Program did not start
General Info
- URL
-
http://i.ocs.s2emg.com/buscape/categorias/2.jpg
- Verdict
- Malicious activity
- Analysis date
- 12/2/2019, 22:30:44
- OS:
- Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
- Indicators:
Software environment set and analysis options
Launch configuration
- Task duration
- 120 seconds
- Additional time used
- 60 seconds
- Fakenet option
- off
- Heavy Evaision option
- off
- MITM proxy
- off
- Route via Tor
- off
- Network geolocation
- off
- Privacy
- Public submission
- Autoconfirmation of UAC
- on
Software preset
- Internet Explorer 8.0.7601.17514
- Adobe Acrobat Reader DC MUI (15.023.20070)
- Adobe Flash Player 26 ActiveX (26.0.0.131)
- Adobe Flash Player 26 NPAPI (26.0.0.131)
- Adobe Flash Player 26 PPAPI (26.0.0.131)
- Adobe Refresh Manager (1.8.0)
- CCleaner (5.35)
- FileZilla Client 3.36.0 (3.36.0)
- Google Chrome (75.0.3770.100)
- Google Update Helper (1.3.34.7)
- Java 8 Update 92 (8.0.920.14)
- Java Auto Updater (2.8.92.14)
- Microsoft .NET Framework 4.7.2 (4.7.03062)
- Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Access MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Access MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Excel MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Excel MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Groove MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Groove MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office IME (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office IME (Korean) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office InfoPath MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Language Pack 2010 - French/Français (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - German/Deutsch (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - Italian/Italiano (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - Japanese/日本語 (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - Korean/한국어 (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - Portuguese/Português (Brasil) (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - Russian/русский (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - Spanish/Español (14.0.4763.1000)
- Microsoft Office Language Pack 2010 - Turkish/Türkçe (14.0.4763.1013)
- Microsoft Office O MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office O MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office OneNote MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office OneNote MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Outlook MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Outlook MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office PowerPoint MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office PowerPoint MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Professional 2010 (14.0.6029.1000)
- Microsoft Office Proof (Arabic) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Basque) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Catalan) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Dutch) 2010 (14.0.4763.1000)
- Microsoft Office Proof (English) 2010 (14.0.6029.1000)
- Microsoft Office Proof (French) 2010 (14.0.6029.1000)
- Microsoft Office Proof (Galician) 2010 (14.0.4763.1000)
- Microsoft Office Proof (German) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
- Microsoft Office Proof (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Proof (Ukrainian) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
- Microsoft Office Proofing (French) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (German) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Proofing (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Publisher MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Publisher MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office SharePoint Designer MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office SharePoint Designer MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Shared MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Shared MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Single Image 2010 (14.0.6029.1000)
- Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Word MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office Word MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Office X MUI (French) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (German) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (Italian) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (Japanese) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (Korean) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (Russian) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (Spanish) 2010 (14.0.4763.1000)
- Microsoft Office X MUI (Turkish) 2010 (14.0.4763.1013)
- Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
- Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
- Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
- Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
- Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
- Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
- Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
- Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
- Mozilla Firefox 68.0.1 (x86 en-US) (68.0.1)
- Notepad++ (32-bit x86) (7.5.1)
- Opera 12.15 (12.15.1748)
- Skype version 8.29 (8.29)
- Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
- VLC media player (2.2.6)
- WinRAR 5.60 (32-bit) (5.60.0)
Hotfixes
- Client LanguagePack Package
- Client Refresh LanguagePack Package
- CodecPack Basic Package
- Foundation Package
- IE Troubleshooters Package
- InternetExplorer Optional Package
- KB2534111
- KB2999226
- KB4019990
- KB976902
- LocalPack AU Package
- LocalPack CA Package
- LocalPack GB Package
- LocalPack US Package
- LocalPack ZA Package
- ProfessionalEdition
- UltimateEdition
Behavior activities
| MALICIOUS | SUSPICIOUS | INFO |
|---|---|---|
Connects to CnC server
|
No suspicious indicators. |
Reads the hosts file
|
Screenshots
Processes
Total processes
45
Monitored processes
11
Malicious processes
0
Suspicious processes
0
Behavior graph
–
+
Specs description
Integrity level
elevation
Task сontains an error
or was rebooted
Process has crashed
Task contains several
apps running
Executable file was
dropped
Debug information is
available
Process was injected
Network attacks were
detected
Application downloaded
the executable file
Actions similar to
stealing personal data
Behavior similar to
exploiting the vulnerability
Inspected object has
sucpicious PE structure
File is detected by
antivirus software
CPU overrun
RAM overrun
Process starts the
services
Process was added to
the startup
Behavior similar to
spam
Low-level access to
the HDD
Probably Tor was used
System was rebooted
Connects to the
network
Known threat
Process information
Click at the process to see the details.
