Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

https://clapham.allow.me/covid2021/?GOPPAGE61255999D1057&PID=3101

URL

initial url

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Microsoft Cabinet archive data, 61020 bytes, 1 file

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\4f7eeedd-d7f6-4182-8aa5-16f03c76db91.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\0969cd07-a4bc-455e-b755-935dcc78342f.tmp

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5a8e199c-81a9-4936-b706-5f64db957534.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.old. (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies

SQLite 3.x database, last written using SQLite version 3032001

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Current Session

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Current Tabs

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG.old. (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old. (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_1\_metadata\computed_hashes.json

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG.oldg (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Last Sessionbp (copy)

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Last Tabs (copy)

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State43 (copy)

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences. (copy)

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Reporting and NEL

SQLite 3.x database, last written using SQLite version 3032001

modified

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Reporting and NEL-journal

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesE (copy)

UTF-8 Unicode text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State2. (copy)

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications\LOG.olde, (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\a0547d60-ec91-4de8-b973-4d02ee85174c.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications\LOG.oldg (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\TransportSecuritye (copy)

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\c1aff6af-05dd-47aa-becc-0e314feb084f.tmp

UTF-8 Unicode text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cff21966-e84c-4b64-a6dd-f53fd0429396.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old3c (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000004

MPEG-4 LOAS

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\e6c4b7a7-4176-49a2-bbcd-67abdbe9e136.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\0dad7087-158e-4fd7-9ae4-a315a170d0ea.tmp

Google Chrome extension, version 3

dropped

C:\Users\user\AppData\Local\Temp\1ae382d8-7f81-4945-b807-cf3776b963c5.tmp

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Temp\4903bf7a-e852-4da0-a450-3929968fb8e5.tmp

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Temp\b6ba01d9-f118-4f1c-b6d6-408101a16f8b.tmp

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Temp\browser-sslkeys.log

ASCII text

dropped

C:\Users\user\AppData\Local\Temp\ca0680fc-385c-4de2-be0f-f74336146d08.tmp

Google Chrome extension, version 3

dropped

C:\Users\user\AppData\Local\Temp\eda03c05-6b6c-4bd5-a730-75d34e692ce1.tmp

Google Chrome extension, version 3

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\0dad7087-158e-4fd7-9ae4-a315a170d0ea.tmp

Google Chrome extension, version 3

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\bg\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\ca\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\cs\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\da\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\de\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\el\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\en\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\en_GB\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\es\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\es_419\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\et\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\fi\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\fil\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\fr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\hi\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\hr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\hu\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\id\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\it\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\ja\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\ko\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\lt\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\lv\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\nb\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\nl\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\pl\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\pt_BR\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\pt_PT\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\ro\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\ru\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\sk\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\sl\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\sr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\sv\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\th\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\tr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\uk\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\vi\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\zh_CN\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\_locales\zh_TW\messages.json

UTF-8 Unicode text, with CRLF line terminators

modified

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\images\icon_128.png

PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\images\icon_16.png

PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_100679197\CRX_INSTALL\manifest.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\bg\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\ca\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\cs\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\da\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\de\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\el\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\en\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\en_GB\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\es\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\es_419\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\et\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\fi\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\fil\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\fr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\hi\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\hr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\hu\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\id\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\it\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\ja\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\ko\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\lt\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\lv\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\nb\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\nl\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\pl\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\pt_BR\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\pt_PT\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\ro\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\ru\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\sk\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\sl\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\sr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\sv\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\th\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\tr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\uk\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\vi\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\zh_CN\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\_locales\zh_TW\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\images\icon_128.png

PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\images\icon_16.png

PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\CRX_INSTALL\manifest.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_1722641677\ca0680fc-385c-4de2-be0f-f74336146d08.tmp

