Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\ChromiumHTM.R3NNR2H653NWJWZRGMUHAZFFGI\shell\open\command] '' = '"%LOCALAPPDATA%\Chromium\Application\chrome.exe" -- "%1"'
- [<HKLM>\Software\Wow6432Node\Clients\StartMenuInternet\Chromium.R3NNR2H653NWJWZRGMUHAZFFGI\shell\open\command] '' = '"%LOCALAPPDATA%\Chromium\Application\chrome.exe"'
Malicious functions
Injects code into
the following user processes:
- chrome.exe
Reads files which store third party applications passwords
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\chromium\user data\default\web data
- %LOCALAPPDATA%\chromium\user data\default\cookies
Modifies file system
Creates the following files
- %TEMP%\cr_5c321.tmp\chrome.packed.7z
- %LOCALAPPDATA%\chromium\user data\default\extension state\000003.log
- %TEMP%\2530.tmp
- %LOCALAPPDATA%\chromium\user data\default\origin bound certs-journal
- %TEMP%\etilqs_bitselfhxdtayrt
- %TEMP%\2917.tmp
- %TEMP%\scoped_dir_2676_22365\2530.tmp
- %LOCALAPPDATA%\chromium\user data\default\origin bound certs
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\bg\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\ca\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\cs\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\da\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\de\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\el\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\en\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\en_gb\messages.json
- %LOCALAPPDATA%\chromium\user data\default\cache\f_000001
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\es\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\es_419\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\et\messages.json
- %TEMP%\etilqs_kzsdt27xjxjegb2
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\fi\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\fil\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\fr\messages.json
- %LOCALAPPDATA%\chromium\user data\default\cache\f_000002
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\hi\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\hr\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\hu\messages.json
- %LOCALAPPDATA%\chromium\user data\default\extension state\log
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\id\messages.json
- %LOCALAPPDATA%\chromium\user data\default\extension state\000002.dbtmp
- %LOCALAPPDATA%\chromium\user data\default\extension state\000001.dbtmp
- %TEMP%\etilqs_kiez8zzkon0u0an
- %LOCALAPPDATA%\chromium\user data\default\fb40.tmp
- %LOCALAPPDATA%\chromium\user data\default\archived history
- %LOCALAPPDATA%\chromium\user data\default\web data
- %LOCALAPPDATA%\chromium\user data\default\shortcuts-journal
- %LOCALAPPDATA%\chromium\user data\default\shortcuts
- %LOCALAPPDATA%\chromium\user data\default\network action predictor-journal
- %LOCALAPPDATA%\chromium\user data\default\network action predictor
- %LOCALAPPDATA%\chromium\user data\default\visited links
- %LOCALAPPDATA%\chromium\user data\default\cookies-journal
- %TEMP%\etilqs_haye1axgu1ctfar
- %LOCALAPPDATA%\chromium\user data\default\cookies
- %LOCALAPPDATA%\chromium\application\debug.log
- %LOCALAPPDATA%\chromium\user data\default\local storage\chrome-extension_pafkbggdmjlpgkdkcbjmhmfcdpncadgh_0.localstorage-journal
- %LOCALAPPDATA%\chromium\user data\default\current session
- %LOCALAPPDATA%\chromium\user data\default\1af2.tmp
- %LOCALAPPDATA%\chromium\user data\1ad2.tmp
- %LOCALAPPDATA%\chromium\user data\default\local storage\chrome-extension_pafkbggdmjlpgkdkcbjmhmfcdpncadgh_0.localstorage
- %LOCALAPPDATA%\chromium\user data\safe browsing cookies-journal
- %TEMP%\etilqs_xyzhs1pmksnjugb
- %LOCALAPPDATA%\chromium\user data\safe browsing cookies
- %LOCALAPPDATA%\chromium\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\manifest-000001
- %LOCALAPPDATA%\chromium\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\000001.dbtmp
- %LOCALAPPDATA%\chromium\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\manifest-000002
- %LOCALAPPDATA%\chromium\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\000002.dbtmp
- %LOCALAPPDATA%\chromium\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\log
- %LOCALAPPDATA%\chromium\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\chromium\user data\default\extension state\manifest-000002
- %LOCALAPPDATA%\chromium\user data\default\cache\f_000003
- %LOCALAPPDATA%\chromium\user data\default\cache\f_000004
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\it\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\images\flapper.gif
- %TEMP%\scoped_dir_2676_22365\crx_install\images\icon_128.png
- %TEMP%\scoped_dir_2676_22365\crx_install\images\icon_16.png
- %TEMP%\scoped_dir_2676_22365\crx_install\images\topbar_floating_button.png
- %TEMP%\scoped_dir_2676_22365\crx_install\images\topbar_floating_button_close.png
- %TEMP%\scoped_dir_2676_22365\crx_install\images\topbar_floating_button_hover.png
