Analysis Overview
Threat Level: Known bad
The file https://lucky-cougar-41.loca.lt/ was found to be: Known bad.
Malicious Activity Summary
PlugX
PlugX Rat Payload
Executes dropped EXE
Reads user/profile data of web browsers
Loads dropped DLL
Checks installed software on the system
Program crash
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-03-30 11:28
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-03-22 19:16
Reported
2022-03-22 19:47
Platform
win7-20220311-en
Max time kernel
784s
Max time network
1703s
Command Line
Signatures
PlugX
PlugX Rat Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Checks installed software on the system
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://lucky-cougar-41.loca.lt/
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6784f50,0x7fef6784f60,0x7fef6784f70
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1336 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1128 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1656 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2084 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2576 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2768 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3136 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3344 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3268 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3272 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3468 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2128 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3828 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3032 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3652 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3880 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3856 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3420 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=816 /prefetch:8
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=N8AwvILc40PtYnHadvK9L3nv/W02ZoJDhr8pT12Z --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=NewCleanerUIExperiment
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=99.279.200 --initial-client-data=0x160,0x164,0x168,0x134,0x16c,0x13fed25a0,0x13fed25b0,0x13fed25c0
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_1948_EDDICEFRPRCVFCBT" --sandboxed-process-id=2 --init-done-notifier=480 --sandbox-mojo-pipe-token=3967543177419805457 --mojo-platform-channel-handle=444 --engine=2
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_1948_EDDICEFRPRCVFCBT" --sandboxed-process-id=3 --init-done-notifier=640 --sandbox-mojo-pipe-token=6210474021088273157 --mojo-platform-channel-handle=636
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3904 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1700 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1008 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3912 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3848 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=540 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3048 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=540 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=540 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3420 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3548 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,2619114167398271138,8808320389191004193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lucky-cougar-41.loca.lt | udp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| NL | 142.251.36.45:443 | accounts.google.com | udp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| NL | 142.250.179.174:443 | clients2.google.com | udp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| NL | 142.251.36.45:443 | accounts.google.com | tcp |
| NL | 142.250.179.174:443 | clients2.google.com | tcp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| US | 8.8.8.8:53 | edgedl.me.gvt1.com | udp |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.8.8:443 | dns.google | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:443 | dns.google | udp |
| NL | 172.217.168.193:443 | udp | |
| NL | 172.217.168.193:443 | tcp | |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| NL | 142.250.179.131:443 | ssl.gstatic.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.4.4:443 | dns.google | udp |
| NL | 142.250.179.163:443 | update.googleapis.com | tcp |
| US | 8.8.8.8:443 | dns.google | udp |
| US | 8.8.8.8:443 | dns.google | tcp |
| US | 8.8.8.8:443 | dns.google | tcp |
| US | 8.8.8.8:443 | dns.google | tcp |
| US | 8.8.8.8:443 | dns.google | tcp |
| US | 8.8.8.8:443 | dns.google | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| US | 8.8.8.8:443 | dns.google | udp |
| NL | 142.250.179.202:443 | safebrowsing.googleapis.com | tcp |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| US | 8.8.8.8:443 | dns.google | udp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:443 | dns.google | udp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| US | 8.8.8.8:443 | dns.google | udp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:443 | dns.google | udp |
| NL | 142.250.179.163:443 | udp |
Files
\??\pipe\crashpad_1472_AUDJFFJQHRQQRIET
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
| MD5 | 3dcd45838971b3e51d01e62c09d36e08 |
| SHA1 | 9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a |
| SHA256 | d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81 |
| SHA512 | 6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
| MD5 | 3dcd45838971b3e51d01e62c09d36e08 |
| SHA1 | 9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a |
