Technical Information
Malicious functions
Patches code
in AMSI dll
- kmpskl.exe process, Amsi.dll module
in NTDLL dll
- kmpskl.exe process, ntdll.dll module
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
Modifies file system
Creates the following files
- %TEMP%\.net\<File name>\b48\e_sqlite3.dll
- %TEMP%\nv\debug.log
- %TEMP%\nv\e_sqlite3.dll
- <Current directory>\debug.log
- %TEMP%\cdp_16d1fdaa\local state
- %TEMP%\cdp_16d1fdaa\default\cookies
- %TEMP%\cdp_16d1fdaa\default\preferences
- %TEMP%\cdp_16d1fdaa\default\secure preferences
- %TEMP%\cdp_16d1fdaa\default\web data
- %TEMP%\cdp_16d1fdaa\default\login data
- %TEMP%\cdp_16d1fdaa\default\history-journal
- %TEMP%\etilqs_ln17dvsvuxoiybt
- %TEMP%\cdp_16d1fdaa\default\data_reduction_proxy_leveldb\manifest-000001
- %TEMP%\cdp_16d1fdaa\default\data_reduction_proxy_leveldb\000001.dbtmp
- %TEMP%\cdp_16d1fdaa\default\data_reduction_proxy_leveldb\log
- %TEMP%\cdp_16d1fdaa\default\history
- %TEMP%\cdp_16d1fdaa\default\extension cookies-journal
- %TEMP%\etilqs_6g4rx0skfo1jhpf
- %TEMP%\cdp_16d1fdaa\default\top sites-journal
- %TEMP%\cdp_16d1fdaa\default\databases\databases.db-journal
- %TEMP%\etilqs_wqli3ahhv4mmafg
- %TEMP%\etilqs_dlkjzi8og5xlz1f
- %TEMP%\cdp_16d1fdaa\default\favicons-journal
- %TEMP%\etilqs_urrklpwdaxauwei
- %TEMP%\cdp_16d1fdaa\default\extension cookies
- %TEMP%\cdp_16d1fdaa\default\top sites
- %TEMP%\cdp_16d1fdaa\default\favicons
- %TEMP%\cdp_16d1fdaa\default\databases\databases.db
- %TEMP%\cdp_16d1fdaa\default\shortcuts-journal
- %TEMP%\cdp_16d1fdaa\default\6ca5.tmp
- %TEMP%\cdp_16d1fdaa\default\shortcuts
- %TEMP%\cdp_16d1fdaa\default\network action predictor-journal
- %TEMP%\cdp_16d1fdaa\default\network action predictor
- %TEMP%\cdp_16d1fdaa\default\current session
- %TEMP%\cdp_16d1fdaa\default\visited links
- %TEMP%\cdp_16d1fdaa\default\quotamanager-journal
- %TEMP%\etilqs_ci5p1e0ncggcvxd
- %TEMP%\cdp_16d1fdaa\default\quotamanager
- %TEMP%\cdp_16d1fdaa\8d3e.tmp
- %TEMP%\cdp_16d1fdaa\default\cache\index
- %TEMP%\cdp_16d1fdaa\default\cache\data_0
- %TEMP%\cdp_16d1fdaa\default\cache\data_1
- %TEMP%\cdp_16d1fdaa\default\cache\data_2
- %TEMP%\cdp_16d1fdaa\default\cache\data_3
- %TEMP%\cdp_16d1fdaa\default\8ed5.tmp
- %TEMP%\cdp_16d1fdaa\safe browsing cookies-journal
- %TEMP%\etilqs_fv0zt8cmm03otkb
- %TEMP%\cdp_16d1fdaa\default\8fc0.tmp
- %TEMP%\cdp_16d1fdaa\safe browsing cookies
- %TEMP%\cdp_16d1fdaa\default\origin bound certs-journal
- %TEMP%\etilqs_qv79jvvtqkujg0f
- %TEMP%\cdp_16d1fdaa\default\origin bound certs
- %TEMP%\cdp_16d1fdaa\default\extension state\manifest-000001
- %TEMP%\cdp_16d1fdaa\default\extension state\000001.dbtmp
- %TEMP%\cdp_16d1fdaa\default\extension state\log
- %TEMP%\cdp_16d1fdaa\default\extension state\000003.log
- %TEMP%\fad29a0b2b33421fa39c34b800295d7a-journal
