEP:12:YGGYpyBCEl9ljMRE1RRpUT6+ZMUO/NrnLAOK:YHYpQDbPpUTvTOFvAOK
                                  MD5:7639B300B40DDAF95318D2177D3265F9
                                  SHA1:BF9EFDF073231CB3FCFCA5CCCA25B079ECFC45BD
                                  SHA-256:356A9D4ADFEC484DA824E7A72059B724B1686FC90082F4A4B667630436D593B0
                                  SHA-512:70593318C6626B5D25729E8D8109D5611B95283266621BE60ADD7E60C0DD5BC43848E956C767251B7B3CCDF5A0929922DE38F90CC8632CCD0C1CCFC7D6DEFE69
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Die App ist momentan nicht verf\u00fcgbar."},"craw_connect_to_network":{"message":"Bitte stellen Sie eine Verbindung zu einem Netzwerk her."},"app_name":{"message":"Chrome Web Store-Zahlungen"},"app_description":{"message":"Chrome Web Store-Zahlungen"},"iap_unavailable":{"message":"In-App-Zahlungen sind momentan nicht m\u00f6glich."},"please_sign_in":{"message":"Bitte melden Sie sich in Chrome an."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\el\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):1236
                                  Entropy (8bit):4.338644812557597
                                  Encrypted:false
                                  SSDEEP:24:YHYpgFMjXrNW1DWgHle+T2dAplFcTpW1auWgtes9WOFvAOK:YHYpkMj7yxHw+CdAplFcifIs9nhQ
                                  MD5:3026E922B17DBEE2674FDAEE960DF584
                                  SHA1:76602B1E3449F1B67DE42FD31A581B0821BFEFF0
                                  SHA-256:876845B5A061FAB3CF2A1466E01015DC40DF8449F1CB4205F575CEBED8717BAD
                                  SHA-512:0C4DCB2589553F9F75534E6C702EBF9095665C93D213564265E39220A99B61BB112A3B20980CE0377C7E98878E3240EB87312B5ECE874382B7E9CA90A0016992
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"\u0397 \u03b5\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ae \u03c0\u03c1\u03bf\u03c2 \u03c4\u03bf \u03c0\u03b1\u03c1\u03cc\u03bd \u03b4\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03b9\u03b1\u03b8\u03ad\u03c3\u03b9\u03bc\u03b7."},"craw_connect_to_network":{"message":"\u03a3\u03c5\u03bd\u03b4\u03b5\u03b8\u03b5\u03af\u03c4\u03b5 \u03c3\u03b5 \u03ad\u03bd\u03b1 \u03b4\u03af\u03ba\u03c4\u03c5\u03bf."},"app_name":{"message":"\u03a0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03c2 \u03c3\u03c4\u03bf Chrome Web Store"},"app_description":{"message":"\u03a0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03c2 \u03c3\u03c4\u03bf Chrome Web Store"},"iap_unavailable":{"message":"\u039f\u03b9 \u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03c2 \u03b5\u03bd\u03c4\u03cc\u03c2 \u03b5\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ce\u03bd \u03b4\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b1\u03c5\u03c4\u03ae\u03bd \u03c4\u03b7 \u03c3\u03c4\u03b9\u03b3\u03bc\u03ae \u03b4\u03b9\u03b1\u03b8