| SHA256 | d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81 |
| SHA512 | 6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
| MD5 | 3dcd45838971b3e51d01e62c09d36e08 |
| SHA1 | 9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a |
| SHA256 | d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81 |
| SHA512 | 6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
| MD5 | 3dcd45838971b3e51d01e62c09d36e08 |
| SHA1 | 9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a |
| SHA256 | d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81 |
| SHA512 | 6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa |
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
| MD5 | 2c59f3a13078af9aa0dff399035bd33e |
| SHA1 | 6aa287295b922575369a2c750dd426f0d2d51ba3 |
| SHA256 | 2cb1017193ba4e22abeb0be0ddd4c7b1dcd7014c7e5c4071e0c5be100f539e6a |
| SHA512 | f6243b73b39816ff1ce21b4ff322e9eb83ce8b4207a626faa2bb4dfbc50ccba949b6ebbb3e76f140758d1d780d4410e883e29ea5575c359ce45247f3cae51ee4 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
| MD5 | 3dcd45838971b3e51d01e62c09d36e08 |
| SHA1 | 9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a |
| SHA256 | d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81 |
| SHA512 | 6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa |
memory/2244-79-0x000000013FED7000-0x000000013FED8000-memory.dmp
memory/2244-77-0x000000013FED7000-0x000000013FED8000-memory.dmp
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\edls_64.dll
| MD5 | e9a7c44d7bda10b5b7a132d46fcdaf35 |
| SHA1 | 5217179f094c45ba660777cfa25c7eb00b5c8202 |
| SHA256 | 35351366369a7774f9f30f38dc8aa3cd5e087acd8eae79e80c24526cd40e95a1 |
| SHA512 | e76308eee65bf0bf31e58d754e07b63092a4109ef3d44df7b746da99d44be6112bc5f970123c4e82523b6d301392e09c2cfc490e304550b42d152cdb0757e774 |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em000_64.dll
| MD5 | d0cf72186dbaea05c5a5bf6594225fc3 |
| SHA1 | 0e69efd78dc1124122dd8b752be92cb1cbc067a1 |
| SHA256 | 225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907 |
| SHA512 | 8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285 |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em001_64.dll
| MD5 | 7adcb76ec34d774d1435b477e8625c47 |
| SHA1 | ec4ba0ad028c45489608c6822f3cabb683a07064 |
| SHA256 | a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d |
| SHA512 | c1af669ee971b4f4a3bb057fe423a63376cfc19026650036b29d77fed73458d235889a662ac5e12c871c3e77f6fbdb1fa29c0dfa488a4a40fa045d79eb61e7c4 |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em002_64.dll
| MD5 | 5913dc18fc2a5dd49ba064655ac75c24 |
| SHA1 | d941ea7f6a7aa6c8b7dbc65fa37b6bf41dcd9069 |
| SHA256 | 090b958bd2806e2571198847fad60ba446282b783d2da44efe3a879d0507701f |
| SHA512 | d71edd1d2a5fa643f22fe0947c5910cf6b796845f6a782dd8503907babce49055175010296fbd890ff9ce0b3dd5df7ebfe7b8fb079c0ae4b7e562099d6e84197 |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em003_64.dll
| MD5 | ced50723c5ae960adfd3fc726b34cdb1 |
| SHA1 | 962a477d168b786b3d1a301793ab91e1a850f376 |
| SHA256 | 5a9dc132339862cc79f38c1b17db4c0fafa58eec396608ac1583784f1b3b6532 |
| SHA512 | ad70cac1f0a65362f4c2d1c221564c23fc2beecc9842aeb513a1448f2820d987e014af0557a30d50ae136d0bea83b8254ba871937576d3097fce567add578bee |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em004_64.dll
| MD5 | 6e1f355a54cf57047647beb9f5aca079 |
| SHA1 | 529f42911634143507f28d4ea0b6757d6f17af65 |
| SHA256 | 10a6c06788b110c0bfd26603d1dc4e3aec48ba917d4d80dac9fb34f83808eee6 |
| SHA512 | 5ca0bbd9d2337c2e0019969725e904c1ab829dde36d4b35235cc6175d86996dabd2542914d7be0378ed298b758c9e542e059107db8ab7e3de424ac48b8d3aa74 |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em005_64.dll
| MD5 | 169a2ef320119891cf3189aa3fd23b0e |
| SHA1 | de51c936101ef79bbc0f1d3c800cf832d221eef8 |
| SHA256 | 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780 |
| SHA512 | 7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca |
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em000_64.dll
| MD5 | d0cf72186dbaea05c5a5bf6594225fc3 |
| SHA1 | 0e69efd78dc1124122dd8b752be92cb1cbc067a1 |
| SHA256 | 225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907 |
| SHA512 | 8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285 |
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em001_64.dll
| MD5 | 7adcb76ec34d774d1435b477e8625c47 |
| SHA1 | ec4ba0ad028c45489608c6822f3cabb683a07064 |
| SHA256 | a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d |
| SHA512 | c1af669ee971b4f4a3bb057fe423a63376cfc19026650036b29d77fed73458d235889a662ac5e12c871c3e77f6fbdb1fa29c0dfa488a4a40fa045d79eb61e7c4 |
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em003_64.dll
| MD5 | ced50723c5ae960adfd3fc726b34cdb1 |
| SHA1 | 962a477d168b786b3d1a301793ab91e1a850f376 |
| SHA256 | 5a9dc132339862cc79f38c1b17db4c0fafa58eec396608ac1583784f1b3b6532 |
| SHA512 | ad70cac1f0a65362f4c2d1c221564c23fc2beecc9842aeb513a1448f2820d987e014af0557a30d50ae136d0bea83b8254ba871937576d3097fce567add578bee |
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em005_64.dll
| MD5 | 169a2ef320119891cf3189aa3fd23b0e |
| SHA1 | de51c936101ef79bbc0f1d3c800cf832d221eef8 |
| SHA256 | 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780 |
| SHA512 | 7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca |
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em002_64.dll
| MD5 | 5913dc18fc2a5dd49ba064655ac75c24 |
| SHA1 | d941ea7f6a7aa6c8b7dbc65fa37b6bf41dcd9069 |
| SHA256 | 090b958bd2806e2571198847fad60ba446282b783d2da44efe3a879d0507701f |
| SHA512 | d71edd1d2a5fa643f22fe0947c5910cf6b796845f6a782dd8503907babce49055175010296fbd890ff9ce0b3dd5df7ebfe7b8fb079c0ae4b7e562099d6e84197 |