- %TEMP%\fad29a0b2b33421fa39c34b800295d7a
- %TEMP%\d5b6caa98ff64f16930536a9545ec639-journal
- %TEMP%\d5b6caa98ff64f16930536a9545ec639
- %TEMP%\cdp_58e64cea\local state
- %TEMP%\cdp_58e64cea\default\preferences
- %TEMP%\cdp_58e64cea\default\secure preferences
- %TEMP%\cdp_58e64cea\default\web data
- %TEMP%\cdp_58e64cea\default\login data
- %TEMP%\cdp_58e64cea\crashpad\settings.dat
- %TEMP%\cdp_58e64cea\crashpad\throttle_store.dat
- %TEMP%\cdp_58e64cea\crashpadmetrics-active.pma
- %TEMP%\cdp_58e64cea\browsermetrics\browsermetrics-6a7c8fd0-9f4.pma
- %TEMP%\cdp_58e64cea\last version
- %TEMP%\cdp_58e64cea\6ebba958-2e4d-400f-ae22-172fc863e4a2.tmp
- %TEMP%\cdp_58e64cea\08df258d-0f76-45e8-b6c6-0effb7bedc12.tmp
- %TEMP%\cdp_58e64cea\browsermetrics\browsermetrics-6a7c8fd4-ca8.pma
- %TEMP%\cdp_58e64cea\shadercache\gpucache\index
- %TEMP%\cdp_58e64cea\shadercache\gpucache\data_0
- %TEMP%\cdp_58e64cea\shadercache\gpucache\data_1
- %TEMP%\cdp_58e64cea\shadercache\gpucache\data_2
- %TEMP%\cdp_58e64cea\shadercache\gpucache\data_3
- %TEMP%\cdp_58e64cea\grshadercache\gpucache\index
- %TEMP%\cdp_58e64cea\grshadercache\gpucache\data_0
- %TEMP%\cdp_58e64cea\grshadercache\gpucache\data_1
- %TEMP%\cdp_58e64cea\grshadercache\gpucache\data_2
- %TEMP%\cdp_58e64cea\grshadercache\gpucache\data_3
- %TEMP%\cdp_58e64cea\default\history-journal
- %TEMP%\cdp_58e64cea\default\code cache\js\index
- %TEMP%\cdp_58e64cea\default\code cache\wasm\index
- %TEMP%\cdp_58e64cea\default\media history-journal
- %TEMP%\cdp_58e64cea\default\sync data\leveldb\manifest-000001
- %TEMP%\cdp_58e64cea\default\site characteristics database\manifest-000001
- %TEMP%\cdp_58e64cea\default\sync data\leveldb\000001.dbtmp
- %TEMP%\cdp_58e64cea\default\site characteristics database\000001.dbtmp
- %TEMP%\cdp_58e64cea\default\sync data\leveldb\log
- %TEMP%\cdp_58e64cea\default\history
- %TEMP%\cdp_58e64cea\default\media history
- %TEMP%\cdp_58e64cea\default\sync data\leveldb\000003.log
- %TEMP%\cdp_58e64cea\default\site characteristics database\log
- %TEMP%\cdp_58e64cea\default\site characteristics database\000003.log
- %TEMP%\cdp_58e64cea\firstlaunchafterinstallation
- %TEMP%\cdp_58e64cea\default\cd263e2c-9463-475c-b82e-8a1ae0ca86fe.tmp
- %TEMP%\cdp_58e64cea\default\favicons-journal
- %TEMP%\cdp_58e64cea\default\favicons
- %TEMP%\cdp_58e64cea\default\local storage\leveldb\manifest-000001
- %TEMP%\cdp_58e64cea\default\local storage\leveldb\000001.dbtmp
- %TEMP%\cdp_58e64cea\default\local storage\leveldb\log
- %TEMP%\cdp_58e64cea\default\manifest-000001
- %TEMP%\cdp_58e64cea\default\000001.dbtmp
- %TEMP%\cdp_58e64cea\default\manifest-000002
- %TEMP%\cdp_58e64cea\default\000002.dbtmp
- %TEMP%\cdp_58e64cea\default\log
- %TEMP%\cdp_58e64cea\default\top sites-journal
- %TEMP%\cdp_58e64cea\default\gpucache\index