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\en\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):450
                                  Entropy (8bit):4.679939707243892
                                  Encrypted:false
                                  SSDEEP:12:YGGYp4Fp0JAvpErBpUwEGFpfJAKWO/NrnLAOK:YHYpAp0J3pURKpfJzWOFvAOK
                                  MD5:DBEDF86FA9AFB3A23DBB126674F166D2
                                  SHA1:5628AFFBCF6F897B9D7FD9C17DEB9AA75036F1CC
                                  SHA-256:C0945DD5FDECAB40C45361BEC068D1996E6AE01196DCE524266D740808F753FE
                                  SHA-512:931D7BA6DA84D4BB073815540F35126F2F035A71BFE460F3CCAED25AD7C1B1792AB36CD7207B99FDDF5EAF8872250B54A8958CF5827608F0640E8AAFE11E0071
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"App currently unavailable."},"craw_connect_to_network":{"message":"Please connect to a network."},"app_name":{"message":"Chrome Web Store Payments"},"app_description":{"message":"Chrome Web Store Payments"},"iap_unavailable":{"message":"In-App Payments is currently unavailable."},"please_sign_in":{"message":"Please sign into Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\en_GB\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):450
                                  Entropy (8bit):4.679939707243892
                                  Encrypted:false
                                  SSDEEP:12:YGGYp4Fp0JAvpErBpUwEGFpfJAKWO/NrnLAOK:YHYpAp0J3pURKpfJzWOFvAOK
                                  MD5:DBEDF86FA9AFB3A23DBB126674F166D2
                                  SHA1:5628AFFBCF6F897B9D7FD9C17DEB9AA75036F1CC
                                  SHA-256:C0945DD5FDECAB40C45361BEC068D1996E6AE01196DCE524266D740808F753FE
                                  SHA-512:931D7BA6DA84D4BB073815540F35126F2F035A71BFE460F3CCAED25AD7C1B1792AB36CD7207B99FDDF5EAF8872250B54A8958CF5827608F0640E8AAFE11E0071
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"App currently unavailable."},"craw_connect_to_network":{"message":"Please connect to a network."},"app_name":{"message":"Chrome Web Store Payments"},"app_description":{"message":"Chrome Web Store Payments"},"iap_unavailable":{"message":"In-App Payments is currently unavailable."},"please_sign_in":{"message":"Please sign into Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\es\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):542
                                  Entropy (8bit):4.704430479150276
                                  Encrypted:false
                                  SSDEEP:12:YGGYpDbKEzebFcjwWtp6FPbF3QVcqHWO/NrnLAOK:YHYpqEzoFmpQymaWOFvAOK
                                  MD5:3F4B0F56C2839839FC3E3270ED4CB7B6
                                  SHA1:0D74EA655EAE3990E95BD26F6E1467EDF3EB3478
                                  SHA-256:1912EA5E0A62BBC669DC14AB5A5BD5514B0502C483EE1F27C3F8834384187079
                                  SHA-512:4E6A828FE73FC4AB03F0EE966CE7BD8061575A059E90709F908D8D91C5F4EB6A8D25BBFA100E48AD7AC94E76D3BCD3547C277B4150D515222757CC9906AD20A2
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Esta aplicaci\u00f3n no est\u00e1 disponible en este momento."},"craw_connect_to_network":{"message":"Con\u00e9ctate a una red."},"app_name":{"message":"Sistema de pagos de Chrome Web Store"},"app_description":{"message":"Sistema de pagos de Chrome Web Store"},"iap_unavailable":{"message":"Los pagos en la aplicaci\u00f3n no est\u00e1n disponibles en este momento."},"please_sign_in":{"message":"Inicia sesi\u00f3n en Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\es_419\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):510
                                  Entropy (8bit):4.719977015734499
                                  Encrypted:false
                                  SSDEEP:12:YGGYpDbKEzebFcjwWtpML4c9WO/NrnLAOK:YHYpqEzoFmpMLBWOFvAOK
                                  MD5:1FD5DAF46C4D7C4F571C263EC37B943B
                                  SHA1:A57EE5EF6861F88005C2230EA3D633A1B4CA105A
                                  SHA-256:BCC2CF06F66E9E3BB4B7887D0EE0AE4A72A6C49F4B2A578A7733B78208984417
                                  SHA-512:79C3104F1DC51B17B062803209029C8165DBD391FBE0B69BB406D7B4F92FE1898CAC30E20C2E5CFB65D643B978095626C68EAA0CFCA064354D52D52D16BF21A9
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Esta aplicaci\u00f3n no est\u00e1 disponible en este momento."},"craw_connect_to_network":{"message":"Con\u00e9ctate a una red."},"app_name":{"message":"Sistema de pagos de Chrome Web Store"},"app_description":{"message":"Sistema de pagos de Chrome Web Store"},"iap_unavailable":{"message":"En este momento, Pagos En-Apps no est\u00e1 disponible."},"please_sign_in":{"message":"Accede a Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\et\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):460
                                  Entropy (8bit):4.679279844668757
                                  Encrypted:false
                                  SSDEEP:6:YGGYpkeVeVfCb53Q67PZV6pPQpkjA5DeY68AoLRcZplNgCnGcPxYA8KoOK:YGGYpv2A77PrQPQpT/AoLRO/NrnLAOK
                                  MD5:0293A7BAE6EEE62C4067A80E262D6A2D
                                  SHA1:E76B07BD49FFBBFB6841B7335CBE7A9620714402
                                  SHA-256:D06F20D4D68D1DBB89EF7D8E405D9499CB2EB2560217CD5B4A51AB1DD50CAB44
                                  SHA-512:8BF97DA4038A9C4426A285D5FEF0953F4E7E6D0667091A39DE4D4C5B4C35FC7B6A804425DBB4B82356A93950738E4F0937DE1AD777AE75AAC9BFB97D63F771E0
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Rakendus pole praegu saadaval."},"craw_connect_to_network":{"message":"Looge \u00fchendus v\u00f5rguga."},"app_name":{"message":"Chrome'i veebipoe maksed"},"app_description":{"message":"Chrome'i veebipoe maksed"},"iap_unavailable":{"message":"Rakendusesisesed maksed ei ole praegu saadaval."},"please_sign_in":{"message":"Logige Chrome'i sisse."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\fi\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):568
                                  Entropy (8bit):4.768364810051887
                                  Encrypted:false
                                  SSDEEP:12:YGGYpQTajDRdes6KUVJ8epQTNufIRdes6K27lO/NrnLAOK:YHYpQ67esNMpQJufI7esN27lOFvAOK
                                  MD5:E5BBE7DBBE75F45BDCD49DB8C797106E
                                  SHA1:0F069D7D19768180945F0D8B67DC71262FD586A2
                                  SHA-256:BFFB2248B4C66306133FA6ECBB1541F44B3BE22CC8D9A338D690E0B1D0C85532
                                  SHA-512:F6FE20B7A3B99BDBBF6F4737C8C63FE3098F060E6791BC40ED0E95FA5F93AA55C2643766EA2BE099E42EC378CB6E4B6FE7B5F2DA56C03A6A990B94A1F872B825
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Sovellus ei ole t\u00e4ll\u00e4 hetkell\u00e4 k\u00e4ytett\u00e4viss\u00e4."},"craw_connect_to_network":{"message":"Muodosta verkkoyhteys."},"app_name":{"message":"Chrome Web Storen maksut"},"app_description":{"message":"Chrome Web Storen maksut"},"iap_unavailable":{"message":"Sovelluksen sis\u00e4iset maksut eiv\u00e4t ole t\u00e4ll\u00e4 hetkell\u00e4 k\u00e4ytett\u00e4viss\u00e4."},"please_sign_in":{"message":"Kirjaudu sis\u00e4\u00e4n Chromeen."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\fil\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):515
                                  Entropy (8bit):4.699741311937528
                                  Encrypted:false
                                  SSDEEP:12:YGGYpsiwZALE0Dw9DtpsjzAvX2xSWO/NrnLAOK:YHYpsBvpsiX2xSWOFvAOK
                                  MD5:658DAD2AF2DC3AC1567D84E8B95F68B0
                                  SHA1:EE1121215960EC5ED5F7B6BDB8E4680731EBF83D
                                  SHA-256:978BA6D814CF290016833BBAC22DC7C05C2C575B1D6429B9BB14F8C2156BCF29
                                  SHA-512:F2FB93245D80E2CB2CA1BB2B0654FE92AD9041A558850D78AF4031CB83D2AD3BF5ABCFE6BC32160D028CA3914FA69A64784858A34FA56389C08D52B316346A05
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Kasalukuyang hindi available ang app."},"craw_connect_to_network":{"message":"Mangyaring kumonekta sa isang network."},"app_name":{"message":"Mga Pagbabayad sa Chrome Web Store"},"app_description":{"message":"Mga Pagbabayad sa Chrome Web Store"},"iap_unavailable":{"message":"Kasalukuyang hindi available ang Mga Pagbabayad na In-App."},"please_sign_in":{"message":"Mangyaring mag-sign in sa Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\fr\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):562
                                  Entropy (8bit):4.717150188929866
                                  Encrypted:false
                                  SSDEEP:12:YGGYpKdgbfUSPcLf0E1UDWcLf0E1Uop6oTQpGnbgWWO/NrnLAOK:YHYpagI26Qq6QopRTQwnFWOFvAOK
                                  MD5:1E32A78526E3AC8108E73D384F17450B
                                  SHA1:BFE2E47D888BA530A27DD1BDE25C46433C2A545C
                                  SHA-256:80F6EE69F1E022812BCCC1DE1CDC53772CDF90F4E93224161B23FA607D45136A
                                  SHA-512:5504F6D440779BC96571863D60B1E175EEDDC2E65B1ABBCFCFD19123F329F2E025FBA4D49BD23E33B77FFB6061BA6645132E04D4A7DEDE77F514B2151CDDF896
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Application indisponible pour le moment."},"craw_connect_to_network":{"message":"Veuillez vous connecter \u00e0 un r\u00e9seau."},"app_name":{"message":"Paiements via le Chrome\u00a0Web\u00a0Store"},"app_description":{"message":"Paiements via le Chrome\u00a0Web\u00a0Store"},"iap_unavailable":{"message":"Les paiements via l'application ne sont pas disponibles pour le moment."},"please_sign_in":{"message":"Veuillez vous connecter \u00e0 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\hi\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):1055
                                  Entropy (8bit):4.454461505283053
                                  Encrypted:false
                                  SSDEEP:24:YHYpINcVc0KgcNZvCjK7jK6pVi8/pBKgcNkQVcRynX6XjOFvAOK:YHYpIcQvCjIjRpVVBXPsqihQ
                                  MD5:B739E3B798D3EEB8AFB3E368455A8E97
                                  SHA1:56E206DD0AC7EB7B179911BE3F7DD78059CBD4F3
                                  SHA-256:BA7A53A1398168719F2ACD58CC5FE06AB0B769ECA896D70E7208B18085B42FFA
                                  SHA-512:181A3B1275D1D17BD48EAA77805981A96E22589A38990214AF3ED029C4A37C2F05ECF747D8FCF816C2AAED6EF82403757F234D67C360A3A6E5DB6C3F59CA1A0C
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"\u0910\u092a\u094d\u0932\u093f\u0915\u0947\u0936\u0928 \u0907\u0938 \u0938\u092e\u092f \u0909\u092a\u0932\u092c\u094d\u0927 \u0928\u0939\u0940\u0902 \u0939\u0948."},"craw_connect_to_network":{"message":"\u0915\u0943\u092a\u092f\u093e \u0928\u0947\u091f\u0935\u0930\u094d\u0915 \u0938\u0947 \u0915\u0928\u0947\u0915\u094d\u091f \u0915\u0930\u0947\u0902."},"app_name":{"message":"Chrome \u0935\u0947\u092c \u0938\u094d\u091f\u094b\u0930 \u092d\u0941\u0917\u0924\u093e\u0928"},"app_description":{"message":"Chrome \u0935\u0947\u092c \u0938\u094d\u091f\u094b\u0930 \u092d\u0941\u0917\u0924\u093e\u0928"},"iap_unavailable":{"message":"\u0907\u0928-\u0910\u092a \u092d\u0941\u0917\u0924\u093e\u0928 \u0905\u092d\u0940 \u0909\u092a\u0932\u092c\u094d\u0927 \u0928\u0939\u0940\u0902 \u0939\u0948."},"please_sign_in":{"message":"\u0915\u0943\u092a\u092f\u093e Chrome \u092e\u0947\u0902 \u0938\u093e\u0907\u0928 \u0907\u0928 \u0915\u0930\u0947\u0902."},"jwt_retrieve_failed":