- PID
- 3180
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://i.ocs.s2emg.com/buscape/categorias/2.jpg"
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- Parent process
- ––
- User
- admin
- Integrity Level
- MEDIUM
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\wlanutil.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\wevtapi.dll |
| c:\windows\system32\nlaapi.dll |
| c:\windows\system32\wbem\wbemprox.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\credui.dll |
| c:\windows\system32\dhcpcsvc6.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\kernel32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\winsta.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\propsys.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\wbemcomn.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\hid.dll |
| c:\windows\system32\gpapi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\msi.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\wlanapi.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\mmdevapi.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome.dll |
| c:\windows\system32\d3d11.dll |
| c:\program files\google\chrome\application\chrome.exe |
| c:\windows\system32\user32.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\winusb.dll |
| c:\windows\system32\mscms.dll |
| c:\windows\system32\wbem\fastprox.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\system32\samlib.dll |
| c:\windows\system32\wbem\wmiutils.dll |
| c:\windows\system32\wpc.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\ntdsapi.dll |
| c:\windows\system32\ntmarta.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\firewallapi.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\wldap32.dll |
| c:\windows\system32\wbem\wbemsvc.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\wship6.dll |
| c:\windows\system32\windowscodecs.dll |
| c:\windows\system32\wshtcpip.dll |
| c:\windows\system32\ntshrui.dll |
| c:\windows\system32\dui70.dll |
| c:\windows\system32\kbdus.dll |
| c:\windows\system32\cscdll.dll |
| c:\windows\system32\mswsock.dll |
| c:\windows\system32\cscapi.dll |
| c:\windows\system32\explorerframe.dll |
| c:\windows\system32\ehstorshell.dll |
| c:\windows\system32\duser.dll |
| c:\windows\system32\linkinfo.dll |
| c:\windows\system32\cscui.dll |
| c:\windows\system32\imageres.dll |
| c:\windows\system32\slc.dll |
| c:\windows\system32\wbem\wmiperfinst.dll |
| c:\windows\system32\pdh.dll |
| c:\windows\system32\audioses.dll |
- PID
- 884
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6ed2a9d0,0x6ed2a9e0,0x6ed2a9ec
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- MEDIUM
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\profapi.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\userenv.dll |
| c:\program files\google\chrome\application\chrome.exe |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\usp10.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\rpcrt4.dll |
- PID
- 592
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1892 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- MEDIUM
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\windows\system32\user32.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\kernel32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\shlwapi.dll |
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\lpk.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_watcher.dll |
- PID
- 3232
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1016,7777587245234641936,15062026379159450785,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=7864429634730890960 --mojo-platform-channel-handle=1052 --ignored=" --type=renderer " /prefetch:2
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\gdi32.dll |
| c:\program files\google\chrome\application\chrome.exe |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\user32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\profapi.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\webio.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\mfplat.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\avrt.dll |
| c:\windows\system32\evr.dll |
| c:\windows\system32\d3dcompiler_47.dll |
| c:\windows\system32\msmpeg2vdec.dll |
