Trojan.Siggen32.19710

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM chrome.exe
'<SYSTEM32>\taskkill.exe' /F /IM chromedriver.exe

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

nul
%TEMP%\chrome-profile-1768811719645392800\local state
%TEMP%\chrome-profile-1768811719645392800\safe browsing cookies
%TEMP%\chrome-profile-1768811719645392800\default\chromedwritefontcache
%TEMP%\chrome-profile-1768811719645392800\default\cookies
%TEMP%\chrome-profile-1768811719645392800\default\current session
%TEMP%\chrome-profile-1768811719645392800\default\extension cookies
%TEMP%\chrome-profile-1768811719645392800\default\favicons
%TEMP%\chrome-profile-1768811719645392800\default\google profile.ico
%TEMP%\chrome-profile-1768811719645392800\default\history
%TEMP%\chrome-profile-1768811719645392800\default\history provider cache
%TEMP%\chrome-profile-1768811719645392800\default\history-journal
%TEMP%\chrome-profile-1768811719645392800\default\login data
%TEMP%\chrome-profile-1768811719645392800\default\network action predictor
%TEMP%\chrome-profile-1768811719645392800\default\preferences
%TEMP%\chrome-profile-1768811719645392800\default\quotamanager
%TEMP%\chrome-profile-1768811719645392800\default\readme
%TEMP%\chrome-profile-1768811719645392800\default\secure preferences
%TEMP%\chrome-profile-1768811719645392800\default\shortcuts
%TEMP%\chrome-profile-1768811719645392800\default\top sites
%TEMP%\chrome-profile-1768811719645392800\default\visited links
%TEMP%\chrome-profile-1768811719645392800\default\web data
%TEMP%\chrome-profile-1768811719645392800\default\cache\data_0
%TEMP%\chrome-profile-1768811719645392800\default\cache\data_1
%TEMP%\chrome-profile-1768811719645392800\default\cache\data_2
%TEMP%\chrome-profile-1768811719645392800\default\cache\data_3
%TEMP%\chrome-profile-1768811719645392800\default\cache\index
%TEMP%\chrome-profile-1768811719645392800\default\databases\databases.db
%TEMP%\chrome-profile-1768811719645392800\default\data_reduction_proxy_leveldb\current
%TEMP%\chrome-profile-1768811719645392800\default\data_reduction_proxy_leveldb\log
%TEMP%\chrome-profile-1768811719645392800\default\data_reduction_proxy_leveldb\manifest-000001
%TEMP%\chrome-profile-1768811719645392800\default\extension rules\000003.log
%TEMP%\chrome-profile-1768811719645392800\default\extension rules\current
%TEMP%\chrome-profile-1768811719645392800\default\extension rules\log
%TEMP%\chrome-profile-1768811719645392800\default\extension rules\manifest-000001
%TEMP%\chrome-profile-1768811719645392800\default\extension state\000003.log
%TEMP%\chrome-profile-1768811719645392800\default\extension state\current
%TEMP%\chrome-profile-1768811719645392800\default\extension state\log
%TEMP%\chrome-profile-1768811719645392800\default\extension state\manifest-000001
%TEMP%\chrome-profile-1768811719645392800\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_128.png
%TEMP%\chrome-profile-1768811719645392800\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_16.png
%TEMP%\chrome-profile-1768811719645392800\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.html
%TEMP%\chrome-profile-1768811719645392800\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js
%TEMP%\chrome-profile-1768811719645392800\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\manifest.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\128.png
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\manifest.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\128.png
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\manifest.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\128.png
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\16.png
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\32.png
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\48.png
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\manifest.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\128.png
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\manifest.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\messages.json
%TEMP%\chrome-profile-1768811719645392800\default\session storage\current
%TEMP%\chrome-profile-1768811719645392800\default\session storage\log
%TEMP%\chrome-profile-1768811719645392800\default\session storage\manifest-000001
%TEMP%\chrome-profile-1768811719645392800\default\5599.tmp
%TEMP%\chrome-profile-1768811719645392800\default\shortcuts-journal
%TEMP%\etilqs_ddv2daorhg8ffrh
%TEMP%\chrome-profile-1768811719645392800\default\web data-journal
%TEMP%\etilqs_nrf4gesj77rom7h
%TEMP%\chrome-profile-1768811719645392800\default\origin bound certs-journal
%TEMP%\etilqs_kkuhtjacdqho91b
%TEMP%\chrome-profile-1768811719645392800\default\origin bound certs
%TEMP%\chrome-profile-1768811719645392800\7b42.tmp
%TEMP%\chrome-profile-1768811719645392800\default\7c1e.tmp
%TEMP%\chrome-profile-1768811719645392800\default\7c3e.tmp
%TEMP%\chrome-profile-1768811719645392800\b64d.tmp
%TEMP%\chrome-profile-1768811719645392800\1a2a.tmp