- %TEMP%\cdp_58e64cea\default\gpucache\data_0
- %TEMP%\cdp_58e64cea\default\gpucache\data_1
- %TEMP%\cdp_58e64cea\default\gpucache\data_2
- %TEMP%\cdp_58e64cea\default\gpucache\data_3
- %TEMP%\cdp_58e64cea\default\top sites
- %TEMP%\cdp_58e64cea\default\cookies-journal
- %TEMP%\cdp_58e64cea\default\cookies
- %TEMP%\cdp_58e64cea\default\session storage\manifest-000001
- %TEMP%\cdp_58e64cea\default\session storage\000001.dbtmp
- %TEMP%\cdp_58e64cea\default\session storage\log
- %TEMP%\cdp_58e64cea\default\session storage\000003.log
- %TEMP%\cdp_58e64cea\default\web data-journal
- %TEMP%\cdp_58e64cea\default\shared_proto_db\metadata\manifest-000001
- %TEMP%\cdp_58e64cea\default\shared_proto_db\metadata\000001.dbtmp
- %TEMP%\cdp_58e64cea\default\shared_proto_db\metadata\log
- %TEMP%\cdp_58e64cea\default\shared_proto_db\metadata\000003.log
- %TEMP%\cdp_58e64cea\default\sessions\session_13431021787962064
- %TEMP%\cdp_58e64cea\default\visited links
- %TEMP%\cdp_58e64cea\default\code cache\js\index-dir\temp-index
- %TEMP%\cdp_58e64cea\default\code cache\wasm\index-dir\temp-index
- %TEMP%\cdp_58e64cea\default\platform notifications\manifest-000001
- %TEMP%\cdp_58e64cea\default\platform notifications\000001.dbtmp
- %TEMP%\cdp_58e64cea\default\platform notifications\log
- %TEMP%\cdp_58e64cea\default\microsoft edge.lnk
- %TEMP%\cdp_58e64cea\default\b2bc833f-4cc3-472b-a9e8-bdc436a074e6.tmp
- %TEMP%\cdp_58e64cea\default\cache\index
- %TEMP%\cdp_58e64cea\default\cache\data_0
- %TEMP%\cdp_58e64cea\default\cache\data_1
- %TEMP%\cdp_58e64cea\default\cache\data_2
- %TEMP%\cdp_58e64cea\default\cache\data_3
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\microsoft edge (2).lnk
- %TEMP%\cdp_58e64cea\89416ac6-f261-4b3f-adf0-2509a1037523.tmp
- %TEMP%\15e75c7efb74413a8c08ef838f9dfaff-journal
- %TEMP%\15e75c7efb74413a8c08ef838f9dfaff
- %TEMP%\cdp_58e64cea\default\reporting and nel-journal
- %TEMP%\cdp_58e64cea\default\reporting and nel
- %TEMP%\cdp_58e64cea\default\82c99c28-0df5-4335-b1b8-2d4d1a88b648.tmp
- %TEMP%\cdp_58e64cea\default\88cf95ba-bd6c-402f-9b91-b69976aab739.tmp
- %TEMP%\cdp_58e64cea\default\extension state\manifest-000001
- %TEMP%\cdp_58e64cea\default\extension state\000001.dbtmp
- %TEMP%\cdp_58e64cea\default\extension state\log
- %TEMP%\cdp_58e64cea\0eb3cc66-18dd-4c17-a9ee-44011f945c76.tmp
- %TEMP%\cdp_58e64cea\default\heavy_ad_intervention_opt_out.db-journal
- %TEMP%\cdp_58e64cea\default\data_reduction_proxy_leveldb\manifest-000001
- %TEMP%\cdp_58e64cea\default\data_reduction_proxy_leveldb\000001.dbtmp
- %TEMP%\cdp_58e64cea\default\heavy_ad_intervention_opt_out.db
- %TEMP%\cdp_58e64cea\default\data_reduction_proxy_leveldb\manifest-000002
- %TEMP%\cdp_58e64cea\default\data_reduction_proxy_leveldb\000002.dbtmp
- %TEMP%\cdp_58e64cea\default\data_reduction_proxy_leveldb\log
- %TEMP%\cdp_58e64cea\default\previews_opt_out.db-journal
- %TEMP%\cdp_58e64cea\default\previews_opt_out.db
- %TEMP%\cdp_58e64cea\default\shortcuts-journal
- %TEMP%\cdp_58e64cea\default\network action predictor-journal
- %TEMP%\cdp_58e64cea\default\shortcuts
- %TEMP%\cdp_58e64cea\last browser
- %TEMP%\cdp_58e64cea\default\network action predictor
- %TEMP%\cdp_58e64cea\default\preferredapps
- %TEMP%\cdp_58e64cea\default\budgetdatabase\manifest-000001
- %TEMP%\cdp_58e64cea\default\budgetdatabase\000001.dbtmp
- %TEMP%\cdp_58e64cea\default\budgetdatabase\log
- %TEMP%\cdp_58e64cea\default\feature engagement tracker\eventdb\manifest-000001
- %TEMP%\cdp_58e64cea\default\feature engagement tracker\eventdb\000001.dbtmp
- %TEMP%\cdp_58e64cea\default\feature engagement tracker\eventdb\log
- %TEMP%\cdp_58e64cea\default\feature engagement tracker\availabilitydb\manifest-000001
- %TEMP%\cdp_58e64cea\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %TEMP%\cdp_58e64cea\default\feature engagement tracker\availabilitydb\log
- %TEMP%\cdp_58e64cea\ad blocking\49aff544-c97e-480c-ae28-aeb5e37c4054.tmp
- %TEMP%\cdp_58e64cea\default\autofillstrikedatabase\manifest-000001
- %TEMP%\cdp_58e64cea\default\autofillstrikedatabase\000001.dbtmp
- %TEMP%\cdp_58e64cea\default\autofillstrikedatabase\log
- %TEMP%\cdp_58e64cea\default\feature engagement tracker\availabilitydb\000003.log
- %TEMP%\cdp_58e64cea\7058dba8-56a4-4347-817f-023ecc56d92a.tmp
- %TEMP%\cdp_58e64cea\default\be20dbad-3ace-4805-83e8-a4c78d025d3d.tmp
- %TEMP%\cdp_58e64cea\a8152470-5aaf-4487-a30b-48f60c3c4089.tmp
- %TEMP%\cdp_58e64cea\functional data-journal
- %TEMP%\cdp_58e64cea\functional data
- %TEMP%\cdp_58e64cea\functional data-wal
- %TEMP%\cdp_58e64cea\functional san data-journal
- %TEMP%\cdp_58e64cea\functional san data
- %TEMP%\cdp_58e64cea\functional san data-wal
- %TEMP%\cdp_58e64cea\browsermetrics-spare.pma.tmp
Deletes following files that it created itself
- %TEMP%\cdp_16d1fdaa\default\6ca5.tmp
- %TEMP%\cdp_16d1fdaa\default\cache\data_0
- %TEMP%\cdp_16d1fdaa\default\cache\data_1
- %TEMP%\cdp_16d1fdaa\default\cache\data_2
- %TEMP%\cdp_16d1fdaa\default\cache\data_3
- %TEMP%\cdp_16d1fdaa\default\cache\index
- %TEMP%\cdp_16d1fdaa\default\cookies
- %TEMP%\cdp_16d1fdaa\default\current session
- %TEMP%\cdp_16d1fdaa\default\databases\databases.db
- %TEMP%\cdp_16d1fdaa\default\databases\databases.db-journal
- %TEMP%\cdp_16d1fdaa\default\data_reduction_proxy_leveldb\current
- %TEMP%\cdp_16d1fdaa\default\data_reduction_proxy_leveldb\log
- %TEMP%\cdp_16d1fdaa\default\data_reduction_proxy_leveldb\manifest-000001
- %TEMP%\cdp_16d1fdaa\default\extension cookies
- %TEMP%\cdp_16d1fdaa\default\extension cookies-journal
- %TEMP%\cdp_16d1fdaa\default\extension state\000003.log
- %TEMP%\cdp_16d1fdaa\default\extension state\current
