Program did not start
General Info
- URL
-
https://freefilesync.org/download.php
- Verdict
- Malicious activity
- Analysis date
- 8/13/2019, 23:39:39
- OS:
- Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
- Tags:
-
loader
adware
- Indicators:
Software environment set and analysis options
Launch configuration
- Task duration
- 240 seconds
- Additional time used
- 180 seconds
- Fakenet option
- off
- Heavy Evaision option
- off
- MITM proxy
- off
- Route via Tor
- off
- Network geolocation
- off
- Privacy
- Public submission
- Autoconfirmation of UAC
- on
Software preset
- Internet Explorer 8.0.7601.17514
- Adobe Acrobat Reader DC MUI (15.023.20070)
- Adobe Flash Player 26 ActiveX (26.0.0.131)
- Adobe Flash Player 26 NPAPI (26.0.0.131)
- Adobe Flash Player 26 PPAPI (26.0.0.131)
- Adobe Refresh Manager (1.8.0)
- CCleaner (5.35)
- FileZilla Client 3.36.0 (3.36.0)
- Google Chrome (75.0.3770.100)
- Google Update Helper (1.3.34.7)
- Java 8 Update 92 (8.0.920.14)
- Java Auto Updater (2.8.92.14)
- Microsoft .NET Framework 4.7.2 (4.7.03062)
- Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Professional 2010 (14.0.6029.1000)
- Microsoft Office Proof (English) 2010 (14.0.6029.1000)
- Microsoft Office Proof (French) 2010 (14.0.6029.1000)
- Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
- Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
- Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Single Image 2010 (14.0.6029.1000)
- Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
- Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
- Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
- Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
- Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
- Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
- Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
- Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
- Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
- Mozilla Firefox 68.0.1 (x86 en-US) (68.0.1)
- Notepad++ (32-bit x86) (7.5.1)
- Opera 12.15 (12.15.1748)
- Skype version 8.29 (8.29)
- Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
- VLC media player (2.2.6)
- WinRAR 5.60 (32-bit) (5.60.0)
Hotfixes
- Client LanguagePack Package
- Client Refresh LanguagePack Package
- CodecPack Basic Package
- Foundation Package
- IE Troubleshooters Package
- InternetExplorer Optional Package
- KB2534111
- KB2999226
- KB4019990
- KB976902
- LocalPack AU Package
- LocalPack CA Package
- LocalPack GB Package
- LocalPack US Package
- LocalPack ZA Package
- ProfessionalEdition
- UltimateEdition
Behavior activities
| MALICIOUS | SUSPICIOUS | INFO |
|---|---|---|
Application was dropped or rewritten from another process
|
Creates files in the user directory
|
Manual execution by user
|
Screenshots
Processes
Total processes
76
Monitored processes
35
Malicious processes
7
Suspicious processes
0
Behavior graph
–
+
Specs description
Integrity level
elevation
Task сontains an error
or was rebooted
Process has crashed
Task contains several
apps running
Executable file was
dropped
Debug information is
available
Process was injected
Network attacks were
detected
Application downloaded
the executable file
Actions similar to
stealing personal data
Behavior similar to
exploiting the vulnerability
Inspected object has
sucpicious PE structure
File is detected by
antivirus software
CPU overrun
RAM overrun
Process starts the
services
Process was added to
the startup
Behavior similar to
spam
Low-level access to
the HDD
Probably Tor was used
System was rebooted
Connects to the
network
Known threat
Process information
Click at the process to see the details.
- PID
- 3336
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://freefilesync.org/download.php"
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- Parent process
- ––
- User
- admin
- Integrity Level
- MEDIUM
- Exit code
- 3221225547
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\ole32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\hid.dll |
| c:\windows\system32\propsys.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\d3d11.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\credui.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\winusb.dll |
| c:\windows\system32\msi.dll |
| c:\windows\system32\wevtapi.dll |
| c:\windows\system32\gpapi.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\nlaapi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\dhcpcsvc6.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\mscms.dll |
| c:\windows\system32\winsta.dll |
| c:\windows\system32\wlanapi.dll |
| c:\windows\system32\wlanutil.dll |
| c:\windows\system32\mmdevapi.dll |
| c:\windows\system32\wbem\wbemprox.dll |
| c:\windows\system32\wbemcomn.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\ntmarta.dll |
| c:\windows\system32\wldap32.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\wpc.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\samlib.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\wbem\wbemsvc.dll |
| c:\windows\system32\wbem\fastprox.dll |
| c:\windows\system32\ntdsapi.dll |
| c:\windows\system32\wbem\wmiutils.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\system32\firewallapi.dll |
| c:\windows\system32\kbdus.dll |
| c:\windows\system32\explorerframe.dll |
| c:\windows\system32\duser.dll |
| c:\windows\system32\dui70.dll |
| c:\windows\system32\windowscodecs.dll |
| c:\windows\system32\mswsock.dll |
| c:\windows\system32\wshtcpip.dll |
| c:\windows\system32\linkinfo.dll |
| c:\windows\system32\ehstorshell.dll |
| c:\windows\system32\wship6.dll |
| c:\windows\system32\cscui.dll |
| c:\windows\system32\cscdll.dll |
| c:\windows\system32\cscapi.dll |
| c:\windows\system32\ntshrui.dll |
| c:\windows\system32\slc.dll |
| c:\windows\system32\imageres.dll |
| c:\windows\system32\wbem\wmiperfinst.dll |
| c:\windows\system32\pdh.dll |
| c:\windows\system32\bcryptprimitives.dll |
| c:\windows\system32\imagehlp.dll |
| c:\windows\system32\audioses.dll |
| c:\windows\system32\mssprxy.dll |
| c:\program files\winrar\rarext.dll |
| c:\program files\microsoft office\office14\olkfstub.dll |
| c:\progra~1\micros~1\office14\mlshext.dll |
| c:\program files\microsoft office\office14\onfilter.dll |
| c:\program files\microsoft office\office14\visshe.dll |
| c:\program files\common files\microsoft shared\office14\msoshext.dll |
| c:\program files\microsoft office\office14\msohevi.dll |
| c:\windows\system32\mf.dll |
| c:\windows\system32\shdocvw.dll |
| c:\program files\filezilla ftp client\fzshellext.dll |
| c:\windows\system32\syncui.dll |
| c:\program files\notepad++\nppshell_06.dll |
| c:\program files\windows sidebar\sbdrop.dll |
| c:\windows\system32\stobject.dll |
| c:\windows\system32\cryptext.dll |
| c:\windows\system32\colorui.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\cryptnet.dll |
| c:\windows\system32\cabinet.dll |
| c:\windows\system32\devrtl.dll |
| c:\windows\system32\dnsapi.dll |
| c:\windows\system32\rasapi32.dll |
| c:\windows\system32\rasman.dll |
| c:\windows\system32\rtutils.dll |
| c:\windows\system32\sensapi.dll |
| c:\windows\system32\rasadhlp.dll |
| c:\users\admin\downloads\freefilesync_10.14_windows_setup.exe |
| c:\windows\system32\credssp.dll |
| c:\windows\system32\fwpuclnt.dll |
| c:\windows\system32\sfc.dll |
| c:\windows\system32\sfc_os.dll |
| c:\windows\system32\mpr.dll |
- PID
- 388
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6eafa9d0,0x6eafa9e0,0x6eafa9ec
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- MEDIUM
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 1244
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2360 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- MEDIUM
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\ole32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_watcher.dll |
- PID
- 3140
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=12899424487501656813 --mojo-platform-channel-handle=1052 --ignored=" --type=renderer " /prefetch:2
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\mf.dll |
| c:\windows\system32\atl.dll |
| c:\windows\system32\mfplat.dll |
| c:\windows\system32\avrt.dll |
| c:\windows\system32\ksuser.dll |
| c:\windows\system32\msmpeg2vdec.dll |
| c:\windows\system32\evr.dll |
| c:\windows\system32\powrprof.dll |
| c:\windows\system32\slc.dll |
| c:\windows\system32\sqmapi.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\dxva2.dll |
| c:\windows\system32\d3dcompiler_47.dll |
| c:\windows\system32\ddraw.dll |
| c:\windows\system32\dciman32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\swiftshader\libglesv2.dll |
| c:\program files\google\chrome\application\75.0.3770.100\swiftshader\libegl.dll |
- PID
- 300
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=7539026348040398522 --mojo-platform-channel-handle=1644 /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- MEDIUM
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\nlaapi.dll |
| c:\windows\system32\dhcpcsvc6.dll |
| c:\windows\system32\mswsock.dll |
| c:\windows\system32\wship6.dll |
| c:\windows\system32\rasadhlp.dll |
| c:\windows\system32\dnsapi.dll |
| c:\windows\system32\fwpuclnt.dll |
| c:\windows\system32\wshtcpip.dll |
| c:\windows\system32\gpapi.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\bcryptprimitives.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptnet.dll |
| c:\windows\system32\wldap32.dll |
| c:\windows\system32\ntmarta.dll |
- PID
- 3788
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7751367858273954017 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1984 /prefetch:1
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 2396
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17809649679578948730 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2236 /prefetch:1
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 1016
