Malware Analysis Report

2025-01-03 09:27

Sample ID 240604-w9mkjsff8t
Target http://dl.360safe.com/inst_gf_popup_ev.exe
Tags
bootkit discovery persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

Threat Level: Likely malicious

The file http://dl.360safe.com/inst_gf_popup_ev.exe was found to be: Likely malicious.

Malicious Activity Summary

bootkit discovery persistence

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks for any installed AV software in registry

Writes to the Master Boot Record (MBR)

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

NTFS ADS

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Modifies registry class

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-04 18:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-04 18:37

Reported

2024-06-04 18:52

Platform

win11-20240426-en

Max time kernel

900s

Max time network

812s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://dl.360safe.com/inst_gf_popup_ev.exe

Signatures

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A

Checks for any installed AV software in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80 C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Launcher C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80 C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Launcher C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A

Checks installed software on the system

discovery

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133619998602170779" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings C:\Program Files\Google\Chrome\Application\chrome.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\inst_gf_popup_ev.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A
N/A N/A C:\Users\Admin\Downloads\inst_gf_popup_ev.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2964 wrote to memory of 4056 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4056 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 1480 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2964 wrote to memory of 4720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://dl.360safe.com/inst_gf_popup_ev.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd7d89ab58,0x7ffd7d89ab68,0x7ffd7d89ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1776,i,16137296110213439899,1615636172773616594,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1776,i,16137296110213439899,1615636172773616594,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2192 --field-trial-handle=1776,i,16137296110213439899,1615636172773616594,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2800 --field-trial-handle=1776,i,16137296110213439899,1615636172773616594,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2924 --field-trial-handle=1776,i,16137296110213439899,1615636172773616594,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4268 --field-trial-handle=1776,i,16137296110213439899,1615636172773616594,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4656 --field-trial-handle=1776,i,16137296110213439899,1615636172773616594,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4780 --field-trial-handle=1776,i,16137296110213439899,1615636172773616594,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 --field-trial-handle=1776,i,16137296110213439899,1615636172773616594,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3640 --field-trial-handle=1776,i,16137296110213439899,1615636172773616594,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=920 --field-trial-handle=1776,i,16137296110213439899,1615636172773616594,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1816 --field-trial-handle=1776,i,16137296110213439899,1615636172773616594,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4748 --field-trial-handle=1776,i,16137296110213439899,1615636172773616594,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1716 --field-trial-handle=1776,i,16137296110213439899,1615636172773616594,131072 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\inst_gf_popup_ev.exe

"C:\Users\Admin\Downloads\inst_gf_popup_ev.exe"

C:\Users\Admin\Downloads\inst_gf_popup_ev.exe

"C:\Users\Admin\Downloads\inst_gf_popup_ev.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 dl.360safe.com udp
US 104.192.108.20:80 dl.360safe.com tcp
US 104.192.108.20:80 dl.360safe.com tcp
US 104.192.108.20:80 dl.360safe.com tcp
N/A 224.0.0.251:5353 udp
CN 171.8.167.89:80 s.360.cn tcp
CN 171.8.167.89:80 s.360.cn tcp
CN 180.163.237.185:80 inf.safe.360.cn tcp
CN 171.8.167.89:80 s.360.cn tcp
CN 171.8.167.89:80 s.360.cn tcp
CN 180.163.237.185:80 inf.safe.360.cn tcp

Files

\??\pipe\crashpad_2964_PXMCNRELXNBVAHKN

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 6faa51717d55e96ae216b13d6ed91ec4
SHA1 476f107804a61297bef81c75fa9584490ea5e43c
SHA256 e3d47d9b198774f425a6dd316d86b5a2dd296692ea356a98dd70ed890e217a9d
SHA512 c08c33a44516a23dbabc8c73853297fe3c0d23386f0f5b4132e2e0f4e97c2cac45581896901fe07403af33c6f288a6d534ab66f66d819e01a4cc189c95f86e2a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fd834ca8-6f16-4327-9f6d-2adda7be9506.tmp