- %TEMP%\cdp_16d1fdaa\default\extension state\log
- %TEMP%\cdp_16d1fdaa\default\extension state\manifest-000001
- %TEMP%\cdp_16d1fdaa\default\favicons
- %TEMP%\cdp_16d1fdaa\default\favicons-journal
- %TEMP%\cdp_16d1fdaa\default\history
- %TEMP%\cdp_16d1fdaa\default\history-journal
- %TEMP%\cdp_16d1fdaa\default\login data
- %TEMP%\cdp_16d1fdaa\default\network action predictor
- %TEMP%\cdp_16d1fdaa\default\network action predictor-journal
- %TEMP%\cdp_16d1fdaa\default\origin bound certs
- %TEMP%\cdp_16d1fdaa\default\origin bound certs-journal
- %TEMP%\cdp_16d1fdaa\default\preferences
- %TEMP%\cdp_16d1fdaa\default\quotamanager
- %TEMP%\cdp_16d1fdaa\default\quotamanager-journal
- %TEMP%\cdp_16d1fdaa\default\secure preferences
- %TEMP%\cdp_16d1fdaa\default\shortcuts
- %TEMP%\cdp_16d1fdaa\default\shortcuts-journal
- %TEMP%\cdp_16d1fdaa\default\top sites
- %TEMP%\cdp_16d1fdaa\default\top sites-journal
- %TEMP%\cdp_16d1fdaa\default\visited links
- %TEMP%\cdp_16d1fdaa\default\web data
- %TEMP%\cdp_16d1fdaa\local state
- %TEMP%\cdp_16d1fdaa\safe browsing cookies
- %TEMP%\cdp_16d1fdaa\safe browsing cookies-journal
- %TEMP%\fad29a0b2b33421fa39c34b800295d7a-journal
- %TEMP%\d5b6caa98ff64f16930536a9545ec639-journal
- %TEMP%\cdp_58e64cea\default\cd263e2c-9463-475c-b82e-8a1ae0ca86fe.tmp
- %TEMP%\cdp_58e64cea\default\manifest-000001
- %TEMP%\cdp_58e64cea\browsermetrics\browsermetrics-6a7c8fd0-9f4.pma
- %TEMP%\cdp_58e64cea\browsermetrics\browsermetrics-6a7c8fd4-ca8.pma
- %TEMP%\cdp_58e64cea\crashpad\settings.dat
- %TEMP%\cdp_58e64cea\crashpad\throttle_store.dat
- %TEMP%\cdp_58e64cea\crashpadmetrics.pma
- %TEMP%\cdp_58e64cea\default\cache\data_0
- %TEMP%\cdp_58e64cea\default\cache\data_1
- %TEMP%\cdp_58e64cea\default\cache\data_2
- %TEMP%\cdp_58e64cea\default\cache\data_3
- %TEMP%\cdp_58e64cea\default\cache\index
- %TEMP%\cdp_58e64cea\default\code cache\js\index
- %TEMP%\cdp_58e64cea\default\code cache\js\index-dir\the-real-index
- %TEMP%\cdp_58e64cea\default\code cache\wasm\index
- %TEMP%\cdp_58e64cea\default\code cache\wasm\index-dir\the-real-index
- %TEMP%\cdp_58e64cea\default\current
- %TEMP%\cdp_58e64cea\default\gpucache\data_0
- %TEMP%\cdp_58e64cea\default\gpucache\data_1
- %TEMP%\cdp_58e64cea\default\gpucache\data_2
- %TEMP%\cdp_58e64cea\default\gpucache\data_3
- %TEMP%\cdp_58e64cea\default\gpucache\index
- %TEMP%\cdp_58e64cea\default\local storage\leveldb\current
- %TEMP%\cdp_58e64cea\default\microsoft edge.lnk
- %TEMP%\cdp_58e64cea\default\platform notifications\current
- %TEMP%\cdp_58e64cea\default\preferences
- %TEMP%\cdp_58e64cea\default\secure preferences
- %TEMP%\cdp_58e64cea\default\session storage\current
- %TEMP%\cdp_58e64cea\default\shared_proto_db\metadata\current
- %TEMP%\cdp_58e64cea\default\site characteristics database\current
- %TEMP%\cdp_58e64cea\default\sync data\leveldb\current