| c:\windows\system32\ksuser.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\sqmapi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\slc.dll |
| c:\windows\system32\powrprof.dll |
| c:\windows\system32\dxva2.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\mf.dll |
| c:\windows\system32\ddraw.dll |
| c:\windows\system32\atl.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\dciman32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\swiftshader\libglesv2.dll |
| c:\program files\google\chrome\application\75.0.3770.100\swiftshader\libegl.dll |
- PID
- 3884
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1016,7777587245234641936,15062026379159450785,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=4832128318922563017 --mojo-platform-channel-handle=1532 /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- MEDIUM
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\version.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\msctf.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shell32.dll |
| c:\program files\google\chrome\application\chrome.exe |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\mswsock.dll |
| c:\windows\system32\qagentrt.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\fwpuclnt.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\nlaapi.dll |
| c:\windows\system32\wship6.dll |
| c:\windows\system32\p2pcollab.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\wshtcpip.dll |
| c:\windows\system32\rasadhlp.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\gpapi.dll |
| c:\windows\system32\dhcpcsvc6.dll |
| c:\windows\system32\dnsapi.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\fveui.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\cryptnet.dll |
| c:\windows\system32\bcryptprimitives.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\wldap32.dll |
| c:\windows\system32\ntmarta.dll |
- PID
- 3712
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,7777587245234641936,15062026379159450785,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9935589199647778294 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\advapi32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\sechost.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\sspicli.dll |
- PID
- 1596
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,7777587245234641936,15062026379159450785,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4763968275445957637 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:1
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\windows\system32\version.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\user32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\kernelbase.dll |
| c:\program files\google\chrome\application\chrome.exe |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\msasn1.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\sspicli.dll |
- PID
- 2584
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,7777587245234641936,15062026379159450785,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14888594584643931882 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2416 /prefetch:1
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\winnsi.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\shell32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\dwrite.dll |
- PID
- 328
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1016,7777587245234641936,15062026379159450785,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=4635224495050584495 --mojo-platform-channel-handle=3336 /prefetch:2
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- MEDIUM
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\sqmapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\avrt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\slc.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\program files\google\chrome\application\chrome.exe |
| c:\windows\system32\evr.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\mf.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\dxva2.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\mfplat.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\powrprof.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\atl.dll |