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em004_64.dll
| MD5 | 6e1f355a54cf57047647beb9f5aca079 |
| SHA1 | 529f42911634143507f28d4ea0b6757d6f17af65 |
| SHA256 | 10a6c06788b110c0bfd26603d1dc4e3aec48ba917d4d80dac9fb34f83808eee6 |
| SHA512 | 5ca0bbd9d2337c2e0019969725e904c1ab829dde36d4b35235cc6175d86996dabd2542914d7be0378ed298b758c9e542e059107db8ab7e3de424ac48b8d3aa74 |
memory/2544-115-0x000000013FED7000-0x000000013FED8000-memory.dmp
memory/2544-113-0x000000013FED7000-0x000000013FED8000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
| MD5 | 3dcd45838971b3e51d01e62c09d36e08 |
| SHA1 | 9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a |
| SHA256 | d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81 |
| SHA512 | 6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa |
C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
| MD5 | 92ba1a28c5823bdca2d4607ca802def5 |
| SHA1 | 4f2bfa346245d0d7429fb6b13e4d74512f607a62 |
| SHA256 | 004ed0f12ec99910c529d37560fb3ddaa5cf06adbef073bff99bbbee96d48cbc |
| SHA512 | 32379351b08c08fc69da43b11819064268385c62b98aaf46b35857445bbb1b95b9efd70e5a2bb6595ff921165fc407e7924791ec7b1a6b1297ecd3e9c4050295 |
\??\pipe\crashpad_1948_EDDICEFRPRCVFCBT
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
| MD5 | 2c59f3a13078af9aa0dff399035bd33e |
| SHA1 | 6aa287295b922575369a2c750dd426f0d2d51ba3 |
| SHA256 | 2cb1017193ba4e22abeb0be0ddd4c7b1dcd7014c7e5c4071e0c5be100f539e6a |
| SHA512 | f6243b73b39816ff1ce21b4ff322e9eb83ce8b4207a626faa2bb4dfbc50ccba949b6ebbb3e76f140758d1d780d4410e883e29ea5575c359ce45247f3cae51ee4 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
| MD5 | 3dcd45838971b3e51d01e62c09d36e08 |
| SHA1 | 9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a |
| SHA256 | d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81 |
| SHA512 | 6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa |
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\edls_64.dll
| MD5 | e9a7c44d7bda10b5b7a132d46fcdaf35 |
| SHA1 | 5217179f094c45ba660777cfa25c7eb00b5c8202 |
| SHA256 | 35351366369a7774f9f30f38dc8aa3cd5e087acd8eae79e80c24526cd40e95a1 |
| SHA512 | e76308eee65bf0bf31e58d754e07b63092a4109ef3d44df7b746da99d44be6112bc5f970123c4e82523b6d301392e09c2cfc490e304550b42d152cdb0757e774 |
memory/2244-123-0x0000000000220000-0x0000000000221000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-03-22 19:16
Reported
2022-03-22 19:47
Platform
win10-20220223-en
Max time kernel
1690s
Max time network
1696s
Command Line
Signatures
PlugX
PlugX Rat Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Checks installed software on the system
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\WerFault.exe | \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://lucky-cougar-41.loca.lt/
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffaf2ee4f50,0x7ffaf2ee4f60,0x7ffaf2ee4f70
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1668 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1556 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2932 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3984 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4216 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4484 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4476 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4864 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3104 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4288 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4924 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4932 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2488 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=164 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5208 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4532 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1660 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1424 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5636 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4084 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5672 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4480 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4568 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4624 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4476 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4908 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4900 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4932 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4480 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5600 /prefetch:8
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=x97EVL17j3fZU8+1GUdRBuzN0MFA5v6TcSfbKg/1 --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=NewCleanerUIExperiment
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4280 /prefetch:8
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=99.279.200 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff7f54325a0,0x7ff7f54325b0,0x7ff7f54325c0
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_3252_RRIFYHUCTLBOHGMO" --sandboxed-process-id=2 --init-done-notifier=728 --sandbox-mojo-pipe-token=3123479233616420633 --mojo-platform-channel-handle=684 --engine=2
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_3252_RRIFYHUCTLBOHGMO" --sandboxed-process-id=3 --init-done-notifier=928 --sandbox-mojo-pipe-token=1765266329866651826 --mojo-platform-channel-handle=924
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5128 /prefetch:8
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1156 -s 696