MD5 b2f98ff8fe96df87997ad021bba48d58
SHA1 2f49d9b08775dcd65907152672e42b445fb968f1
SHA256 0e36186197f79ac06036f8682191f16381f1453f40a43f6f8f9132bc8905a698
SHA512 8f0620c34f8c119069e713096348095d0c58579822321904ea36a77ff3a52c4d05644c7f95b24f421f77ebef87fe9c7ee39eaad6d000d54fcecc731e255fff31

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 1c5f2e4e10a0efce4205e89e92ceb947
SHA1 164e759284af32efc63c977c255c82ebe86b4b90
SHA256 5e69089158679e1224c65c0f70cc08dc94ab0a20deae92d24ed65eb7d420cb49
SHA512 425680f4eb10833ed47a0501829ac0225e256051aba00b529584cc6ae89cbb89e115541070c53b6f80a774c7b81f704017c681b6d69223a4ef4b83fde3c34f7a

C:\Users\Admin\Downloads\inst_gf_popup_ev.exe:Zone.Identifier

MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cb72fbe55311d1e1ee6b66005246eae9
SHA1 d361029d0b49e799438223d8c88009a3966ce68b
SHA256 db191a4b697714609811e5c45df37b13aca4d3f1db68470f728d96316f7cd150
SHA512 3dbd762aded1a9c051a98418f97b07245d949a63f5619816dfcb86ca1ec0d784cf5caa8aa4a57d418a5ee09b3ebe2bd88856ac0acc804de08e6275171deba646

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 abebac4661580a986995041cb5584942
SHA1 e7515a4a64a1c1a4a4f04a038c29e333661eec86
SHA256 9c44d58b6c2abcb5c824d95a462dffdffb9f747c45a4418b4d33d4561484c05b
SHA512 afeb7bc64dfd1bbdbfbc263046c3206b9e34253c231d233bf83d1729192cf090ef2a640f49e40f6ffe58dbb38b635156b46bc5eda9d80cc028caee1b473a3d82

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe60e14c.TMP

MD5 b1c8400d16bda6063708e9a8043a048d
SHA1 7b61106315da4df62ebf5e20f83464bc1ffeeb00
SHA256 33b29c7125b9c9b17cab2c66c2e26247ac94e0eb00f40e0818d6c71dd9cc18b7
SHA512 5f65973a9da5e9da9d516b3bae1cdcc28514d9cbf7abf5673578ee24424f483b3a4f545a0624840a20de818037ff79829f389085a154768613ea46d2bf0fb6c7

memory/1472-122-0x0000000004580000-0x0000000004581000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{0FC68E63-5763-44ea-B93B-9AFCDCA6BA69}.tmp

MD5 ea47d98dd9cb1772a409c11b818a9a02
SHA1 02a952f3aa72a61a113c9d7ebae18da86e2cc500
SHA256 f9e81781a3484a6732b03b3a22a0388db03b4311be2874abbee276bd9e82c854
SHA512 cbdedbafc598d75fb4b854db4bfb376363c801dca4bd7d8c79df784cb5402f48a8aaa64899ad4d75f2d40a6625db37d2a5cbc8fbc3696d7ceac6c938fbd31788

C:\Users\Admin\AppData\Local\Temp\{190FAB0E-603E-4f1d-8A44-EA28FF0F5D8A}.tmp\MiniUI.dll

MD5 5123c3b8adeb6192d5a6b9dc50c867b1
SHA1 6d142074a21aa50c240ce57ca19a61e104bbdf41
SHA256 273ce954c8d33abaac3a0fd8546719f09718c1d91317ecf5b99181dffa3fe26a
SHA512 067305a8f09c480fe4a4c8609638c9a490c4ebe2782bd13c10b380df14f76d4748eb785f44e7bcb86514718f99d07c3c6a4b43928a294b18020cb0fa589ee2a0

C:\Users\Admin\AppData\Local\Temp\{343EC146-9EF6-4bad-A54C-75DFD5F250FD}.tmp\miniui.xml