- %TEMP%\cdp_58e64cea\firstlaunchafterinstallation
- %TEMP%\cdp_58e64cea\grshadercache\gpucache\data_0
- %TEMP%\cdp_58e64cea\grshadercache\gpucache\data_1
- %TEMP%\cdp_58e64cea\grshadercache\gpucache\data_2
- %TEMP%\cdp_58e64cea\grshadercache\gpucache\data_3
- %TEMP%\cdp_58e64cea\grshadercache\gpucache\index
- %TEMP%\cdp_58e64cea\last version
- %TEMP%\cdp_58e64cea\local state
- %TEMP%\cdp_58e64cea\shadercache\gpucache\data_0
- %TEMP%\cdp_58e64cea\shadercache\gpucache\data_1
- %TEMP%\cdp_58e64cea\shadercache\gpucache\data_2
- %TEMP%\cdp_58e64cea\shadercache\gpucache\data_3
- %TEMP%\cdp_58e64cea\shadercache\gpucache\index
- %TEMP%\15e75c7efb74413a8c08ef838f9dfaff-journal
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\microsoft edge (2).lnk
- %TEMP%\cdp_58e64cea\default\data_reduction_proxy_leveldb\manifest-000001
- %TEMP%\cdp_58e64cea\functional data-journal
- %TEMP%\cdp_58e64cea\functional san data-journal
Moves the following files
- from %TEMP%\cdp_16d1fdaa\default\data_reduction_proxy_leveldb\000001.dbtmp to %TEMP%\cdp_16d1fdaa\default\data_reduction_proxy_leveldb\current
- from %TEMP%\cdp_16d1fdaa\8d3e.tmp to %TEMP%\cdp_16d1fdaa\local state
- from %TEMP%\cdp_16d1fdaa\default\8ed5.tmp to %TEMP%\cdp_16d1fdaa\default\secure preferences
- from %TEMP%\cdp_16d1fdaa\default\8fc0.tmp to %TEMP%\cdp_16d1fdaa\default\preferences
- from %TEMP%\cdp_16d1fdaa\default\extension state\000001.dbtmp to %TEMP%\cdp_16d1fdaa\default\extension state\current
- from %TEMP%\cdp_58e64cea\crashpadmetrics-active.pma to %TEMP%\cdp_58e64cea\crashpadmetrics.pma
- from %TEMP%\cdp_58e64cea\default\sync data\leveldb\000001.dbtmp to %TEMP%\cdp_58e64cea\default\sync data\leveldb\current
- from %TEMP%\cdp_58e64cea\default\site characteristics database\000001.dbtmp to %TEMP%\cdp_58e64cea\default\site characteristics database\current
- from %TEMP%\cdp_58e64cea\default\local storage\leveldb\000001.dbtmp to %TEMP%\cdp_58e64cea\default\local storage\leveldb\current
- from %TEMP%\cdp_58e64cea\default\000001.dbtmp to %TEMP%\cdp_58e64cea\default\current
- from %TEMP%\cdp_58e64cea\default\session storage\000001.dbtmp to %TEMP%\cdp_58e64cea\default\session storage\current
- from %TEMP%\cdp_58e64cea\default\shared_proto_db\metadata\000001.dbtmp to %TEMP%\cdp_58e64cea\default\shared_proto_db\metadata\current
- from %TEMP%\cdp_58e64cea\default\code cache\js\index-dir\temp-index to %TEMP%\cdp_58e64cea\default\code cache\js\index-dir\the-real-index
- from %TEMP%\cdp_58e64cea\default\code cache\wasm\index-dir\temp-index to %TEMP%\cdp_58e64cea\default\code cache\wasm\index-dir\the-real-index
- from %TEMP%\cdp_58e64cea\default\platform notifications\000001.dbtmp to %TEMP%\cdp_58e64cea\default\platform notifications\current