- %TEMP%\scoped_dir_2676_22365\crx_install\images\topbar_floating_button_maximize.png
- %TEMP%\scoped_dir_2676_22365\crx_install\images\topbar_floating_button_pressed.png
- %TEMP%\scoped_dir_2676_22365\crx_install\manifest.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_metadata\verified_contents.json
- %TEMP%\scoped_dir_2676_22365\decoded_images
- %TEMP%\scoped_dir_2676_22365\decoded_message_catalogs
- %LOCALAPPDATA%\chromium\user data\9318.tmp
- %LOCALAPPDATA%\chromium\user data\default\extension rules\000003.log
- %LOCALAPPDATA%\chromium\user data\default\41e9.tmp
- %LOCALAPPDATA%\chromium\user data\default\cache\f_000005
- %LOCALAPPDATA%\chromium\user data\default\cache\f_000006
- %LOCALAPPDATA%\chromium\user data\default\cache\f_000007
- %LOCALAPPDATA%\chromium\user data\default\cache\f_000008
- %LOCALAPPDATA%\chromium\user data\default\cache\f_000009
- %LOCALAPPDATA%\chromium\user data\default\cache\f_00000a
- %LOCALAPPDATA%\chromium\user data\default\cache\f_00000b
- %LOCALAPPDATA%\chromium\user data\default\cache\f_00000c
- %LOCALAPPDATA%\chromium\user data\default\57ca.tmp
- %LOCALAPPDATA%\chromium\user data\68db.tmp
- %LOCALAPPDATA%\chromium\user data\default\6c07.tmp
- %TEMP%\scoped_dir_2676_22365\crx_install\css\craw_window.css
- %TEMP%\scoped_dir_2676_22365\crx_install\html\craw_window.html
- %TEMP%\scoped_dir_2676_22365\crx_install\craw_window.js
- %TEMP%\scoped_dir_2676_22365\crx_install\craw_background.js
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\zh_tw\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\ko\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\lt\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\lv\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\nb\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\nl\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\pl\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\pt_br\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\pt_pt\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\ro\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\ru\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\sk\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\sl\messages.json
- %LOCALAPPDATA%\chromium\user data\default\archived history-journal
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\sr\messages.json
- %LOCALAPPDATA%\chromium\user data\default\local storage\https_www.google.com_0.localstorage-journal
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\sv\messages.json
- %LOCALAPPDATA%\chromium\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\chromium\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\chromium\user data\default\session storage\manifest-000002
- %LOCALAPPDATA%\chromium\user data\default\session storage\000002.dbtmp
- %LOCALAPPDATA%\chromium\user data\default\session storage\log
- %LOCALAPPDATA%\chromium\user data\default\session storage\000003.log
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\th\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\tr\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\uk\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\vi\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\zh_cn\messages.json
- %TEMP%\scoped_dir_2676_22365\crx_install\_locales\ja\messages.json
- %LOCALAPPDATA%\chromium\user data\default\local storage\https_www.google.com_0.localstorage
- %LOCALAPPDATA%\chromium\user data\41c8.tmp
- %LOCALAPPDATA%\chromium\user data\default\favicons
- %TEMP%\etilqs_n2lslfhv7f3enog
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\mksnapshot.ia32.exe.assert.manifest
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\nacl_irt_x86_32.nexe
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\nacl_irt_x86_64.nexe
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\am.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\ar.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\bg.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\bn.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\ca.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\chrome_100_percent.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\chrome_200_percent.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\cs.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\da.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\de.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\el.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\en-gb.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\en-us.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\es-419.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\es.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\et.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\fa.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\fi.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\fil.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\fr.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\gu.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\he.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\hi.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\hr.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\36.0.1923.0.manifest