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1924 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1532,16739831072530488156,110279301709270745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4908 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| NL | 142.251.36.45:443 | accounts.google.com | udp |
| NL | 142.250.179.174:443 | clients2.google.com | udp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| NL | 142.251.36.45:443 | accounts.google.com | tcp |
| NL | 142.250.179.174:443 | clients2.google.com | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.4.4:443 | dns.google | udp |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 172.217.168.193:443 | udp | |
| NL | 172.217.168.193:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.4.4:443 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:443 | dns.google | udp |
| NL | 142.250.179.163:443 | update.googleapis.com | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| US | 151.101.1.229:443 | cdn.jsdelivr.net | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| NL | 142.250.179.163:443 | udp | |
| US | 8.8.8.8:443 | dns.google | udp |
| NL | 142.250.179.202:443 | safebrowsing.googleapis.com | tcp |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.4.4:443 | dns.google | udp |
| NL | 142.250.179.163:443 | udp | |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.4.4:443 | dns.google | udp |
| NL | 142.250.179.163:443 | udp |
Files
\??\pipe\crashpad_3608_JLWOEJWLOKTSQOMV
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
| MD5 | 3dcd45838971b3e51d01e62c09d36e08 |
| SHA1 | 9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a |
| SHA256 | d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81 |
| SHA512 | 6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
| MD5 | 3dcd45838971b3e51d01e62c09d36e08 |
| SHA1 | 9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a |
| SHA256 | d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81 |
| SHA512 | 6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa |
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
| MD5 | f951d82568673d58aaa455efe977ced6 |
| SHA1 | d790bde9fbcf61c4cdfefd8fbb31ba17f240f254 |
| SHA256 | 99c026e64b732736d3ed71791fd2995e5bab4b52dfc99fdad6655061d6275608 |
| SHA512 | f72875ac449a5e4ab4a68bed751f7603fbd1bc5e77fbe0bd746b7d2338ff88b0687dd1944e53e1a1f0364b2001aa8e053bb1fff358bffa149aeaa563c2536aeb |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
| MD5 | 3dcd45838971b3e51d01e62c09d36e08 |
| SHA1 | 9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a |
| SHA256 | d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81 |
| SHA512 | 6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa |
memory/1156-127-0x00007FFAFEC10000-0x00007FFAFEC11000-memory.dmp
memory/1156-126-0x00007FFAFEC70000-0x00007FFAFEC71000-memory.dmp
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
| MD5 | f951d82568673d58aaa455efe977ced6 |
| SHA1 | d790bde9fbcf61c4cdfefd8fbb31ba17f240f254 |
| SHA256 | 99c026e64b732736d3ed71791fd2995e5bab4b52dfc99fdad6655061d6275608 |
| SHA512 | f72875ac449a5e4ab4a68bed751f7603fbd1bc5e77fbe0bd746b7d2338ff88b0687dd1944e53e1a1f0364b2001aa8e053bb1fff358bffa149aeaa563c2536aeb |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\edls_64.dll
| MD5 | e9a7c44d7bda10b5b7a132d46fcdaf35 |
| SHA1 | 5217179f094c45ba660777cfa25c7eb00b5c8202 |
| SHA256 | 35351366369a7774f9f30f38dc8aa3cd5e087acd8eae79e80c24526cd40e95a1 |
| SHA512 | e76308eee65bf0bf31e58d754e07b63092a4109ef3d44df7b746da99d44be6112bc5f970123c4e82523b6d301392e09c2cfc490e304550b42d152cdb0757e774 |
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
| MD5 | f951d82568673d58aaa455efe977ced6 |
| SHA1 | d790bde9fbcf61c4cdfefd8fbb31ba17f240f254 |
| SHA256 | 99c026e64b732736d3ed71791fd2995e5bab4b52dfc99fdad6655061d6275608 |
| SHA512 | f72875ac449a5e4ab4a68bed751f7603fbd1bc5e77fbe0bd746b7d2338ff88b0687dd1944e53e1a1f0364b2001aa8e053bb1fff358bffa149aeaa563c2536aeb |
\??\pipe\crashpad_3252_RRIFYHUCTLBOHGMO
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
| MD5 | 97aee534d094600f4ed6602771750e01 |
| SHA1 | f2912fc5f75d6beb8dd70cbe35874974c44ca758 |
| SHA256 | ad82adca16b381fbba003c045bfcc1c466e61c291dc23a8f4c77a4e77b005928 |
| SHA512 | 0d7f18366edf0e6d60455513dc71695c800647505552ca9b81c02695345ed0d3487e4c13302ee751b87783ebead3222dd61dbe3feff15ac917722b703c7383d4 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
| MD5 | 3dcd45838971b3e51d01e62c09d36e08 |
| SHA1 | 9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a |
| SHA256 | d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81 |
| SHA512 | 6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa |
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em004_64.dll
| MD5 | 6e1f355a54cf57047647beb9f5aca079 |
| SHA1 | 529f42911634143507f28d4ea0b6757d6f17af65 |
| SHA256 | 10a6c06788b110c0bfd26603d1dc4e3aec48ba917d4d80dac9fb34f83808eee6 |
| SHA512 | 5ca0bbd9d2337c2e0019969725e904c1ab829dde36d4b35235cc6175d86996dabd2542914d7be0378ed298b758c9e542e059107db8ab7e3de424ac48b8d3aa74 |
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em002_64.dll
| MD5 | 5913dc18fc2a5dd49ba064655ac75c24 |
| SHA1 | d941ea7f6a7aa6c8b7dbc65fa37b6bf41dcd9069 |
| SHA256 | 090b958bd2806e2571198847fad60ba446282b783d2da44efe3a879d0507701f |
| SHA512 | d71edd1d2a5fa643f22fe0947c5910cf6b796845f6a782dd8503907babce49055175010296fbd890ff9ce0b3dd5df7ebfe7b8fb079c0ae4b7e562099d6e84197 |
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em005_64.dll
| MD5 | 169a2ef320119891cf3189aa3fd23b0e |
| SHA1 | de51c936101ef79bbc0f1d3c800cf832d221eef8 |
