IOC Report
rU6YAgkoAw.exe

loading gif

Files

File Path
Type
Category
Malicious
rU6YAgkoAw.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\ffmpeg.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\libEGL.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\libGLESv2.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\vk_swiftshader.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\build.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
dropped
 malicious
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\ffmpeg.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\libEGL.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\libGLESv2.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\main.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\vk_swiftshader.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\vulkan-1.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\start.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
modified
 malicious
C:\Users\user\AppData\Local\Temp\svchost (3).exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmpAADD.tmp.exe
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\UserData\Updater.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
dropped
 malicious
C:\Users\user\AppData\Roaming\svchos.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost (3).exe_6b3b463e962e5c2699281581d7029176619de8_1f2af782_f4cf4be7-b06a-43e0-bb0f-166f851b48d0\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE36.tmp.dmp
Mini DuMP crash report, 16 streams, Thu Mar 28 16:04:41 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC0A8.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC107.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rU6YAgkoAw.exe.log
CSV text
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\start.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchos.exe.log
CSV text
dropped
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\LICENSE.electron.txt
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\LICENSES.chromium.html
HTML document, ASCII text
dropped
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\chrome_100_percent.pak
data
dropped
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\chrome_200_percent.pak
data
dropped
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\d3dcompiler_47.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\icudtl.dat
data
dropped
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\resources.pak
data
dropped
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\snapshot_blob.bin
data
dropped
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\v8_context_snapshot.bin
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\LICENSE.electron.txt
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\LICENSES.chromium.html
HTML document, ASCII text
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\chrome_100_percent.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\chrome_200_percent.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\d3dcompiler_47.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\icudtl.dat
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\af.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\am.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\ar.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\bg.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\bn.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\ca.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\cs.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\da.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\de.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\el.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\en-GB.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\en-US.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\es-419.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\es.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\et.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\fa.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\fi.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\fil.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\fr.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\gu.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\he.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\hi.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\hr.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\hu.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\id.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\it.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\ja.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\kn.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\ko.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\lt.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\lv.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\ml.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\mr.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\ms.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\nb.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\nl.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\pl.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\pt-BR.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\pt-PT.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\ro.