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\hr\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):503
                                  Entropy (8bit):4.819520019697578
                                  Encrypted:false
                                  SSDEEP:12:YGGYpTOEu5TfIJPFJEPJEsxmfEWJEsxmfRpmJEzrMrQp5TfnHV5/WIWO/NrnLAOK:YHYpq7EJPkJExfJExRpmJE/LXzHV5/ji
                                  MD5:9CF848209FF50DBF68F5292B3421831C
                                  SHA1:D29880B7B15102469123D8747BF645706CE8595B
                                  SHA-256:EA1744C3CFBAA684A31A00067E8493ED114EFF3E878C797C9C55A7B122D855CD
                                  SHA-512:B784AEE4926F850F30072ABDA85E2E2E3966285F14BDF647BD2A41C5C06CAB04BC962584830E4E913896010396EAD02D90528235B9D9EDA1BDEFBFBB5333EDF5
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Aplikacija trenuta\u010dno nije dostupna."},"craw_connect_to_network":{"message":"Pove\u017eite se s mre\u017eom."},"app_name":{"message":"Pla\u0107anja u web-trgovini Chrome"},"app_description":{"message":"Pla\u0107anja u web-trgovini Chrome"},"iap_unavailable":{"message":"Pla\u0107anje u aplikaciji trenuta\u010dno nije dostupno."},"please_sign_in":{"message":"Prijavite se na Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\hu\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):612
                                  Entropy (8bit):4.865151680865773
                                  Encrypted:false
                                  SSDEEP:12:YGGYpiKQhMDCJNYygdGs61gdGs3piKQChMDZAYRO/NrnLAOK:YHYpzQhsiPgdG1gdGcpzQChsZAYOFvAD
                                  MD5:4AD92AFDE3408FBBE43B0C3C71677650
                                  SHA1:3488901077F336A3196F9AE116E36DF1674E1ACA
                                  SHA-256:61258FE04C23AE14FDC99EE846CEA71CC703990CC0F80C3934299646E86C475E
                                  SHA-512:EB945FA455DEB9D70033DC0A8AA55D1F47AA00214B70AD34D5419A54F9C05B267F96F9785139F452BEE6972376DDF13EE51C681845A2B0818172FB75BA1FD093
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Az alkalmaz\u00e1s jelenleg nem \u00e9rhet\u0151 el."},"craw_connect_to_network":{"message":"K\u00e9rj\u00fck, csatlakozzon egy h\u00e1l\u00f3zathoz."},"app_name":{"message":"Chrome Internetes \u00e1ruh\u00e1z Fizet\u00e9si rendszere"},"app_description":{"message":"Chrome Internetes \u00e1ruh\u00e1z Fizet\u00e9si rendszere"},"iap_unavailable":{"message":"Az alkalmaz\u00e1son bel\u00fcli fizet\u00e9s jelenleg nem \u00e9rhet\u0151 el."},"please_sign_in":{"message":"Jelentkezzen be a Chrome-ba."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\id\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):461
                                  Entropy (8bit):4.642271834875684
                                  Encrypted:false
                                  SSDEEP:12:YGGYpDBHAeSnLPo2sWo25pmo22C/SzFAAh+M9WO/NrnLAOK:YHYplHcFTpmzOptWOFvAOK
                                  MD5:9008516AA1D8F8C2B8ECE70B7E4963AD
                                  SHA1:EA7AD4BE77A80A4B9FB1E59A340010830E494747
                                  SHA-256:89CAB0AF2B53C6ABEB93C8C628DDCBDD286A7A2672FE03440411BB654E3A0675
                                  SHA-512:46534829417CAD54310BA90AD4545918A2E934508E0CC3467E367944E52315B1BC6500119214EABD40D641DD167C077935436135AF1C0DB1D1007AE98E6175FC
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Aplikasi tidak tersedia saat ini."},"craw_connect_to_network":{"message":"Sambungkan ke jaringan."},"app_name":{"message":"Pembayaran Chrome Webstore"},"app_description":{"message":"Pembayaran Chrome Webstore"},"iap_unavailable":{"message":"Pembayaran Dalam Aplikasi saat ini tidak tersedia."},"please_sign_in":{"message":"Harap masuk ke Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\it\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):464
                                  Entropy (8bit):4.701550173628233
                                  Encrypted:false
                                  SSDEEP:12:YGGYpmXXHEva6PIqd6WIqd3p6PqTX2zaWO/NrnLAOK:YHYpmnkvNtdRtd3pX6+WOFvAOK
                                  MD5:BB9C32BA62DDA02F9471C64B5F9CF916
                                  SHA1:9825037D5D9185C58456CDD887C77B10A41D8C84
                                  SHA-256:43A0B113D3773BA78F82BB9E42DDC46F6892D0FBBB351F94A7C105E4A146E9C1
                                  SHA-512:4D3DB91A6251F2DD9CBF97D29805A7AC23F49988966E9B686D486B4A8CEBEA33F5502E3891D5231674061127C282C745FB87FDA7467A6172851BF6925506C8CA
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"App al momento non disponibile."},"craw_connect_to_network":{"message":"Collegati a una rete."},"app_name":{"message":"Pagamenti Chrome Web Store"},"app_description":{"message":"Pagamenti Chrome Web Store"},"iap_unavailable":{"message":"La funzione Pagamenti In-App non \u00e8 al momento disponibile."},"please_sign_in":{"message":"Accedi a Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\ja\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):806
                                  Entropy (8bit):4.671841695172103
                                  Encrypted:false
                                  SSDEEP:12:YGGYpqbrR5IYstMNcXh82q8b0kOoZ46ToZ43pqbtVD2CR5IYstR0O8b0KhO/Nrnk:YHYpcFiLRMACqNpctVPieOAhOFvAOK
                                  MD5:96C8CBD161D3CE9CB1A46CB2CD0C6583
                                  SHA1:78BBFCF035B5B620E353C8E520653ADD3F4E7DB8
                                  SHA-256:81D8F1D9F72B3139BC5D9845BCF82990308FB6175D07514D8238B1E6D5D02E8A
                                  SHA-512:692468B7B44D961D8248BBC30CC11DE9F3F7E89D01A609E6CB71CAF653D8212C15DFA834C5FB6E8261FD21A25E9616861C0A3FC01DB27CBBE79C3FDE2C6549DD
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"\u30a2\u30d7\u30ea\u306f\u73fe\u5728\u3054\u5229\u7528\u3044\u305f\u3060\u3051\u307e\u305b\u3093\u3002"},"craw_connect_to_network":{"message":"\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u306b\u63a5\u7d9a\u3057\u3066\u304f\u3060\u3055\u3044\u3002"},"app_name":{"message":"Chrome \u30a6\u30a7\u30d6\u30b9\u30c8\u30a2\u6c7a\u6e08"},"app_description":{"message":"Chrome \u30a6\u30a7\u30d6\u30b9\u30c8\u30a2\u6c7a\u6e08"},"iap_unavailable":{"message":"\u30a2\u30d7\u30ea\u5185\u30da\u30a4\u30e1\u30f3\u30c8\u306f\u73fe\u5728\u3054\u5229\u7528\u3044\u305f\u3060\u3051\u307e\u305b\u3093\u3002"},"please_sign_in":{"message":"Chrome \u306b\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u304f\u3060\u3055\u3044\u3002"},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\ko\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):656
                                  Entropy (8bit):4.88216622785951
                                  Encrypted:false
                                  SSDEEP:12:YGGYpqHZMskkrcaw6cT/pb8pqHkrskeQV7wUO/NrnLAOK:YHYpsrkYcawwps5kdwUOFvAOK
                                  MD5:3CAF23A8EA2332D78B725B6C99EC3202
                                  SHA1:95C3504F55A929449EF2E3AB92014562AACD39AD
                                  SHA-256:BFE72BBC492B9018A599CB6575366696E431E6A38400E4B2ED06EAE3340D3AE5
                                  SHA-512:C000FCCB567D3590D4C401005E78C539961455BB13686296EC4FF7018BB0A4DAB2DA96FBDAA33D999C1409B5796932370219B3FF8490B671586DEBD6145519D6
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"\ud604\uc7ac \uc571\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4."},"craw_connect_to_network":{"message":"\ub124\ud2b8\uc6cc\ud06c\uc5d0 \uc5f0\uacb0\ud558\uc138\uc694."},"app_name":{"message":"Chrome \uc6f9 \uc2a4\ud1a0\uc5b4 \uacb0\uc81c"},"app_description":{"message":"Chrome \uc6f9 \uc2a4\ud1a0\uc5b4 \uacb0\uc81c"},"iap_unavailable":{"message":"\ud604\uc7ac \uc778\uc571 \uacb0\uc81c\ub97c \uc0ac\uc6a9\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4."},"please_sign_in":{"message":"Chrome\uc5d0 \ub85c\uadf8\uc778\ud558\uc138\uc694."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\lt\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):576
                                  Entropy (8bit):4.846810495221701
                                  Encrypted:false
                                  SSDEEP:12:YGGYpmEOnxwkD9AMoAYQa9AMoAYNpALveYAyO/NrnLAOK:YHYpmznayAMHcAMHQpAzeYAyOFvAOK
                                  MD5:41F2D63952202E528DBBB683B480F99C
                                  SHA1:9DD998542DBE6609299D4A5A25364A32FA7D7865
                                  SHA-256:FF7C083CD1E6134DD8263C634336EB852274BAD1BFAD18762814C42BC65309D8
                                  SHA-512:7BD2E2D4264C6BD62DF2584F3C1D3A910C5C5A28F4532F1E8F0C2235E93714EDD6074EA24960D4DEB4F9125DA81CA813F06330EFF66FA8DF1552D1DAC686441E
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Programa \u0161iuo metu negalima."},"craw_connect_to_network":{"message":"Prisijunkite prie tinklo."},"app_name":{"message":"\u201eChrome\u201c internetin\u0117s parduotuv\u0117s mok\u0117jimo sistema"},"app_description":{"message":"\u201eChrome\u201c internetin\u0117s parduotuv\u0117s mok\u0117jimo sistema"},"iap_unavailable":{"message":"Mok\u0117jimai programoje \u0161iuo metu negalimi."},"please_sign_in":{"message":"Prisijunkite prie \u201eChrome\u201c."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\lv\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):584
                                  Entropy (8bit):4.856464171821628
                                  Encrypted:false
                                  SSDEEP:12:YGGYp6nQ11155y9k5hInf6whInf3pRKbqk0R5VR8WO/NrnLAOK:YHYpp11dy9iIdIvpc2ZgWOFvAOK
                                  MD5:1D21ED2D46338636E24401F6E56E326F
                                  SHA1:24497EDB25724BC4A57823C5CD06F50DB9647DD4
                                  SHA-256:434A375C32B8A21C435511C551F740FD4D170EC528A8F4EFC3D798EA4A07B606
                                  SHA-512:10A870718CC6281EE09DE01900D303B06589D9281C5849D6105C6FCF58BFFA3855F29C6ECA3689FFE6EF304BABCF41C5700EE2D8AFE711D57CB711194366FA6A
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Lietotne pagaid\u0101m nav pieejama."},"craw_connect_to_network":{"message":"L\u016bdzu, izveidojiet savienojumu ar t\u012bklu."},"app_name":{"message":"Chrome interneta veikala maks\u0101jumu sist\u0113ma"},"app_description":{"message":"Chrome interneta veikala maks\u0101jumu sist\u0113ma"},"iap_unavailable":{"message":"Maks\u0101jumi lietotn\u0113s pa\u0161laik nav pieejami."},"please_sign_in":{"message":"L\u016bdzu, pierakstieties p\u0101rl\u016bk\u0101 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\nb\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):501
                                  Entropy (8bit):4.804937629013952
                                  Encrypted:false
                                  SSDEEP:12:YGGYpB928UZjdyE9iDCiop8682fURHWO/NrnLAOK:YHYpXK/iOiop8NFHWOFvAOK
                                  MD5:8F0168B9A546D5A99FD8A262C975C80E
                                  SHA1:B0718071BD0B7251D4459E9C87DF50C14622FBD6
                                  SHA-256:F03FA7384DF79EBA6E0274D570996030F595A3BF6B781929DD9DB6593262E41F
                                  SHA-512:A1191CDC496DDD7470BDCFAF186BB9488767159E0CA6A6242D195FA3351704DC8F8BBD03DBEE57D37BBD897C9E8D14B7325FB37D58AC80DEC0F972FF893758B8
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Appen er utilgjengelig for \u00f8yeblikket."},"craw_connect_to_network":{"message":"Du m\u00e5 koble til et nettverk."},"app_name":{"message":"Chrome Nettmarked-betalinger"},"app_description":{"message":"Chrome Nettmarked-betalinger"},"iap_unavailable":{"message":"Betaling i app er ikke tilgjengelig for \u00f8yeblikket."},"please_sign_in":{"message":"Du m\u00e5 logge p\u00e5 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\nl\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):472
                                  Entropy (8bit):4.651254944398292
                                  Encrypted:false
                                  SSDEEP:12:YGGYpqK5XUoE32GFM2GapUEn7v0WO/NrnLAOK:YHYp/XaLeLapUEgWOFvAOK
                                  MD5:E7F74DCE7B6411E4E0D95E9252CF74FA
                                  SHA1:33CC6C73C5F8D0144C0260C2E5A9BD0DB3EF6477
                                  SHA-256:3564AEF46C01602B19CC29FD8A79676C543427EDE98206D0C91B33AF0CCF3977
                                  SHA-512:B0987002F8BC4F0B0AC41A87E90BA729464BF2F34D1CC413DD3837019F5F37FD46EB9E9FDABB97F5BDCB50768ABF808AF6E7C531CD7BCA477C71990D2F13335B
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"App momenteel niet beschikbaar."},"craw_connect_to_network":{"message":"Maak verbinding met een netwerk."},"app_name":{"message":"Betalingen via Chrome Web Store"},"app_description":{"message":"Betalingen via Chrome Web Store"},"iap_unavailable":{"message":"In-app-betalingen is momenteel niet beschikbaar."},"please_sign_in":{"message":"Log in bij Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\pl\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):549
                                  Entropy (8bit):4.978056737225237
                                  Encrypted:false
                                  SSDEEP:12:YGGYpTHlBqHdqcUP5Qp0mAW5Qp0mdpm5Qp0p9JqD2WO/NrnLAOK:YHYpRMdO5bmj5bmdpm5bLJBWOFvAOK
                                  MD5:E16649D87E4CA6462192CF78EBE543EC
                                  SHA1:53097D592B13F3C1370366B25024EA72208B136A
                                  SHA-256:EB435F7460A63576CA1ECB51948E7A3AD5168D2F175AE2B5836D469672923D84
                                  SHA-512:6EC702CEC6E312CAC6F33109A57F7D83A3F073F2F9A9BD42DB0F91A36F87D800EEB978C69023B6A0E00B86ECE3E1024C269F89D038F0926619F40D075F6689DD
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Aplikacja jest obecnie niedost\u0119pna."},"craw_connect_to_network":{"message":"Po\u0142\u0105cz si\u0119 z sieci\u0105."},"app_name":{"message":"P\u0142atno\u015bci w sklepie Chrome Web Store"},"app_description":{"message":"P\u0142atno\u015bci w sklepie Chrome Web Store"},"iap_unavailable":{"message":"P\u0142atno\u015bci w ramach aplikacji s\u0105 teraz niedost\u0119pne."},"please_sign_in":{"message":"Zaloguj si\u0119 w Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\pt_BR\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):513
                                  Entropy (8bit):4.734605177119403
                                  Encrypted:false
                                  SSDEEP:12:YGGYpGAV9hv3/1PIc6WIc3paIBMMAV+KcIWO/NrnLAOK:YHYpGwLvt5R53pacHw1pWOFvAOK
                                  MD5:1F4BC8A5EFD59D61127ABEECD4B6CAE3
                                  SHA1:8647B4D2D643AE4F784ABDDC50D87A39AD02971A
                                  SHA-256:E1950CBBF056F068EA56160DDB318F3E6232BFBBE096D221C7CA6FCAACE2A8B9
                                  SHA-512:B58A95BBBC0A16B06826684198B481D2E15A7C760956721C3B538C62C902873A7856F328506457EE66311E45D7A16A4AAAC85B12853AA7EF09780189D28EB3DE
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Aplicativo indispon\u00edvel no momento."},"craw_connect_to_network":{"message":"Conecte-se a uma rede."},"app_name":{"message":"Pagamentos da Chrome Web Store"},"app_description":{"message":"Pagamentos da Chrome Web Store"},"iap_unavailable":{"message":"No momento, os Pagamentos no aplicativo n\u00e3o est\u00e3o dispon\u00edveis."},"please_sign_in":{"message":"Fa\u00e7a login no Google Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\pt_PT\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):503
                                  Entropy (8bit):4.742240430473613
                                  Encrypted:false
                                  SSDEEP:12:YGGYpmvMAV9BKx1PIZUFWIZUapITEpBqMAVCWWO/NrnLAOK:YHYpmvMwOxtEUIEUapIITqMwCWWOFvAD
                                  MD5:D80ECE7E4B3741CD9CD29B89D006B864
                                  SHA1:8F0D587B78E36861ED00524ABF886FA20E14CAE4
                                  SHA-256:C8FF9ACAEA1D3B6F8483339CB40F66BC563CCA8DD87F2337F813C492B20F451B
                                  SHA-512:8A53D9618BBD1A62CD48501E5620932631C1B045612082D99429628D2BF4409AEE3FA695107E82037B5CB332111C456CF3A74235C66B61380CF1E382914F1088
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Aplica\u00e7\u00e3o atualmente indispon\u00edvel."},"craw_connect_to_network":{"message":"Ligue-se a uma rede."},"app_name":{"message":"Pagamentos via Chrome Web Store"},"app_description":{"message":"Pagamentos via Chrome Web Store"},"iap_unavailable":{"message":"Os Pagamentos na app est\u00e3o atualmente indispon\u00edveis."},"please_sign_in":{"message":"Inicie sess\u00e3o no Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\ro\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):554
                                  Entropy (8bit):4.8596885592394505
                                  Encrypted:false
                                  SSDEEP:12:YGGYpqOHHEG7PMeH8EPJWb2r9EWJWb2r9RpmJW9FjkUhI3C7PMdWO/NrnLAOK:YHYpbnEG7PjlJBfJBRpmJmBh57PEWOFY
                                  MD5:D63E66B94A4EA2085D80E76209582FB1
                                  SHA1:4ECAC3EB64DD6253310A0776E6D42257FC290D77
                                  SHA-256:91A5AAD210C3E0241106E8821B3897EDEFEC9D85033C94DB2324FF3A5FDE5AC7
                                  SHA-512:09AC34CF286FD0730EED4F6DB3E2FD00A026D0F42DCC75AE49B045DDAD38DFA38B0FB7823ECAC8B0A9BC2A89F4EAF4BCE081779F2ECDF6CC39286045577DC5C9
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"\u00cen prezent, aplica\u021bia nu este disponibil\u0103."},"craw_connect_to_network":{"message":"Conecteaz\u0103-te la o re\u021bea."},"app_name":{"message":"Pl\u0103\u021bi prin Magazinul web Chrome"},"app_description":{"message":"Pl\u0103\u021bi prin Magazinul web Chrome"},"iap_unavailable":{"message":"Pl\u0103\u021bile \u00een aplica\u021bie nu sunt disponibile momentan."},"please_sign_in":{"message":"Conecteaz\u0103-te la Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\ru\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):1165
                                  Entropy (8bit):4.224419823550506
                                  Encrypted:false
                                  SSDEEP:24:YHYpNQVFc0BHlbZ0JRiKUG0L6RqQV9zJd0L6RqQV9zJRp00EQVqaQVFc0BRTlPzU:YHYpNQLHFQYKA6wQTz+6wQTz3paQAaQ8
                                  MD5:22F9E62ABAD82C2190A839851245A495
                                  SHA1:E7F79BD875918F0D0799DB5F45FAC6297FB66AF7
                                  SHA-256:9FC1167626C97BCBFDAFF23C6033A44252F89A501AF1DF41C43CB3A994FEB09F
                                  SHA-512:F577F2F0C344C4E4050AF025A9FB9AC78CADF7FE177F63AB9863826A9808B7FBF5D3363E3B61D7A6DB083EF5EBAC5474D710347B701640AB9C229A3E5D1F0A48
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"\u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e."},"craw_connect_to_network":{"message":"\u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u0441\u044c \u043a \u0441\u0435\u0442\u0438."},"app_name":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 Chrome"},"app_description":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 Chrome"},"iap_unavailable":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b."},"