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\hu.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\36.0.1922.0.manifest
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\36.0.1920.0.manifest
- %TEMP%\cr_5c321.tmp\setup.ex_
- %TEMP%\cr_5c321.tmp\setup.exe
- %TEMP%\chrome_installer.log
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome.7z
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\icudtl.dat
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\chrome.dll
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\chrome_child.dll
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\chrome_elf.dll
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\d3dcompiler_43.dll
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\d3dcompiler_46.dll
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\ffmpegsumo.dll
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\libegl.dll
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\libglesv2.dll
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\metro_driver.dll
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\ppgooglenaclpluginchrome.dll
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\xinput1_3.dll
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\chrome.exe
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\delegate_execute.exe
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\nacl64.exe
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\wow_helper.exe
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\extensions\external_extensions.json
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\35.0.1914.0.manifest
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\35.0.1915.0.manifest
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\35.0.1916.0.manifest
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\36.0.1917.0.manifest
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\36.0.1918.0.manifest
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\36.0.1919.0.manifest
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\36.0.1921.0.manifest
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\id.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\it.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\ja.pak
- %LOCALAPPDATA%\chromium\application\chrome.exe
- %LOCALAPPDATA%\chromium\application\36.0.1923.0\installer\setup.exe
- %HOMEPATH%\desktop\chromium.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\chromium.lnk
- %APPDATA%\microsoft\windows\start menu\programs\chromium\chromium.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\chromium.lnk
- %LOCALAPPDATA%\chromium\user data\default\extension rules\manifest-000001
- %LOCALAPPDATA%\chromium\user data\default\extension rules\000001.dbtmp
- %LOCALAPPDATA%\chromium\user data\default\extension rules\manifest-000002
- %LOCALAPPDATA%\chromium\user data\default\extension rules\000002.dbtmp
- %LOCALAPPDATA%\chromium\user data\default\extension rules\log
- %LOCALAPPDATA%\chromium\user data\first run
- %TEMP%\etilqs_9ztscek3sfjemtj
- %LOCALAPPDATA%\chromium\user data\default\top sites-journal
- %LOCALAPPDATA%\chromium\user data\default\ec70.tmp
- %LOCALAPPDATA%\chromium\user data\default\cache\index
- %LOCALAPPDATA%\chromium\user data\default\cache\data_0
- %LOCALAPPDATA%\chromium\user data\default\cache\data_1
- %LOCALAPPDATA%\chromium\user data\default\cache\data_2
- %LOCALAPPDATA%\chromium\user data\default\cache\data_3
- %LOCALAPPDATA%\chromium\user data\default\top sites
- %LOCALAPPDATA%\chromium\user data\default\history-journal
- %TEMP%\etilqs_fku7xaxfbrnvc7g
- %LOCALAPPDATA%\chromium\user data\default\web data-journal
- %LOCALAPPDATA%\chromium\user data\default\history
- %LOCALAPPDATA%\chromium\user data\default\favicons-journal
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\visualelements\splash-620x300.png
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\visualelementsmanifest.xml
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\visualelements\smalllogo.png
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\secondarytile.png
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\visualelements\logo.png
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\ko.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\lt.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\lv.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\ml.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\mr.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\ms.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\nb.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\nl.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\pl.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\pt-br.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\pt-pt.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\resources.pak
- %TEMP%\etilqs_6xi1tcullkztauh
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\ru.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\ro.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\sl.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\sr.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\sv.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\sw.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\ta.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\te.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\th.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\tr.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\uk.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\vi.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\zh-cn.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\zh-tw.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\kn.pak
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\36.0.1923.0\locales\sk.pak
- %LOCALAPPDATA%\chromium\user data\default\a6a9.tmp
Deletes the following files
- %TEMP%\cr_5c321.tmp\setup.ex_
- %LOCALAPPDATA%\chromium\user data\local state~rf11933a.tmp
- %LOCALAPPDATA%\chromium\user data\default\preferences~rf116c0b.tmp
- %LOCALAPPDATA%\chromium\user data\local state~rf1168d0.tmp
- %LOCALAPPDATA%\chromium\user data\default\preferences~rf1141ff.tmp
- %LOCALAPPDATA%\chromium\user data\local state~rf1141ef.tmp
- %TEMP%\2530.tmp
- %TEMP%\scoped_dir_2676_22365\decoded_message_catalogs
- %TEMP%\scoped_dir_2676_22365\decoded_images
- %TEMP%\scoped_dir_2676_22365\2530.tmp
- %TEMP%\scoped_dir_2676_22365\crx_install\images\icon_16.png
- %TEMP%\scoped_dir_2676_22365\crx_install\images\icon_128.png
- %LOCALAPPDATA%\chromium\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\chromium\user data\default\session storage\current~rf1138bc.tmp
- %TEMP%\2917.tmp
- %LOCALAPPDATA%\chromium\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\chromium\user data\default\extension state\current~rf111eb6.tmp
- %LOCALAPPDATA%\chromium\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\manifest-000001
- %LOCALAPPDATA%\chromium\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\current~rf111cd3.tmp
- %LOCALAPPDATA%\chromium\user data\default\fb40.tmp
- %LOCALAPPDATA%\chromium\user data\default\extension rules\manifest-000001
- %LOCALAPPDATA%\chromium\user data\default\extension rules\current~rf10e7fd.tmp
- %TEMP%\cr_5c321.tmp\setup.exe
- %TEMP%\cr_5c321.tmp\chrome.packed.7z
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\wow_helper.exe
- %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\chrome.exe
- %LOCALAPPDATA%\chromium\user data\default\preferences~rf11a708.tmp
- %LOCALAPPDATA%\chromium\user data\local state~rf11d816.tmp
Moves the following files
- from %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome-bin\visualelementsmanifest.xml to %LOCALAPPDATA%\chromium\application\visualelementsmanifest.xml
- from %LOCALAPPDATA%\chromium\user data\default\a6a9.tmp to %LOCALAPPDATA%\chromium\user data\default\preferences
- from %LOCALAPPDATA%\chromium\user data\local state to %LOCALAPPDATA%\chromium\user data\local state~rf11933a.tmp
- from %LOCALAPPDATA%\chromium\user data\9318.tmp to %LOCALAPPDATA%\chromium\user data\local state
- from %LOCALAPPDATA%\chromium\user data\default\preferences to %LOCALAPPDATA%\chromium\user data\default\preferences~rf116c0b.tmp
- from %LOCALAPPDATA%\chromium\user data\default\6c07.tmp to %LOCALAPPDATA%\chromium\user data\default\preferences
- from %LOCALAPPDATA%\chromium\user data\local state to %LOCALAPPDATA%\chromium\user data\local state~rf1168d0.tmp
- from %LOCALAPPDATA%\chromium\user data\68db.tmp to %LOCALAPPDATA%\chromium\user data\local state
- from %LOCALAPPDATA%\chromium\user data\default\57ca.tmp to %LOCALAPPDATA%\chromium\user data\default\transportsecurity
- from %LOCALAPPDATA%\chromium\user data\default\preferences to %LOCALAPPDATA%\chromium\user data\default\preferences~rf1141ff.tmp
- from %LOCALAPPDATA%\chromium\user data\default\41e9.tmp to %LOCALAPPDATA%\chromium\user data\default\preferences
- from %LOCALAPPDATA%\chromium\user data\local state to %LOCALAPPDATA%\chromium\user data\local state~rf1141ef.tmp
- from %LOCALAPPDATA%\chromium\user data\41c8.tmp to %LOCALAPPDATA%\chromium\user data\local state
- from %LOCALAPPDATA%\chromium\user data\default\session storage\current to %LOCALAPPDATA%\chromium\user data\default\session storage\current~rf1138bc.tmp
- from %LOCALAPPDATA%\chromium\user data\default\preferences to %LOCALAPPDATA%\chromium\user data\default\preferences~rf11a708.tmp
- from %LOCALAPPDATA%\chromium\user data\default\session storage\000002.dbtmp to %LOCALAPPDATA%\chromium\user data\default\session storage\current
- from %LOCALAPPDATA%\chromium\user data\default\extension state\current to %LOCALAPPDATA%\chromium\user data\default\extension state\current~rf111eb6.tmp
- from %LOCALAPPDATA%\chromium\user data\default\extension state\000002.dbtmp to %LOCALAPPDATA%\chromium\user data\default\extension state\current
- from %LOCALAPPDATA%\chromium\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\chromium\user data\default\extension state\current
- from %LOCALAPPDATA%\chromium\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\current to %LOCALAPPDATA%\chromium\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\current~rf111cd3.tmp
- from %LOCALAPPDATA%\chromium\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\000002.dbtmp to %LOCALAPPDATA%\chromium\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\current
- from %LOCALAPPDATA%\chromium\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\000001.dbtmp to %LOCALAPPDATA%\chromium\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\current
- from %LOCALAPPDATA%\chromium\user data\1ad2.tmp to %LOCALAPPDATA%\chromium\user data\local state
- from %LOCALAPPDATA%\chromium\user data\default\1af2.tmp to %LOCALAPPDATA%\chromium\user data\default\preferences
- from %LOCALAPPDATA%\chromium\user data\default\ec70.tmp to %LOCALAPPDATA%\chromium\user data\default\google profile.ico
- from %LOCALAPPDATA%\chromium\user data\default\extension rules\current to %LOCALAPPDATA%\chromium\user data\default\extension rules\current~rf10e7fd.tmp
- from %LOCALAPPDATA%\chromium\user data\default\extension rules\000002.dbtmp to %LOCALAPPDATA%\chromium\user data\default\extension rules\current
- from %LOCALAPPDATA%\chromium\user data\default\extension rules\000001.dbtmp to %LOCALAPPDATA%\chromium\user data\default\extension rules\current
- from %LOCALAPPDATA%\chromium\temp\source2420_9350\chrome.7z to %LOCALAPPDATA%\chromium\application\36.0.1923.0\installer\chrome.7z
- from %LOCALAPPDATA%\chromium\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\chromium\user data\default\session storage\current
- from %LOCALAPPDATA%\chromium\user data\local state to %LOCALAPPDATA%\chromium\user data\local state~rf11d816.tmp
Substitutes the following files
- %LOCALAPPDATA%\chromium\user data\default\extension rules\current
- %LOCALAPPDATA%\chromium\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\current
- %LOCALAPPDATA%\chromium\user data\default\extension state\current
- %LOCALAPPDATA%\chromium\user data\default\session storage\current
- %TEMP%\scoped_dir_2676_22365\crx_install\images\icon_128.png
- %TEMP%\scoped_dir_2676_22365\crx_install\images\icon_16.png
- %LOCALAPPDATA%\chromium\user data\local state
- %LOCALAPPDATA%\chromium\user data\default\preferences
Network activity
TCP
HTTP GET requests
- http://re####ctor.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvZjAxQUFXVHlhaFhwNHJ6dDVCakV0NUEyQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
- http://r3######5hnedn7l.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvZjAxQUFXVHlhaFhwNHJ6dDVCakV0NUEyQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx?cm########################...
- http://tools.google.com/chrome/intl/en/welcome.html
UDP
- DNS ASK google.com
- DNS ASK clients3.google.com
- DNS ASK tr######e.googleapis.com
- DNS ASK clients2.google.com
- DNS ASK tools.google.com
- DNS ASK ss#.#static.com
- DNS ASK re####ctor.gvt1.com
- DNS ASK r3######5hnedn7l.gvt1.com
- DNS ASK go#####analytics.com
- DNS ASK gs##tic.com
- DNS ASK go#####agmanager.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK fo###.gstatic.com
- DNS ASK st###.#.doubleclick.net
- DNS ASK go##le.nl
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Chromium\User Data'
Creates and executes the following
- '%TEMP%\cr_5c321.tmp\setup.exe' --install-archive="%TEMP%\CR_5C321.tmp\CHROME.PACKED.7Z"
- '%LOCALAPPDATA%\chromium\application\chrome.exe'
- '%LOCALAPPDATA%\chromium\application\chrome.exe' --type=gpu-process --channel="2676.0.66644773\689490806" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,15 --gpu-vendor-id=0x0000 --gpu-device-id=0x0000 --gpu-driver-vendor --gpu-dri...
- '%LOCALAPPDATA%\chromium\application\chrome.exe' --type=renderer --lang=en-US --force-fieldtrials=BrowserPreReadExperiment/100-pct-default/Prerender/PrerenderNoUse/UMA-New-Install-Uniformity-Trial/Control/UMA-Session-Randomized-Uniformity-Tri...
- '%LOCALAPPDATA%\chromium\application\chrome.exe' --type=utility --channel="2676.3.643299531\1358540988" --lang=en-US --no-sandbox /prefetch:-645351001
- '%LOCALAPPDATA%\chromium\application\chrome.exe' --type=utility --channel="2676.6.1616055327\1653979538" --lang=en-US --ignored=" --type=renderer " /prefetch:-645351001
- '%LOCALAPPDATA%\chromium\application\chrome.exe' --type=utility --channel="2676.7.1784839044\104129753" --lang=en-US --ignored=" --type=renderer " /prefetch:-645351001
- '%LOCALAPPDATA%\chromium\application\chrome.exe' --type=utility --channel="2676.9.2000439624\718763687" --lang=en-US --ignored=" --type=renderer " /prefetch:-645351001