| c:\windows\system32\msmpeg2vdec.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\ksuser.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\devobj.dll |
- PID
- 3452
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1016,7777587245234641936,15062026379159450785,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=1584861498024323501 --mojo-platform-channel-handle=2368 /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- MEDIUM
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\windows\system32\userenv.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\winmm.dll |
| c:\program files\google\chrome\application\chrome.exe |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\wininet.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\clbcatq.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\gdi32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\ntmarta.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\wldap32.dll |
| c:\windows\system32\linkinfo.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\propsys.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\sendmail.dll |
| c:\windows\system32\cscdll.dll |
| c:\windows\system32\cscui.dll |
| c:\windows\system32\twext.dll |
| c:\windows\system32\uxtheme.dll |
| c:\windows\system32\devrtl.dll |
| c:\windows\system32\acppage.dll |
| c:\windows\system32\zipfldr.dll |
| c:\windows\system32\shdocvw.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\cscapi.dll |
| c:\windows\system32\rpcrtremote.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\ntshrui.dll |
| c:\windows\system32\fxsresm.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\windowscodecs.dll |
| c:\windows\system32\sfc_os.dll |
| c:\windows\system32\msimg32.dll |
| c:\windows\system32\slc.dll |
| c:\windows\system32\sfc.dll |
| c:\windows\system32\srvcli.dll |
| c:\program files\notepad++\nppshell_06.dll |
| c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll |
| c:\windows\system32\synceng.dll |
| c:\windows\system32\syncui.dll |
| c:\program files\winrar\rarext.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\msi.dll |
| c:\windows\system32\wer.dll |
- PID
- 332
- CMD
- "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1016,7777587245234641936,15062026379159450785,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=665827875204235734 --mojo-platform-channel-handle=488 --ignored=" --type=renderer " /prefetch:8
- Path
- C:\Program Files\Google\Chrome\Application\chrome.exe
- Indicators
- No indicators
- Parent process
- chrome.exe
- User
- admin
- Integrity Level
- LOW
- Exit code
- 0
- Version:
- Company
- Google LLC
- Description
- Google Chrome
- Version
- 75.0.3770.100
Modules
| Image |
|---|
| c:\program files\google\chrome\application\chrome.exe |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\systemroot\system32\ntdll.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll |
| c:\windows\system32\version.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\iertutil.dll |
| c:\windows\system32\dbghelp.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\oleacc.dll |
| c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
| c:\windows\system32\uiautomationcore.dll |
| c:\windows\system32\crypt32.dll |
| c:\windows\system32\dwmapi.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\psapi.dll |
| c:\windows\system32\dwrite.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\userenv.dll |
| c:\windows\system32\ole32.dll |
| c:\program files\google\chrome\application\75.0.3770.100\chrome_child.dll |
| c:\windows\system32\dxgi.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\winspool.drv |
| c:\windows\system32\winhttp.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\wtsapi32.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\webio.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\dhcpcsvc.dll |
| c:\windows\system32\profapi.dll |
| c:\windows\system32\wintrust.dll |
| c:\windows\system32\comdlg32.dll |
| c:\windows\system32\urlmon.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\winmm.dll |
| c:\windows\system32\wininet.dll |
Registry activity
Total events
649
Read events
569
Write events
79
Delete events
1
Modification events
PID
Process
Operation
Key
Name
Value
3180
chrome.exe
delete key
HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
failed_count
0
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
2
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
01000000
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
1
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
dr
1
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome
UsageStatsInSample
0
3180
chrome.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
usagestats
0
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
metricsid
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
metricsid_installdate
0
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
metricsid_enableddate
0
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
0
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
lastrun
13219795867303625
3180
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
LanguageList
en-US
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice
Progid
ChromeHTML
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
Progid
ChromeHTML
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice
Progid
ChromeHTML
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice
Progid
ChromeHTML
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice
Progid
ChromeHTML
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice
Progid
ChromeHTML
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice
Progid
ChromeHTML
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice
Progid
ChromeHTML
3180
chrome.exe
write
HKEY_CLASSES_ROOT\.htm
ChromeHTML
3180
chrome.exe
write
HKEY_CLASSES_ROOT\.html
ChromeHTML
3180
chrome.exe
write
HKEY_CLASSES_ROOT\.shtml
ChromeHTML
3180
chrome.exe
write
HKEY_CLASSES_ROOT\.xht
ChromeHTML
3180
chrome.exe
write
HKEY_CLASSES_ROOT\.xhtml
ChromeHTML
3180
chrome.exe
write
HKEY_CLASSES_ROOT\ftp
URL Protocol
3180
chrome.exe
write
HKEY_CLASSES_ROOT\ftp\DefaultIcon
C:\Program Files\Google\Chrome\Application\chrome.exe,0
3180
chrome.exe
write
HKEY_CLASSES_ROOT\ftp\shell\open\command
"C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
3180
chrome.exe
write
HKEY_CLASSES_ROOT\ftp\shell\open\ddeexec
3180
chrome.exe
write
HKEY_CLASSES_ROOT\ftp\shell
open
3180
chrome.exe
write
HKEY_CLASSES_ROOT\http
URL Protocol
3180
chrome.exe
write
HKEY_CLASSES_ROOT\http\DefaultIcon
C:\Program Files\Google\Chrome\Application\chrome.exe,0
3180
chrome.exe
write
HKEY_CLASSES_ROOT\http\shell\open\command
"C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
3180
chrome.exe
write
HKEY_CLASSES_ROOT\http\shell\open\ddeexec
3180
chrome.exe
write
HKEY_CLASSES_ROOT\http\shell
open
3180
chrome.exe
write
HKEY_CLASSES_ROOT\https
URL Protocol
3180
chrome.exe
write
HKEY_CLASSES_ROOT\https\DefaultIcon
C:\Program Files\Google\Chrome\Application\chrome.exe,0
3180
chrome.exe
write
HKEY_CLASSES_ROOT\https\shell\open\command
"C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
3180
chrome.exe
write
HKEY_CLASSES_ROOT\https\shell\open\ddeexec
3180
chrome.exe
write
HKEY_CLASSES_ROOT\https\shell
open
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Clients\StartmenuInternet
Google Chrome
3180
chrome.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault
S-1-5-21-1302019708-1500728564-335382590-1000
D9FD449555F72E00
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Common\Rlz\PTimes
C
796F5E0458A9D501
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Common\Rlz\RLZs
C1
1C1GCEA_enUA812UA812
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Common\Rlz\RLZs
C2
1C2GCEA_enUA812
3180
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Common\Rlz\RLZs
C7
1C7GCEA_enUA812
592
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
3180-13219795865428625
259
3884
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
LanguageList
en-US
3884
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
@%SystemRoot%\system32\p2pcollab.dll,-8042
Peer to Peer Trust
3884
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
@%SystemRoot%\system32\qagentrt.dll,-10
System Health Authentication
3884
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
@%SystemRoot%\system32\dnsapi.dll,-103
Domain Name System (DNS) Server Trust
3884
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
@%SystemRoot%\System32\fveui.dll,-843
BitLocker Drive Encryption
3884
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
@%SystemRoot%\System32\fveui.dll,-844
BitLocker Data Recovery Agent
3452
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
LanguageList
en-US
3452
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
@sendmail.dll,-21
Desktop (create shortcut)
3452
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
@zipfldr.dll,-10148
Compressed (zipped) folder
3452
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
@sendmail.dll,-4
Mail recipient
3452
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
@C:\Windows\system32\FXSRESM.dll,-120
Fax recipient
Files activity
Executable files
0
Suspicious files
6
Text files
65
Unknown types
0
Dropped files
PID
Process
Filename
Type
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Local State~RF3b0b7a.TMP
text
MD5:
535c68da85ba44f44316061694c81132
SHA256:
2b5c5eb807a3e6ff83617ce0cadc697a500623c6990503ca95d96be1c29aa6dc
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old
text
MD5:
97aa7678fb9d338d08c371711b54a104
SHA256:
4657635b66fa68ae1550b7bff4e54016f8874b4df43a004c9a7244c8465c6ca8
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\95605584-3fbd-47a4-a800-b45b30e5ad7f.tmp
––
MD5:
––
SHA256:
––
3884
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State
text
MD5:
62af8f1e01d09779fcd0310636b970c2
SHA256:
c6537e5d2efc3b23687b76ad68ad0a6f972e7c942f2289c9e6684164f56c78ad
3884
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State~RF3b0502.TMP
text
MD5:
62af8f1e01d09779fcd0310636b970c2
SHA256:
c6537e5d2efc3b23687b76ad68ad0a6f972e7c942f2289c9e6684164f56c78ad
3884
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\2e391fde-0720-4989-a291-9a28aeaf17b0.tmp
––
MD5:
––
SHA256:
––
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Local State
text
MD5:
535c68da85ba44f44316061694c81132
SHA256:
2b5c5eb807a3e6ff83617ce0cadc697a500623c6990503ca95d96be1c29aa6dc
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Local State~RF3acda6.TMP
text
MD5:
535c68da85ba44f44316061694c81132
SHA256:
2b5c5eb807a3e6ff83617ce0cadc697a500623c6990503ca95d96be1c29aa6dc
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\96e94beb-da11-468f-81de-c11ac95c8278.tmp
––
MD5:
––
SHA256:
––
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF3acbf0.TMP
text
MD5:
ed49e33bf39ea948136404e06b717c60
SHA256:
9c88d818a56015b81e6f026081df0a640714057c58057363debf943efe0dcb33
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
text
MD5:
ed49e33bf39ea948136404e06b717c60
SHA256:
9c88d818a56015b81e6f026081df0a640714057c58057363debf943efe0dcb33
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\a1f4625e-9530-4dbf-ac48-30f27ef53830.tmp
––
MD5:
––
SHA256:
––
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Local State
text
MD5:
0f06f2677c37ab666e16e0751ba2f721
SHA256:
841723aaa08b249dd5be02c866b978edf69a6689406d25a525e9f22e1f3044c6
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Local State~RF3a7dd0.TMP
text
MD5:
0f06f2677c37ab666e16e0751ba2f721
SHA256:
841723aaa08b249dd5be02c866b978edf69a6689406d25a525e9f22e1f3044c6
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\7a4c7359-37c9-4dfa-8a75-ac5e974e453e.tmp
––
MD5:
––
SHA256:
––
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
text
MD5:
e4c32c6471b081537b716a34507133f1
SHA256:
c8033ec8cf82674b2de89d1aef1107ecba53bf76bbdd495aef1b8e0c4bed93ad
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF3a56c0.TMP
text
MD5:
e4c32c6471b081537b716a34507133f1
SHA256:
c8033ec8cf82674b2de89d1aef1107ecba53bf76bbdd495aef1b8e0c4bed93ad
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\e20b235e-88bc-4e88-a848-303886a2f023.tmp
––
MD5:
––
SHA256:
––
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Local State
text
MD5:
0a74b55d7b9da9dfb6c6ea248121dff6
SHA256:
0329a6ba28d17e6f51da058128c4c4a46af8db8fdfb46165b42bded009442d64
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Local State~RF3a1f55.TMP
text
MD5:
0a74b55d7b9da9dfb6c6ea248121dff6
SHA256:
0329a6ba28d17e6f51da058128c4c4a46af8db8fdfb46165b42bded009442d64
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\bedff49a-08d4-4c5d-a740-772edd92e6d8.tmp
––
MD5:
––
SHA256:
––
3884
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity~RF3a1ad1.TMP
text
MD5:
ab630108ffeb4e825be929ef8959f467
SHA256:
dcc8555e552184b889226fa1ef48bb58e42d041d044644622119aa9e756b289d
3884
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity
text
MD5:
ab630108ffeb4e825be929ef8959f467
