Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
|
 |
|
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB
--service-sandbox-type=none --mojo-platform-channel-handle=1940 --field-trial-handle=1712,i,1373269792511892383,14833017251772175095,131072
--disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
|
|
|
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\Remittance.htm
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://www.iana.org/domains/reserved
|
|||
|
https://www.iana.org/_img/2022/fonts/SourceCodePro-Regular.woff
|
192.0.46.8
|
||
|
https://example.com/
|
|||
|
https://href.li/?https://example.com
|
192.0.78.26
|
||
|
https://www.iana.org/_js/iana.js
|
192.0.46.8
|
||
|
https://www.iana.org/_img/2022/iana-logo-header.svg
|
192.0.46.8
|
||
|
https://www.iana.org/_img/2022/fonts/NotoSans-Regular.woff
|
192.0.46.8
|
||
|
https://example.com/favicon.ico
|
93.184.216.34
|
||
|
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
|
216.58.209.45
|
||
|
http://www.iana.org/domains/reserved
|
192.0.46.8
|
||
|
https://hhid829389.xyz/?aoul&qrc=glenn.walker
|
unknown
|
||
|
https://www.iana.org/_img/bookmark_icon.ico
|
192.0.46.8
|
||
|
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1
|
142.250.180.174
|
||
|
https://www.iana.org/_css/2022/iana_website.css
|
192.0.46.8
|
||
|
http://www.iana.org/_img/2022/iana-logo-header.svg
|
192.0.46.8
|
||
|
https://www.iana.org/domains/example
|
192.0.46.8
|
||
|
http://www.iana.org/_img/bookmark_icon.ico
|
192.0.46.8
|
||
|
https://www.iana.org/_js/jquery.js
|
192.0.46.8
|
||
|
https://example.com/
|
93.184.216.34
|
||
|
https://hhid829389.xyz/?aoul&qrc=glenn.walker@cra-arc.gc.ca
|
108.174.197.216
|
||
|
http://www.iana.org/domains
|
192.0.46.8
|
||
|
http://www.iana.org/domains
|
|||
|
https://www.iana.org/_img/2022/fonts/NotoSans-Bold.woff
|
192.0.46.8
|
There are 13 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
hhid829389.xyz
|
108.174.197.216
|
|
|
|
accounts.google.com
|
216.58.209.45
|
||
|
www.google.com
|
142.250.184.100
|
||
|
clients.l.google.com
|
142.250.180.174
|
||
|
example.com
|
93.184.216.34
|
||
|
ianawww.vip.icann.org
|
192.0.46.8
|
||
|
href.li
|
192.0.78.26
|
||
|
www.vip.icann.org
|
192.0.47.7
|
||
|
clients2.google.com
|
unknown
|
||
|
www.iana.org
|
unknown
|
||
|
pti.icann.org
|
unknown
|
||
|
www.icann.org
|
unknown
|
There are 2 hidden domains, click here to show them.
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
108.174.197.216
|
hhid829389.xyz
|
United States
|
|
|
|
192.0.46.8
|
ianawww.vip.icann.org
|
United States
|
||
|
192.168.2.1
|
unknown
|
unknown
|
||
|
93.184.216.34
|
example.com
|
European Union
|
||
|
216.58.209.45
|
accounts.google.com
|
United States
|
||
|
192.0.78.26
|
href.li
|
United States
|
||
|
239.255.255.250
|
unknown
|
Reserved
|
||
|
142.250.184.100
|
www.google.com
|
United States
|
||
|
142.250.180.174
|
clients.l.google.com
|
United States
|
||
|
127.0.0.1
|
unknown
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault
|
S-1-5-21-3853321935-2125563209-4053062332-1002
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
|
ahfgeienlihckogmohjhadlkjgocpleb
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
|
gdaefkejpgkiemlaofpalmlakkmbjdnl
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
|
kmendfapggjehodndflmmgagdbamhnfd
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
|
mhjfbmdgcfjbbpaeojofohoefgiehjai
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
|
neajdppkdcdipfabeoofebfddakdcjhd
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
|
nkeimhogjdpnpccoofpliimaahmaaome
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
prefs.preference_reset_time
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
|
gdaefkejpgkiemlaofpalmlakkmbjdnl
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
|
kmendfapggjehodndflmmgagdbamhnfd
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
|
neajdppkdcdipfabeoofebfddakdcjhd
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
|
nkeimhogjdpnpccoofpliimaahmaaome
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
|
nmmhkkegccagdldgiimedpiccmgmieda
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
|
nmmhkkegccagdldgiimedpiccmgmieda
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
|
nmmhkkegccagdldgiimedpiccmgmieda
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
|
state
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
|
StatusCodes
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
|
StatusCodes
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
|
state
|
||
|
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
|
dr