| SHA256 | 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780 |
| SHA512 | 7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca |
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em003_64.dll
| MD5 | ced50723c5ae960adfd3fc726b34cdb1 |
| SHA1 | 962a477d168b786b3d1a301793ab91e1a850f376 |
| SHA256 | 5a9dc132339862cc79f38c1b17db4c0fafa58eec396608ac1583784f1b3b6532 |
| SHA512 | ad70cac1f0a65362f4c2d1c221564c23fc2beecc9842aeb513a1448f2820d987e014af0557a30d50ae136d0bea83b8254ba871937576d3097fce567add578bee |
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em001_64.dll
| MD5 | 7adcb76ec34d774d1435b477e8625c47 |
| SHA1 | ec4ba0ad028c45489608c6822f3cabb683a07064 |
| SHA256 | a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d |
| SHA512 | c1af669ee971b4f4a3bb057fe423a63376cfc19026650036b29d77fed73458d235889a662ac5e12c871c3e77f6fbdb1fa29c0dfa488a4a40fa045d79eb61e7c4 |
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\em000_64.dll
| MD5 | d0cf72186dbaea05c5a5bf6594225fc3 |
| SHA1 | 0e69efd78dc1124122dd8b752be92cb1cbc067a1 |
| SHA256 | 225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907 |
| SHA512 | 8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285 |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em005_64.dll
| MD5 | 169a2ef320119891cf3189aa3fd23b0e |
| SHA1 | de51c936101ef79bbc0f1d3c800cf832d221eef8 |
| SHA256 | 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780 |
| SHA512 | 7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em004_64.dll
| MD5 | 6e1f355a54cf57047647beb9f5aca079 |
| SHA1 | 529f42911634143507f28d4ea0b6757d6f17af65 |
| SHA256 | 10a6c06788b110c0bfd26603d1dc4e3aec48ba917d4d80dac9fb34f83808eee6 |
| SHA512 | 5ca0bbd9d2337c2e0019969725e904c1ab829dde36d4b35235cc6175d86996dabd2542914d7be0378ed298b758c9e542e059107db8ab7e3de424ac48b8d3aa74 |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em003_64.dll
| MD5 | ced50723c5ae960adfd3fc726b34cdb1 |
| SHA1 | 962a477d168b786b3d1a301793ab91e1a850f376 |
| SHA256 | 5a9dc132339862cc79f38c1b17db4c0fafa58eec396608ac1583784f1b3b6532 |
| SHA512 | ad70cac1f0a65362f4c2d1c221564c23fc2beecc9842aeb513a1448f2820d987e014af0557a30d50ae136d0bea83b8254ba871937576d3097fce567add578bee |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em002_64.dll
| MD5 | 5913dc18fc2a5dd49ba064655ac75c24 |
| SHA1 | d941ea7f6a7aa6c8b7dbc65fa37b6bf41dcd9069 |
| SHA256 | 090b958bd2806e2571198847fad60ba446282b783d2da44efe3a879d0507701f |
| SHA512 | d71edd1d2a5fa643f22fe0947c5910cf6b796845f6a782dd8503907babce49055175010296fbd890ff9ce0b3dd5df7ebfe7b8fb079c0ae4b7e562099d6e84197 |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em001_64.dll
| MD5 | 7adcb76ec34d774d1435b477e8625c47 |
| SHA1 | ec4ba0ad028c45489608c6822f3cabb683a07064 |
| SHA256 | a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d |
| SHA512 | c1af669ee971b4f4a3bb057fe423a63376cfc19026650036b29d77fed73458d235889a662ac5e12c871c3e77f6fbdb1fa29c0dfa488a4a40fa045d79eb61e7c4 |
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\em000_64.dll
| MD5 | d0cf72186dbaea05c5a5bf6594225fc3 |
| SHA1 | 0e69efd78dc1124122dd8b752be92cb1cbc067a1 |
| SHA256 | 225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907 |
| SHA512 | 8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
| MD5 | 3dcd45838971b3e51d01e62c09d36e08 |
| SHA1 | 9884fc2f1ed03043d5a6aa5f59625b7a0cad4c2a |
| SHA256 | d7081c02c19718ed94ef3154ede0d045c50ba7d9e7653b7b5c589ac1a0b36f81 |
| SHA512 | 6e2b5e3b75bd872bd01c6b8feaea76aea733f75320e4b88877ef1aae061d37ac0de82943502c2c575f67dcd77961bba506d5f16489bd33b8aa621e472fe648fa |
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\edls_64.dll
| MD5 | e9a7c44d7bda10b5b7a132d46fcdaf35 |
| SHA1 | 5217179f094c45ba660777cfa25c7eb00b5c8202 |
| SHA256 | 35351366369a7774f9f30f38dc8aa3cd5e087acd8eae79e80c24526cd40e95a1 |
| SHA512 | e76308eee65bf0bf31e58d754e07b63092a4109ef3d44df7b746da99d44be6112bc5f970123c4e82523b6d301392e09c2cfc490e304550b42d152cdb0757e774 |
memory/1156-153-0x000001B784D50000-0x000001B784D51000-memory.dmp
memory/1156-154-0x000001B784C80000-0x000001B784C81000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2022-03-22 19:16
Reported
2022-03-22 19:47
Platform
win10v2004-20220310-en
Max time kernel
1811s
Max time network
1752s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections | C:\Windows\System32\svchost.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://lucky-cougar-41.loca.lt/
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff2e0a4f50,0x7fff2e0a4f60,0x7fff2e0a4f70
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1704 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1996 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2416 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4048 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5048 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5208 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4464 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4360 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4420 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5056 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4064 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4448 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4172 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4448 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4392 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=664 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4680 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1060 /prefetch:8
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5332 /prefetch:8