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\sk\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):548
                                  Entropy (8bit):4.850036636276313
                                  Encrypted:false
                                  SSDEEP:12:YGGYprMpsgCmIkPJE7ZEWJE7ZRpmJEtMxfAVADJ4ZAvIWO/NrnLAOK:YHYprMFCmvJE7ZfJE7ZRpmJEtMSVGKZo
                                  MD5:4BBAA10FD00AADBBA3EF6E805E8E1A62
                                  SHA1:1991901BD6A20C4A7977F09DF30C0CFF0524C504
                                  SHA-256:906C4F7FDDE15DE4C841E7910BBF14D9175E894BCB244B56E8447A5ADFA5B7AB
                                  SHA-512:3490F8826E3DB0C8B4FE7B1866DA27F6585ADF52E74392A592A60A916E8A784FF7B92B3DE8985084546D663588369D9BB03FCB25196B7F9C6DF607BEB7DEF010
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Aplik\u00e1cia moment\u00e1lne nie je dostupn\u00e1."},"craw_connect_to_network":{"message":"Pripojte sa k sieti."},"app_name":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"app_description":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"iap_unavailable":{"message":"Platby v aplik\u00e1cii moment\u00e1lne nie s\u00fa k dispoz\u00edcii."},"please_sign_in":{"message":"Prihl\u00e1ste sa do prehliada\u010da Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\sl\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):494
                                  Entropy (8bit):4.7695148367588285
                                  Encrypted:false
                                  SSDEEP:12:YGGYpTOEtyPFTEPJEsvmfEWJEsvmfRpmJEiArERfH5/4WO/NrnLAOK:YHYpqoyPRAJEs4fJEs4RpmJEi6AfH5/x
                                  MD5:F45DE58765A37FD095319D7DEB0F2FB6
                                  SHA1:B585A485C9BC1982EDF7AE0B9AC73A8E91D41CB5
                                  SHA-256:8366774AA582035BC7D949F4E28FAEC371C305D01404DF56FFF5A78B4F6ECDB7
                                  SHA-512:F86334E6E6F90961AD9C8E7DD1A4E923476249469180AC69D9DE59746FE26FAECB585898FC50310380F20CEB0971CA1EB7B55046DA75276840AEA6BAFF574E66
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Aplikacija trenutno ni na voljo."},"craw_connect_to_network":{"message":"Pove\u017eite se z omre\u017ejem."},"app_name":{"message":"Pla\u010dila v spletni trgovini Chrome"},"app_description":{"message":"Pla\u010dila v spletni trgovini Chrome"},"iap_unavailable":{"message":"Pla\u010dila v aplikacijah trenutno niso na voljo."},"please_sign_in":{"message":"Prijavite se v Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\sr\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):1152
                                  Entropy (8bit):4.2078334514915685
                                  Encrypted:false
                                  SSDEEP:24:YHYpY0f7BxQVnRl5LRO1QV1J0V8aQVEeORbo0V8aQVEeORbIp00V4i0f7BXR2QVj:YHYpV9xQVP5LyQHQQc/QcGpcH9XR2QVj
                                  MD5:92C1FAC62EB7F92EC3794D4A141BEF32
                                  SHA1:2AFA41BF51BF9A1089B0B92A9D2DC74299B79813
                                  SHA-256:9DF154C93B02695AF1CC39F085D9D178EC6AF131A62C2AFC65F125F8F9A5B7AC
                                  SHA-512:D0709E4F586EAC03548A47D72156CF48D9B4EB9AF9ED8335DF75F541AE1B4172541647EC8BA081965647A9EAE10DB342F87558977BE6075B2D3CC5C3995ED6EE
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"\u0410\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0458\u0430 \u0458\u0435 \u0442\u0440\u0435\u043d\u0443\u0442\u043d\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430."},"craw_connect_to_network":{"message":"\u041f\u043e\u0432\u0435\u0436\u0438\u0442\u0435 \u0441\u0430 \u043c\u0440\u0435\u0436\u043e\u043c."},"app_name":{"message":"\u041f\u043b\u0430\u045b\u0430\u045a\u0430 \u0443 Chrome \u0432\u0435\u0431-\u043f\u0440\u043e\u0434\u0430\u0432\u043d\u0438\u0446\u0438"},"app_description":{"message":"\u041f\u043b\u0430\u045b\u0430\u045a\u0430 \u0443 Chrome \u0432\u0435\u0431-\u043f\u0440\u043e\u0434\u0430\u0432\u043d\u0438\u0446\u0438"},"iap_unavailable":{"message":"\u041f\u043b\u0430\u045b\u0430\u045a\u0430 \u0443 \u0430\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0458\u0438 \u0441\u0443 \u0442\u0440\u0435\u043d\u0443\u0442\u043d\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430."},"please_sign_in":{"message":"\u041f\u04