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
|
user_experience_metrics.stability.exited_cleanly
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
media.cdm.origin_data
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
software_reporter.reporting
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
media.storage_id_salt
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
google.services.last_account_id
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
google.services.account_id
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
settings_reset_prompt.last_triggered_for_startup_urls
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
settings_reset_prompt.last_triggered_for_homepage
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
module_blocklist_cache_md5_digest
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
software_reporter.prompt_seed
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
default_search_provider_data.template_url_data
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
safebrowsing.incidents_sent
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
pinned_tabs
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
browser.show_home_button
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
search_provider_overrides
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
settings_reset_prompt.last_triggered_for_default_search
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
prefs.preference_reset_time
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
software_reporter.prompt_version
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
google.services.last_username
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
session.startup_urls
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
session.restore_on_startup
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
settings_reset_prompt.prompt_wave
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
homepage
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
|
homepage_is_newtabpage
|
||
|
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
|
lastrun
|
||
|
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
|
lastrun
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
||
|
HKEY_USERSS-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry
|
TraceTimeLast
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault
|
S-1-5-21-3853321935-2125563209-4053062332-1002
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
|
state
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
|
StatusCodes
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
|
StatusCodes
|
||
|
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
|
state
|
There are 44 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
22B82A80000
|
heap
|
page read and write
|
||
|
E69EC9B000
|
stack
|
page read and write
|
||
|
22B83A50000
|
trusted library allocation
|
page read and write
|
||
|
E69F0F9000
|
stack
|
page read and write
|
||
|
22B83810000
|
trusted library allocation
|
page read and write
|
||
|
22B82C20000
|
trusted library allocation
|
page read and write
|
||
|
22B82AE0000
|
heap
|
page read and write
|
||
|
22B82B29000
|
heap
|
page read and write
|
||
|
22B82D10000
|
heap
|
page read and write
|
||
|
22B82950000
|
trusted library allocation
|
page read and write
|
||
|
E69F17F000
|
stack
|
page read and write
|
||
|
22B82CD0000
|
heap
|
page readonly
|
||
|
22B82AE8000
|
heap
|
page read and write
|
||
|
22B82AA0000
|
heap
|
page read and write
|
||
|
22B82CE0000
|
trusted library allocation
|
page read and write
|
||
|
22B82AF0000
|
heap
|
page read and write
|
||
|
E69F07A000
|
stack
|
page read and write
|
||
|
22B82B30000
|
heap
|
page read and write
|
||
|
22B82B30000
|
heap
|
page read and write
|
||
|
E69F1F9000
|
stack
|
page read and write
|
||
|
22B82D15000
|
heap
|
page read and write
|
||
|
22B82B30000
|
heap
|
page read and write
|
||
|
22B82C80000
|
trusted library allocation
|
page read and write
|
||
|
22B82940000
|
heap
|
page read and write
|
||
|
22B82C10000
|
trusted library allocation
|
page read and write
|
||
|
22B82D20000
|
trusted library allocation
|
page read and write
|
||
|
22B82CC0000
|
trusted library allocation
|
page read and write
|
||
|
22B82D1A000
|
heap
|
page read and write
|
||
|
E69F279000
|
stack
|
page read and write
|
||
|
E69F2FD000
|
stack
|
page read and write
|
||
|
22B82CF0000
|
trusted library allocation
|
page read and write
|
There are 21 hidden memdumps, click here to show them.
DOM / HTML
|
URL
|
Malicious
|
|
|---|---|---|
|
https://example.com/
|
||
|
http://www.iana.org/domains/reserved
|
||
|
http://www.iana.org/domains
|