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17003732074638261184 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1808 /prefetch:1
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 3804
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=519279640582981098 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 3588
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13072397254192025568 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 2768
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=5508921292621854863 --mojo-platform-channel-handle=3280 --ignored=" --type=renderer " /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 2648
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=15991782985851105053 --mojo-platform-channel-handle=3760 --ignored=" --type=renderer " /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 3940
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=17801032383323728581 --mojo-platform-channel-handle=3744 --ignored=" --type=renderer " /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 3184
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=15750968107771370006 --mojo-platform-channel-handle=3888 --ignored=" --type=renderer " /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 2496
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=15980706630273744209 --mojo-platform-channel-handle=3844 --ignored=" --type=renderer " /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 3844
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=10339817474991733487 --mojo-platform-channel-handle=3924 --ignored=" --type=renderer " /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 2224
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=18095663078059807680 --mojo-platform-channel-handle=3484 --ignored=" --type=renderer " /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 1296
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=14250034338541245303 --mojo-platform-channel-handle=4084 /prefetch:2
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- MEDIUM
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\imm32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\mf.dll |
| c:\windows\system32\atl.dll |
| c:\windows\system32\mfplat.dll |
| c:\windows\system32\avrt.dll |
| c:\windows\system32\ksuser.dll |
| c:\windows\system32\msmpeg2vdec.dll |
| c:\windows\system32\evr.dll |
| c:\windows\system32\powrprof.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\slc.dll |
| c:\windows\system32\sqmapi.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\dxva2.dll |
- PID
- 2932
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=15830077754465239973 --mojo-platform-channel-handle=4112 --ignored=" --type=renderer " /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 3312
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=17210296653874415994 --mojo-platform-channel-handle=4108 --ignored=" --type=renderer " /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 1252
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3658751608061578977 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:1
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 3648
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=11716680542413879802 --mojo-platform-channel-handle=2852 /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- MEDIUM
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\propsys.dll |
| c:\windows\system32\ntmarta.dll |
| c:\windows\system32\wldap32.dll |
| c:\windows\system32\linkinfo.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\shdocvw.dll |
| c:\windows\system32\twext.dll |
| c:\windows\system32\cscui.dll |
| c:\windows\system32\cscdll.dll |
| c:\windows\system32\cscapi.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\zipfldr.dll |
| c:\program files\winrar\rarext.dll |
| c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll |
| c:\windows\system32\msimg32.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\windowscodecs.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\system32\ntshrui.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\slc.dll |
| c:\windows\system32\syncui.dll |
| c:\windows\system32\synceng.dll |
| c:\program files\notepad++\nppshell_06.dll |
| c:\windows\system32\acppage.dll |
| c:\windows\system32\sfc.dll |
| c:\windows\system32\sfc_os.dll |
| c:\windows\system32\msi.dll |
| c:\windows\system32\wer.dll |
| c:\windows\system32\devrtl.dll |
| c:\windows\system32\netutils.dll |
- PID
- 3676
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,3826757917758363919,10361257737978075332,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=2566028501586196065 --mojo-platform-channel-handle=484 --ignored=" --type=renderer " /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 3964
- CMD
- "C:\Users\admin\Downloads\FreeFileSync_10.14_Windows_Setup.exe"
- Path
- C:\Users\admin\Downloads\FreeFileSync_10.14_Windows_Setup.exe
- Indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- MEDIUM
- Exit code
- 0
- Version:
- Company
- FreeFileSync.org
- Description
- FreeFileSync Setup
- Version
- 10.14
Modules
| Image |
|---|
| c:\users\admin\downloads\freefilesync_10.14_windows_setup.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\propsys.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\comres.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\ntmarta.dll |
| c:\windows\system32\wldap32.dll |
| c:\windows\system32\shell32.dll |
| c:\users\admin\appdata\local\temp\is-jagsi.tmp\freefilesync_10.14_windows_setup.tmp |
- PID
- 2688
- CMD
- "C:\Users\admin\AppData\Local\Temp\is-JAGSI.tmp\FreeFileSync_10.14_Windows_Setup.tmp" /SL5="$B01EA,13438735,240128,C:\Users\admin\Downloads\FreeFileSync_10.14_Windows_Setup.exe"
- Path
- C:\Users\admin\AppData\Local\Temp\is-JAGSI.tmp\FreeFileSync_10.14_Windows_Setup.tmp
- Indicators
- No indicators
- Parent process
- FreeFileSync_10.14_Windows_Setup.exe
- User
- admin
- Integrity Level
- MEDIUM
- Exit code
- 0
- Version:
- Company
- Description
- Setup/Uninstall
- Version
- 51.1052.0.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\is-jagsi.tmp\freefilesync_10.14_windows_setup.tmp |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\msimg32.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\mpr.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\propsys.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\comres.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\ntmarta.dll |
| c:\windows\system32\wldap32.dll |
- PID
- 332
- CMD
- "C:\Users\admin\Downloads\FreeFileSync_10.14_Windows_Setup.exe" /SPAWNWND=$70224 /NOTIFYWND=$B01EA
- Path
- C:\Users\admin\Downloads\FreeFileSync_10.14_Windows_Setup.exe
- Indicators
- Parent process
- FreeFileSync_10.14_Windows_Setup.tmp
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- FreeFileSync.org
- Description
- FreeFileSync Setup
- Version
- 10.14
Modules
| Image |
|---|
| c:\users\admin\downloads\freefilesync_10.14_windows_setup.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\propsys.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\comres.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\ntmarta.dll |
| c:\windows\system32\wldap32.dll |
| c:\windows\system32\shell32.dll |
| c:\users\admin\appdata\local\temp\is-gkmuq.tmp\freefilesync_10.14_windows_setup.tmp |
- PID
- 3796
- CMD
- "C:\Users\admin\AppData\Local\Temp\is-GKMUQ.tmp\FreeFileSync_10.14_Windows_Setup.tmp" /SL5="$10016A,13438735,240128,C:\Users\admin\Downloads\FreeFileSync_10.14_Windows_Setup.exe" /SPAWNWND=$70224 /NOTIFYWND=$B01EA
- Path
- C:\Users\admin\AppData\Local\Temp\is-GKMUQ.tmp\FreeFileSync_10.14_Windows_Setup.tmp
- Indicators
- Parent process
- FreeFileSync_10.14_Windows_Setup.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- Description
- Setup/Uninstall
- Version
- 51.1052.0.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\is-gkmuq.tmp\freefilesync_10.14_windows_setup.tmp |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\msimg32.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\mpr.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\propsys.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\comres.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\ntmarta.dll |
| c:\windows\system32\wldap32.dll |
| c:\windows\system32\shfolder.dll |
| c:\windows\system32\imageres.dll |
| c:\program files\common files\microsoft shared\ink\tiptsf.dll |
| c:\windows\system32\msftedit.dll |
| c:\users\admin\appdata\local\temp\is-6v92q.tmp\freefilesync.exe |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\explorerframe.dll |
| c:\windows\system32\duser.dll |
| c:\windows\system32\dui70.dll |
| c:\windows\system32\sfc.dll |
| c:\windows\system32\sfc_os.dll |
| c:\windows\system32\devrtl.dll |
| c:\windows\system32\linkinfo.dll |
| c:\windows\system32\ntshrui.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\cscapi.dll |
| c:\windows\system32\slc.dll |
| c:\program files\freefilesync\freefilesync.exe |
| c:\program files\freefilesync\realtimesync.exe |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\credssp.dll |
| c:\windows\system32\mswsock.dll |
| c:\windows\system32\wshqos.dll |
| c:\windows\system32\wshtcpip.dll |
| c:\windows\system32\wship6.dll |
| c:\windows\system32\dnsapi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\rasadhlp.dll |
| c:\windows\system32\fwpuclnt.dll |
| c:\windows\system32\netutils.dll |
- PID
- 2028
- CMD
- "C:\Users\admin\AppData\Local\Temp\is-6V92Q.tmp\FreeFileSync.exe" ffs_installer_convert_jpg_to_bmp "C:\Users\admin\AppData\Local\Temp\is-6V92Q.tmp\img_2.jpg"
- Path
- C:\Users\admin\AppData\Local\Temp\is-6V92Q.tmp\FreeFileSync.exe
- Indicators
- No indicators
- Parent process
- FreeFileSync_10.14_Windows_Setup.tmp
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- FreeFileSync.org
- Description
- FreeFileSync - Folder Comparison and Synchronization
- Version
- 10.14