Google Chrome extension, version 3

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\am\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\ar\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\bg\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\bn\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\ca\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\cs\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\da\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\de\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\el\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\en\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\es\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\et\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\fa\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\fi\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\fil\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\fr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\gu\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\hi\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\hr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\hu\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\id\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\it\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\ja\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\kn\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\ko\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\lt\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\lv\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\ml\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\mr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\ms\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\nb\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\nl\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\pl\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\pt\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\ro\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\ru\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\sk\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\sl\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\sr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\sv\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\sw\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\ta\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\te\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\th\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\tr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\uk\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\vi\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\zh\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\_locales\zh_TW\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\CRX_INSTALL\manifest.json

ASCII text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir5916_2018190755\eda03c05-6b6c-4bd5-a730-75d34e692ce1.tmp

Google Chrome extension, version 3

dropped

There are 211 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://clapham.allow.me/covid2021/?GOPPAGE61255999D1057&PID=3101'

Details

Is windows:	true
Is dropped:	false
PID:	5916
Target ID:	0
Parent PID:	4304
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://clapham.allow.me/covid2021/?GOPPAGE61255999D1057&PID=3101'
Size:	2150896
MD5:	C139654B5C1438A95B321BB01AD63EF6
Time:	07:57:29
Date:	26/08/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff677c70000
Modulesize:	2199552
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,12626956359303723085,12777355795646735380,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1684 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	2856
Target ID:	1
Parent PID:	5916
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,12626956359303723085,12777355795646735380,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1684 /prefetch:8
Size:	2150896
MD5:	C139654B5C1438A95B321BB01AD63EF6
Time:	07:57:30
Date:	26/08/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff677c70000
Modulesize:	2199552
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://clapham.allow.me/covid2021/?GOPPAGE61255999D1057&PID=3101

unknown

https://www.google.com

unknown

https://dns.google

unknown

https://ogs.google.com

unknown

https://support.google.com/chromecast/troubleshooter/2995236

unknown

https://accounts.google.com

unknown

https://payments.google.com/payments/v4/js/integrator.js

unknown

https://www.google.com;

unknown

https://support.google.com/chromecast/answer/2998456

unknown

https://hangouts.google.com/

unknown

https://clients2.googleusercontent.com

unknown

https://apis.google.com

unknown

https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external

unknown

https://sandbox.google.com/payments/v4/js/integrator.js

unknown

https://www.google.com/

unknown

https://feedback.googleusercontent.com

unknown

https://clients2.google.com

unknown

https://clients2.google.com/service/update2/crx

unknown

There are 8 hidden URLs, click here to show them.

Domains

Name

Malicious

accounts.google.com

172.217.168.45

Details

Name:	accounts.google.com
IP:	172.217.168.45
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

clapham.allow.me

52.56.219.240

Details

Name:	clapham.allow.me
IP:	52.56.219.240
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

clients.l.google.com

142.250.203.110

googlehosted.l.googleusercontent.com

142.250.203.97

clients2.googleusercontent.com

unknown

clients2.google.com

unknown

IPs

Domain

Country

Malicious

192.168.2.1

unknown

142.250.203.110

clients.l.google.com

United States

Details

IP:	142.250.203.110
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	clients.l.google.com

52.56.219.240

clapham.allow.me

United States

Details

IP:	52.56.219.240
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Country:	United States
Countrycode:	USA
ASN number:	16509
ASN name:	AMAZON-02US
Private:	false
Domain:	clapham.allow.me

172.217.168.45

accounts.google.com

United States

Details

IP:	172.217.168.45
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	accounts.google.com

142.250.203.97

googlehosted.l.googleusercontent.com

United States

Details

IP:	142.250.203.97
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	googlehosted.l.googleusercontent.com