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4680 /prefetch:8
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2388 /prefetch:8
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4412 /prefetch:8
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,12208858377826216006,16184601871157031093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4936 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| NL | 178.79.208.1:80 | tcp | |
| US | 93.184.220.29:80 | tcp | |
| US | 93.184.220.29:80 | tcp | |
| US | 20.42.65.90:443 | tcp | |
| US | 8.8.8.8:53 | crl4.digicert.com | udp |
| US | 93.184.220.29:80 | crl4.digicert.com | tcp |
| US | 8.8.8.8:53 | licensing.mp.microsoft.com | udp |
| US | 20.96.63.25:443 | licensing.mp.microsoft.com | tcp |
| US | 8.8.8.8:53 | storesdk.dsx.mp.microsoft.com | udp |
| NL | 104.80.225.205:443 | storesdk.dsx.mp.microsoft.com | tcp |
| US | 93.184.220.29:80 | crl4.digicert.com | tcp |
| US | 8.8.8.8:53 | licensing.mp.microsoft.com | udp |
| US | 20.96.63.25:443 | licensing.mp.microsoft.com | tcp |
| US | 20.96.63.25:443 | licensing.mp.microsoft.com | tcp |
| US | 20.96.63.25:443 | licensing.mp.microsoft.com | tcp |
| US | 93.184.220.29:80 | crl4.digicert.com | tcp |
| US | 93.184.220.29:80 | crl4.digicert.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | lucky-cougar-41.loca.lt | udp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| NL | 142.250.179.174:443 | clients2.google.com | udp |
| NL | 142.251.36.45:443 | accounts.google.com | udp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:443 | dns.google | tcp |
| US | 8.8.8.8:443 | dns.google | tcp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| US | 8.8.8.8:443 | dns.google | udp |
| CA | 193.34.76.44:443 | lucky-cougar-41.loca.lt | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 172.217.168.193:443 | udp | |
| NL | 172.217.168.193:443 | tcp | |
| NL | 142.250.179.131:443 | ssl.gstatic.com | tcp |
| US | 8.8.8.8:443 | dns.google | tcp |
| US | 8.8.8.8:443 | dns.google | tcp |
| US | 8.8.8.8:443 | dns.google | udp |
| US | 8.8.8.8:443 | dns.google | udp |
| NL | 142.250.179.163:443 | update.googleapis.com | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.4.4:443 | dns.google | udp |
| NL | 142.250.179.202:443 | safebrowsing.googleapis.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| NL | 104.123.41.133:80 | tcp | |
| NL | 104.123.41.133:80 | tcp | |
| NL | 104.110.191.140:80 | tcp | |
| NL | 104.110.191.140:80 | tcp | |
| NL | 104.110.191.140:80 | tcp | |
| NL | 104.123.41.133:80 | tcp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| US | 8.8.4.4:443 | dns.google | udp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:443 | dns.google | udp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:443 | dns.google | udp |
| NL | 142.250.179.163:443 | udp | |
| US | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| NL | 142.250.179.163:443 | udp |
Files
memory/4984-134-0x00000195BFF70000-0x00000195BFF80000-memory.dmp
memory/4984-135-0x00000195C0860000-0x00000195C0870000-memory.dmp
memory/4984-136-0x00000195C0BF0000-0x00000195C0BF4000-memory.dmp
\??\pipe\crashpad_1064_WXNPSSPVWWMJHVQX
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Temp\chrome_BITS_1064_290821534\khaoiebndkojlmppeemjhbpbandiljpe_48_win_ccfl2wvh5b5bfuztfguafrvlpm.crx3
| MD5 | e8fae5f775b15f88fd410e6c9b23c0c4 |
| SHA1 | 149151e2ad212b1a529ca40c5e5510adbd8bba84 |
| SHA256 | 5f1c8af8a15da419e629cc50d85e7326cda080bd1f7df8ac38a16b98e0a2739b |
| SHA512 | 6d9999f4a2fe6101cb08c1be0299e73c5de7cba756caa4e628d18f80fd8e3243442af6bebdc96bd4c8ce32e24c54f81bc573a12368d8c6b8d826467f58b9baa0 |
C:\Users\Admin\AppData\Local\Temp\chrome_BITS_1064_264856050\ALzUVHP-vRgKCzqwbtGugSE
| MD5 | 0bf5369cda2102f7a1f1fec9ae6f69ff |
| SHA1 | 1a6b9c07dd6cf2aa5d969499ddff8a0dfc15e86c |
| SHA256 | fd515ec0dc30d25a09641b8b83729234bc50f4511e35ce17d24fd996252eaace |
| SHA512 | 39c131142cecb88eedf7f74bac4dfbc50c1de88f3ffd10d1cca79b154a95c59d6f09c78580367e39dbc648fa0a87a74a4e9a336d691f68388e43b7e2efd40f71 |
C:\Users\Admin\AppData\Local\Temp\chrome_BITS_1064_1152499724\0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx
| MD5 | b92bbcfd3c31f799c5863d78154db555 |
| SHA1 | 86b1b058e1e7d2f1f35e830db446b59e15670e5e |
| SHA256 | 6f6bc93dcd62dc251850d2ff458fda96083ceb7fbe8eeb11248b8485ef2aea23 |
| SHA512 | 38be0c179619c045a321d1fa2c67dda8419a33075a87f548feed9a858f5ba19b5b980c53d4a3bb5b745c7ce566b53773785aa1f7677e37dd5793ccae76e83787 |
C:\Users\Admin\AppData\Local\Temp\chrome_BITS_1064_2053125997\jflookgnkcckhobaglndicnbbgbonegd_2787_all_acgnvv6n3hacb3n4e4czianutfka.crx3
| MD5 | fe78c6753cc2bdb3613881d5f32e2b62 |
| SHA1 | aad2684de63a8a923163082ddfe8d5dd02e94ed2 |
| SHA256 | a9316b83adecfbb08b86a942afa6a9dd27ac46decf77d0301482e99166d139c0 |
| SHA512 | 613dae6d1a5ce2e77d342f5c450ddffa74e60bd57feac5c49c1fddd622dea351771f64c152030916a5ff1f0125bfd3a49e3a04f998af6330cd283099a6060da5 |
memory/4984-143-0x00000195C31B0000-0x00000195C31B4000-memory.dmp
memory/4984-144-0x00000195C31B0000-0x00000195C31B4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\chrome_BITS_1064_1842171432\aapLKTSZ439A-0g3nqJr3Q
| MD5 | 5e2ec48715685943e1d278ead69f5ec9 |
| SHA1 | a96964084338ebcd2a0375f81777dea88ed2d8d0 |
| SHA256 | 70497f45af368f6d591eb9b93a097b7b56821b0770ee00f04b2f5901487a0421 |
| SHA512 | 6deaf5fd5456d0493cf8731a97e664bad1e7b00ffc73c099fc0df346e9468d450453d3baf10b18e4061a81b7d1f87cac12425ba7b18160a61c8d0318dc1d0122 |
C:\Users\Admin\AppData\Local\Temp\chrome_BITS_1064_282721150\obedbbhbpmojnkanicioggnmelmoomoc_20220222.432047118_all_ENUS500000_hbwjwk7bommr565nn72etjdnwe.crx3
| MD5 | a75cd4f42d1c9dbdaf22b31e06c0fe44 |