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\is-6v92q.tmp\freefilesync.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\windowscodecs.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
- PID
- 3188
- CMD
- "C:\Windows\system32\cmd.exe" /c tasklist /FO CSV > "C:\Users\admin\AppData\Local\Temp\is-6V92Q.tmp\tasklist.txt"
- Path
- C:\Windows\system32\cmd.exe
- Indicators
- No indicators
- Parent process
- FreeFileSync_10.14_Windows_Setup.tmp
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Windows Command Processor
- Version
- 6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
| Image |
|---|
| c:\windows\system32\cmd.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\winbrand.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\tasklist.exe |
- PID
- 2092
- CMD
- tasklist /FO CSV
- Path
- C:\Windows\system32\tasklist.exe
- Indicators
- No indicators
- Parent process
- cmd.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Lists the current running tasks
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\tasklist.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\mpr.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\framedynos.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\wbem\wbemprox.dll |
| c:\windows\system32\wbemcomn.dll |
| c:\windows\system32\winsta.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\wbem\wbemsvc.dll |
| c:\windows\system32\wbem\fastprox.dll |
| c:\windows\system32\ntdsapi.dll |
| c:\windows\system32\wbem\wmiutils.dll |
- PID
- 1436
- CMD
- "powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionProcess 'C:\Program Files\FreeFileSync\Bin\*'"
- Path
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
- Indicators
- No indicators
- Parent process
- FreeFileSync_10.14_Windows_Setup.tmp
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 1
- Version:
- Company
- Microsoft Corporation
- Description
- Windows PowerShell
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\windowspowershell\v1.0\powershell.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\atl.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\mscoree.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\propsys.dll |
| c:\windows\system32\ntmarta.dll |
| c:\windows\system32\wldap32.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\shdocvw.dll |
| c:\windows\system32\linkinfo.dll |
| c:\windows\system32\ntshrui.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\cscapi.dll |
| c:\windows\system32\slc.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll |
| c:\windows\system32\version.dll |
| c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll |
| c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system\9e0a3b9b9f457233a335d7fba8f95419\system.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\4bdde288f147e3b3f2c090ecdf704e6d\microsoft.powershell.consolehost.ni.dll |
| c:\windows\assembly\gac_msil\system.management.automation\1.0.0.0__31bf3856ad364e35\system.management.automation.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.management.a#\a8e3a41ecbcc4bb1598ed5719f965110\system.management.automation.ni.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.core\fbc05b5b05dc6366b02b8e2f77d080f1\system.core.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\e112e4460a0c9122de8c382126da4a2f\microsoft.powershell.commands.diagnostics.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuratio#\f02737c83305687a68c088927a6c5a98\system.configuration.install.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.wsman.man#\f1865caa683ceb3d12b383a94a35da14\microsoft.wsman.management.ni.dll |
| c:\windows\assembly\gac_msil\microsoft.wsman.runtime\1.0.0.0__31bf3856ad364e35\microsoft.wsman.runtime.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.transactions\ad18f93fc713db2c4b29b25116c13bd8\system.transactions.ni.dll |
| c:\windows\assembly\gac_32\system.transactions\2.0.0.0__b77a5c561934e089\system.transactions.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\82d7758f278f47dc4191abab1cb11ce3\microsoft.powershell.commands.utility.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\583c7b9f52114c026088bdb9f19f64e8\microsoft.powershell.commands.management.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\6c5bef3ab74c06a641444eff648c0dde\microsoft.powershell.security.ni.dll |
| c:\windows\microsoft.net\framework\v2.0.50727\culture.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.xml\461d3b6b3f43e6fbe6c897d5936e17e4\system.xml.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\system.management.ni.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.directoryser#\45ec12795950a7d54691591c615a9e3c\system.directoryservices.ni.dll |
| c:\windows\system32\shfolder.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\assembly\nativeimages_v2.0.50727_32\system.data\1e85062785e286cd9eae9c26d2c61f73\system.data.ni.dll |
| c:\windows\assembly\gac_32\system.data\2.0.0.0__b77a5c561934e089\system.data.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\microsoft.net\framework\v2.0.50727\mscorjit.dll |
| c:\windows\microsoft.net\framework\v2.0.50727\diasymreader.dll |
| c:\windows\system32\netutils.dll |
- PID
- 2844
- CMD
- "C:\Program Files\FreeFileSync\FreeFileSync.exe" ffs_finalize_installation
- Path
- C:\Program Files\FreeFileSync\FreeFileSync.exe
- Indicators
- No indicators
- Parent process
- FreeFileSync_10.14_Windows_Setup.tmp
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- FreeFileSync.org
- Description
- FreeFileSync - Folder Comparison and Synchronization
- Version
- 10.14
Modules
| Image |
|---|
| c:\program files\freefilesync\freefilesync.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\apphelp.dll |
| c:\program files\freefilesync\bin\freefilesync_win32.exe |
- PID
- 3380
- CMD
- "C:\Program Files\FreeFileSync\Bin\FreeFileSync_Win32.exe" ffs_finalize_installation
- Path
- C:\Program Files\FreeFileSync\Bin\FreeFileSync_Win32.exe
- Indicators
- No indicators
- Parent process
- FreeFileSync.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- FreeFileSync.org
- Description
- FreeFileSync - Folder Comparison and Synchronization
- Version
- 10.14
Modules
| Image |
|---|
| c:\program files\freefilesync\bin\freefilesync_win32.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\powrprof.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\mpr.dll |
| c:\windows\system32\vssapi.dll |
| c:\windows\system32\atl.dll |
| c:\windows\system32\vsstrace.dll |
| c:\windows\system32\propsys.dll |
| c:\windows\system32\msimg32.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\mswsock.dll |
| c:\windows\system32\wship6.dll |
| c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll |
| c:\windows\system32\windowscodecs.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\imageres.dll |
| c:\windows\system32\iconcodecservice.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\imagehlp.dll |
| c:\windows\system32\bcryptprimitives.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\gpapi.dll |
| c:\users\admin\appdata\local\temp\is-gkmuq.tmp\freefilesync_10.14_windows_setup.tmp |
| c:\users\admin\downloads\freefilesync_10.14_windows_setup.exe |
- PID
- 2828
- CMD
- "C:\Program Files\FreeFileSync\FreeFileSync.exe"
- Path
- C:\Program Files\FreeFileSync\FreeFileSync.exe
- Indicators
- No indicators
- Parent process
- ––
- User
- admin
- Integrity Level
- MEDIUM
- Version:
- Company
- FreeFileSync.org
- Description
- FreeFileSync - Folder Comparison and Synchronization
- Version
- 10.14
Modules
| Image |
|---|
| c:\program files\freefilesync\freefilesync.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\apphelp.dll |
- PID
- 3652
- CMD
- "C:\Program Files\FreeFileSync\Bin\FreeFileSync_Win32.exe"
- Path
- C:\Program Files\FreeFileSync\Bin\FreeFileSync_Win32.exe
- Indicators
- Parent process
- FreeFileSync.exe
- User
- admin
- Integrity Level
- MEDIUM
- Version:
- Company
- FreeFileSync.org
- Description
- FreeFileSync - Folder Comparison and Synchronization
- Version
- 10.14
Modules
| Image |
|---|
| c:\program files\freefilesync\bin\freefilesync_win32.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\comdlg32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\powrprof.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\mpr.dll |
| c:\windows\system32\vssapi.dll |
| c:\windows\system32\atl.dll |
| c:\windows\system32\vsstrace.dll |
| c:\windows\system32\propsys.dll |
| c:\windows\system32\msimg32.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\mswsock.dll |
| c:\windows\system32\wship6.dll |
| c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll |
| c:\windows\system32\windowscodecs.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\imageres.dll |
| c:\windows\system32\iconcodecservice.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\msisip.dll |
| c:\windows\system32\wshext.dll |
| c:\windows\system32\windowspowershell\v1.0\pwrshsip.dll |
| c:\windows\system32\imagehlp.dll |
| c:\windows\system32\bcryptprimitives.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\gpapi.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\linkinfo.dll |
| c:\windows\system32\ntmarta.dll |
| c:\windows\system32\wldap32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dnsapi.dll |
| c:\windows\system32\normaliz.dll |
| c:\windows\system32\schannel.dll |
| c:\windows\system32\rasapi32.dll |
| c:\windows\system32\rasman.dll |
| c:\windows\system32\rtutils.dll |
| c:\windows\system32\sensapi.dll |
| c:\windows\system32\nlaapi.dll |
| c:\windows\system32\rasadhlp.dll |
| c:\windows\system32\wshtcpip.dll |
| c:\windows\system32\fwpuclnt.dll |
| c:\windows\system32\credssp.dll |
| c:\windows\system32\secur32.dll |
| c:\program files\common files\microsoft shared\ink\tiptsf.dll |
| c:\windows\system32\explorerframe.dll |
| c:\windows\system32\duser.dll |
| c:\windows\system32\dui70.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\xmllite.dll |