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\sv\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):523
                                  Entropy (8bit):4.788896709100935
                                  Encrypted:false
                                  SSDEEP:12:YGGYpg6hVGZE3aFMaap8Sp5b6hwUwrdIWO/NrnLAOK:YHYpg6hPaeaap8Sr6hwXIWOFvAOK
                                  MD5:6E1BE9CEE29818E54E3D1C7D483DD6F7
                                  SHA1:B9DD926B60E225C5BE8A1DBB7EF3ACE422A204A9
                                  SHA-256:E348583D8C53F4A5DEC4551DA93785C17108466E427E06F84708AA383EA0E326
                                  SHA-512:3ADB32C0F098E064B774E7E7F615F54C44ADFB3BFC554B06A17048C6077C5885D42BD89F6733D64D65EA1785033B36B386EF0B6661FD539855484EA5A2900BB7
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Appen \u00e4r inte tillg\u00e4nglig f\u00f6r tillf\u00e4llet."},"craw_connect_to_network":{"message":"Anslut till ett n\u00e4tverk."},"app_name":{"message":"Betalning via Chrome Web Store"},"app_description":{"message":"Betalning via Chrome Web Store"},"iap_unavailable":{"message":"Betalning i appen \u00e4r inte tillg\u00e4ngligt f\u00f6r n\u00e4rvarande."},"please_sign_in":{"message":"Logga in i Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\th\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):1300
                                  Entropy (8bit):4.09652661599029
                                  Encrypted:false
                                  SSDEEP:24:YHYpqQV8k6Nvgnd0BQV3d0BQV5pWdPiWdBy7MIoWOFvAOK:YHYpqQ+k6NUaBQlaBQXpW3dBUMIehQ
                                  MD5:283D5177FB2FC7082967988E2683EC7C
                                  SHA1:DEDE43967F3CEF9D9325F140872A63BFCE2AA8C5
                                  SHA-256:E8D5820BDE31B66A7641068FDEDD1A5F20C1A783460B98887A670F38422099CF
                                  SHA-512:74413C00C58B7136038D4C41D5C7C79EC02A9830779ABB719D72536B74C5E338B1548A20290559FB3F4E2A938B728CF99041050DD1970848EE9A6590EB0AB3E4
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"\u0e44\u0e21\u0e48\u0e2a\u0e32\u0e21\u0e32\u0e23\u0e16\u0e43\u0e0a\u0e49\u0e07\u0e32\u0e19\u0e41\u0e2d\u0e1b\u0e44\u0e14\u0e49\u0e43\u0e19\u0e02\u0e13\u0e30\u0e19\u0e35\u0e49"},"craw_connect_to_network":{"message":"\u0e42\u0e1b\u0e23\u0e14\u0e40\u0e0a\u0e37\u0e48\u0e2d\u0e21\u0e15\u0e48\u0e2d\u0e01\u0e31\u0e1a\u0e40\u0e04\u0e23\u0e37\u0e2d\u0e02\u0e48\u0e32\u0e22"},"app_name":{"message":"\u0e23\u0e30\u0e1a\u0e1a\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19\u0e02\u0e2d\u0e07 Chrome \u0e40\u0e27\u0e47\u0e1a\u0e2a\u0e42\u0e15\u0e23\u0e4c"},"app_description":{"message":"\u0e23\u0e30\u0e1a\u0e1a\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19\u0e02\u0e2d\u0e07 Chrome \u0e40\u0e27\u0e47\u0e1a\u0e2a\u0e42\u0e15\u0e23\u0e4c"},"iap_unavailable":{"message":"\u0e23\u0e30\u0e1a\u0e1a\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19\u0e43\u0e19\u0e41\u0e2d\u0e1b\u0e1e\u0e25\u0e34\u0e40\u0e04\u0e0a\u0e31\u0e19\u0e44\u0e21\u0e48\u0e1e\u0e23\u0e49\u0e2d\u0e21\u0e4

