IOC Report
https://cents-alt-traffic-transactions.trycloudflare.com/login.html

loading gif

Files

File Path
Type
Category
Malicious
C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\0912d852-47f0-4dd2-8098-28c5dd1236ca.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\916c92a4-7c8b-4766-9629-9f6b596610d9.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\096a502a-c15c-480c-82c7-96307310a475.tmp
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\35afe563-6cbe-44f6-9950-baa0eca5c9fd.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8887aa76-1dcf-4df8-af1f-5895136388b6.tmp
UTF-8 Unicode text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9dabe396-a898-4fe7-8255-799165bf9062.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG
ASCII text
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache
zlib compressed data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)
Google Chrome extension, version 3
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)
UTF-8 Unicode text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\845a3c7b-8f90-4b25-aba5-29e9ffc4f283.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\a214b845-f5dd-41c5-bf16-03cfef25045a.tmp
UTF-8 Unicode text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp
ASCII text
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)
ASCII text
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\a1cacd70-2179-4baa-9010-fa0daf982ce8.tmp
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\e42fc3e2-5d7f-45d0-8629-62f8bf6face4.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\cbeea246-b5f9-4ab3-93a1-89cdbeb20e14.tmp
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\f10fbfdd-1c6c-4ae1-ba2b-94d32c3cd431.tmp
Google Chrome extension, version 3
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\bg\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\ca\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\cs\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\da\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\de\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\el\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\en\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\en_GB\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\es\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\es_419\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\et\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\fi\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\fil\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\fr\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\hi\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\hr\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\hu\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\id\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\it\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\ja\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\ko\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\lt\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\lv\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\nb\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\nl\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\pl\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\pt_BR\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\pt_PT\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\ro\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\ru\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\sk\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\sl\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\sr\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\sv\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\th\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\tr\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\uk\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\vi\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\zh_CN\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_locales\zh_TW\messages.json
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\_metadata\verified_contents.json
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\craw_background.js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\craw_window.js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\css\craw_window.css
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\html\craw_window.html
HTML document, ASCII text
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\images\flapper.gif
GIF image data, version 89a, 30 x 30
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\images\icon_128.png
PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\images\icon_16.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
modified
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\images\topbar_floating_button.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\images\topbar_floating_button_close.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\images\topbar_floating_button_hover.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\images\topbar_floating_button_maximize.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\images\topbar_floating_button_pressed.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\CRX_INSTALL\manifest.json
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir1428_742433826\f10fbfdd-1c6c-4ae1-ba2b-94d32c3cd431.tmp
Google Chrome extension, version 3
dropped
There are 75 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://cents-alt-traffic-transactions.trycloudflare.com/login.html
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,14611007250167622640,17041937121130853476,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1952 /prefetch:8

URLs

Name
IP
Malicious
https://cents-alt-traffic-transactions.trycloudflare.com/login.html
malicious
https://cents-alt-traffic-transactions.trycloudflare.com/login.html
104.17.123.55
 malicious
https://cents-alt-traffic-transactions.trycloudflare.com/login.html2
unknown
 malicious
https://cents-alt-traffic-transactions.trycloudflare.com/login.html
malicious
https://dns.google
unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
unknown
https://www.google.com/intl/en-US/chrome/blank.html
unknown
https://ogs.google.com
unknown
https://s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/rC56cpX1uS2qJKOxJ-5Sb8u-.svg
52.217.11.134
https://www.google.com/images/cleardot.gif
unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1
142.250.185.206
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
142.250.186.77
https://payments.google.com/payments/v4/js/integrator.js
unknown
https://s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/ZJH_2F3Xi0SopxxCuN7EKeDY.jpg
52.217.11.134
https://sandbox.google.com/payments/v4/js/integrator.js
unknown
https://www.google.com/images/x2.gif
unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
104.18.11.207
https://accounts.google.com/MergeSession
unknown
https://www.google.com
unknown
https://www.google.com/images/dot2.gif
unknown
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
104.17.24.14
https://cents-alt-traffic-transactions.trycloudflare.com/favicon.ico
104.17.123.55
https://accounts.google.com
unknown
https://clients2.googleusercontent.com
unknown
https://apis.google.com
unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
104.18.11.207
https://www.google.com/accounts/OAuthLogin?issueuberauth=1
unknown
https://www.google.com/
unknown
https://www-googleapis-staging.sandbox.google.com
unknown
https://clients2.google.com
unknown
https://clients2.google.com/service/update2/crx
unknown
There are 20 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
gstaticadssl.l.google.com
142.250.74.195
s3.amazonaws.com
52.217.11.134
accounts.google.com
142.250.186.77
cdnjs.cloudflare.com
104.17.24.14
maxcdn.bootstrapcdn.com
104.18.11.207
clients.l.google.com
142.250.185.206
cents-alt-traffic-transactions.trycloudflare.com
104.17.123.55
use.fontawesome.com
unknown
clients2.google.com
unknown
code.jquery.com
unknown

IPs

IP
Domain
Country
Malicious
104.17.24.14
cdnjs.cloudflare.com
United States
142.250.185.206
clients.l.google.com
United States
192.168.2.1
unknown
unknown
52.217.11.134
s3.amazonaws.com
United States
104.18.11.207
maxcdn.bootstrapcdn.com
United States
104.17.123.55
cents-alt-traffic-transactions.trycloudflare.com
United States
239.255.255.250
unknown
Reserved
142.250.186.77
accounts.google.com
United States
142.250.74.195
gstaticadssl.l.google.com
United States
127.0.0.1
unknown
unknown

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault
S-1-5-21-3853321935-2125563209-4053062332-1002
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
ahfgeienlihckogmohjhadlkjgocpleb
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gdaefkejpgkiemlaofpalmlakkmbjdnl
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gfdkimpbcpahaombhbimeihdjnejgicl
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
kmendfapggjehodndflmmgagdbamhnfd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
mfehgcgbbipciphmccgaenjidiccnmng
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
mhjfbmdgcfjbbpaeojofohoefgiehjai
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
neajdppkdcdipfabeoofebfddakdcjhd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nkeimhogjdpnpccoofpliimaahmaaome
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
pkedcjkdefgpdelpbcmbmeomcjbeemfm
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
prefs.preference_reset_time
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gfdkimpbcpahaombhbimeihdjnejgicl
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
dr
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.reporting
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
module_blacklist_cache_md5_digest
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
media.storage_id_salt
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.last_account_id
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.account_id
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.prompt_seed
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_homepage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
default_search_provider_data.template_url_data
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
safebrowsing.incidents_sent
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
pinned_tabs
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
search_provider_overrides
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_default_search
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
prefs.preference_reset_time
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.last_username
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
session.startup_urls
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
session.restore_on_startup
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.prompt_version
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_startup_urls
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.prompt_wave
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
homepage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
homepage_is_newtabpage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
browser.show_home_button
HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
lastrun
There are 32 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
FA63B77000
stack
page read and write
25DF5602000
trusted library allocation
page read and write
2991BC00000
heap
page read and write
2991BB20000
heap
page read and write
FE9867C000
stack
page read and write
FA63C7D000
stack
page read and write
2F01823C000
heap
page read and write
2F018313000
heap
page read and write
25DF4E00000
heap
page read and write
25DF4E28000
heap
page read and write
FA6397B000
stack
page read and write
2991BC29000
heap
page read and write
25DF4F00000
heap
page read and write
2991BD02000
heap
page read and write
25DF4BA0000
heap
page read and write
2F0181E0000
trusted library allocation
page read and write
FE986FE000
stack
page read and write
FA635AF000
stack
page read and write
2991BC87000
heap
page read and write
25DF4E13000
heap
page read and write
2991BC02000
heap
page read and write
2F018252000
heap
page read and write
A0D827E000
stack
page read and write
2F018213000
heap
page read and write
2F01827E000
heap
page read and write
2991BC13000
heap
page read and write
2991C402000
trusted library allocation
page read and write
2F0180E0000
heap
page read and write
A0D817F000
stack
page read and write
A0D7F77000
stack
page read and write
2F018263000
heap
page read and write
2F018308000
heap
page read and write
25DF4E79000
heap
page read and write
25DF4F13000
heap
page read and write
2F018070000
heap
page read and write
FA63A7B000
stack
page read and write
FE98B7F000
stack
page read and write
FE98C7E000
stack
page read and write
2F01825E000
heap
page read and write
2991BC3C000
heap
page read and write
2991BD13000
heap
page read and write
2F018200000
heap
page read and write
25DF4F02000
heap
page read and write
FA6352B000
stack
page read and write
2991BAB0000
heap
page read and write
2F018300000
heap
page read and write
25DF4E40000
heap
page read and write
2F018A02000
trusted library allocation
page read and write
A0D7C7F000
stack
page read and write
FE9897B000
stack
page read and write
2991BAC0000
heap
page read and write
2F018261000
heap
page read and write
25DF4BB0000
heap
page read and write
2991BC70000
heap
page read and write
25DF4E02000
heap
page read and write
2F018288000
heap
page read and write
A0D7E7B000
stack
page read and write
25DF4C10000
heap
page read and write
FE9877E000
stack
page read and write
2991BC8E000
heap
page read and write
FA6387F000
stack
page read and write
FA63D7E000
stack
page read and write
A0D792B000
stack
page read and write
2F018229000
heap
page read and write
25DF4E6F000
heap
page read and write
FA63E7E000
stack
page read and write
2F018080000
heap
page read and write
A0D79AF000
stack
page read and write
2F018302000
heap
page read and write
A0D7D7D000
stack
page read and write
2F01825F000
heap
page read and write
25DF4D10000
trusted library allocation
page read and write
25DF4E55000
heap
page read and write
A0D807D000
stack
page read and write
2991C3C0000
trusted library allocation
page read and write
FE98A7B000
stack
page read and write
There are 66 hidden memdumps, click here to show them.

DOM / HTML

URL
Malicious
https://cents-alt-traffic-transactions.trycloudflare.com/login.html
 malicious