| c:\windows\system32\msftedit.dll |
| c:\windows\system32\msls31.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\searchfolder.dll |
| c:\windows\system32\structuredquery.dll |
| c:\windows\system32\mssprxy.dll |
| c:\windows\system32\thumbcache.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\shdocvw.dll |
| c:\windows\system32\ieframe.dll |
| c:\windows\system32\mssvp.dll |
| c:\windows\system32\mapi32.dll |
| c:\windows\system32\slc.dll |
| c:\windows\system32\networkexplorer.dll |
| c:\windows\system32\ntshrui.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\cscapi.dll |
| c:\windows\system32\drprov.dll |
| c:\windows\system32\winsta.dll |
| c:\windows\system32\ntlanman.dll |
| c:\windows\system32\davclnt.dll |
| c:\windows\system32\davhlpr.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\wpdshext.dll |
| c:\windows\system32\portabledeviceapi.dll |
| c:\windows\system32\audiodev.dll |
| c:\windows\system32\wmvcore.dll |
| c:\windows\system32\wmasf.dll |
| c:\windows\system32\ehstorshell.dll |
| c:\windows\system32\ehstorapi.dll |
Registry activity
Total events
2388
Read events
2110
Write events
275
Delete events
3
Modification events
PID
Process
Operation
Key
Name
Value
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
failed_count
0
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
2
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
01000000
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
1
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
dr
1
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome
UsageStatsInSample
0
3336
chrome.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
usagestats
0
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
metricsid
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
metricsid_installdate
0
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
metricsid_enableddate
0
3336
chrome.exe
delete key
HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
0
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
lastrun
13210205995440375
3336
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
LanguageList
en-US
3336
chrome.exe
delete key
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
aapocclcgogkmnckokdopfmhonfmgoek
30A03E07F8ED17144F72CB5912BC8E33E1581194AD45A65CBA94EFF20502A302
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
ahfgeienlihckogmohjhadlkjgocpleb
15B1C3FE35F29528448F36A72A4DFBC58A8083C7190559D25865779166D220A2
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
aohghmighlieiainnegkcijnfilokake
2C6BD423C31FB304A474A52E19C7780EB18AE63DA04384F2E4103B797150AF05
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
apdfllckaahabafndbhieahigkjlhalf
61B90579BB8A94B510B7D243AF2F2D56DA85B6DB5D4F3F3810EEF51534144C36
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
blpcfgokakmgnkcojhhkbfbldkacnbeo
33E2D9DCB8D19BDB435F4287FBEBE12EF00BD2FD30B5048B83614565FBE9FB1D
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
felcaaldnbdncclmgdcncolpebgiejap
CBE18AB7F3852C58DBC7B2601DEE1F62BE1AD3CD4675FDAC0ED73526CF2B7322
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gfdkimpbcpahaombhbimeihdjnejgicl
D6B079666F209503A09486C70AC09307652A0F7F783166A999B27C99D0DA79E2
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
ghbmnnjooekpmoecnnnilnnbdlolhkhi
5679DCEC414011386E96327967C4A11DF892B7F0913BB22B5525DF02D780EDB6
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
kmendfapggjehodndflmmgagdbamhnfd
00175B8120231631976CA8B862A3416996C9373BA3D289F0619DDA992973DDFA
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
mfehgcgbbipciphmccgaenjidiccnmng
63355C14E8C7DF9A075F2EDDEA6F2807DC8166B83F96F4C975B9B6554C6324D7
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
mhjfbmdgcfjbbpaeojofohoefgiehjai
0E265BFED6F1C7D5F0A9BD790C50BB30E78E959631D51EEBB8BB0DE73E65763C
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
neajdppkdcdipfabeoofebfddakdcjhd
04A45240BDA55E8777FA04357712CA6DD942253A21323E4C7D3CCF769B34BFED
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nkeimhogjdpnpccoofpliimaahmaaome
5D58C2FED93EFDED578B006CB02BBB8DEC329128E2D098172E1316CDD15254DC
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
E1B1EC0085BBFB61A744E581DEB460576B9A5E92FD5150AE7EE3CDE81057636F
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
pjkljhegncpnkpknbcohdijeoejaedia
7E3ACE0172CE97F58E5075F382602643418C685C2716497089A51CF80DD96FB0
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
pkedcjkdefgpdelpbcmbmeomcjbeemfm
6B9B6467F591E31B916B3371DD6CC6BF3172959DA4081893323AB4C658953E3F
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
pkedcjkdefgpdelpbcmbmeomcjbeemfm
BD2E7C5E6A19E56A5C34C699CA1E49613B09BD0A5F81629D821C103BDBCDA284
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Implementing
1C00000001000000E307080002000D00150028003300370200000000
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Implementing
1C00000001000000E307080002000D001500280033003D0200000000
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Common\Rlz\PTimes
C
7FDE5CDB1F52D501
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Common\Rlz\RLZs
C1
1C1GCEA_enUA812UA812
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Common\Rlz\RLZs
C2
1C2GCEA_enUA812
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Common\Rlz\RLZs
C7
1C7GCEA_enUA812
3336
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
1
1244
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
3336-13210205994268500
259
1244
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
3336-13210205994268500
0
300
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
LanguageList
en-US
3652
FreeFileSync_Win32.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
LanguageList
en-US
3652
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FreeFileSync_Win32_RASAPI32
EnableFileTracing
0
3652
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FreeFileSync_Win32_RASAPI32
EnableConsoleTracing
0
3652
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FreeFileSync_Win32_RASAPI32
FileTracingMask
4294901760
3652
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FreeFileSync_Win32_RASAPI32
ConsoleTracingMask
4294901760
3652
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FreeFileSync_Win32_RASAPI32
MaxFileSize
1048576
3652
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FreeFileSync_Win32_RASAPI32
FileDirectory
%windir%\tracing
3652
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FreeFileSync_Win32_RASMANCS
EnableFileTracing
0
3652
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FreeFileSync_Win32_RASMANCS
EnableConsoleTracing
0
3652
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FreeFileSync_Win32_RASMANCS
FileTracingMask
4294901760
3652
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FreeFileSync_Win32_RASMANCS
ConsoleTracingMask
4294901760
3652
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FreeFileSync_Win32_RASMANCS
MaxFileSize
1048576
3652
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FreeFileSync_Win32_RASMANCS
FileDirectory
%windir%\tracing
3652
FreeFileSync_Win32.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
3652
FreeFileSync_Win32.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000093000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
3652
FreeFileSync_Win32.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3652
FreeFileSync_Win32.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3652
FreeFileSync_Win32.exe
write
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
NodeSlots
0202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
3652
FreeFileSync_Win32.exe
write
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
MRUListEx
0200000001000000000000000700000006000000030000000500000004000000FFFFFFFF
3652
FreeFileSync_Win32.exe
write
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
TV_FolderType
{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}
3652
FreeFileSync_Win32.exe
write
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
TV_TopViewID
{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
3652
FreeFileSync_Win32.exe
write
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
TV_TopViewVersion
0
3652
FreeFileSync_Win32.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU
1
7B00330031004600390034004100300030002D0039003200420034002D0041003000340030002D0038004400430032002D003000430041003500450046003500390036004500330042007D00000014001F4225481E03947BC34DB131E946B44C8DD5740000001A00EEBBFE23000010007DB10D7BD29C934A973346CC89022E7C00002A0000000000EFBE000000200000000000000000000000000000000000000000000000000100000020002A0000001900EFBE7E47B3FBE4C93B4BA2BAD3F5D3CD46F98207BA827A5B6945B5D7EC83085F08CC2000CC030000C603811914109C0320000000006000000000000000000000000000000000000000000000000000010000940000003153505330F125B7EF471A10A5F102608C9EEBAC2D0000000A000000001F0000000E0000004F00750074006C006F006F006B002000460069006C006500730000002900000004000000001F0000000C000000460069006C006500200066006F006C0064006500720000000D0000000C0000000001000000150000000E000000004000000000103E58CD46D501000000003100000031535053B1166D44AD8D7048A748402EA43D788C15000000640000000015000000B9061AD31FB1F222000000002801000031535053A66A63283D95D211B5D600C04FD918D0110000001900000000130000007F018070A90000002000000000111000009600000014001F44471A0359723FA74489C55595FE6B30EE200000001A00EEBBFE2300001000D09AD3FD8F23AF46ADB46C85480369C700006000310000000000FE4EA25E10004F55544C4F4F7E310000480008000400EFBE1B4D1860FE4EA25E2A0000004F2A00000000030000000000000000000000000000004F00750074006C006F006F006B002000460069006C006500730000001800000000002D00000018000000001F0000000E0000004F00750074006C006F006F006B002000460069006C00650073000000250000000B000000001F0000000A0000004400690072006500630074006F00720079000000000000002D00000031535053901C6949177E1A10A91C08002B2ECDA9110000000300000000030000000000000000000000280100003153505340E83E1E2BBC6C4782372ACD1A839B226100000008000000001F0000002700000043003A005C00550073006500720073005C00610064006D0069006E005C0044006F00630075006D0065006E00740073005C004F00750074006C006F006F006B002000460069006C0065007300000000002500000003000000001F100000010000000700000066006F006C006400650072000000000011000000140000000003000000010000007500000011000000001F000000310000007B00310036003800350044003400410042002D0041003500310042002D0034004100460031002D0041003400450035002D004300450045003800370030003000320034003300310044007D002E004D006500720067006500200041006E00790000000000000000002900000031535053FCB3B4B9512B424AB5D8324146AFCF250D000000080000000001000000000000002D00000031535053C0E85BCF6C23D34ABACECD608A2748D71100000064000000000B000000FFFF0000000000000000000000000000