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\tr\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):572
                                  Entropy (8bit):4.93347615778905
                                  Encrypted:false
                                  SSDEEP:12:YGGYpFh852XmYG45SfVVh5SX8pFBkw452kK/O/NrnLAOK:YHYpFhJ2Y95AJ5I8pFhlkwOFvAOK
                                  MD5:1BF2AA4BB904B406C9C2B7DF769BB540
                                  SHA1:8D29C4B7A79AB0657747CA194D1934292A46D2A8
                                  SHA-256:0F2E8285BA3E2BDBA6B16435FB941B07159AACFAC80196AD5941B79AB52B712A
                                  SHA-512:0DF48AE0A518A940489E91D8A0D6E7E47A3153747358E06CD792BFA3D826F47FA1502268F602E7D7EDFC1C111AEB3FAF0E67F845986DDA77E2FC4B3336BCF46C
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"Uygulama \u015fu anda kullan\u0131lam\u0131yor."},"craw_connect_to_network":{"message":"L\u00fctfen bir a\u011fa ba\u011flan\u0131n."},"app_name":{"message":"Chrome Web Ma\u011fazas\u0131 \u00d6demeleri"},"app_description":{"message":"Chrome Web Ma\u011fazas\u0131 \u00d6demeleri"},"iap_unavailable":{"message":"Uygulama \u0130\u00e7i \u00d6demeler \u015fu anda kullan\u0131lamaz."},"please_sign_in":{"message":"L\u00fctfen Chrome'da oturum a\u00e7\u0131n."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\_locales\uk\messages.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines
                                  Category:dropped
                                  Size (bytes):1088
                                  Entropy (8bit):4.268588181103308
                                  Encrypted:false
                                  SSDEEP:24:YHYpNQVVQVrll5eN7jAQVF0Zz0id0Zz0iRp00AQVqaQVVQVSMQVvjlkYHA1RnWOi:YHYpNQPQZ75exkQAz0/z00p2QAaQPQQN
                                  MD5:FD1C9890679036E1AD914218753B1E8E
                                  SHA1:58160F7A0FC94110A2876223E406A517C8E2660B
                                  SHA-256:39D19CC3387FFCE13A8F11DAD72E2FCBB7CD1A4367EC699AD7C40D6F52ECE717
                                  SHA-512:03E81C398EE6A5DC65A40CA07E1A4CBEC2662D2C151A76C9ECB813587D672AC71311C39C5C5DA8A1AE78A3A6CE3938609D1365F7819424FC34289C7743DF00D2
                                  Malicious:false
                                  Reputation:low
                                  Preview:{"craw_app_unavailable":{"message":"\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u0430 \u0442\u0438\u043c\u0447\u0430\u0441\u043e\u0432\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430."},"craw_connect_to_network":{"message":"\u041f\u0456\u0434\u2019\u0454\u0434\u043d\u0430\u0439\u0442\u0435\u0441\u044f \u0434\u043e \u043c\u0435\u0440\u0435\u0436\u0456."},"app_name":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0456 \u0412\u0435\u0431-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0443 Chrome"},"app_description":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0456 \u0412\u0435\u0431-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0443 Chrome"},"iap_unavailable":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0456 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u0443 \u0437\u0430\u0440\u0430\u0437 \u043d\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0456."},"please_sign_in":{"message":"\u0423\u0432\u0456\u0439\u0434\u0456\u0442\u044c \u0443

                                  C:\Users\user\AppData\Local\Temp\scoped_dir5680_2088814485\CRX_INSTALL\manifest.json

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text
                                  Category:dropped
                                  Size (bytes):1098
                                  Entropy (8bit):4.919185521409901
                                  Encrypted:false
                                  SSDEEP:24:BeVvlH141v5GFqeq7x7S4dudxNfN3IFKrGQZDN4:QVNVgvLecJSR1Y8r5ZW
                                  MD5:6CA25F3EF585B63F01BCDF8635120704
                                  SHA1:00C063811E31EA5F9A00F175A71EA25E7821F621
                                  SHA-256:49D9DE983F7436BA786E6E04A5A20C10F41687AE06B266B1B6553F696719563D
                                  SHA-512:566BFD9BADBD8951EE52E5911EB68B51E86286989096D32DE6E32A2523761B0E0AFCA251EF3BEA36B5D51FB8354A5FCA567772A02C3F3B9D8DFE529609FA0430
                                  Malicious:false
                                  Reputation:low
                                  Preview:{."update_url": "https://clients2.google.com/service/update2/crx",.. "name": "__MSG_APP_NAME__",. "description": "__MSG_APP_DESCRIPTION__",. "manifest_version": 2,. "version": "1.0.0.6",. "minimum_chrome_version": "29",. "default_locale": "en",. "app": {. "background": {. "scripts": [. "craw_background.js". ]. }. },. "permissions": [. "identity",. "webview",. "https://www.google.com/",. "https://www.googleapis.com/*",. "https://payments.google.com/payments/v4/js/integrator.js",. "https://sandbox.google.com/payments/v4/js/integrator.js". ],. "oauth2": {. "auto_approve": true,. "scopes": [. "https://www.googleapis.com/auth/sierra",. "https://www.googleapis.com/auth/sierrasandbox",. "https://www.googleapis.com/auth/chromewebstore",. "https://www.googleapis.com/auth/chromewebstore.readonly". ],. "client_id": "203784468217.apps.googleusercontent.com". },. "icons": {. "16": "images/icon_16.png",. "128