239.255.255.250

unknown

Reserved

127.0.0.1

unknown

Registry

Path

Value

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

S-1-5-21-3853321935-2125563209-4053062332-1002

C:\Program Files\Google\Chrome\Application\chrome.exe

ahfgeienlihckogmohjhadlkjgocpleb

C:\Program Files\Google\Chrome\Application\chrome.exe

gdaefkejpgkiemlaofpalmlakkmbjdnl

C:\Program Files\Google\Chrome\Application\chrome.exe

gfdkimpbcpahaombhbimeihdjnejgicl

C:\Program Files\Google\Chrome\Application\chrome.exe

kmendfapggjehodndflmmgagdbamhnfd

C:\Program Files\Google\Chrome\Application\chrome.exe

mfehgcgbbipciphmccgaenjidiccnmng

C:\Program Files\Google\Chrome\Application\chrome.exe

mhjfbmdgcfjbbpaeojofohoefgiehjai

C:\Program Files\Google\Chrome\Application\chrome.exe

neajdppkdcdipfabeoofebfddakdcjhd

C:\Program Files\Google\Chrome\Application\chrome.exe

nkeimhogjdpnpccoofpliimaahmaaome

C:\Program Files\Google\Chrome\Application\chrome.exe

nmmhkkegccagdldgiimedpiccmgmieda

C:\Program Files\Google\Chrome\Application\chrome.exe

prefs.preference_reset_time

C:\Program Files\Google\Chrome\Application\chrome.exe

state

C:\Program Files\Google\Chrome\Application\chrome.exe

StatusCodes

C:\Program Files\Google\Chrome\Application\chrome.exe

StatusCodes

C:\Program Files\Google\Chrome\Application\chrome.exe

state

C:\Program Files\Google\Chrome\Application\chrome.exe

software_reporter.reporting

C:\Program Files\Google\Chrome\Application\chrome.exe

module_blacklist_cache_md5_digest

C:\Program Files\Google\Chrome\Application\chrome.exe

media.storage_id_salt

C:\Program Files\Google\Chrome\Application\chrome.exe

google.services.last_account_id

C:\Program Files\Google\Chrome\Application\chrome.exe

google.services.account_id

C:\Program Files\Google\Chrome\Application\chrome.exe

software_reporter.prompt_seed

C:\Program Files\Google\Chrome\Application\chrome.exe

settings_reset_prompt.last_triggered_for_homepage

C:\Program Files\Google\Chrome\Application\chrome.exe

default_search_provider_data.template_url_data

C:\Program Files\Google\Chrome\Application\chrome.exe

safebrowsing.incidents_sent

C:\Program Files\Google\Chrome\Application\chrome.exe

pinned_tabs

C:\Program Files\Google\Chrome\Application\chrome.exe

search_provider_overrides

C:\Program Files\Google\Chrome\Application\chrome.exe

settings_reset_prompt.last_triggered_for_default_search

C:\Program Files\Google\Chrome\Application\chrome.exe

prefs.preference_reset_time

C:\Program Files\Google\Chrome\Application\chrome.exe

google.services.last_username

C:\Program Files\Google\Chrome\Application\chrome.exe

session.startup_urls

C:\Program Files\Google\Chrome\Application\chrome.exe

session.restore_on_startup

C:\Program Files\Google\Chrome\Application\chrome.exe

software_reporter.prompt_version

C:\Program Files\Google\Chrome\Application\chrome.exe

settings_reset_prompt.last_triggered_for_startup_urls

C:\Program Files\Google\Chrome\Application\chrome.exe

settings_reset_prompt.prompt_wave

C:\Program Files\Google\Chrome\Application\chrome.exe

homepage

C:\Program Files\Google\Chrome\Application\chrome.exe

homepage_is_newtabpage

C:\Program Files\Google\Chrome\Application\chrome.exe

browser.show_home_button

C:\Program Files\Google\Chrome\Application\chrome.exe

user_experience_metrics.stability.exited_cleanly

C:\Program Files\Google\Chrome\Application\chrome.exe

lastrun

C:\Program Files\Google\Chrome\Application\chrome.exe

Blob

C:\Program Files\Google\Chrome\Application\chrome.exe

Blob

C:\Program Files\Google\Chrome\Application\chrome.exe

Blob

C:\Program Files\Google\Chrome\Application\chrome.exe

Blob

There are 33 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

7FF56EF8E000

