Click to jump to signature section
Source: unknown | HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49708 version: TLS 1.2 |
Source: unknown | HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49713 version: TLS 1.2 |
Source: unknown | HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49714 version: TLS 1.2 |
Source: unknown | HTTPS traffic detected: 40.126.29.8:443 -> 192.168.2.17:49715 version: TLS 1.2 |
Source: unknown | HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49716 version: TLS 1.2 |
Source: unknown | HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49721 version: TLS 1.2 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.200 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.200 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.200 |
Source: unknown | UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown | UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown | UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown | UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown | UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown | UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.200 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.200 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.200 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.200 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.200 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.200 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.200 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.200 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.200 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.203 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.203 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.203 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.203 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.193.120.112 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.193.120.112 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.193.120.112 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.193.120.112 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.193.120.112 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.193.120.112 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.193.120.112 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.193.120.112 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.193.120.112 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.193.120.112 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.193.120.112 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.193.120.112 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.193.120.112 |
Source: global traffic | DNS traffic detected: DNS query: download.lenovo.com |
Source: global traffic | DNS traffic detected: DNS query: www.google.com |
Source: unknown | Network traffic detected: HTTP traffic on port 49708 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49721 |
Source: unknown | Network traffic detected: HTTP traffic on port 49676 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49678 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49691 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49719 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49719 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49718 |
Source: unknown | Network traffic detected: HTTP traffic on port 49713 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49717 |
Source: unknown | Network traffic detected: HTTP traffic on port 49715 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49716 |
Source: unknown | Network traffic detected: HTTP traffic on port 49680 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49715 |
Source: unknown | Network traffic detected: HTTP traffic on port 49717 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49714 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49713 |
Source: unknown | Network traffic detected: HTTP traffic on port 49675 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49707 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49677 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49691 |
Source: unknown | Network traffic detected: HTTP traffic on port 49721 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49723 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49708 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49707 |
Source: unknown | Network traffic detected: HTTP traffic on port 49716 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49714 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49718 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49723 |
Source: unknown | HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49708 version: TLS 1.2 |
Source: unknown | HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49713 version: TLS 1.2 |
Source: unknown | HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49714 version: TLS 1.2 |
Source: unknown | HTTPS traffic detected: 40.126.29.8:443 -> 192.168.2.17:49715 version: TLS 1.2 |
Source: unknown | HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49716 version: TLS 1.2 |
Source: unknown | HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49721 version: TLS 1.2 |
Source: C:\Users\user\Downloads\u1ra101us17.exe | File created: C:\Windows\TempInst |
Source: C:\Users\user\Downloads\u1ra101us17.exe | File created: C:\Windows\TempInst\is-5AHOE.tmp |
Source: C:\Users\user\Downloads\u1ra101us17.exe | File created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | File created: C:\Windows\is-BBEMV.tmp |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | File created: C:\Windows\TempInst\is-2L981.tmp |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | File created: C:\Windows\TempInst\is-2L981.tmp\_isetup |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | File created: C:\Windows\TempInst\is-2L981.tmp\_isetup\_setup64.tmp |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | File deleted: C:\Windows\is-BBEMV.tmp |
Source: classification engine | Classification label: sus23.evad.win@24/12@8/89 |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | File created: C:\Users\user\Downloads\a37fe17a-04a3-4a31-9e10-b8ef14f0235f.tmp |
Source: C:\Users\user\Downloads\u1ra101us17.exe | Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales |
Source: C:\Users\user\Downloads\u1ra101us17.exe | Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales |
Source: C:\Users\user\Downloads\u1ra101us17.exe | Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization |
Source: unknown | Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://download.lenovo.com/pccbbs/desktop/u1ra101us17.exe |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5340 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5340 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4932 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4932 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: C:\Users\user\Downloads\u1ra101us17.exe "C:\Users\user\Downloads\u1ra101us17.exe" |
Source: C:\Users\user\Downloads\u1ra101us17.exe | Process created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp "C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp" /SL5="$80240,3550847,180224,C:\Users\user\Downloads\u1ra101us17.exe" |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: C:\Users\user\Downloads\u1ra101us17.exe "C:\Users\user\Downloads\u1ra101us17.exe" |
Source: C:\Users\user\Downloads\u1ra101us17.exe | Process created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp "C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp" /SL5="$80240,3550847,180224,C:\Users\user\Downloads\u1ra101us17.exe" |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown |
Source: C:\Users\user\Downloads\u1ra101us17.exe | Section loaded: version.dll |
Source: C:\Users\user\Downloads\u1ra101us17.exe | Section loaded: uxtheme.dll |
Source: C:\Users\user\Downloads\u1ra101us17.exe | Section loaded: apphelp.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: version.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: uxtheme.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: kernel.appcore.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: wtsapi32.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: winsta.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: textinputframework.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: coreuicomponents.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: coremessaging.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: ntmarta.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: coremessaging.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: wintypes.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: wintypes.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: wintypes.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: windows.storage.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: wldp.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: profapi.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: shfolder.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: rstrtmgr.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: ncrypt.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: ntasn1.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: textshaping.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: msftedit.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: windows.globalization.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: bcp47langs.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: bcp47mrm.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: globinputhost.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: windows.ui.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: windowmanagementapi.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: inputhost.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: twinapi.appcore.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: twinapi.appcore.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: propsys.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Section loaded: dwmapi.dll |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Window found: window name: TMainForm |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL |
Source: Window Recorder | Window detected: More than 3 window changes detected |
Source: C:\Users\user\Downloads\u1ra101us17.exe | Executable created and started: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | File created: C:\Users\user\Downloads\a37fe17a-04a3-4a31-9e10-b8ef14f0235f.tmp | Jump to dropped file |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | File created: C:\Users\user\Downloads\Unconfirmed 690274.crdownload | Jump to dropped file |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | File created: C:\Windows\TempInst\is-2L981.tmp\_isetup\_setup64.tmp | Jump to dropped file |
Source: C:\Users\user\Downloads\u1ra101us17.exe | File created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Jump to dropped file |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | File created: C:\Windows\TempInst\is-2L981.tmp\_isetup\_setup64.tmp | Jump to dropped file |
Source: C:\Users\user\Downloads\u1ra101us17.exe | File created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Jump to dropped file |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe | File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk |
Source: C:\Users\user\Downloads\u1ra101us17.exe | Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX |
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp | Dropped PE file which has not been started: C:\Windows\TempInst\is-2L981.tmp\_isetup\_setup64.tmp | Jump to dropped file |