                                  Static File Info

                                  ⊘No static file info

                                  Network Behavior

                                  Network Port Distribution

                                  TCP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Aug 5, 2022 12:18:09.170825005 CEST49763443192.168.2.5142.250.185.205
                                  Aug 5, 2022 12:18:09.170888901 CEST44349763142.250.185.205192.168.2.5
                                  Aug 5, 2022 12:18:09.170985937 CEST49763443192.168.2.5142.250.185.205
                                  Aug 5, 2022 12:18:09.171279907 CEST49763443192.168.2.5142.250.185.205
                                  Aug 5, 2022 12:18:09.171297073 CEST44349763142.250.185.205192.168.2.5
                                  Aug 5, 2022 12:18:09.182199001 CEST49764443192.168.2.5142.250.181.238
                                  Aug 5, 2022 12:18:09.182238102 CEST44349764142.250.181.238192.168.2.5
                                  Aug 5, 2022 12:18:09.182324886 CEST49764443192.168.2.5142.250.181.238
                                  Aug 5, 2022 12:18:09.182646036 CEST49764443192.168.2.5142.250.181.238
                                  Aug 5, 2022 12:18:09.182656050 CEST44349764142.250.181.238192.168.2.5
                                  Aug 5, 2022 12:18:09.223211050 CEST49765443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:09.223253012 CEST44349765195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:09.223717928 CEST49766443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:09.223737001 CEST49765443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:09.223747015 CEST44349766195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:09.223823071 CEST49766443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:09.224322081 CEST49766443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:09.224335909 CEST44349766195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:09.225537062 CEST49765443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:09.225554943 CEST44349765195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:09.230787039 CEST44349763142.250.185.205192.168.2.5
                                  Aug 5, 2022 12:18:09.231470108 CEST49763443192.168.2.5142.250.185.205
                                  Aug 5, 2022 12:18:09.231498957 CEST44349763142.250.185.205192.168.2.5
                                  Aug 5, 2022 12:18:09.232592106 CEST44349763142.250.185.205192.168.2.5
                                  Aug 5, 2022 12:18:09.232664108 CEST49763443192.168.2.5142.250.185.205
                                  Aug 5, 2022 12:18:09.240853071 CEST44349764142.250.181.238192.168.2.5
                                  Aug 5, 2022 12:18:09.241157055 CEST49764443192.168.2.5142.250.181.238
                                  Aug 5, 2022 12:18:09.241184950 CEST44349764142.250.181.238192.168.2.5
                                  Aug 5, 2022 12:18:09.241796970 CEST44349764142.250.181.238192.168.2.5
                                  Aug 5, 2022 12:18:09.241877079 CEST49764443192.168.2.5142.250.181.238
                                  Aug 5, 2022 12:18:09.243159056 CEST44349764142.250.181.238192.168.2.5
                                  Aug 5, 2022 12:18:09.243236065 CEST49764443192.168.2.5142.250.181.238
                                  Aug 5, 2022 12:18:09.305773020 CEST44349765195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:09.306493998 CEST49765443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:09.306566000 CEST44349765195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:09.307672024 CEST44349766195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:09.307689905 CEST44349765195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:09.307816029 CEST49765443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:09.308047056 CEST49766443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:09.308072090 CEST44349766195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:09.309847116 CEST44349766195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:09.309942961 CEST49766443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:09.955988884 CEST49763443192.168.2.5142.250.185.205
                                  Aug 5, 2022 12:18:09.956206083 CEST49765443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:09.956207037 CEST44349763142.250.185.205192.168.2.5
                                  Aug 5, 2022 12:18:09.956340075 CEST49766443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:09.956351042 CEST44349765195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:09.956531048 CEST44349766195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:09.956629992 CEST49763443192.168.2.5142.250.185.205
                                  Aug 5, 2022 12:18:09.956659079 CEST44349763142.250.185.205192.168.2.5
                                  Aug 5, 2022 12:18:09.957134962 CEST49765443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:09.957164049 CEST44349765195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:09.959333897 CEST49764443192.168.2.5142.250.181.238
                                  Aug 5, 2022 12:18:09.959506035 CEST44349764142.250.181.238192.168.2.5
                                  Aug 5, 2022 12:18:09.959513903 CEST49764443192.168.2.5142.250.181.238
                                  Aug 5, 2022 12:18:09.981914997 CEST44349765195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:09.982012987 CEST49765443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:09.987092018 CEST44349764142.250.181.238192.168.2.5
                                  Aug 5, 2022 12:18:09.987149954 CEST49764443192.168.2.5142.250.181.238
                                  Aug 5, 2022 12:18:09.987165928 CEST44349764142.250.181.238192.168.2.5
                                  Aug 5, 2022 12:18:09.987180948 CEST44349764142.250.181.238192.168.2.5
                                  Aug 5, 2022 12:18:09.987246037 CEST49764443192.168.2.5142.250.181.238
                                  Aug 5, 2022 12:18:10.005907059 CEST44349763142.250.185.205192.168.2.5
                                  Aug 5, 2022 12:18:10.006012917 CEST49763443192.168.2.5142.250.185.205
                                  Aug 5, 2022 12:18:10.006036043 CEST44349763142.250.185.205192.168.2.5
                                  Aug 5, 2022 12:18:10.006053925 CEST44349763142.250.185.205192.168.2.5
                                  Aug 5, 2022 12:18:10.006136894 CEST49763443192.168.2.5142.250.185.205
                                  Aug 5, 2022 12:18:10.012346983 CEST49764443192.168.2.5142.250.181.238
                                  Aug 5, 2022 12:18:10.012366056 CEST44349764142.250.181.238192.168.2.5
                                  Aug 5, 2022 12:18:10.031240940 CEST49763443192.168.2.5142.250.185.205
                                  Aug 5, 2022 12:18:10.031276941 CEST44349763142.250.185.205192.168.2.5
                                  Aug 5, 2022 12:18:10.077025890 CEST49766443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:10.077054977 CEST44349766195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:10.131051064 CEST49765443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:10.131069899 CEST44349765195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:10.276015997 CEST49766443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:10.342446089 CEST49766443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:10.367638111 CEST44349766195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:10.367659092 CEST44349766195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:10.367723942 CEST49766443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:10.367742062 CEST44349766195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:10.367774963 CEST44349766195.201.57.90192.168.2.5
                                  Aug 5, 2022 12:18:10.367786884 CEST49766443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:10.367825031 CEST49766443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:10.419290066 CEST49766443192.168.2.5195.201.57.90
                                  Aug 5, 2022 12:18:10.419312954 CEST44349766195.201.57.90192.168.2.5

                                  UDP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Aug 5, 2022 12:18:09.113161087 CEST6270453192.168.2.58.8.8.8
                                  Aug 5, 2022 12:18:09.140119076 CEST5393453192.168.2.58.8.8.8
                                  Aug 5, 2022 12:18:09.140500069 CEST53627048.8.8.8192.168.2.5
                                  Aug 5, 2022 12:18:09.145143032 CEST6371253192.168.2.58.8.8.8
                                  Aug 5, 2022 12:18:09.175616980 CEST53637128.8.8.8192.168.2.5
                                  Aug 5, 2022 12:18:09.205730915 CEST53539348.8.8.8192.168.2.5

                                  DNS Queries

                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                  Aug 5, 2022 12:18:09.113161087 CEST192.168.2.58.8.8.80xf340Standard query (0)accounts.google.comA (IP address)IN (0x0001)
                                  Aug 5, 2022 12:18:09.140119076 CEST192.168.2.58.8.8.80xb1b5Standard query (0)ipwho.isA (IP address)IN (0x0001)
                                  Aug 5, 2022 12:18:09.145143032 CEST192.168.2.58.8.8.80x63adStandard query (0)clients2.google.comA (IP address)IN (0x0001)

                                  DNS Answers

                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                  Aug 5, 2022 12:18:09.140500069 CEST8.8.8.8192.168.2.50xf340No error (0)accounts.google.com142.250.185.205A (IP address)IN (0x0001)
                                  Aug 5, 2022 12:18:09.175616980 CEST8.8.8.8192.168.2.50x63adNo error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)
                                  Aug 5, 2022 12:18:09.175616980 CEST8.8.8.8192.168.2.50x63adNo error (0)clients.l.google.com142.250.181.238A (IP address)IN (0x0001)
                                  Aug 5, 2022 12:18:09.205730915 CEST8.8.8.8192.168.2.50xb1b5No error (0)ipwho.is195.201.57.90A (IP address)IN (0x0001)

                                  HTTP Request Dependency Graph

                                  • accounts.google.com
                                  • ipwho.is
                                  • clients2.google.com
                                  • https:

                                  HTTPS Proxied Packets

                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  0192.168.2.549763142.250.185.205443C:\Program Files\Google\Chrome\Application\chrome.exe
                                  TimestampkBytes transferredDirectionData
                                  2022-08-05 10:18:09 UTC0OUTPOST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1
                                  Host: accounts.google.com
                                  Connection: keep-alive
                                  Content-Length: 1
                                  Origin: https://www.google.com
                                  Content-Type: application/x-www-form-urlencoded
                                  Sec-Fetch-Site: none
                                  Sec-Fetch-Mode: no-cors
                                  Sec-Fetch-Dest: empty
                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
                                  Accept-Encoding: gzip, deflate, br
                                  Accept-Language: en-US,en;q=0.9
                                  2022-08-05 10:18:09 UTC0OUTData Raw: 20
                                  Data Ascii:
                                  2022-08-05 10:18:10 UTC4INHTTP/1.1 200 OK
                                  Content-Type: application/json; charset=utf-8
                                  Access-Control-Allow-Origin: https://www.google.com
                                  Access-Control-Allow-Credentials: true
                                  X-Content-Type-Options: nosniff
                                  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                  Pragma: no-cache
                                  Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                  Date: Fri, 05 Aug 2022 10:18:09 GMT
                                  Strict-Transport-Security: max-age=31536000; includeSubDomains
                                  Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                  Content-Security-Policy: script-src 'report-sample' 'nonce-4mKaxuIiPqXZIxAw8mmJ2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self'
                                  Content-Security-Policy: script-src 'nonce-4mKaxuIiPqXZIxAw8mmJ2Q' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport
                                  Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport
                                  Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
                                  Cross-Origin-Opener-Policy: same-origin
                                  Server: ESF
                                  X-XSS-Protection: 0
                                  Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                  Accept-Ranges: none
                                  Vary: Accept-Encoding
                                  Connection: close
                                  Transfer-Encoding: chunked
                                  2022-08-05 10:18:10 UTC6INData Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a
                                  Data Ascii: 11["gaia.l.a.r",[]]
                                  2022-08-05 10:18:10 UTC6INData Raw: 30 0d 0a 0d 0a
                                  Data Ascii: 0