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\ru.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\sk.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\sl.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\sr.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\sv.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\sw.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\ta.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\te.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\th.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\tr.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\uk.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\ur.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\vi.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\zh-CN.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\locales\zh-TW.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\resources.pak
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\resources\app.asar
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\resources\elevate.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\snapshot_blob.bin
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\v8_context_snapshot.bin
data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\7z-out\vk_swiftshader_icd.json
JSON data
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\app-64.7z
7-zip archive data, version 0.4
dropped
C:\Users\user\AppData\Local\Temp\nspBED4.tmp\nsis7z.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\tmpD46E.tmp.bat
DOS batch file, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\main\503039a5-5054-49bb-b89c-9fcea481f63f.tmp
JSON data
dropped
C:\Users\user\AppData\Roaming\main\Local State (copy)
JSON data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
\Device\Null
ASCII text, with CRLF line terminators, with overstriking
dropped
There are 101 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\rU6YAgkoAw.exe
"C:\Users\user\Desktop\rU6YAgkoAw.exe"
 malicious
C:\Users\user\AppData\Local\Temp\tmpAADD.tmp.exe
"C:\Users\user\AppData\Local\Temp\tmpAADD.tmp.exe"
malicious
C:\Users\user\AppData\Local\Temp\svchost (3).exe
"C:\Users\user~1\AppData\Local\Temp\svchost (3).exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
 malicious
C:\Users\user\AppData\Local\Temp\build.exe
"C:\Users\user~1\AppData\Local\Temp\build.exe"
malicious
C:\Users\user\AppData\Local\Temp\start.exe
"C:\Users\user~1\AppData\Local\Temp\start.exe"
malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' & exit
malicious
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpD46E.tmp.bat""
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"'
malicious
C:\Users\user\AppData\Roaming\svchos.exe
C:\Users\user\AppData\Roaming\svchos.exe
 malicious
C:\Users\user\AppData\Roaming\svchos.exe
"C:\Users\user\AppData\Roaming\svchos.exe"
malicious
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe
C:\Users\user~1\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe
 malicious
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe
"C:\Users\user~1\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\main" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1836,i,5338084480249902922,7187138240786215467,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
malicious
C:\Users\user\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe
"C:\Users\user~1\AppData\Local\Temp\2eHfvuySzqzZl8qUAC9nldhe9q6\main.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\main" --mojo-platform-channel-handle=2148 --field-trial-handle=1836,i,5338084480249902922,7187138240786215467,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
malicious
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 7424 -s 1184
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\timeout.exe
timeout 3
There are 8 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://doh.cox.net/dns-querydot.cox.net68.105.28.1168.105.28.122001:578:3f::30
unknown
https://www.google.com/chrome/privacy/eula_text.htmlInasimamiwa
unknown
https://support.google.com/chrome/answer/6098869
unknown
https://dns10.quad9.net/dns-query
unknown
https://www.google.com/chrome/privacy/eula_text.html
unknown
https://chromium.dns.nextdns.io
unknown
http://www.unicode.org/copyright.html
unknown
https://doh.familyshield.opendns.com/dns-query
unknown
https://chrome.google.com/webstore?hl=ca&category=theme81https://myactivity.google.com/myactivity/?u
unknown
https://doh.cleanbrowsing.org/doh/security-filter
unknown
https://dns.google/dns-query
unknown
https://public.dns.iij.jp/
unknown
https://chrome.google.com/webstore?hl=el
unknown
https://passwords.google.comCompte
unknown
https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/Cloudflare
unknown
https://photos.google.com/settings?referrer=CHROME_NTP
unknown
https://doh.cox.net/dns-query
unknown
https://myactivity.google.com/
unknown
https://perfetto.dev/docs/contributing/getting-started#community).No
unknown
https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11Pd
unknown
https://doh.quickline.ch/dns-query
unknown
https://www.nic.cz/odvr/
unknown
https://chrome-devtools-frontend.appspot.com/
unknown
https://developers.google.com/speed/public-dns/privacy
unknown
https://dns11.quad9.net/dns-query
unknown
https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
unknown
https://passwords.google.comAkaunti
unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