3652
FreeFileSync_Win32.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU
MRUListEx
0100000000000000FFFFFFFF
3652
FreeFileSync_Win32.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*
1
14001F4225481E03947BC34DB131E946B44C8DD5740000001A00EEBBFE23000010007DB10D7BD29C934A973346CC89022E7C00002A0000000000EFBE000000200000000000000000000000000000000000000000000000000100000020002A0000001900EFBE7E47B3FBE4C93B4BA2BAD3F5D3CD46F98207BA827A5B6945B5D7EC83085F08CC2000CC030000C603811914109C0320000000006000000000000000000000000000000000000000000000000000010000940000003153505330F125B7EF471A10A5F102608C9EEBAC2D0000000A000000001F0000000E0000004F00750074006C006F006F006B002000460069006C006500730000002900000004000000001F0000000C000000460069006C006500200066006F006C0064006500720000000D0000000C0000000001000000150000000E000000004000000000103E58CD46D501000000003100000031535053B1166D44AD8D7048A748402EA43D788C15000000640000000015000000B9061AD31FB1F222000000002801000031535053A66A63283D95D211B5D600C04FD918D0110000001900000000130000007F018070A90000002000000000111000009600000014001F44471A0359723FA74489C55595FE6B30EE200000001A00EEBBFE2300001000D09AD3FD8F23AF46ADB46C85480369C700006000310000000000FE4EA25E10004F55544C4F4F7E310000480008000400EFBE1B4D1860FE4EA25E2A0000004F2A00000000030000000000000000000000000000004F00750074006C006F006F006B002000460069006C006500730000001800000000002D00000018000000001F0000000E0000004F00750074006C006F006F006B002000460069006C00650073000000250000000B000000001F0000000A0000004400690072006500630074006F00720079000000000000002D00000031535053901C6949177E1A10A91C08002B2ECDA9110000000300000000030000000000000000000000280100003153505340E83E1E2BBC6C4782372ACD1A839B226100000008000000001F0000002700000043003A005C00550073006500720073005C00610064006D0069006E005C0044006F00630075006D0065006E00740073005C004F00750074006C006F006F006B002000460069006C0065007300000000002500000003000000001F100000010000000700000066006F006C006400650072000000000011000000140000000003000000010000007500000011000000001F000000310000007B00310036003800350044003400410042002D0041003500310042002D0034004100460031002D0041003400450035002D004300450045003800370030003000320034003300310044007D002E004D006500720067006500200041006E00790000000000000000002900000031535053FCB3B4B9512B424AB5D8324146AFCF250D000000080000000001000000000000002D00000031535053C0E85BCF6C23D34ABACECD608A2748D71100000064000000000B000000FFFF0000000000000000000000000000
3652
FreeFileSync_Win32.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*
MRUListEx
0100000000000000FFFFFFFF
3652
FreeFileSync_Win32.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU
1
7B00330031004600390034004100300030002D0039003200420034002D0041003000340030002D0038004400430032002D003000430041003500450046003500390036004500330042007D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000C2000000580000004203000038020000000000000000000000000000000000000100000000000000
3652
FreeFileSync_Win32.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU
1
7B00330031004600390034004100300030002D0039003200420034002D0041003000340030002D0038004400430032002D003000430041003500450046003500390036004500330042007D00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000BE0000002E000000420400008602000000000000000000000000000000000000C2000000580000004203000038020000000000000000000000000000000000000100000000000000
3652
FreeFileSync_Win32.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU
MRUListEx
0100000000000000FFFFFFFF
3652
FreeFileSync_Win32.exe
write
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Mode
4
3652
FreeFileSync_Win32.exe
write
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
LogicalViewMode
1
3652
FreeFileSync_Win32.exe
write
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
FFlags
1092616257
3652
FreeFileSync_Win32.exe
write
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
IconSize
16
3652
FreeFileSync_Win32.exe
write
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
ColInfo
00000000000000000000000000000000FDDFDFFD100000000000000000000000040000001800000030F125B7EF471A10A5F102608C9EEBAC0A0000001001000030F125B7EF471A10A5F102608C9EEBAC0E0000007800000030F125B7EF471A10A5F102608C9EEBAC040000007800000030F125B7EF471A10A5F102608C9EEBAC0C00000050000000
3652
FreeFileSync_Win32.exe
write
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Sort
000000000000000000000000000000000200000030F125B7EF471A10A5F102608C9EEBAC0A0000000100000030F125B7EF471A10A5F102608C9EEBAC0E000000FFFFFFFF
3652
FreeFileSync_Win32.exe
write
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
FFlags
1
3652
FreeFileSync_Win32.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDOpen\Modules\GlobalSettings\ProperTreeModuleInner
ProperTreeModuleInner
9C000000980000003153505305D5CDD59C2E1B10939708002B2CF9AE3B0000002A000000004E0061007600500061006E0065005F004300460044005F0046006900720073007400520075006E0000000B000000000000004100000030000000004E0061007600500061006E0065005F00530068006F0077004C00690062007200610072007900500061006E00650000000B000000FFFF00000000000000000000
3652
FreeFileSync_Win32.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Modules\NavPane
ExpandedState
06000000160014001F8080A63C324DC29940B94D446DD2D7249E0000010000004D0000002D00000031535053357EC777E31B5043A48C7563D727776D1100000002000000000B000000FFFF0000000000001C00000031535053A66A63283D95D211B5D600C04FD918D00000000000000000160014001F4225481E03947BC34DB131E946B44C8DD50000010000004D0000002D00000031535053357EC777E31B5043A48C7563D727776D1100000002000000000B000000FFFF0000000000001C00000031535053A66A63283D95D211B5D600C04FD918D00000000000000000160014001F43983FFBB4EAC18D42A78AD1F5659CBA930000010000004D0000002D00000031535053357EC777E31B5043A48C7563D727776D1100000002000000000B000000FFFF0000000000001C00000031535053A66A63283D95D211B5D600C04FD918D0000000000000000002000000010000004D0000002D00000031535053357EC777E31B5043A48C7563D727776D1100000002000000000B000000FFFF0000000000001C00000031535053A66A63283D95D211B5D600C04FD918D00000000000000000160014001F580D1A2CF021BE504388B07367FC96EF3C0000010000004D0000002D00000031535053357EC777E31B5043A48C7563D727776D1100000002000000000B00000000000000000000001C00000031535053A66A63283D95D211B5D600C04FD918D00000000000000000160014001F50E04FD020EA3A6910A2D808002B30309D0000010000004D0000002D00000031535053357EC777E31B5043A48C7563D727776D1100000002000000000B000000FFFF0000000000001C00000031535053A66A63283D95D211B5D600C04FD918D00000000000000000
3648
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
LanguageList
en-US
1436
powershell.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
LanguageList
en-US
3380
FreeFileSync_Win32.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
LanguageList
en-US
3380
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E
Blob
0F0000000100000014000000A8569CCD21EF9CC5737C7A12DF608C2CBC545DF153000000010000006500000030633021060B2A84680186F6770205010130123010060A2B0601040182373C0101030200C03021060B2A84680186F6770205010730123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C0090000000100000054000000305206082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030306082B06010505070308060A2B0601040182370A030406082B0601050507030606082B060105050703070B0000000100000034000000430065007200740075006D002000540072007500730074006500640020004E006500740077006F0072006B0020004300410000006200000001000000200000005C58468D55F58E497E743982D2B50010B6D165374ACF83A7D4A32DB768C4408E1400000001000000140000000876CDCB07FF24F6C5CDEDBB90BCE284374675F71D0000000100000010000000E3F9AF952C6DF2AAA41706A77A44C20303000000010000001400000007E032E020B72C3F192F0628A2593A19A70F069E2000000001000000BF030000308203BB308202A3A00302010202030444C0300D06092A864886F70D0101050500307E310B300906035504061302504C31223020060355040A1319556E697A65746F20546563686E6F6C6F6769657320532E412E31273025060355040B131E43657274756D2043657274696669636174696F6E20417574686F72697479312230200603550403131943657274756D2054727573746564204E6574776F726B204341301E170D3038313032323132303733375A170D3239313233313132303733375A307E310B300906035504061302504C31223020060355040A1319556E697A65746F20546563686E6F6C6F6769657320532E412E31273025060355040B131E43657274756D2043657274696669636174696F6E20417574686F72697479312230200603550403131943657274756D2054727573746564204E6574776F726B20434130820122300D06092A864886F70D01010105000382010F003082010A0282010100E3FB7DA372BAC2F0C91487F56B014EE16E4007BA6D275D7FF75B2DB35AC7515FABA432A66187B66E0F86D2300297F8D76957A118395D6A6479C60159AC3C314A387CD204D24B28E8205F3B07A2CC4D73DBF3AE4FC756D55AA79689FAF3AB68D423865927CF0927BCAC6E72831C3072DFE0A2E9D2E1747519BD2A9E7B1554041BD74339AD5528C5E21ABBF4C0E4AE384933CC76859F3945D2A49EF2128C51F87CE42D7FF5AC5FEB169FB12DD1BACC9142774C25C990386FDBF0CCFB8E1E97593ED5604EE60528ED4979134BBA48DB2FF972D339CAFE1FD83472F5B440CF3101C3ECDE112D175D1FB850D15E19A769DE073328CA5095F9A754CB54865045A9F9490203010001A3423040300F0603551D130101FF040530030101FF301D0603551D0E041604140876CDCB07FF24F6C5CDEDBB90BCE284374675F7300E0603551D0F0101FF040403020106300D06092A864886F70D01010505000382010100A6A8AD22CE013DA6A3FF62D0489D8B5E72B07844E3DC1CAF09FD2348FABD2AC4B95504B510A38D27DE0B8263D0EEDE0C3779415B22B2B09A415CA670E0D4D077CB23D300E06C562FE1690D0DD9AABF218150D906A5A8FF9537D0AAFEE2B3F5992D45848AE54209D774022FF789D899E9BC27D4478DBA0D461C77CF14A41CB9A431C49C28740334FF331926A5E90D74B73E97C676E82796A366DDE1AEF2415BCA9856837370E4861AD23141BA2FBE2D135A766F4EE84E810E3F5B0322A012BE6658114ACB03C4B42A2A2D9617E03954BC48D376279D9A2D06A6C9EC39D2ABDB9F9A0B27023529B14095E7F9E89C55881946D6B734F57ECE399AD938F151F74F2C