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  1192.168.2.549765195.201.57.90443C:\Program Files\Google\Chrome\Application\chrome.exe
                                  TimestampkBytes transferredDirectionData
                                  2022-08-05 10:18:09 UTC0OUTGET / HTTP/1.1
                                  Host: ipwho.is
                                  Connection: keep-alive
                                  Upgrade-Insecure-Requests: 1
                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
                                  Sec-Fetch-Site: none
                                  Sec-Fetch-Mode: navigate
                                  Sec-Fetch-User: ?1
                                  Sec-Fetch-Dest: document
                                  Accept-Encoding: gzip, deflate, br
                                  Accept-Language: en-US,en;q=0.9
                                  2022-08-05 10:18:09 UTC1INHTTP/1.1 200 OK
                                  Server: nginx/1.20.2
                                  Date: Fri, 05 Aug 2022 10:18:09 GMT
                                  Content-Type: application/json; charset=utf-8
                                  Transfer-Encoding: chunked
                                  Connection: close
                                  X-Powered-By: PHP/7.4.29
                                  Access-Control-Allow-Origin: *
                                  Access-Control-Allow-Headers: *
                                  X-Robots-Tag: noindex
                                  2022-08-05 10:18:09 UTC2INData Raw: 32 62 38 0d 0a 7b 22 69 70 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 33 22 2c 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 74 79 70 65 22 3a 22 49 50 76 34 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 45 75 72 6f 70 65 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 22 45 55 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 75 72 69 63 68 22 2c 22 72 65 67 69 6f 6e 5f 63 6f 64 65 22 3a 22 5a 48 22 2c 22 63 69 74 79 22 3a 22 5a 5c 75 30 30 66 63 72 69 63 68 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 34 37 2e 33 37 36 38 38 36 36 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 38 2e 35 34 31 36 39 34 2c 22 69 73 5f 65 75 22 3a 66 61 6c
                                  Data Ascii: 2b8{"ip":"102.129.143.3","success":true,"type":"IPv4","continent":"Europe","continent_code":"EU","country":"Switzerland","country_code":"CH","region":"Zurich","region_code":"ZH","city":"Z\u00fcrich","latitude":47.3768866,"longitude":8.541694,"is_eu":fal


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  2192.168.2.549764142.250.181.238443C:\Program Files\Google\Chrome\Application\chrome.exe
                                  TimestampkBytes transferredDirectionData
                                  2022-08-05 10:18:09 UTC0OUTGET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1
                                  Host: clients2.google.com
                                  Connection: keep-alive
                                  X-Goog-Update-Interactivity: fg
                                  X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm
                                  X-Goog-Update-Updater: chromecrx-85.0.4183.121
                                  Sec-Fetch-Site: none
                                  Sec-Fetch-Mode: no-cors
                                  Sec-Fetch-Dest: empty
                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
                                  Accept-Encoding: gzip, deflate, br
                                  Accept-Language: en-US,en;q=0.9
                                  2022-08-05 10:18:09 UTC2INHTTP/1.1 200 OK
                                  Content-Security-Policy: script-src 'report-sample' 'nonce-Pq2X3CshV--8LJYCG68YPA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
                                  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                  Pragma: no-cache
                                  Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                  Date: Fri, 05 Aug 2022 10:18:09 GMT
                                  Content-Type: text/xml; charset=UTF-8
                                  X-Daynum: 5695
                                  X-Daystart: 11889
                                  X-Content-Type-Options: nosniff
                                  X-Frame-Options: SAMEORIGIN
                                  X-XSS-Protection: 1; mode=block
                                  Server: GSE
                                  Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                  Accept-Ranges: none
                                  Vary: Accept-Encoding
                                  Connection: close
                                  Transfer-Encoding: chunked
                                  2022-08-05 10:18:09 UTC3INData Raw: 33 31 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 39 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 31 31 38 38 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22
                                  Data Ascii: 31b<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5695" elapsed_seconds="11889"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
                                  2022-08-05 10:18:09 UTC4INData Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61
                                  Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
                                  2022-08-05 10:18:09 UTC4INData Raw: 30 0d 0a 0d 0a
                                  Data Ascii: 0


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  3192.168.2.549766195.201.57.90443C:\Program Files\Google\Chrome\Application\chrome.exe
                                  TimestampkBytes transferredDirectionData
                                  2022-08-05 10:18:10 UTC6OUTGET /favicon.ico HTTP/1.1
                                  Host: ipwho.is
                                  Connection: keep-alive
                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
                                  Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8
                                  Sec-Fetch-Site: same-origin
                                  Sec-Fetch-Mode: no-cors
                                  Sec-Fetch-Dest: image
                                  Referer: https://ipwho.is/
                                  Accept-Encoding: gzip, deflate, br
                                  Accept-Language: en-US,en;q=0.9
                                  2022-08-05 10:18:10 UTC6INHTTP/1.1 200 OK
                                  Server: nginx/1.20.2
                                  Date: Fri, 05 Aug 2022 10:18:10 GMT
                                  Content-Type: image/x-icon
                                  Content-Length: 4286
                                  Last-Modified: Sat, 23 Apr 2022 10:36:41 GMT
                                  Connection: close
                                  ETag: "6263d6b9-10be"
                                  Accept-Ranges: bytes
                                  2022-08-05 10:18:10 UTC6INData Raw: 00 00 01 00 01 00 20 20 00 00 01 00 20 00 a8 10 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 10 00 00 13 0b 00 00 13 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc ab b0 00 d8 be c2 03 b8 89 91 27 ab 73 7c 6a c1 99 9f ac f3 eb ec d9 b2 7e 87 f2 9f 60 6a fb 9f 5f 69 f6 9f 5f 69 e9 a1 62 6d cf a3 66 70 a0 a5 68 72 5c a7 6d 77 1d b6 85 8d 01 af 7a 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf 94 9b 00 cb a8 ae 03 ac 74 7d 32 a5 6a 74 92 a1 62 6d de 9c 5a 65 fb b9 8a 92 ff ee e2 e4 ff a5 69 73 ff 9b 59 64 ff 9c
                                  Data Ascii: ( @ 's|j~`j_i_ibmfphr\mwzt}2jtbmZeisYd
                                  2022-08-05 10:18:10 UTC10INData Raw: 9a 57 62 ff 9a 57 62 ff 9c 5b 66 e7 bc 90 97 80 ff ff ff 13 fb f8 f9 00 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 67 71 00 9b 58 63 00 9d 5b 66 4c 9e 5e 69 e7 c4 9c a3 ff e6 d5 d8 ff e0 cb cf ff b3 80 89 fe a8 6e 78 dd f0 e6 e8 e4 c2 99 a0 fd 9a 56 62 ff ae 77 80 ff f0 e6 e8 ff b5 84 8c ff 9b 58 63 ff 9c 5a 65 ff 9c 5a 65 ff 9c 5a 65 ff 9c 5a 65 fa 9d 5b 66 da 9e 5e 69 90 a4 67 71 32 b2 80 88 02 ac 74 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 61 6b 00 a4 68 71 02 9d 5b 66 4e 9c 5a 65 c7 a1 63 6d fb 9f 60 6a f2 9b 59 64 a6 a9 70 79 2e f4 ec ed 30 b4 82 8b 7a a7 6c 76 bc a8 6e 77 e7 e5 d4 d7 fc d7 bd c2 ff 9e 5d 68 ff a1 62 6c fb a0 61 6c dd 9e 5d 68 a6 9e 5d 67
                                  Data Ascii: WbWb[fgqXc[fL^inxVbwXcZeZeZeZe[f^igq2t}akhq[fNZecm`jYdpy.0zlvnw]hblal]h]g


                                  Statistics

                                  CPU Usage

                                  Click to jump to process

                                  Memory Usage

                                  Click to jump to process

                                  High Level Behavior Distribution

                                  Click to dive into process behavior distribution

                                  Behavior

                                  Click to jump to process

                                  System Behavior

                                  General

                                  Target ID:0
                                  Start time:12:18:03
                                  Start date:05/08/2022
                                  Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  Wow64 process (32bit):false
                                  Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
                                  Imagebase:0x7ff6a7220000
                                  File size:2150896 bytes
                                  MD5 hash:C139654B5C1438A95B321BB01AD63EF6
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:low

                                  General

                                  Target ID:1
                                  Start time:12:18:05
                                  Start date:05/08/2022
                                  Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  Wow64 process (32bit):false
                                  Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,8637681438283644612,4347384113639239081,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
                                  Imagebase:0x7ff6a7220000
                                  File size:2150896 bytes
                                  MD5 hash:C139654B5C1438A95B321BB01AD63EF6
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:low

                                  General

                                  Target ID:2
                                  Start time:12:18:06
                                  Start date:05/08/2022
                                  Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  Wow64 process (32bit):false
                                  Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ipwho.is
                                  Imagebase:0x7ff6a7220000
                                  File size:2150896 bytes
                                  MD5 hash:C139654B5C1438A95B321BB01AD63EF6
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:low

                                  Disassembly

                                  ⊘No disassembly