unknown
https://passwords.google.com
unknown
https://www.nic.cz/odvr/CZ.NIC
unknown
https://policies.google.com/
unknown
https://doh-02.spectrum.com/dns-query
unknown
https://www.google.com/chrome/privacy/eula_text.htmlGestionat
unknown
https://public.dns.iij.jp/dns-queryIijUShttps://nextdns.io/privacyNextDNShttps://chromium.dns.nextdn
unknown
https://www.quad9.net/home/privacy/Quad9
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://perfetto.dev/docs/contributing/getting-started#community).
unknown
https://public.dns.iij.jp/IIJ
unknown
https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
unknown
https://dns10.quad9.net/dns-querydns10.quad9.net9.9.9.10149.112.112.102620:fe::102620:fe::fe:10
unknown
https://chrome.google.com/webstore?hl=caS
unknown
https://cleanbrowsing.org/privacyCleanBrowsing
unknown
https://nextdns.io/privacy
unknown
https://odvr.nic.cz/doh
unknown
https://chrome.google.com/webstore/category/extensions
unknown
https://doh.cleanbrowsing.org/doh/family-filter
unknown
https://support.google.com/chromebook?p=app_intent
unknown
https://doh.xfinity.com/dns-query
unknown
https://alekberg.net/privacyalekberg.net
unknown
https://cleanbrowsing.org/privacy
unknown
https://www.quad9.net/home/privacy/
unknown
https://developers.google.com/speed/public-dns/privacyGoogle
unknown
https://chrome.cloudflare-dns.com/dns-queryone.one.one.one1dot1dot1dot1.cloudflare-dns.com1.1.1.11.0
unknown
https://dns64.dns.google/dns-query
unknown
http://upx.sf.net
unknown
https://doh.cleanbrowsing.org/doh/adult-filter
unknown
https://doh.opendns.com/dns-query
unknown
https://doh-01.spectrum.com/dns-query
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
https://dns.quad9.net/dns-query
unknown
https://www.cisco.com/c/en/us/about/legal/privacy-full.html
unknown
https://chrome.google.com/webstore?hl=el&category=theme81https://myactivity.google.com/myactivity/?u
unknown
https://dns.quad9.net/dns-querydns.quad9.netdns9.quad9.net9.9.9.9149.112.112.1122620:fe::fe2620:fe::
unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
unknown
https://dns.sb/privacy/DNS.SBhttps://doh.dns.sb/dns-query
unknown
https://chrome.cloudflare-dns.com/dns-query
unknown
https://odvr.nic.cz/dohodvr.nic.cz185.43.135.1193.17.47.12001:148f:fffe::12001:148f:ffff::1
unknown
http://93.123.39.68/order.exe
93.123.39.68
https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC
unknown
https://public.dns.iij.jp/dns-query
unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
unknown
https://chrome.google.com/webstore?hl=swUmeondoa
unknown
https://dns.sb/privacy/
unknown
https://doh.dns.sb/dns-query
unknown
https://support.google.com/chrome/a/?p=block_warn
unknown
https://alekberg.net/privacy
unknown
https://dnsnl.alekberg.net/dns-query
unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
unknown
There are 69 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
leetboy.dynuddns.net
185.196.11.223
 malicious
rentry.co
104.21.95.148
cosmicdust.zip
192.236.232.25
cosmoplanets.net
172.67.142.111
blue.o7lab.me
94.156.66.112
windowsupdatebg.s.llnwi.net
69.164.0.128

IPs

IP
Domain
Country
Malicious
185.196.11.223
leetboy.dynuddns.net
Switzerland
malicious
93.123.39.68
unknown
Bulgaria
94.156.66.112
blue.o7lab.me
Bulgaria
192.236.232.25
cosmicdust.zip
United States
172.67.142.111
cosmoplanets.net
United States
104.21.95.148
rentry.co
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rU6YAgkoAw_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rU6YAgkoAw_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rU6YAgkoAw_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rU6YAgkoAw_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rU6YAgkoAw_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rU6YAgkoAw_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rU6YAgkoAw_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rU6YAgkoAw_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rU6YAgkoAw_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rU6YAgkoAw_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rU6YAgkoAw_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rU6YAgkoAw_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rU6YAgkoAw_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rU6YAgkoAw_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum
Version
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
ProgramId
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
FileId
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
LowerCaseLongPath
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
LongPathHash
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
Name
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
OriginalFileName
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
Publisher
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
Version
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
BinFileVersion
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
BinaryType
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
ProductName
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
ProductVersion
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
LinkDate
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
BinProductVersion
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
AppxPackageFullName
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
AppxPackageRelativeId
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