SHA256:
dcc8555e552184b889226fa1ef48bb58e42d041d044644622119aa9e756b289d
3884
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\fe965244-7341-4b6a-9606-cd0eb6943c6f.tmp
––
MD5:
––
SHA256:
––
3884
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity
text
MD5:
b45e17c852dab2b13f909488d417d022
SHA256:
72a5f95f42ab3ac6e4750f2206498c53d412bd51c1ded6ce9ecedeb6ba8b6925
3884
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity~RF39e4ec.TMP
text
MD5:
b45e17c852dab2b13f909488d417d022
SHA256:
72a5f95f42ab3ac6e4750f2206498c53d412bd51c1ded6ce9ecedeb6ba8b6925
3884
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\f317a919-23d9-4de9-b276-b99d3064dc2f.tmp
––
MD5:
––
SHA256:
––
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
text
MD5:
ed6ee6fd9b589c715eade81604789597
SHA256:
ded4159b05ef0e9daa97e49090dc0673ba2fe2aed41292bd3671499775fbf922
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF39e0f4.TMP
text
MD5:
ed6ee6fd9b589c715eade81604789597
SHA256:
ded4159b05ef0e9daa97e49090dc0673ba2fe2aed41292bd3671499775fbf922
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ce3b6604-0e5b-423c-ab0d-d1cb5debe72f.tmp
––
MD5:
––
SHA256:
––
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Local State
text
MD5:
b42b058e27156d2c834bf299e5f4fad1
SHA256:
92ba999108198f8a81dec0ecd01ba73731359d5508283f2e11399a4c574d9d75
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Local State~RF39e019.TMP
text
MD5:
b42b058e27156d2c834bf299e5f4fad1
SHA256:
92ba999108198f8a81dec0ecd01ba73731359d5508283f2e11399a4c574d9d75
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\b5417863-8069-481d-98f5-564dcc5ce4df.tmp
––
MD5:
––
SHA256:
––
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
––
MD5:
––
SHA256:
––
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Last Session
binary
MD5:
92eb31d830454841999ecdb4a714d301
SHA256:
63f01870e03b0329f3ae859435ef5610661a45085390af36275ae7d6808c8ffb
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG.old
text
MD5:
1276f7de036cb69ffbc104fa79f1d060
SHA256:
3044aa641bd2fed097ee25a5ad052d276eea8ec75a807a244102d75af9ac94f1
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG.old~RF39c1d3.TMP
text
MD5:
1276f7de036cb69ffbc104fa79f1d060
SHA256:
3044aa641bd2fed097ee25a5ad052d276eea8ec75a807a244102d75af9ac94f1
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RF39c166.TMP
text
MD5:
370df9c4af340d044e2946d87d515fd8
SHA256:
f4761a6412fee517fddf04004ddcb13b935994fba8550318534705c979a29343
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old
text
MD5:
370df9c4af340d044e2946d87d515fd8
SHA256:
f4761a6412fee517fddf04004ddcb13b935994fba8550318534705c979a29343
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
binary
MD5:
f50f89a0a91564d0b8a211f8921aa7de
SHA256:
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
––
MD5:
––
SHA256:
––
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG
text
MD5:
0a1e4fd3ace5662881e0870b918bd008
SHA256:
313e012fc23b70e0e414df0f3d43282af9451366499e57d3f4b2334eafa54377
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log
binary
MD5:
891a884b9fa2bff4519f5f56d2a25d62
SHA256:
e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old
––
MD5:
––
SHA256:
––
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old
text
MD5:
722d616be0caaf9ed585c9aea7f3742c
SHA256:
f86c514fa380332be463670b3b334c8feedc2f6cb9b4118ea367729b056de0fb
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old
text
MD5:
454106ccf080f3e3795c229fc73350d4
SHA256:
9974dc611be9e20bdfa7b8d939cb913ad23859dea5f52ebb8d10cead9ab5b4fa
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old~RF39bbf7.TMP
text
MD5:
454106ccf080f3e3795c229fc73350d4
SHA256:
9974dc611be9e20bdfa7b8d939cb913ad23859dea5f52ebb8d10cead9ab5b4fa
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old
text
MD5:
911b244e4a362b56f2478647d2d61a40
SHA256:
3a5aec1ea537d8841e604d0aa4cd5f9241c805a3d4eb4e372cfb7eeb3678a361
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old
text
MD5:
0acecca4cf9ade756da7cc9dcdf02d50
SHA256:
18f910775132b4fee014ea0fab836d857f367e76232fab4ae6a86a92e4c3ebee
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT
text
MD5:
a874f3e3462932a0c15ed8f780124fc5
SHA256:
01bd196d6a114691ec642082ebf6591765c0168d4098a0cd834869bd11c8b87d
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT~RF39bb3c.TMP
text
MD5:
a874f3e3462932a0c15ed8f780124fc5
SHA256:
01bd196d6a114691ec642082ebf6591765c0168d4098a0cd834869bd11c8b87d
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000020.dbtmp
text
MD5:
a874f3e3462932a0c15ed8f780124fc5
SHA256:
01bd196d6a114691ec642082ebf6591765c0168d4098a0cd834869bd11c8b87d
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old
text
MD5:
3d551b6e929cf62f7aa66091e718704b
SHA256:
1698a1b1bc3e86676392fb8bd4c712438302a5a2220503c08f290ed4b1790404
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old~RF39bacf.TMP
text
MD5:
3d551b6e929cf62f7aa66091e718704b
SHA256:
1698a1b1bc3e86676392fb8bd4c712438302a5a2220503c08f290ed4b1790404
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\81afc933-c909-421c-a956-6a96f6b22155.tmp
––
MD5:
––
SHA256:
––
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Last Tabs
binary
MD5:
0686d6159557e1162d04c44240103333
SHA256:
3303d5eed881951b0bb52cf1c6bfa758770034d0120c197f9f7a3520b92a86fb
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF39baa0.TMP
text
MD5:
a519780ed0a2f4336db4f5651d79c369
SHA256:
da5b71bd0075b55757bf757bf5f4d4a1dcbcf0762cda5b31b28680963e068c75
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old
text
MD5:
a519780ed0a2f4336db4f5651d79c369
SHA256:
da5b71bd0075b55757bf757bf5f4d4a1dcbcf0762cda5b31b28680963e068c75
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old
text
MD5:
213ae3da120d7862d60b5763b6c9d466
SHA256:
5736534d6ee654c1bf1a8e79e73330af58f622e8657285330d2c7189a55604f4
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF39ba52.TMP
text
MD5:
213ae3da120d7862d60b5763b6c9d466
SHA256:
5736534d6ee654c1bf1a8e79e73330af58f622e8657285330d2c7189a55604f4
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old
text
MD5:
dc32343f45b01764b6267ad36548102a
SHA256:
a250f5ad57d4bd58aae92810d50278e3be2dbf869f126a3a3519691bcdfc2075
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old
text
MD5:
c4d6cbb269c626168a5d6d0d8cce6c30
SHA256:
b62cdbb758278a0c2e50593357390119441d8de09428eb29027f3dfd1332e348
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF39ba13.TMP
text
MD5:
c4d6cbb269c626168a5d6d0d8cce6c30
SHA256:
b62cdbb758278a0c2e50593357390119441d8de09428eb29027f3dfd1332e348
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF39ba13.TMP
text
MD5:
dc32343f45b01764b6267ad36548102a
SHA256:
a250f5ad57d4bd58aae92810d50278e3be2dbf869f126a3a3519691bcdfc2075
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Version
text
MD5:
1a89a1bebe6c843c4ff582e7ed33ca1f
SHA256:
65099ca087b66aa8ca420ab121daad713e1db5a61c5a574d9b1c0df24f012520
3180
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
binary
MD5:
9c016064a1f864c8140915d77cf3389a
SHA256:
0e7265d4a8c16223538edd8cd620b8820611c74538e420a88e333be7f62ac787
884
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma
binary
MD5:
b59113c2dcd2d346f31a64f231162ada
SHA256:
1d97c69aea85d3b06787458ea47576b192ce5c5db9940e5eaa514ff977ce2dc2
Network activity
HTTP(S) requests
1
TCP/UDP connections
11
DNS requests
9
Threats
1
HTTP requests
| PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
| 3884 | chrome.exe | GET | –– | 195.22.26.248:80 | http://i.ocs.s2emg.com/buscape/categorias/2.jpg | PT |
––
|
––
|
malicious |
Connections
| PID | Process | IP | ASN | CN | Reputation |
|---|---|---|---|---|---|
| 3884 | chrome.exe | 172.217.18.99:443 | Google Inc. | US | whitelisted |
| 3884 | chrome.exe | 172.217.16.141:443 | Google Inc. | US | suspicious |
| 3884 | chrome.exe | 195.22.26.248:80 | Claranet Ltd | PT | malicious |
| 3884 | chrome.exe | 172.217.22.68:443 | Google Inc. | US | whitelisted |
| 3884 | chrome.exe | 216.58.205.227:443 | Google Inc. | US | whitelisted |
| 3884 | chrome.exe | 172.217.16.163:443 | Google Inc. | US | whitelisted |
| 3884 | chrome.exe | 172.217.21.238:443 | Google Inc. | US | whitelisted |
DNS requests
| Domain | IP | Reputation |
|---|---|---|
| i.ocs.s2emg.com | 195.22.26.248
|
malicious |
| clientservices.googleapis.com | 172.217.18.99
|
shared |
| accounts.google.com | 172.217.16.141
|
whitelisted |
| www.google.com | 172.217.22.68
|
whitelisted |
| ssl.gstatic.com | 216.58.205.227
|
whitelisted |
| www.google.it | 172.217.16.163
|
whitelisted |
| www.gstatic.com | 172.217.16.163
|
whitelisted |
| clients1.google.com | 172.217.21.238
|
whitelisted |
Debug output strings
No debug info.