MD5 af1cd79ef667fb3cd3b5cc49337bd89d
SHA1 63dc8f9bb045c663c47ed095a83fe9de62d41e43
SHA256 0678544adb8067160d76bffe15a80cde62885b1c58a557a21525a79917b3cdae
SHA512 8c6acb109e78444da76f3523c9c08ddb885f8cd67edb773e700da0f586273de6866b83c5a9f30884c24564cacf50dda67dae5c678718113d2a253461e134bbc6

C:\Users\Admin\AppData\Local\Temp\{343EC146-9EF6-4bad-A54C-75DFD5F250FD}.tmp\defaultskin.ui

MD5 6dcabf11b96d17c091c6f323210e75be
SHA1 d5ea4f30b7b0121558bf563c18d4e6188766f75d
SHA256 032aad4ff08378a0c4dd98533a6c99a41a8ba2ce006df71817d529e670835d6a
SHA512 b7cda99125285f5401e1109d935a4f6a7217ab5442555e274f0044c15b727e720dc11441000916558539395f637579270fe9f4e0a862948645e236f595d46a23

C:\Users\Admin\AppData\Local\Temp\{51A51B1A-CAF0-4add-8FE4-0FFA01040F22}.tmp\360Base.dll

MD5 7e519aca128e7c13921ff1ce28c6f464
SHA1 16aeb633ba8bc52c8fee2187d307b9389a78824e
SHA256 b4348c968e41541a849fd7ec54a059330157598fc34437c4356875ba76fa4a5d
SHA512 7d7b1f3b55721812c9265acd7005cf1d1709f1003a1c198f8ab2f1ade5391900559ba12aa274c900415b0d4d0c02441a21498eee3c712897074834fa83f59934

C:\Users\Admin\AppData\Local\Temp\{51A51B1A-CAF0-4add-8FE4-0FFA01040F22}.tmp\CrashReport.dll

MD5 361ee0170374127e396e7ab4d839bdb3
SHA1 44430877438ca137b0386de1223349b8e86a3270
SHA256 bb393ebae1fd656b019cd086c05fcece979405c4616989bfdde6d60044d08b8d
SHA512 617b80214537675a5964f0cbc3d8e5bec53afb7ce8c5a7de18ad4ea9389767294c11407f85c72a08dd400020ed06f37e6898c85bcea74c06e9d43f84cc4caafa

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 5681ab9f051445aca4f52810e6458fca
SHA1 3584734af2fe572821e6edfff3b15bd9ca1adab7
SHA256 f7905042eeaec70d92977aaf28d9834556a557d6cefde0e29850caefe031794f
SHA512 b744aec0a60b5a05ecfe19d4f66cc2684a5eb3f8eeaab0ef0d4cff65003525abafb719c64ec3c393a0a82962bfc19966d09ad94184ae16226a5a1d68cfe00357

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5 17e633cd90e243637209d783cc11e3cc
SHA1 e04cd5346367a7e279f8d55c305d049fab71f303
SHA256 d3d51decec9289997d5e4e14677ef81a1fc90f1be78a78bbce2afca69e132c3e
SHA512 27d66dee7237f56c37f2c83e8b79d2995decd9a31cd083365f9d8105655a26e4b11adea23b97fc6a778b7109fa0edaaa74c3a281c528a014089b099acd049fe1

C:\Users\Admin\AppData\Local\Temp\{0CCB37F4-6D35-4c9a-BA09-99C2ED71BA71}.tmp

MD5 16510e0379708d5d7a94f3ab20cea425
SHA1 9ea8e35b960b0a6d920f6f7ed255f66543cc29a4
SHA256 88d035748bc2c294c2be4b021504a02efa132b4d725aad0201c4f196d5243875
SHA512 35e9288bf22bd5f2b45503e762ec236035951514d8df27b4e6e1126f5423f43759f99ef0cd442d65ed4f4bd74595f24312bea529c34998f98c70dd3d22b4168d

C:\Users\Admin\AppData\Local\Temp\{9376132C-D14F-4fbc-8D03-CB5CA3FD4BA0}.tmp\Register.xml

MD5 4f0c40029890740c6cb55f6fdcc226e2
SHA1 e092da21b076d433b168d121efab344eaa6bb530
SHA256 018fd1bf992296f70af5ce69c77e1aca3ce18544b7cb804e74cc406ea42a56e3
SHA512 2e4d5860256f6fd5b0c42968ec8a1961e47038d4bff630fe9b053745cb7e40a836c8c799158d2ff100d2e58de2e87fcda5626949e4d8382374a756ad40fa5e6d

C:\Users\Admin\AppData\Local\Temp\{9376132C-D14F-4fbc-8D03-CB5CA3FD4BA0}.tmp\360safe.setup

MD5 1d37b9273410ac6b9fd06b56d589a185
SHA1 80aef0d07db9b4dc5ee92843b093b0629000e75f
SHA256 a311e1e1d2cc503509afb237e7499b3c3839661c5d48ce17f00b666e7aec9d22
SHA512 e5857fae2e394c464b34d78fd97b04421c7a541029a9eabc0590bb5774d5b39a76874565e693156bdf998716183e0b18982116598a5829101af1113cfe199788

C:\Users\Admin\AppData\Local\Temp\{9376132C-D14F-4fbc-8D03-CB5CA3FD4BA0}.tmp\UninstallRootDirFileList.xml

MD5 3f2fcc037ae18642d1051f4ecd8d4810
SHA1 8f150031ef8e3f7b41d53c0bb46040c762a105e6
SHA256 67bb2ed2a241e1cef9d228689559e6b9399194a53f20e215348fe2afffdf89b7
SHA512 23d9b218bbc5627befc773926cc481fee5afb748f998c13b60134d0a1c1b84b30b989c22ab1058ac6c4e6ee8f16672fa87958f9bfb595ba0c58e80b4d92992c3

C:\Users\Admin\AppData\Local\Temp\{9376132C-D14F-4fbc-8D03-CB5CA3FD4BA0}.tmp\Plugin.xml

MD5 fa2ec42acbd9e1f68b73fe635e8ff7fe
SHA1 b5418d0bbb177338a23c5eebd272aab7991f2f5a
SHA256 adfda45a7e3d5b34967c421c0cbffe3bef219519f947eb74a68ea33e33863ee6
SHA512 ea7e4a7af086330b027663a899a9560f72eb500a631712fd086e90ec91de3dacf496805ab9ec501ffde3f9f291fbf39138dc6925b5f2b2643f06e7bfbbafa1f9

C:\Users\Admin\AppData\Local\Temp\{37A338B7-2CAF-485b-BEAA-0E9A798B939C}.tmp\360SafeAssist.exe

MD5 2e1c7c69bea7a3a0022adc6a966395ca
SHA1 1d750d40ea40a44192f1af0a7734119e1c49a34f
SHA256 b9d6e08a1d75f3b5a86ce0d68cc57556ccec9eefddea0588da36db4bbfab6b0e
SHA512 ff42c3a5587d88864f7692715019733e8e24de0f28c0643d5b952408c4700d7927a0833ae4fedd284fdd8edeb425450980f9dcb21c9fbf7c4d811636a5d3e51c

C:\Users\Admin\AppData\Local\Temp\{9376132C-D14F-4fbc-8D03-CB5CA3FD4BA0}.tmp\filelist.xml

MD5 2e8146106616e010d3c0eb0f691f2449
SHA1 383d2dcafc66d397806817ffec77b4ad61bc217a
SHA256 dbfc4540c073b062ef4a28058cbf7ecced33da847061d679c30a169c8e4b5a60
SHA512 21f2a02d3c2b06edea24d186a2e86dc88b1875e1d53ca9324ebb61f06a492dfc21ef3bc94bcd345a0d82c68d7eb7fa47dbca9220f2b0ce22c985ceae1e7f20eb

C:\Users\Admin\AppData\Roaming\360Safe\360safe.setup.log

MD5 c9519746eb05f691ceb96cb454fa7788
SHA1 841eadb20401768e3c208ab906d8db020345a075
SHA256 00f5a4d20dfefab3c6e05f662fff68bf73ffd67e63f63e5bd7b51c55f1e9e4a6
SHA512 8cb44c6c41406f40d7256875fd3a10b14d924963624cdbb37aa9812a62a072013a3decc413ae8b537dae96602e74c428fff828bcc6d44074073da9dc9f45bda5