Size
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
Language
\REGISTRY\A\{d8dce538-61a8-38cd-7b33-a7309ef14e05}\Root\InventoryApplicationFile\svchost (3).exe|a27685539ac88465
Usn
There are 25 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
C62000
unkown
page readonly
 malicious
300B000
trusted library allocation
page read and write
 malicious
B73000
trusted library allocation
page execute and read and write
C5D000
stack
page read and write
1247000
trusted library allocation
page execute and read and write
7FF7C81BB000
unkown
page execute read
50B000
unkown
page readonly
271C000
trusted library allocation
page read and write
400000
heap
page read and write
634D000
stack
page read and write
1240000
trusted library allocation
page read and write
13D8000
heap
page read and write
28F1000
heap
page read and write
715000
heap
page read and write
400000
unkown
page readonly
3010000
heap
page read and write
1406000
heap
page read and write
2FB9000
trusted library allocation
page read and write
272F000
trusted library allocation
page read and write
2EF1000
heap
page read and write
1230000
trusted library allocation
page read and write
34D000
stack
page read and write
13F9000
heap
page read and write
BA7000
trusted library allocation
page execute and read and write
30B0000
heap
page read and write
13AF000
stack
page read and write
2F2E000
trusted library allocation
page read and write
3602000
unkown
page readonly
10F9000
stack
page read and write
3711000
trusted library allocation
page read and write
1403000
heap
page read and write
7FF7C95BB000
unkown
page execute read
712000
heap
page read and write
2A1C000
heap
page read and write
CD0000
heap
page read and write
581D000
stack
page read and write
2FF1000
trusted library allocation
page read and write
2FF5000
trusted library allocation
page read and write
3230000
heap
page read and write
57DE000
stack
page read and write
32B0000
heap
page read and write
7FF7CDD32000
unkown
page readonly
4EFC000
stack
page read and write
124B000
trusted library allocation
page execute and read and write
19B000
stack
page read and write
71A000
heap
page read and write
27F6000
heap
page read and write
2C02000
unkown
page readonly
11F5000
heap
page read and write
2E71000
heap
page read and write
5ADE000
stack
page read and write
7FF7CDD42000
unkown
page readonly
2FE0000
heap
page read and write
897000
heap
page read and write
29F1000
heap
page read and write
1520000
heap
page read and write
759000
stack
page read and write
2A40000
heap
page read and write
2AF1000
heap
page read and write
2C02000
unkown
page readonly
402000
unkown
page readonly
E02000
unkown
page readonly
868000
heap
page read and write
3070000
heap
page read and write
7FF7C81BB000
unkown
page execute read
33B0000
heap
page read and write
65C000
stack
page read and write
2713000
trusted library allocation
page read and write
1220000
trusted library allocation
page read and write
7FF7C63BB000
unkown
page execute read
2711000
trusted library allocation
page read and write
2A40000
heap
page read and write
31B0000
heap
page read and write
1200000
trusted library allocation
page read and write
5C1E000
stack
page read and write
9B000
stack
page read and write
2C0F000
stack
page read and write
894000
heap
page read and write
12A0000
heap
page read and write
3271000
heap
page read and write
3071000
heap
page read and write
58E0000
heap
page read and write
1802000
unkown
page readonly
1E0000
heap
page read and write
7FF7C9FBB000
unkown
page execute read
25AE000
stack
page read and write
7FF7C8BBB000
unkown
page execute read
2FF0000
heap
page read and write
4C66000
heap
page read and write
7FF7C9FBB000
unkown
page execute read
2202000
unkown
page readonly
2EC1000
trusted library allocation
page read and write
7FF7C95BB000
unkown
page execute read
7FF7C5F21000
unkown
page execute read
7FF7CC7BB000
unkown
page execute read
E02000
unkown
page readonly
B74000
trusted library allocation
page read and write
CA0000
heap
page execute and read and write
3FE000
unkown
page read and write
7FF7CA9BB000
unkown
page execute read
13B0000
trusted library allocation
page read and write
54A0000
heap
page read and write
3004000
trusted library allocation
page read and write
1214000
trusted library allocation
page read and write
3130000
heap
page read and write
B6E000
stack
page read and write
3030000
heap
page read and write
5D1E000
stack
page read and write
2F6C000
trusted library allocation
page read and write
2970000
heap
page read and write
624C000
stack
page read and write
30F0000
heap
page read and write
2DB0000
heap
page read and write
3170000
heap
page read and write
402000
unkown
page readonly
121D000
trusted library allocation
page execute and read and write
7FF7C5F20000
unkown
page readonly
32F0000
heap
page read and write
C70000
heap
page read and write
1802000
unkown
page readonly
31F1000
heap
page read and write
2FB0000
heap
page read and write
2F5C000
trusted library allocation
page read and write
7F0000
heap
page read and write
400000
unkown
page readonly
13D0000
heap
page read and write
2F75000
trusted library allocation
page read and write
4002000
unkown
page readonly
401000
unkown
page execute read
2DF0000
heap
page read and write
15E0000
heap
page execute and read and write
7FF7C5F20000
unkown
page readonly
2C7C000
stack
page read and write
55A0000
heap
page read and write
7B0000
heap
page read and write
2FF1000
heap
page read and write
7C0000
heap
page read and write
11F0000
heap
page read and write
B80000
trusted library allocation
page read and write
2C70000
heap
page read and write
7FF7CA9BB000
unkown
page execute read
BAB000
trusted library allocation
page execute and read and write
33F1000
heap
page read and write
C60000
trusted library allocation
page execute and read and write
408000
unkown
page readonly
7FF7C8BBB000
unkown
page execute read
DC0000
heap
page read and write
B50000
unkown
page readonly
40A000
unkown
page write copy
B2F000
stack
page read and write
60F0000
heap
page read and write
7FF7CD1BB000
unkown
page execute read
402000
unkown
page readonly
3330000
heap
page read and write
401000
unkown
page execute read
2EC0000
heap
page read and write
DE0000
heap
page read and write
2D70000
heap
page read and write
2A40000
heap
page read and write
400000
unkown
page readonly
2A0F000
unkown
page read and write
31F0000
heap
page read and write
3171000
heap
page read and write
2680000
trusted library allocation
page read and write
2BB0000
heap
page read and write
123A000
trusted library allocation
page execute and read and write
B7D000
trusted library allocation
page execute and read and write
DDF000
stack
page read and write
2C90000
heap
page read and write
432D000
unkown
page readonly
3021000
trusted library allocation
page read and write
1237000
trusted library allocation
page execute and read and write
2F61000
trusted library allocation
page read and write
2D20000
heap
page read and write
2CB0000
heap
page read and write
2CF0000
heap
page read and write
7FF7C6DBB000
unkown
page execute read
2B71000
heap
page read and write
2EE4000
trusted library allocation
page read and write
7FF7CDD29000
unkown
page readonly
2CA0000
heap
page read and write
2BF0000
heap
page read and write
2F92000
trusted library allocation
page read and write
2EBE000
stack
page read and write
2E80000
heap
page read and write
5BDE000
stack
page read and write
2A40000
heap
page read and write
1C7CAF62000
unkown
page readonly
2900000
heap
page read and write
2202000
unkown
page readonly
2700000
heap
page read and write
549F000
stack
page read and write
B52000
unkown
page readonly
860000
heap
page read and write
C90000
trusted library allocation
page read and write
2FCA000
trusted library allocation
page read and write
883000
heap
page read and write
2FE0000
trusted library allocation
page read and write
2A40000
heap
page read and write
13ED000
heap
page read and write
2A30000
heap
page read and write
7F6000
heap
page read and write
7FF7CB3BB000
unkown
page execute read
27F1000
heap
page read and write
1E5000
heap
page read and write
7FF7C77BB000
unkown
page execute read
1260000
trusted library allocation
page read and write
144C000
heap
page read and write
3017000
heap
page read and write
1270000
trusted library allocation
page execute and read and write
D70000
heap
page read and write
2F0E000
stack
page read and write
267E000
stack
page read and write
3B0000
heap
page read and write
29F0000
heap
page read and write
1213000
trusted library allocation
page execute and read and write
7FF7C77BB000
unkown
page execute read
1232000
trusted library allocation
page read and write
1C7CAF60000
unkown
page readonly
256C000
stack
page read and write
48AD000
stack
page read and write
2E3E000
stack
page read and write
799000
heap
page read and write
4C78000
heap
page read and write
13B5000
trusted library allocation
page read and write
2B70000
heap
page read and write
2A40000
heap
page read and write
7FF7C5F21000
unkown
page execute read
2871000
heap
page read and write
3EE5000
trusted library allocation
page read and write
537E000
stack
page read and write
CC0000
heap
page execute and read and write
C72000
unkown
page readonly
2A10000
heap
page read and write
1280000
trusted library allocation
page read and write
3602000
unkown
page readonly
4FFE000
stack
page read and write
4BF0000
heap
page read and write
B84000
trusted library allocation
page read and write
2CBC000
stack
page read and write
7FF7CBDBB000
unkown
page execute read
C1E000
stack
page read and write
7FF7CB3BB000
unkown
page execute read
BD0000
heap
page read and write
7FF7C63BB000
unkown
page execute read
5616000
heap
page read and write
C60000
unkown
page readonly
3EC1000
trusted library allocation
page read and write
2D0F000
heap
page read and write
850000
trusted library allocation
page read and write
401000
unkown
page execute read
7FF7CDBBB000
unkown
page execute read
32F1000
heap
page read and write
3270000
heap
page read and write
150E000
stack
page read and write
B97000
trusted library allocation
page execute and read and write
2F70000
heap
page read and write
2A71000
heap
page read and write
DBE000
stack
page read and write
7FF7C6DBB000
unkown
page execute read
271A000
trusted library allocation
page read and write
3370000
heap
page read and write
2F4F000
stack
page read and write
1469000
heap
page read and write
2F8A000
trusted library allocation
page read and write
711000
heap
page read and write
83E000
stack
page read and write
2C71000
heap
page read and write
2D71000
heap
page read and write
5390000
heap
page execute and read and write
30F1000
heap
page read and write
1610000
heap
page read and write
2E7F000
stack
page read and write
2F71000
heap
page read and write
D0C000
stack
page read and write
3371000
heap
page read and write
There are 266 hidden memdumps, click here to show them.