| SHA1 | dfea9712224315d809cf432b1d84128dfa11ada5 |
| SHA256 | 191e8d0245ef4a9e9fac8966c175ae9b3943d70cfe949de9e33d3c6a19b7c840 |
| SHA512 | d7b54e94a2a42697a7b25fb287fae12d7342acde89a482dd00c37edbe5234f2c8f899732dd519a0fdff15c1f04cb21bbd618e78df4102e61878aad22a8826449 |
memory/4984-147-0x00000195C31E0000-0x00000195C31E4000-memory.dmp
memory/4984-148-0x00000195C31D0000-0x00000195C31D1000-memory.dmp
memory/4984-149-0x00000195C2E20000-0x00000195C2E24000-memory.dmp
memory/4984-150-0x00000195C2E10000-0x00000195C2E11000-memory.dmp
memory/4984-151-0x00000195C2E10000-0x00000195C2E14000-memory.dmp
memory/4984-152-0x00000195C0B10000-0x00000195C0B11000-memory.dmp
C:\ProgramData\Microsoft\Network\Downloader\edb.chk
| MD5 | 1951bfd31ac7398bad69936bd0f71a6f |
| SHA1 | 4a96d017891ed56906d37e7ea9c68ed9b4c77431 |
| SHA256 | 570300280d7d28c35a0c33772414f5be165aa650ffe7497e8c9e319509eb2463 |
| SHA512 | 04e8ac8c966ca6bfb33f7527f3e0640d4b0a9d4b0a16a8990728835f069b83112bd26fef20052fbd43d02ab09a0050d7be5454ef7561873b01c3d018120abcda |
C:\ProgramData\Microsoft\Network\Downloader\edb.log
| MD5 | ce727a9270ffef37909be15314df42fb |
| SHA1 | 96fc258dfede2006eec8b49aa0d14aba667c8779 |
| SHA256 | bedd5fac9037356a8cd45b271e8fd4ed0de8da2e4af72b37b2ac0b321c197493 |
| SHA512 | cd9210f3621cc20794f2d3f54b17c4b97d2411c7537f8345bb7c8b7ba5eddb750275415f77e6129daf7aa4807b63eb06ff9391b62f95f56108d152e7085a20ac |
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
| MD5 | e373bbce26310c92e3995132a3241d7c |
| SHA1 | 1686462007181579b744e7fab619f5dd8a91b85f |
| SHA256 | 989db0a273c8314cdd89b0516d983fc2f559dee62de5f0dc94b65b7732f6c5ac |
| SHA512 | 5676f51ba575f00aa3b20967d80179adbd38f546a48d47e28e6574045e93212aa58576f67b5e144284bb4c2b6820c93d41d0e6f5ea5105255367ec0e9d8b7a9c |
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
| MD5 | d20bd9e96e02bc836371b17607b06748 |
| SHA1 | 0748bef3cf918d2c0836d772c3a3ed6a91e98f26 |
| SHA256 | 0b83b190953dac1ac4663f5cd786bc728b59cc5791290a7373a4d7ee2f5cac6c |
| SHA512 | 7edb56d1bade40d5f69cab08f3dd0a858258d0c835b2a83058b7347191a9a27518721d27b75efe2d87a22fb4caee87676235f02dd9ae0db6de262289f21f5640 |
memory/808-159-0x000002F37B140000-0x000002F37B144000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\chrome_BITS_1064_166771327\EWvH2e-LS80S29cxzuTfRA
| MD5 | d7d63288830d5930f435d6841de6de5a |
| SHA1 | a2afc39ac8fd17fa88030ba8b48d9d8ee93c24d5 |
| SHA256 | c64c9c1008f3ba5f6e18b3ca524bc98dcd8acfae0a2720a8f1f3ef0f8d643d05 |
| SHA512 | d4d85fd16a291474f99a6fa9cc76d5432f5865fa0d76e4185ff5ab775045122cdab771e88da8fc317a059ab901373644b2e7251d31c4fa2c389d9b7584351e20 |
memory/808-161-0x000002F37B430000-0x000002F37B434000-memory.dmp
memory/808-162-0x000002F37B420000-0x000002F37B421000-memory.dmp
memory/808-164-0x000002F37B160000-0x000002F37B161000-memory.dmp
memory/808-163-0x000002F37B180000-0x000002F37B184000-memory.dmp
memory/808-165-0x000002F37B160000-0x000002F37B164000-memory.dmp
memory/808-166-0x000002F37B060000-0x000002F37B061000-memory.dmp
C:\ProgramData\Microsoft\Network\Downloader\edb.chk
| MD5 | 616d45ec9d5ca2c9522dfa3b23add5b0 |
| SHA1 | a7f151ce0a091b224dc1d00de2210f838d683254 |
| SHA256 | 3d8ca239f15e6dd1f8aca038c26868101f7c10fcd6c85bc6080c0db83cab8c20 |
| SHA512 | c8abb07b5cc5354e99bda5b75e0684624aa7bc72a011c61021ae5970a8ce8abed06aa64a2060af3370215a9335310548e5581dcc734aeeb7fcdb5ae35680081e |
C:\ProgramData\Microsoft\Network\Downloader\edb.log
| MD5 | ec15827e4a670bf881b7de5704f6c590 |
| SHA1 | 5c8c5bd42faa710807e11739c0309e9c18050737 |
| SHA256 | 54f4c5b0b96888ee1b400e23013b4651245edb11ef7baa10e92f9e93e88a03f1 |
| SHA512 | cb532704a30f319f056eeec02a823507d708d143321a6820f697a67edffb3baafd1127973bcfb03d1c0ed66c9a5ccb04875b3198f33986722ad4b3e9a029692f |
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
| MD5 | 7214948a2950ff2083b205a8006399b1 |
| SHA1 | 383fccf4f58ff12ae82621271da3620cc02baffa |
| SHA256 | c07508951faac3b5f1958291aca9aaff3c31d786912d830a5fa2bcb7866c78fe |
| SHA512 | 5c951ab441a9fe442cd08b7aab93a81f0928565c44ac5585cfff6bc54cbebbf9180478cd45a861f20a0e8c41e91a356798841676f160b5e8879fd3878057fc30 |
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
| MD5 | a08d922db207703303e6cf74c690e97c |
| SHA1 | 548cc427dc2581615fe89706ae8059c2cac86cf5 |
| SHA256 | 7321c4308e6678a18c6c888760c9b991a9a24a16effc37dcb6584a782e7a9716 |
| SHA512 | 33bdc10d4044d2f4e82c15c72c12b43ea0320da66e5c5b0ddbdd4233e8a7a878502c49e26999293f308d2e05359906a316a5b42b1ea1f063a912ace9435223cf |
memory/4488-173-0x000002C9D3180000-0x000002C9D3184000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\chrome_BITS_1064_1834650257\S3ybLvFx94Hgn9pWLt24ug
| MD5 | 867bf8c831d8385cc3ffa006bc864a22 |
| SHA1 | c0eaed582e36c741c9d904b89ef29954d2852042 |
| SHA256 | b4ddbdce4f8d5c080328aa34c19cb533f2eedec580b5d97dc14f74935e4756b7 |
| SHA512 | 359a39916d9cfa6c24ac0c5b152945297a84106bf03aacf69e0439ddc70118adc5ae4a5e26efe9e111c3f26381a7418d9e49a117cd6fd00aedf0a410b9dd8218 |
memory/4488-175-0x000002C9D5680000-0x000002C9D5684000-memory.dmp
memory/4488-176-0x000002C9D5670000-0x000002C9D5671000-memory.dmp
memory/4488-177-0x000002C9D31B0000-0x000002C9D31B4000-memory.dmp
memory/4488-178-0x000002C9D31A0000-0x000002C9D31A1000-memory.dmp
memory/4488-179-0x000002C9D31A0000-0x000002C9D31A4000-memory.dmp
memory/4488-180-0x000002C9D30A0000-0x000002C9D30A1000-memory.dmp
C:\ProgramData\Microsoft\Network\Downloader\edb.chk
| MD5 | 5a4bbbafa584cc6868d44014086adfe8 |
| SHA1 | 27389b5c5a2e39d9bbd8297029243bf2afb42d81 |
| SHA256 | c7dd5862854ca2625e11ab28191f3ff0a0b098e812112df415b7f698b626d714 |
| SHA512 | 342d7fb724aa24ac588e8d53b61b366b5e6edb55c9cb21966871a69368aa97b22a1d40f0520d44d059e911ba00b5fc5daeaebc1695a080fe3b502ed20d058d24 |