- from %TEMP%\cdp_58e64cea\default\82c99c28-0df5-4335-b1b8-2d4d1a88b648.tmp to %TEMP%\cdp_58e64cea\default\network persistent state
- from %TEMP%\cdp_58e64cea\default\extension state\000001.dbtmp to %TEMP%\cdp_58e64cea\default\extension state\current
- from %TEMP%\cdp_58e64cea\default\data_reduction_proxy_leveldb\000001.dbtmp to %TEMP%\cdp_58e64cea\default\data_reduction_proxy_leveldb\current
- from %TEMP%\cdp_58e64cea\default\budgetdatabase\000001.dbtmp to %TEMP%\cdp_58e64cea\default\budgetdatabase\current
- from %TEMP%\cdp_58e64cea\default\feature engagement tracker\eventdb\000001.dbtmp to %TEMP%\cdp_58e64cea\default\feature engagement tracker\eventdb\current
- from %TEMP%\cdp_58e64cea\default\feature engagement tracker\availabilitydb\000001.dbtmp to %TEMP%\cdp_58e64cea\default\feature engagement tracker\availabilitydb\current
- from %TEMP%\cdp_58e64cea\ad blocking\49aff544-c97e-480c-ae28-aeb5e37c4054.tmp to %TEMP%\cdp_58e64cea\ad blocking\blocklist
- from %TEMP%\cdp_58e64cea\default\autofillstrikedatabase\000001.dbtmp to %TEMP%\cdp_58e64cea\default\autofillstrikedatabase\current
- from %TEMP%\cdp_58e64cea\browsermetrics-spare.pma.tmp to %TEMP%\cdp_58e64cea\browsermetrics-spare.pma
Modifies the following files
- %LOCALAPPDATA%\google\chrome\application\debug.log
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %TEMP%\.ses
Substitutes the following files
- %TEMP%\cdp_58e64cea\crashpadmetrics-active.pma
- %TEMP%\cdp_58e64cea\default\cache\data_1
- %TEMP%\cdp_58e64cea\default\cache\data_0
- %TEMP%\cdp_58e64cea\default\preferences
- %TEMP%\cdp_58e64cea\local state
Network activity
Connects to
- 'ss#.#static.com':443
- 'go###eapis.com':443
TCP
Other
- 'ss#.#static.com':443
- 'go###eapis.com':443
UDP
- DNS ASK google.com
- DNS ASK ss#.#static.com
- DNS ASK go###eapis.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\cdp_16d1fdaa'
- ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\cdp_58e64cea'
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --disable-gpu --remote-debugging-port=27169 --user-data-dir="%TEMP%\cdp_58e64cea" --profile-directory="Default" --no-first-run --no-default-browser-check --disable-extensions --disable-componen...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --disable-gpu --remote-debugging-port=27169 --user-data-dir="%TEMP%\cdp_58e64cea" --profile-directory=Default --no-first-run --no-default-browser-check --disable-extensions --disable-component-...
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1808,7886613060229063525,2778902665052172524,131072 --disable-features=OptimizationGuideModelDownload...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --disable-gpu --remote-debugging-port=27169 --user-data-dir="%TEMP%\cdp_58e64cea" --profile-directory=Default --no-first-run --no-default-browser-check --disable-extensions --disable-component-...' (with hidden window)