unkown

page readonly

28428A00000

unkown

page read and write

28429840000

unkown

page read and write

2842DD70000

unkown

page read and write

284287C0000

heap private

page read and write

28428A92000

unkown

page read and write

2842E0A2000

unkown

page read and write

7FF56E766000

unkown

page readonly

28429940000

unkown

page readonly

7FF56EB40000

unkown

page readonly

7FF56ED73000

unkown

page readonly

7FF56EF9D000

unkown

page readonly

28429CC1000

unkown

page read and write

2842DFE0000

unkown

page read and write

28428FF3000

unkown

page read and write

7FF56EECC000

unkown

page readonly

28429002000

unkown

page read and write

7FF56EF25000

unkown

page readonly

2842DF78000

unkown

page readonly

2842E0AE000

unkown

page read and write

28428900000

unkown

page readonly

7FF56EE0F000

unkown

page readonly

7FF56EDF7000

unkown

page readonly

2842DFE0000

unkown

page readonly

7FF56ECE3000

unkown

page readonly

28428AA4000

unkown

page read and write

2842E000000

unkown

page read and write

2842E041000

unkown

page read and write

7FF56EEC7000

unkown

page readonly

28428AFF000

unkown

page read and write

28428C00000

unkown

page readonly

7FF56EFBF000

unkown

page readonly

2842E240000

unkown

page readonly

28429113000

unkown

page read and write

7FF56EB47000

unkown

page readonly

7FF56EEA2000

unkown

page readonly

2842E061000

unkown

page read and write

AE187FE000

unkown

page read and write

7FF56EFBF000

unkown

page readonly

284289F0000

unkown

page read and write

AE183FB000

unkown

page read and write

28428A58000

unkown

page read and write

2842DFE0000

unkown

page read and write

2842DFA0000

unkown

page read and write

2842E087000

unkown

page read and write

28429970000

unkown

page readonly

2842DEA4000

unkown

page read and write

7FF56EB34000

unkown

page readonly

7FF56EE98000

unkown

page readonly

28428A90000

unkown

page read and write

7FF56EF0A000

unkown

page readonly

28428FF0000

unkown

page read and write

7FF56EEF5000

unkown

page readonly

7FF56ED78000

unkown

page readonly

7FF56EE34000

unkown

page readonly

7FF56ECBD000

unkown

page readonly

2842DFD0000

unkown

page read and write

2842DE80000

unkown

page read and write

AE188FC000

unkown

page read and write

2842DF60000

unkown

page write copy

2842DCE0000

unkown

page read and write

7FF56EB3A000

unkown

page readonly

7FF56ED10000

unkown

page readonly

7FF56ECE1000

unkown

page readonly

28428910000

unkown

page readonly

AE1867F000

unkown

page read and write

7FF56EF03000

unkown

page readonly

28429CE0000

unkown

page read and write

2842DF90000

unkown

page read and write

7FF56EEAC000

unkown

page readonly

2842DEB0000

unkown

page read and write

7FF56EEED000

unkown

page readonly

AE181FA000

unkown

page read and write

2842DCF0000

unkown

page read and write

28429930000

unkown

page readonly

7FF56EE6D000

unkown

page readonly

7FF56ECAA000

unkown

page readonly

2842E04E000

unkown

page read and write

28428A3D000

unkown

page read and write

28428AB2000

unkown

page read and write

7FF56EF7F000

unkown

page readonly

AE1877F000

unkown

page read and write

2842DFE0000

unkown

page read and write

7FF56EFA4000

unkown

page readonly

7FF56EEB7000

unkown

page readonly

7FF56EF86000

unkown

page readonly

7FF56ECAC000

unkown

page readonly

2842E01F000

unkown

page read and write

284289E0000

unkown

page readonly

AE182FE000

unkown

page read and write

7FF56EE90000

unkown

page readonly

28429015000

unkown

page read and write

7FF56ECC7000

unkown

page readonly

2842E230000

unkown

page readonly

2842E220000

unkown

page readonly

2842E02C000