C:\ProgramData\Microsoft\Network\Downloader\edb.log
| MD5 | 9b00ff34b15f46d8fcf7c9d9697edc25 |
| SHA1 | d1d1a6ce27427478931ff8c54ebbec8fbb365479 |
| SHA256 | 9a8c8adc3ea6bc3ca1220e557bcb741c81540adfd1db32a4dea41cd0887aff24 |
| SHA512 | a2ace0f12c9f9be41bf9317101c09109a7b98f782d28e7cb11ea6cc1a1c4651df8b53050da46f588d2f2e89fdba8a073626b06081ffcb63fa8845fd8a3c21fb6 |
memory/1104-187-0x000002B87EF20000-0x000002B87EF24000-memory.dmp
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
| MD5 | 679ac78d2cd25bcbd736cc7970dd2d13 |
| SHA1 | 4dfe7fef59940e09b0ef14556e0d800218ce0f0e |
| SHA256 | a202a554ce2fbaba50643cf9da84438bd474642a772c8bed8673ea52b66a0048 |
| SHA512 | 0a66f6e23e4c343c5373fd18ec483e4de8f73d8fb67fc9e0eb52f6252f5e4c982e0de30542a75fe706e08980eae69bd7ffca4ad01bc2910a22626a6729a7c34f |
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
| MD5 | 2735a2120d7a82a6a64bfad28a0afb60 |
| SHA1 | ced5b42386f0661de1ded0f142e8d7cf30786855 |
| SHA256 | 46029a0dfcaef20ef8297a9f4d8142b084d9ef76759283dbcb715e582305625f |
| SHA512 | 396f33c79eeb776f38cd080fd3f6b7b47f1228ccf8b40060feb1bdae87fdb310ef362e6ee30835757848d1dc708d25601d78ea6dc54ddd4b9fc3cc87b5ac85a8 |
C:\Users\Admin\AppData\Local\Temp\chrome_BITS_1064_922796438\jamhcnnkihinmdlkakkaopbjbbcngflc_102.0.4958.0_all_n3hnsh7yej72ofx72klbtx3d3i.crx3
| MD5 | 938e336351fcebcc655faee85feb3c56 |
| SHA1 | 166b7479bd80f791985168dfb57e10bb79d8d3cf |
| SHA256 | 10bf5d922ee95e12076f19e1039aa992fc96fdf31c2e4a13d0f198c731473024 |
| SHA512 | aa22c382f01350ee3fa744ad6c6bdd26d857e10d1b3f74eb6f5850608004437d8ef1652d83f93074d9b98f131e7fd5be2055c3225f86323f82c1d8d3a18aa0ac |
memory/1104-189-0x000002B87F230000-0x000002B87F234000-memory.dmp
memory/1104-190-0x000002B87F220000-0x000002B87F221000-memory.dmp
memory/1104-191-0x000002B87EF50000-0x000002B87EF54000-memory.dmp
memory/1104-192-0x000002B87EF40000-0x000002B87EF41000-memory.dmp
memory/1104-193-0x000002B87EF40000-0x000002B87EF44000-memory.dmp
memory/1104-194-0x000002B87EE40000-0x000002B87EE41000-memory.dmp
C:\ProgramData\Microsoft\Network\Downloader\edb.chk
| MD5 | 2e3e994ace6b5d522d2939913bf7a408 |
| SHA1 | 9c0515199db830383a0341b603a6193abc0f0dc7 |
| SHA256 | 1595e96ab3bd228c5b6196370cb6caa70fe5502a5d525b18dc3aaaf023b11058 |
| SHA512 | 05a07478e16d2121825aa937ab4281d69b4a62d5c0e3127c8548a20ae005f64fc23d209297a741054e337234b73e9d9d7b8ac8f3eee85e5268a0edbe6dd0bfa6 |
C:\ProgramData\Microsoft\Network\Downloader\edb.log
| MD5 | 0a602c62169518393ec8e0df8658ecdb |
| SHA1 | 46e3cec1d32fb6919ed5cb4440ab75da1461eb13 |
| SHA256 | 90e9daf558931577b4bec8ba6632af3ba9d11e15a134f46cb8d5eb3832f619d1 |
| SHA512 | 8aabaea5cd119da2647c43e8c825b17682dca297a3fb013cbe51e46a39e4f9e42d7c142a66135ffd559c1a44d56bdb3816056b7e4b64cc5ccce4b1497381ebfe |
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
| MD5 | beebf61354924d9ec6e9073d7eea36e9 |
| SHA1 | 5cde183f27d8f9637d0cb7e2ae8e2f4d9ee49759 |
| SHA256 | 73f5d54fafb95c6e4c7a97c51dd0eedd1f3d6b25740620c5d4163b1d01d447e8 |
| SHA512 | 253e28451764ef64efb4512c483757ec9816f62933b754b635241a43dee78613d92256cb3d7bc271c4821666217b952ed4b619125b71acb882e44a062a9dcbff |
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
| MD5 | 1c98407a226db64dac26bffdbcaf0106 |
| SHA1 | 98091557ddca761574a6f3420f73be38415b709c |
| SHA256 | 8e5a1b0448b23cbe148474ed9b2fb6115c7e0231d8b744292f6243ca198d134f |
| SHA512 | c7448948eacfa948c6089f843137c8a41e6e3908274c682ffa345891cb2354aaa77b116d30f3c0d58f1638509df3c326d36dc9d47f786d3dfc03d124a4883d8e |
memory/3472-201-0x000001FE86C80000-0x000001FE86C84000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\chrome_BITS_1064_380504156\anGnv31dmOJhheXBnYQ3gw
| MD5 | 5a576555382cdbd3070937971e3052a2 |
| SHA1 | 644a9ef25ecf72f65d4cdd8fc68a6c48ca839350 |
| SHA256 | 478aa915e78878e332a0b4bb4d2a6fb67ff1c7f7b62fe906f47095ba5ae112d0 |
| SHA512 | 265881bd1e9e58069fb0c205897d1e9682cfd05d38d8ea5029adf84ff36664f4d91abffc6d5cedf4fc3c817c1da22323225da91c1dd3abe90e96da6fb89bb141 |
memory/3472-203-0x000001FE86F80000-0x000001FE86F84000-memory.dmp
memory/3472-204-0x000001FE86F70000-0x000001FE86F71000-memory.dmp
memory/3472-205-0x000001FE86CB0000-0x000001FE86CB4000-memory.dmp
memory/3472-206-0x000001FE86CA0000-0x000001FE86CA1000-memory.dmp
memory/3472-207-0x000001FE86CA0000-0x000001FE86CA4000-memory.dmp
memory/3472-208-0x000001FE849A0000-0x000001FE849A1000-memory.dmp
C:\ProgramData\Microsoft\Network\Downloader\edb.chk
| MD5 | e72f20c7947e11cf2e7da6d37f8689f2 |
| SHA1 | e92d278f6c2218332dad8f2ffcd4004203246952 |
| SHA256 | ca3ad23874163ed1f16dad2093c976f77ff452bf9463c20afa4e76ab3267aa1d |
| SHA512 | c3b3554365ab4d4433e64a8b471457f88ae7886ac108421a8d41e722e82fdb07c911e87cb66f1581c60bc457cde1705311164bb995ab04f96353a25784294400 |
memory/3664-212-0x00000250F4C00000-0x00000250F4C04000-memory.dmp
memory/3664-213-0x00000250F4F10000-0x00000250F4F14000-memory.dmp
memory/3664-214-0x00000250F4F00000-0x00000250F4F01000-memory.dmp
memory/3664-215-0x00000250F4C30000-0x00000250F4C34000-memory.dmp
memory/3664-216-0x00000250F4C20000-0x00000250F4C21000-memory.dmp
memory/3664-217-0x00000250F4C20000-0x00000250F4C24000-memory.dmp
memory/3664-218-0x00000250F2920000-0x00000250F2921000-memory.dmp
memory/2044-221-0x0000017C1A670000-0x0000017C1A674000-memory.dmp
memory/2044-222-0x0000017C1A980000-0x0000017C1A984000-memory.dmp
memory/2044-223-0x0000017C1A970000-0x0000017C1A971000-memory.dmp
memory/2044-224-0x0000017C1A6A0000-0x0000017C1A6A4000-memory.dmp
memory/2044-225-0x0000017C1A690000-0x0000017C1A691000-memory.dmp
memory/2044-226-0x0000017C1A690000-0x0000017C1A694000-memory.dmp