3380
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E
Blob
040000000100000010000000D5E98140C51869FC462C8975620FAA7803000000010000001400000007E032E020B72C3F192F0628A2593A19A70F069E1D0000000100000010000000E3F9AF952C6DF2AAA41706A77A44C2031400000001000000140000000876CDCB07FF24F6C5CDEDBB90BCE284374675F76200000001000000200000005C58468D55F58E497E743982D2B50010B6D165374ACF83A7D4A32DB768C4408E0B0000000100000034000000430065007200740075006D002000540072007500730074006500640020004E006500740077006F0072006B002000430041000000090000000100000054000000305206082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030306082B06010505070308060A2B0601040182370A030406082B0601050507030606082B0601050507030753000000010000006500000030633021060B2A84680186F6770205010130123010060A2B0601040182373C0101030200C03021060B2A84680186F6770205010730123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C00F0000000100000014000000A8569CCD21EF9CC5737C7A12DF608C2CBC545DF12000000001000000BF030000308203BB308202A3A00302010202030444C0300D06092A864886F70D0101050500307E310B300906035504061302504C31223020060355040A1319556E697A65746F20546563686E6F6C6F6769657320532E412E31273025060355040B131E43657274756D2043657274696669636174696F6E20417574686F72697479312230200603550403131943657274756D2054727573746564204E6574776F726B204341301E170D3038313032323132303733375A170D3239313233313132303733375A307E310B300906035504061302504C31223020060355040A1319556E697A65746F20546563686E6F6C6F6769657320532E412E31273025060355040B131E43657274756D2043657274696669636174696F6E20417574686F72697479312230200603550403131943657274756D2054727573746564204E6574776F726B20434130820122300D06092A864886F70D01010105000382010F003082010A0282010100E3FB7DA372BAC2F0C91487F56B014EE16E4007BA6D275D7FF75B2DB35AC7515FABA432A66187B66E0F86D2300297F8D76957A118395D6A6479C60159AC3C314A387CD204D24B28E8205F3B07A2CC4D73DBF3AE4FC756D55AA79689FAF3AB68D423865927CF0927BCAC6E72831C3072DFE0A2E9D2E1747519BD2A9E7B1554041BD74339AD5528C5E21ABBF4C0E4AE384933CC76859F3945D2A49EF2128C51F87CE42D7FF5AC5FEB169FB12DD1BACC9142774C25C990386FDBF0CCFB8E1E97593ED5604EE60528ED4979134BBA48DB2FF972D339CAFE1FD83472F5B440CF3101C3ECDE112D175D1FB850D15E19A769DE073328CA5095F9A754CB54865045A9F9490203010001A3423040300F0603551D130101FF040530030101FF301D0603551D0E041604140876CDCB07FF24F6C5CDEDBB90BCE284374675F7300E0603551D0F0101FF040403020106300D06092A864886F70D01010505000382010100A6A8AD22CE013DA6A3FF62D0489D8B5E72B07844E3DC1CAF09FD2348FABD2AC4B95504B510A38D27DE0B8263D0EEDE0C3779415B22B2B09A415CA670E0D4D077CB23D300E06C562FE1690D0DD9AABF218150D906A5A8FF9537D0AAFEE2B3F5992D45848AE54209D774022FF789D899E9BC27D4478DBA0D461C77CF14A41CB9A431C49C28740334FF331926A5E90D74B73E97C676E82796A366DDE1AEF2415BCA9856837370E4861AD23141BA2FBE2D135A766F4EE84E810E3F5B0322A012BE6658114ACB03C4B42A2A2D9617E03954BC48D376279D9A2D06A6C9EC39D2ABDB9F9A0B27023529B14095E7F9E89C55881946D6B734F57ECE399AD938F151F74F2C
3380
FreeFileSync_Win32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E
Blob
1900000001000000100000001F7E750B566B128AC0B8D6576D2A70A50F0000000100000014000000A8569CCD21EF9CC5737C7A12DF608C2CBC545DF153000000010000006500000030633021060B2A84680186F6770205010130123010060A2B0601040182373C0101030200C03021060B2A84680186F6770205010730123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C0090000000100000054000000305206082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030306082B06010505070308060A2B0601040182370A030406082B0601050507030606082B060105050703070B0000000100000034000000430065007200740075006D002000540072007500730074006500640020004E006500740077006F0072006B0020004300410000006200000001000000200000005C58468D55F58E497E743982D2B50010B6D165374ACF83A7D4A32DB768C4408E1400000001000000140000000876CDCB07FF24F6C5CDEDBB90BCE284374675F71D0000000100000010000000E3F9AF952C6DF2AAA41706A77A44C20303000000010000001400000007E032E020B72C3F192F0628A2593A19A70F069E040000000100000010000000D5E98140C51869FC462C8975620FAA782000000001000000BF030000308203BB308202A3A00302010202030444C0300D06092A864886F70D0101050500307E310B300906035504061302504C31223020060355040A1319556E697A65746F20546563686E6F6C6F6769657320532E412E31273025060355040B131E43657274756D2043657274696669636174696F6E20417574686F72697479312230200603550403131943657274756D2054727573746564204E6574776F726B204341301E170D3038313032323132303733375A170D3239313233313132303733375A307E310B300906035504061302504C31223020060355040A1319556E697A65746F20546563686E6F6C6F6769657320532E412E31273025060355040B131E43657274756D2043657274696669636174696F6E20417574686F72697479312230200603550403131943657274756D2054727573746564204E6574776F726B20434130820122300D06092A864886F70D01010105000382010F003082010A0282010100E3FB7DA372BAC2F0C91487F56B014EE16E4007BA6D275D7FF75B2DB35AC7515FABA432A66187B66E0F86D2300297F8D76957A118395D6A6479C60159AC3C314A387CD204D24B28E8205F3B07A2CC4D73DBF3AE4FC756D55AA79689FAF3AB68D423865927CF0927BCAC6E72831C3072DFE0A2E9D2E1747519BD2A9E7B1554041BD74339AD5528C5E21ABBF4C0E4AE384933CC76859F3945D2A49EF2128C51F87CE42D7FF5AC5FEB169FB12DD1BACC9142774C25C990386FDBF0CCFB8E1E97593ED5604EE60528ED4979134BBA48DB2FF972D339CAFE1FD83472F5B440CF3101C3ECDE112D175D1FB850D15E19A769DE073328CA5095F9A754CB54865045A9F9490203010001A3423040300F0603551D130101FF040530030101FF301D0603551D0E041604140876CDCB07FF24F6C5CDEDBB90BCE284374675F7300E0603551D0F0101FF040403020106300D06092A864886F70D01010505000382010100A6A8AD22CE013DA6A3FF62D0489D8B5E72B07844E3DC1CAF09FD2348FABD2AC4B95504B510A38D27DE0B8263D0EEDE0C3779415B22B2B09A415CA670E0D4D077CB23D300E06C562FE1690D0DD9AABF218150D906A5A8FF9537D0AAFEE2B3F5992D45848AE54209D774022FF789D899E9BC27D4478DBA0D461C77CF14A41CB9A431C49C28740334FF331926A5E90D74B73E97C676E82796A366DDE1AEF2415BCA9856837370E4861AD23141BA2FBE2D135A766F4EE84E810E3F5B0322A012BE6658114ACB03C4B42A2A2D9617E03954BC48D376279D9A2D06A6C9EC39D2ABDB9F9A0B27023529B14095E7F9E89C55881946D6B734F57ECE399AD938F151F74F2C
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\FreeFileSync
InstallDir
C:\Program Files\FreeFileSync
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\FreeFileSync
CreateDesktopShortcut
1
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\FreeFileSync
CreateStartmenuEntry
1
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\FreeFileSync
CreateSendToShortcut
1
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ffs_gui
FreeFileSync.ffs_gui.1
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ffs_gui
Content Type
Application/xml
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_gui.1
FreeFileSync Configuration
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_gui.1\DefaultIcon
C:\Program Files\FreeFileSync\FreeFileSync.exe,0
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_gui.1\shell\open\command
"C:\Program Files\FreeFileSync\FreeFileSync.exe" "%1"
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_gui.1\shell\edit
Edit with FreeFileSync
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_gui.1\shell\edit
Icon
C:\Program Files\FreeFileSync\FreeFileSync.exe,0
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_gui.1\shell\edit\command
"C:\Program Files\FreeFileSync\FreeFileSync.exe" -edit "%1"
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ffs_batch
FreeFileSync.ffs_batch.1
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ffs_batch
Content Type
Application/xml
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_batch.1
FreeFileSync Batch File
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_batch.1\DefaultIcon
C:\Program Files\FreeFileSync\FreeFileSync.exe,1
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_batch.1\shell\open\command
"C:\Program Files\FreeFileSync\FreeFileSync.exe" "%1"
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_batch.1\shell\edit
Edit with FreeFileSync
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_batch.1\shell\edit
Icon
C:\Program Files\FreeFileSync\FreeFileSync.exe,0
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_batch.1\shell\edit\command
"C:\Program Files\FreeFileSync\FreeFileSync.exe" -edit "%1"
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ffs_db
FreeFileSync.ffs_db.1
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_db.1
FreeFileSync Synchronization Database
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_db.1
NoOpen
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeFileSync.ffs_db.1\DefaultIcon
C:\Program Files\FreeFileSync\FreeFileSync.exe,2
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ffs_real
RealTimeSync.ffs_real.1
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ffs_real
Content Type
Application/xml
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RealTimeSync.ffs_real.1
RealTimeSync Configuration
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RealTimeSync.ffs_real.1\DefaultIcon
C:\Program Files\FreeFileSync\RealTimeSync.exe,0
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RealTimeSync.ffs_real.1\shell\open\command
"C:\Program Files\FreeFileSync\RealTimeSync.exe" "%1"
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
Inno Setup: Setup Version
5.6.1 (u)
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
Inno Setup: App Path
C:\Program Files\FreeFileSync
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
InstallLocation
C:\Program Files\FreeFileSync\
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
Inno Setup: Icon Group
(Default)
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
Inno Setup: User
admin
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
Inno Setup: Setup Type
custom
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
Inno Setup: Selected Components
installtype,installtype\local,shortcuts,shortcuts\desktop,shortcuts\startmenu,shortcuts\sendto
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
Inno Setup: Deselected Components
installtype\portable
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
Inno Setup: Language
English
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
DisplayName
FreeFileSync 10.14
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
DisplayIcon
C:\Program Files\FreeFileSync\FreeFileSync.exe
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
UninstallString
"C:\Program Files\FreeFileSync\Uninstall\unins000.exe"
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
QuietUninstallString
"C:\Program Files\FreeFileSync\Uninstall\unins000.exe" /SILENT
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
DisplayVersion
10.14
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
Publisher
FreeFileSync.org
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
URLInfoAbout
https://FreeFileSync.org
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
NoModify
1
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
NoRepair
1
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
InstallDate
20190813
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
MajorVersion
10
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
MinorVersion
14
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
VersionMajor
10
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
VersionMinor
14
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeFileSync_is1
EstimatedSize
38307
3796
FreeFileSync_10.14_Windows_Setup.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
GlobalAssocChangedCounter
65
Files activity
Executable files
13
Suspicious files
75
Text files
264
Unknown types
24
Dropped files
PID
Process
Filename
Type
3336
chrome.exe
C:\Users\admin\Downloads\Unconfirmed 24675.crdownload
executable
MD5:
8140b70628c55283af6bdbdbd78052d5
SHA256:
33551fb0d28f2b1a64f55ee16c56f8610d7d2a7bc4f2825c6ba70658a66a8741
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\FreeFileSync.exe
executable
MD5:
bb2a215ff5f78978a5eaaec7b594dd6a
SHA256:
829e9e61bd6918b36b5219d06257e34655d99668169538b9a5ae9e6ea85bda25
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Bin\RealTimeSync_Win32.exe
executable
MD5:
7ebbf42f1c8226c94771c7ebff922c08
SHA256:
c87db5c95dc0fe0344bacb0a07a45a9444ac6c101e9b101356d9ec334f1292f7
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Users\admin\AppData\Local\Temp\is-6V92Q.tmp\FreeFileSync.exe
executable
MD5:
bb2a215ff5f78978a5eaaec7b594dd6a
SHA256:
829e9e61bd6918b36b5219d06257e34655d99668169538b9a5ae9e6ea85bda25
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\RealTimeSync.exe
executable
MD5:
9edb88c3241b67788dcb056a95f4d9be
SHA256:
a3c88c1df405d5dfd3535713737f9073ee4eb709a1763999c956378dd35312d0
3964
FreeFileSync_10.14_Windows_Setup.exe
C:\Users\admin\AppData\Local\Temp\is-JAGSI.tmp\FreeFileSync_10.14_Windows_Setup.tmp
executable
MD5:
d1cf60f3a2d8b8349b95acac7c844045
SHA256:
d062110b6da25600488adc5be22a659b22d1d7c355dae59653a501293a4af6b7
3336
chrome.exe
C:\Users\admin\Downloads\FreeFileSync_10.14_Windows_Setup.exe
executable
MD5:
bdc28fcfa782039ef0af9e0a98d376eb
SHA256:
1b0ae7c794989881525d0a14e66681a11a6b80261095ce31a3a45a759d4dec4e
3336
chrome.exe
C:\Users\admin\Downloads\Unconfirmed 24675.crdownload
executable
MD5:
bdc28fcfa782039ef0af9e0a98d376eb
SHA256:
1b0ae7c794989881525d0a14e66681a11a6b80261095ce31a3a45a759d4dec4e
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Bin\RealTimeSync_x64.exe
executable
MD5:
85f5d38ed6a9cc1ef508a61bbd06d879
SHA256:
2fe8f163233146b76d94a77418a15f823dce8db5f4fd566fca7d10f925f3d0ff
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Uninstall\unins000.exe
executable
MD5:
d1cf60f3a2d8b8349b95acac7c844045
SHA256:
d062110b6da25600488adc5be22a659b22d1d7c355dae59653a501293a4af6b7
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Bin\FreeFileSync_Win32.exe
executable
MD5:
7810129720b0ecb9224dbb4d929909ab
SHA256:
ff24e316bae621fd0b7e5bff7653e4deabf5f4f8d5b0fb9bff497d3aed4ca447
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Bin\FreeFileSync_x64.exe
executable
MD5:
c6f3e61b46b367d2a789f93ffcd60eae
SHA256:
f3c7f770000043e85f3ca60857cf63c3ddb96c8561cc0f40b0e9bbde27229dcf
332
FreeFileSync_10.14_Windows_Setup.exe
C:\Users\admin\AppData\Local\Temp\is-GKMUQ.tmp\FreeFileSync_10.14_Windows_Setup.tmp
executable
MD5:
d1cf60f3a2d8b8349b95acac7c844045
SHA256:
d062110b6da25600488adc5be22a659b22d1d7c355dae59653a501293a4af6b7
3336
chrome.exe
C:\Users\admin\AppData\Local\Temp\scoped_dir3336_14312\CRX_INSTALL\_locales\it\messages.json
––
MD5:
––
SHA256:
––
300
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3
––
MD5:
––
SHA256:
––
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
text
MD5:
fdd61a8528650593e3c9a80621540655
SHA256:
c23c6f0282a69af11404e5aa5e471934da446868d79d2a96172a9e68e8b3e3a3
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
text
MD5:
b50a457e1505d8a903196fa629a18c21
SHA256:
c57719edde31f5631f40009c36ebba213ea1d1d7871632bd5b80a942dd756cbc
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
binary
MD5:
e952942b492db39a75dd2669b98ebe74
SHA256:
14f92b911f9fe774720461eec5bb4761ae6bfc9445c67e30bf624a8694b4b1da
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
text
MD5:
0d90865db6dad1b497674e0cec46ea2c
SHA256:
44a9b23ceb421df77153917a46e8e2f7896c44b34f4267f248c83e243fd054c7
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
text
MD5:
eba4f7d24251e378258f2aa73217c569
SHA256:
7b840ca7225ecb712a98089cadada1f61d7b73b2bf8d4afafc75152d89079f7c
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\52a604ef-6e75-4055-841d-56354194988f.tmp
––
MD5:
––
SHA256:
––
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\2b881842-839c-4efc-86af-1fa0a2217230.tmp
––
MD5:
––
SHA256:
––
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links
binary
MD5:
7483dad5e1dc8995974e9d15f49820fa
SHA256:
aa39e41d0c1bf8f71d91aea861fb91be2c6416d8185f84fb98dfa5056fc17685
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log
binary
MD5:
d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA256:
99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG
text
MD5:
0396d2f7802eff079155a690e8916055
SHA256:
734e69e0f759226f8fec710d5ef70ed026b15f47d183ef2fc07393e3b2d5de35
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG
text
MD5:
85025e5949d245838c4a1e6244602da3
SHA256:
2a69a7eb1bc159f296d01e1a7ed0f5d7c312bff4f6b1bbf595d17e0ade3a5d6a
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG
text
MD5:
d4a166786479773f20f5edaf88b54df8
SHA256:
a1dd9a30a9f73916ede19ac159dd49cacce90e8cfa297c40869ec136aeeeb7b7
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG
text
MD5:
014a4a5febb41ce0f82dcc789021f599
SHA256:
8fe331a9d21db0bd21b110120ea4b80a727697554c038af8d141e142851e1854
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
text
MD5:
61d98905b2e515b90cb9582c09b098c4
SHA256:
b84f33806e56317a8f0f0fd73ac8054f9b4b1294587a838f071e8769538f0aaf
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\000003.log
binary
MD5:
fd9f7d6b7578b2f0da0809c1402ccb24
SHA256:
77a8b301fe2a979eafb17a573c60b1099ac1bbc6289973b303b8d5c8bfedb94f
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
binary
MD5:
b4114a6507dda4dd6b49a883bbd562a8
SHA256:
9b17d9fb2ac5830186e821088b1dabde9d891f6d4128101eefc64748b7e7cb08
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG
text
MD5:
d32755ec553df3c1307dc165fa6fad43
SHA256:
2ff1ead4edb9ee5107c3b7fafecd94b98e4f67d4926a2c9ada020bd8536824a1
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Current Tabs
binary
MD5:
acacd8d1adcc362aa6a8fcdb53276142
SHA256:
39b55ed21a68806fc9cccda2596b407d8a2c0520be451423512efefded11dbf6
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
text
MD5:
8f762a35f9320379a1f9588d0b78ddcb
SHA256:
e92ec3e9cd183ce17477749d34c2502d5dbacc43235dc559f55a3157cb43f6ad
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
sqlite
MD5:
2f83e3fb2f367422d1b85e8254162651
SHA256:
9670f9cffdcc6fd6ed50503e63ea02e5ca36de40df420b6102e66a30db109f0d
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\MANIFEST-000002
binary
MD5:
22bf0e81636b1b45051b138f48b3d148
SHA256:
e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000020
binary
MD5:
506562585675f86ceab6a68bf036a597
SHA256:
2bb80413a9331da8e530be250c3d1e1ae21a38f34a93806200575cee6df9b00b
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Login Data
sqlite
MD5:
34aeec6b8b7aae3b0ed24ac4acdd1f8e
SHA256:
a758007d8fa6a13b2d728a09ce43883150cb18b945eda4bf15224ee7f92bd5de
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
text
MD5:
b10ca9b1a9684e5257bb41eb4c8c8a2e
SHA256:
424b5ca70e4a4ae4b6620a235e40da99a45c1d402e2917342964b1aeb2e9fc73
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
binary
MD5:
5d2f5fd2131dc478b9207e5f40077f5d
SHA256:
88a89157ce9245af58e9c08793e33522a2abc58c63a114c345330cf7967cd737
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG
text
MD5:
5f69f4aa640985d9121ad1d867f0ab34
SHA256:
8fb5c8fc3cdd4b297fce9d955f582b46d9cefcde3fb6d565a3d2fcd481d31d16
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Local State~RF38753f.TMP
text
MD5:
565910d01e09958c86cda8c0aed4aa75
SHA256:
2d738826e13b1e3cc86aa17101eb4f2cad8c72eaacc803f60253f5112fada43f
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG
text
MD5:
734d016e6b30c512b8675dcb7df70a2b
SHA256:
6c555a73409af1a45b5c115361c43ad7a3de204ef08fb9691ab33b3180837ed9
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
––
MD5:
––
SHA256:
––
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
––
MD5:
––
SHA256:
––
300
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies
sqlite
MD5:
1550c6b1f1528d0d304a3e12dc2e9c14
SHA256:
36b3f2b60aa5862605728d673d713b067627d962a48ac64cb70f896b9f2e152b
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
sqlite
MD5:
e48b0f183c3f3dd826209f6abb82fc9c
SHA256:
d955947599dd5125f48168927ebc4c61f398664301138859280f659ab36f8fb0
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Current Session
binary
MD5:
9a26ef7b21f3b652b41623a114598fdc
SHA256:
1a468068337904c84fbb76db2bebbcefed0fa0da6447e0f27e886f68eebe89be
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache
binary
MD5:
7de421c97748db6b2aa2446ac0afeda9
SHA256:
580ebeb5acfc2db1e2cf9e619a8e10736ddbd76a4c0aaf4b232e126c03ffdb0d
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\History
sqlite
MD5:
a8fa271608f15b999af3ef60b4c96c5a
SHA256:
52d8c85868d0d92cf3adea82606eaf62bbd9f28b4a01e971b3a24e6e19eea57c
300
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal
––
MD5:
––
SHA256:
––
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\27ff4600-edba-41da-9c05-2416714bc5bb.tmp
––
MD5:
––
SHA256:
––
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\History-journal
––
MD5:
––
SHA256:
––
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Favicons-journal
––
MD5:
––
SHA256:
––
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
binary
MD5:
7fc454f561180b0d1f2f199da6c64137
SHA256:
1edd49909af8da2613e75294d4edd88539d6a0b81f562eb80c5f564e79eab98e
3380
FreeFileSync_Win32.exe
C:\Program Files\FreeFileSync\Install.dat
binary
MD5:
91d9fc939a6f84aa32629e481008836b
SHA256:
d41e72cb6cf9b0bf50d5ce75644a2e387b090643b69909c857b018f104a11c32
3380
FreeFileSync_Win32.exe
C:\Program Files\FreeFileSync\Install.dat.6a52.tmp
––
MD5:
––
SHA256:
––
3380
FreeFileSync_Win32.exe
C:\Program Files\FreeFileSync\Install.dat.99f7.tmp
––
MD5:
––
SHA256:
––
1436
powershell.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
binary
MD5:
e52e703712c7329ce3b3f25e59fec327
SHA256:
f7094b5facfa401d43eea54fb324a514a57d1a40d66c7dea60fc48d545b44a02
1436
powershell.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF3848b1.TMP
binary
MD5:
e52e703712c7329ce3b3f25e59fec327
SHA256:
f7094b5facfa401d43eea54fb324a514a57d1a40d66c7dea60fc48d545b44a02
1436
powershell.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GPSS9GZXDDDWJWYJW3EF.temp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Uninstall\unins000.dat
dat
MD5:
9ccc8a6c6ea6dec291748a9475509154
SHA256:
aa3dabeda4344c09a101d3ab246e27689edf86c78b83a5caeb0eb8ee0abbe6a7
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Uninstall\unins000.msg
binary
MD5:
3c4697e6f46b10815d5ec6c46fdef413
SHA256:
29f507920254e881eb4ee7fb7564099a62b6a6fc7427889936f1e82b829ccbb3
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo\FreeFileSync.lnk
lnk
MD5:
0aac0648197d89a233386ba0eecb554d
SHA256:
70ee60ddf44de5bdea89a6fb6f6338ab994f6228623acdf0fb5f15a890f5a8c2
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealTimeSync.lnk
lnk
MD5:
1a720cd61a91d1f3423571aee5a60563
SHA256:
797844c0e55318dbfba6fb211bbab908fd385d18a18f793e1ae83c7eb3367f2b
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Users\Public\Desktop\RealTimeSync.lnk
lnk
MD5:
7804faa120789e1f2fa8a07a578720f3
SHA256:
e81c7d1ca847fc92dbbc6ebaa1ed1307ef27a38c27471bf0dedb19dbd91a5803
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeFileSync.lnk
lnk
MD5:
6a8a2968a45844bc8d0cda997875f7b2
SHA256:
268a6186d1171adc8be92aa9a7d467a95d9a34c271b44961e4ad555f444562ac
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Users\Public\Desktop\FreeFileSync.lnk
lnk
MD5:
7cba6a42a2fe70d0e453aebd16e1e295
SHA256:
fb74c5a9278c88451cd75b2618589c07f41375c35cfeab2a196ecfb0214b3999
3652
FreeFileSync_Win32.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
text
MD5:
6c48c7e3793715053e49f3f1701b1f1a
SHA256:
812de3bcbf1d4c1b0be6e60e14d7e61ad653f11506718fa50df5ae743f8af341
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Bin\is-HVN8A.tmp
––
MD5:
––
SHA256:
––
3336
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
binary
MD5:
cffb22fa282b292a908ee3bed00e23f7
SHA256:
351dfe00d32e46baf16db6fe9c658d5d77adc56da0df87e5c4b59590da1093f6
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Bin\is-DS4TS.tmp
––
MD5:
––
SHA256:
––
300
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State~RF38756e.TMP
text
MD5:
b6f39e12f254e57c7a1f1908ee252845
SHA256:
4661247cc1f6a794c5677b4de50053922a4a71365f9515ee8dcb392ce2e49dd5
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Bin\is-T4CD8.tmp
––
MD5:
––
SHA256:
––
300
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State
text
MD5:
b6f39e12f254e57c7a1f1908ee252845
SHA256:
4661247cc1f6a794c5677b4de50053922a4a71365f9515ee8dcb392ce2e49dd5
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Bin\is-JA49I.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\ukrainian.lng
text
MD5:
ac97644a15756fc0f48e2dbeec954f2a
SHA256:
7b21949035fecde31a0becda9a145b8b5506c70f8cedcc926231777235235d57
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-U1Q12.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\russian.lng
text
MD5:
05f06452cd0fee0d4323d2db28de681f
SHA256:
eadf38221e136b9b00aeb3d01b0b437eced2ef479bd6ef3dff3e209087b0e277
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\spanish.lng
text
MD5:
e2e96d8eb498a062cf65ab7676b93c00
SHA256:
80e4f49996a7a34da1a3c409e198eb4be7affeea66eb5b3f23035e3bf4b34502
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\slovak.lng
text
MD5:
bcee83ce3fe4a110723ca0218edf6cbb
SHA256:
05b486cb1bcb0658e5e0f95105ac442db3064d7fb99dec082534af0dababc552
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\swedish.lng
text
MD5:
507e1f0ac62ee18f2b0db7e043a32a86
SHA256:
d5c6d46aa05e28dc0858d29e10d0b38091e6c068980caf2ce3df3c53f1bc9b26
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\slovenian.lng
text
MD5:
ffe2f3fa7f932db844c5d6c4abd4bcc3
SHA256:
730f757fc4efef263b97048f6f0a91cb1414207a0f17b59894568cab215e7fac
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-C8FH1.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-PBVSS.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-6J3VM.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-M322T.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\polish.lng
text
MD5:
55dd32224bd024524f26d2d834b8d649
SHA256:
5f66118ed23153e77f55b64b223ac1de5141e46aa056e964faa4e04e0719afb4
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\portuguese_br.lng
text
MD5:
f2e778570d9131ff929fb05e8b2f75fd
SHA256:
9e4fad3eb1d1edd6d09f1abfd8c1c19e5a1179a69d014505c291523841708081
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\romanian.lng
text
MD5:
f7bb4e68eea53d30932d87dbbe10fd58
SHA256:
65a7cf191799b772f986e087b00e2434ccf51e5417cb813d588681bdf7163cd3
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\portuguese.lng
text
MD5:
1421af217e9ceea9f6904391db1dc18c
SHA256:
e18d5bf43a884c35b360e585409b0050a4458fc74f5f3d9b3337ef450eaed59b
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-SR4JE.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-1HU96.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-T8SGM.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-91512.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-EKDGK.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\norwegian.lng
text
MD5:
b40f071c39e02f2c43c8fdf71d9bb123
SHA256:
2abe575bff8ae51c5db8935ee307278ecbf3eb378e1e407b7ade77abfe6e91a2
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\korean.lng
text
MD5:
46f8909235db2179c20857a01c2438eb
SHA256:
935b6b355875ca6d4af69cb44a6b471372a33bbefe54a2a24010014f9f833155
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\lithuanian.lng
text
MD5:
c82131a1c00d9a8a6a963327d201849c
SHA256:
37058a5f02a2ad1afc48ce95c11e09524eaaf1757324798ba35daa75a4cd68ec
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\italian.lng
text
MD5:
3290414162f26b478dcd26a5c13538c8
SHA256:
300b8d32cdd58625dd20354ec20a26ae6cd44edd4680d83910bd642eaa4ae5e2
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\japanese.lng
text
MD5:
fcc50d79d4468fe72ffd17114d7700d2
SHA256:
9b70a9a2f55924220bd7e4b184da6bf5f8cb18b7b97364685cd2ce3274d0bccb
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-PMN94.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-VG3DV.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-KDVU0.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-D93LI.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-GGB2P.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\greek.lng
text
MD5:
87fa9423f252965c4c220901860ef9bb
SHA256:
cf8161b9d58fc7f35afc04739c4d1fb8e0c2c0740bd1e5cc60cc5a5eb64c35fd
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\hebrew.lng
text
MD5:
cf0ae54c4fb2787bb44c6bb1dbc4af66
SHA256:
fc91e754ae27b18d2ca816de3a763380920de8242fc31fc29f28d4b854be1cd2
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\hungarian.lng
text
MD5:
f95ff6cd5fc35bcb34c416503b1972d1
SHA256:
0eff19ebf0a3d86cde5c0cd7cd99b6a90bcc429fb011bf8140a796797f035f02
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\hindi.lng
text
MD5:
214d7781a2c2bddc2d58b147c14c3a2d
SHA256:
83481c984b05f565a4af9909291999823e2f590ef0ad08d0acc0a4e6384423dd
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-U0C8T.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-OL93B.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-KI3A9.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-685TT.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\german.lng
text
MD5:
58ff5a48d064a1bf5d11908f678bc216
SHA256:
b3bfeaf9098915d2009e7bc236a13ed0f99913b532e36a240631d10182709b7e
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\english_uk.lng
text
MD5:
332aed691bfa63f193e31af2c72445c5
SHA256:
24b9a4876a903112bac3ac8a170e6acd249d7615913152dfed16878df280c501
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\french.lng
text
MD5:
d655d9c18dd206b2a47a82112a1a4983
SHA256:
92b86bc08b928f5f1e9c1ae0d5dad31d8474ad4ba45d5b184b5699ab44abc0c5
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-4IKV3.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-73QHV.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\is-G6T50.tmp
––
MD5:
––
SHA256:
––
3796
FreeFileSync_10.14_Windows_Setup.tmp
C:\Program Files\FreeFileSync\Resources\Languages\czech.lng
text
MD5:
ae897973852fa59d70360d5159413433
SHA256:
96b866571c6f5ff6a7fb8ca6b5de7e1f71bbc18457f6d1b9fcff759278969dd8