unkown

page read and write

28428A71000

unkown

page read and write

2842DF54000

unkown

page write copy

7FF56EC4A000

unkown

page readonly

28429118000

unkown

page read and write

2842E011000

unkown

page read and write

AE17FF7000

unkown

page read and write

2842DEB0000

unkown

page read and write

7FF56EEB3000

unkown

page readonly

7FF56E7B1000

unkown

page readonly

7FF56EB63000

unkown

page readonly

28429100000

unkown

page read and write

7FF56EE70000

unkown

page readonly

28429102000

unkown

page read and write

2842DD80000

unkown

page read and write

AE1857F000

unkown

page read and write

2842DD30000

unkown

page readonly

AE17EFE000

unkown

page read and write

2842DF57000

unkown

page write copy

28428A96000

unkown

page read and write

2842DF7C000

unkown

page write copy

2842DEA0000

unkown

page read and write

2842DF64000

unkown

page readonly

28428820000

heap default

page read and write

2842DFC0000

unkown

page read and write

2842DEA1000

unkown

page read and write

7FF56EFBD000

unkown

page readonly

7FF56EF8B000

unkown

page readonly

28428B13000

unkown

page read and write

AE17E7E000

unkown

page read and write

7FF56EC7F000

unkown

page readonly

2842E07D000

unkown

page read and write

7FF56EAC6000

unkown

page readonly

7FF56E4C3000

unkown

page readonly

28429000000

unkown

page read and write

28429158000

unkown

page read and write

7FF56ED54000

unkown

page readonly

7FF56E4B8000

unkown

page readonly

28429118000

unkown

page read and write

28428830000

unkown

page readonly

2842DD60000

unkown

page read and write

2842DE80000

unkown

page read and write

2842E300000

unkown

page readonly

28428A29000

unkown

page read and write

2842DE88000

unkown

page read and write

28428B02000

unkown

page read and write

AE17B9C000

unkown

page read and write

7FF56EAF0000

unkown

page readonly

2842DE8E000

unkown

page read and write

7FF56EED8000

unkown

page readonly

AE186FF000

unkown

page read and write

7FF56EFAE000

unkown

page readonly

2842DFE0000

unkown

page read and write

28428F90000

unkown

page read and write

7FF56EE80000

unkown

page readonly

7FF56EFBB000

unkown

page readonly

7FF56EB4F000

unkown

page readonly

AE18AFC000

unkown

page read and write

28429960000

unkown

page readonly

7FF56E769000

unkown

page readonly

2842DF50000

unkown

page read and write

AE184FB000

unkown

page read and write

7FF56ECB1000

unkown

page readonly

7FF56ED5D000

unkown

page readonly

2842DEC0000

unkown

page read and write

28429950000

unkown

page readonly

28428A77000

unkown

page read and write

28428A7B000

unkown

page read and write

28429159000

unkown

page read and write

7FF56EA6F000

unkown

page readonly

7FF56EF78000

unkown

page readonly

28428A13000

unkown

page read and write

AE189FF000

unkown

page read and write

2842DEC4000

unkown

page read and write

2842DFB0000

unkown

page read and write

28429760000

unkown

page read and write

AE180F9000

unkown

page read and write

7FF56ECB3000

unkown

page readonly

7FF56EFAB000

unkown

page readonly

28428A8D000

unkown

page read and write

28429980000

unkown

page readonly

2842E2D0000

unkown

page read and write

7FF56ED57000

unkown

page readonly

28429920000

unkown

page readonly

7FF56E4C8000

unkown

page readonly

2842E2E0000

unkown

page readonly

7FF56ED8C000

unkown

page readonly

2842E2C0000

unkown

page readonly

7FF56EEF9000

unkown

page readonly

AE185FE000

unkown

page read and write

7FF56EE94000

unkown

page readonly

7FF56EE77000

unkown

page readonly

There are 177 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

Domains

IPs

Registry

Memdumps