Deletes following files that it created itself

%TEMP%\chrome-profile-1768811719645392800\default\5599.tmp
%TEMP%\chrome-profile-1768811719645392800\default\history provider cache

Moves the following files

from %TEMP%\chrome-profile-1768811719645392800\default\data_reduction_proxy_leveldb\log to %TEMP%\chrome-profile-1768811719645392800\default\data_reduction_proxy_leveldb\log.old
from %TEMP%\chrome-profile-1768811719645392800\default\current session to %TEMP%\chrome-profile-1768811719645392800\default\last session
from %TEMP%\chrome-profile-1768811719645392800\default\extension state\log to %TEMP%\chrome-profile-1768811719645392800\default\extension state\log.old
from %TEMP%\chrome-profile-1768811719645392800\7b42.tmp to %TEMP%\chrome-profile-1768811719645392800\local state
from %TEMP%\chrome-profile-1768811719645392800\default\7c1e.tmp to %TEMP%\chrome-profile-1768811719645392800\default\secure preferences
from %TEMP%\chrome-profile-1768811719645392800\default\7c3e.tmp to %TEMP%\chrome-profile-1768811719645392800\default\preferences
from %TEMP%\chrome-profile-1768811719645392800\b64d.tmp to %TEMP%\chrome-profile-1768811719645392800\local state
from %TEMP%\chrome-profile-1768811719645392800\1a2a.tmp to %TEMP%\chrome-profile-1768811719645392800\local state
from %TEMP%\chrome-profile-1768811719645392800\default\session storage\log to %TEMP%\chrome-profile-1768811719645392800\default\session storage\log.old

Substitutes the following files

%TEMP%\chrome-profile-1768811719645392800\default\data_reduction_proxy_leveldb\log
%TEMP%\chrome-profile-1768811719645392800\default\current session
%TEMP%\chrome-profile-1768811719645392800\default\extension state\log
%TEMP%\chrome-profile-1768811719645392800\default\session storage\log

Network activity

Connects to

'ip##pi.com':80
'ap#.###eallyour.money':443
'localhost':9223
'google.com':443

TCP

HTTP GET requests

http://ip##pi.com/json/?fi#######################

Other

'ap#.###eallyour.money':443
'google.com':443

UDP

DNS ASK ip##pi.com
DNS ASK ap#.###eallyour.money
DNS ASK google.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\chrome-profile-1768811719645392800'

Executes the following

'<SYSTEM32>\getmac.exe' /fo csv /nh
'<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name
'<SYSTEM32>\cmd.exe' /c ver
'<SYSTEM32>\robocopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data" %TEMP%\chrome-profile-1768811719645392800 /E /R:0 /W:0 /NFL /NDL /NJH /NJS /NC /NS /NP
'<SYSTEM32>\taskkill.exe' /F /IM chrome.exe' (with hidden window)
'<SYSTEM32>\robocopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data" %TEMP%\chrome-profile-1768811719645392800 /E /R:0 /W:0 /NFL /NDL /NJH /NJS /NC /NS /NP' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial