Trojan.DownLoader29.46043

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SecurityHealth' = '<LS_APPDATA>\Brow\ibox32.exe'

Malicious functions

Terminates or attempts to terminate

the following system processes:

%WINDIR%\syswow64\ctfmon.exe

Modifies file system

Creates the following files

<LS_APPDATA>\brow\ibox32.exe
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\pt_br\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\pt_pt\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\ro\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\sk\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\sl\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\sr\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\sv\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\th\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\tr\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\uk\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\nl\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\pl\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\vi\messages.json
<LS_APPDATA>\google\chrome\test1\default\gpucache\index
<LS_APPDATA>\google\chrome\test1\default\gpucache\data_0
<LS_APPDATA>\google\chrome\test1\default\gpucache\data_1
<LS_APPDATA>\google\chrome\test1\default\gpucache\data_2
<LS_APPDATA>\google\chrome\test1\default\gpucache\data_3
<LS_APPDATA>\google\chrome\test1\487.tmp
<LS_APPDATA>\google\chrome\test1\default\current session
<LS_APPDATA>\google\chrome\test1\safe browsing cookies-journal
%TEMP%\etilqs_cqkgc8b6mstq9mv
<LS_APPDATA>\google\chrome\test1\safe browsing cookies
<LS_APPDATA>\@system.temp
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\zh_cn\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\zh_tw\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\lv\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\ko\messages.json
<LS_APPDATA>\google\chrome\test1\default\2d10.tmp
%TEMP%\scoped_dir_1864_226\crx_install\_locales\zh_tw\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\manifest.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\ar\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\bg\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\ca\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\cs\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\da\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\de\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\el\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\en\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\en_gb\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\en_us\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\es\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\es_419\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\et\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\fi\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\fil\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\fr\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\he\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\hi\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\hr\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\hu\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\id\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\it\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\ja\messages.json
<LS_APPDATA>\google\chrome\test1\default\e8b.tmp
%TEMP%\scoped_dir_1864_226\crx_install\_locales\vi\messages.json
%TEMP%\scoped_dir_1864_5394\crx_install\_locales\lt\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\bg\messages.json
%TEMP%\scoped_dir_1864_1064\crx_install\manifest.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\sk\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\sl\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\sr\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\sv\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\th\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\tr\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\uk\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\vi\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\zh_cn\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\zh_tw\messages.json
<LS_APPDATA>\google\chrome\test1\35eb.tmp
<LS_APPDATA>\google\chrome\test1\default\35fb.tmp
<LS_APPDATA>\google\chrome\test1\default\40ba.tmp
<LS_APPDATA>\google\chrome\test1\default\extension state\manifest-000001
<LS_APPDATA>\google\chrome\test1\default\extension state\000001.dbtmp
<LS_APPDATA>\google\chrome\test1\default\extension state\log
<LS_APPDATA>\google\chrome\test1\default\extension state\000003.log
<LS_APPDATA>\google\chrome\test1\default\cookies-journal
%TEMP%\etilqs_rfymtnbqedqzpht
<LS_APPDATA>\google\chrome\test1\default\cookies
<LS_APPDATA>\google\chrome\test1\default\databases\databases.db-journal
%TEMP%\etilqs_3uzid8mcnuf7jff
<LS_APPDATA>\google\chrome\test1\default\databases\databases.db
<LS_APPDATA>\google\chrome\test1\default\quotamanager-journal
%TEMP%\etilqs_cmdhwkrncnz9enu
<LS_APPDATA>\google\chrome\test1\default\quotamanager
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\ro\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\uk\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\zh_cn\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\pl\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\ar\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\bg\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\ca\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\cs\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\da\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\de\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\el\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\en_gb\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\en_us\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\es\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\es_419\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\et\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\fi\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\fil\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\fr\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\he\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\hi\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\hr\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\hu\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\id\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\it\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\ja\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\ko\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\lt\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\lv\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\ms\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\nl\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\pt_br\messages.json
%TEMP%\scoped_dir_1864_7791\crx_install\manifest.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\tr\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\th\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\sv\messages.json
%TEMP%\etilqs_vy67vt4hlhe4dil
<LS_APPDATA>\google\chrome\test1\default\visited links
<LS_APPDATA>\google\chrome\test1\default\login data
%TEMP%\ce30.tmp
%TEMP%\scoped_dir_1864_1064\docs.crx
%TEMP%\ce60.tmp
%TEMP%\scoped_dir_1864_7791\drive.crx
%TEMP%\ce70.tmp
%TEMP%\scoped_dir_1864_226\youtube.crx
%TEMP%\ceb0.tmp
%TEMP%\scoped_dir_1864_5394\search.crx
%TEMP%\cec1.tmp
%TEMP%\scoped_dir_1864_28169\gmail.crx
<LS_APPDATA>\google\chrome\test1\default\cache\index
<LS_APPDATA>\google\chrome\test1\default\cache\data_0
<LS_APPDATA>\google\chrome\test1\default\cache\data_1
<LS_APPDATA>\google\chrome\test1\default\cache\data_2
<LS_APPDATA>\google\chrome\test1\default\cache\data_3
%TEMP%\scoped_dir_1864_28169\crx_install\manifest.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\ar\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\bg\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\ca\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\cs\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\da\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\de\messages.json
<LS_APPDATA>\google\chrome\test1\default\network action predictor-journal
<LS_APPDATA>\google\chrome\test1\default\shortcuts-journal
<LS_APPDATA>\google\chrome\test1\default\login data-journal
<LS_APPDATA>\google\chrome\test1\default\5eb3.tmp
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\el\messages.json
<LS_APPDATA>\google\chrome\test1\default\top sites
<LS_APPDATA>\brow\rcx2f31.tmp
<LS_APPDATA>\brow\rcx3e55.tmp
<LS_APPDATA>\brow\rcx4b66.tmp
%HOMEPATH%\appdata\@con2.bin
<LS_APPDATA>\mode3.bin
<LS_APPDATA>\@000001.dat
<LS_APPDATA>\google\chrome\clocal.dat
<LS_APPDATA>\google\chrome\local.dat
<LS_APPDATA>\google\chrome\plug\script.js
<LS_APPDATA>\google\chrome\plug\manifest.json
<LS_APPDATA>\google\chrome\plug\main.html
<LS_APPDATA>\google\chrome\test1\default\extension rules\manifest-000001
<LS_APPDATA>\brow\rcx2721.tmp
<LS_APPDATA>\google\chrome\test1\default\extension rules\000001.dbtmp
<LS_APPDATA>\google\chrome\test1\default\web data-journal
%TEMP%\etilqs_ccdywoo4t425zjl
<LS_APPDATA>\google\chrome\test1\default\history-journal
%TEMP%\etilqs_uo23p1q09wsznxj
<LS_APPDATA>\google\chrome\test1\default\web data
<LS_APPDATA>\google\chrome\test1\default\history
<LS_APPDATA>\google\chrome\test1\default\favicons-journal
%TEMP%\etilqs_g5uiyukml3mhvs6
<LS_APPDATA>\google\chrome\test1\default\favicons
<LS_APPDATA>\google\chrome\test1\default\top sites-journal
%TEMP%\etilqs_foewqwok3ecjzzm
<LS_APPDATA>\google\chrome\test1\default\c7c6.tmp
<LS_APPDATA>\google\chrome\test1\default\extension rules\log
<LS_APPDATA>\google\chrome\test1\default\shortcuts
%TEMP%\scoped_dir_1864_7791\crx_install\_locales\pt_pt\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\en\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\fil\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\de\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\el\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\en\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\es\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\fi\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\fil\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\fr\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\he\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\hi\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\hr\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\hu\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\id\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\it\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\ja\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\ko\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\lt\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\lv\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\nl\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\pl\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\pt_br\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\pt_pt\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\ro\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\sk\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\sl\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\sr\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\es\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\da\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\fi\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\cs\messages.json
<LS_APPDATA>\google\chrome\test1\default\network action predictor
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\fr\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\hi\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\hr\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\hu\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\id\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\it\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\ja\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\ko\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\lt\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\lv\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\nl\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\pl\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\pt_br\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\pt_pt\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\ro\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\sk\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\sl\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\sr\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\th\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\tr\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\uk\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\vi\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\zh_cn\messages.json
%TEMP%\scoped_dir_1864_28169\crx_install\_locales\zh_tw\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\manifest.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\ar\messages.json
%TEMP%\scoped_dir_1864_226\crx_install\_locales\ca\messages.json
<LS_APPDATA>\google\chrome\test1\default\64bf.tmp

Sets the 'hidden' attribute to the following files

%HOMEPATH%\appdata\@con2.bin
<LS_APPDATA>\mode3.bin

Deletes the following files

<LS_APPDATA>\google\chrome\test1\default\c7c6.tmp
%TEMP%\scoped_dir_1864_5394\search.crx
%TEMP%\scoped_dir_1864_1064\crx_install\icon_128.png
%TEMP%\scoped_dir_1864_1064\crx_install\icon_16.png
%TEMP%\scoped_dir_1864_7791\crx_install\128.png
<LS_APPDATA>\google\chrome\test1\default\secure preferences~rf1140af.tmp
<LS_APPDATA>\google\chrome\test1\default\preferences~rf1140bf.tmp
<LS_APPDATA>\google\chrome\test1\local state~rf1140de.tmp
%TEMP%\scoped_dir_1864_1064\decoded_images
%TEMP%\scoped_dir_1864_1064\decoded_message_catalogs
%TEMP%\scoped_dir_1864_1064\docs.crx
%TEMP%\scoped_dir_1864_7791\decoded_images
%TEMP%\scoped_dir_1864_7791\decoded_message_catalogs
%TEMP%\scoped_dir_1864_7791\drive.crx
<LS_APPDATA>\google\chrome\test1\default\preferences~rf115ec7.tmp
<LS_APPDATA>\google\chrome\test1\default\secure preferences~rf1164e1.tmp
%TEMP%\scoped_dir_1864_5394\decoded_message_catalogs
<LS_APPDATA>\google\chrome\test1\local state~rf116adc.tmp
%TEMP%\scoped_dir_1864_5394\decoded_images
%TEMP%\scoped_dir_1864_226\decoded_message_catalogs
%TEMP%\ce30.tmp
%TEMP%\ce60.tmp
%TEMP%\ce70.tmp
%TEMP%\ceb0.tmp
%TEMP%\cec1.tmp
%TEMP%\scoped_dir_1864_28169\crx_install\128.png
%TEMP%\scoped_dir_1864_226\crx_install\128.png
%TEMP%\scoped_dir_1864_5394\crx_install\128.png
%TEMP%\scoped_dir_1864_5394\crx_install\16.png
%TEMP%\scoped_dir_1864_5394\crx_install\32.png
%TEMP%\scoped_dir_1864_5394\crx_install\48.png
%TEMP%\scoped_dir_1864_28169\decoded_images
%TEMP%\scoped_dir_1864_28169\decoded_message_catalogs
%TEMP%\scoped_dir_1864_28169\gmail.crx
%TEMP%\scoped_dir_1864_226\decoded_images
%TEMP%\scoped_dir_1864_226\youtube.crx
<LS_APPDATA>\google\chrome\test1\default\secure preferences~rf11aae3.tmp

Moves the following files

from <LS_APPDATA>\brow\rcx2721.tmp to <LS_APPDATA>\brow\ibox32.exe
from <LS_APPDATA>\google\chrome\test1\default\secure preferences to <LS_APPDATA>\google\chrome\test1\default\secure preferences~rf1164e1.tmp
from <LS_APPDATA>\google\chrome\test1\default\64bf.tmp to <LS_APPDATA>\google\chrome\test1\default\secure preferences
from <LS_APPDATA>\google\chrome\test1\default\preferences to <LS_APPDATA>\google\chrome\test1\default\preferences~rf115ec7.tmp
from <LS_APPDATA>\google\chrome\test1\default\5eb3.tmp to <LS_APPDATA>\google\chrome\test1\default\preferences
from <LS_APPDATA>\google\chrome\test1\default\extension state\000001.dbtmp to <LS_APPDATA>\google\chrome\test1\default\extension state\current
from <LS_APPDATA>\google\chrome\test1\local state to <LS_APPDATA>\google\chrome\test1\local state~rf1140de.tmp
from <LS_APPDATA>\google\chrome\test1\default\preferences to <LS_APPDATA>\google\chrome\test1\default\preferences~rf1140bf.tmp
from <LS_APPDATA>\google\chrome\test1\default\40ba.tmp to <LS_APPDATA>\google\chrome\test1\default\preferences
from <LS_APPDATA>\google\chrome\test1\local state to <LS_APPDATA>\google\chrome\test1\local state~rf116adc.tmp
from <LS_APPDATA>\google\chrome\test1\35eb.tmp to <LS_APPDATA>\google\chrome\test1\local state
from <LS_APPDATA>\google\chrome\test1\default\35fb.tmp to <LS_APPDATA>\google\chrome\test1\default\secure preferences
from <LS_APPDATA>\google\chrome\test1\default\2d10.tmp to <LS_APPDATA>\google\chrome\test1\default\preferences
from <LS_APPDATA>\google\chrome\test1\default\e8b.tmp to <LS_APPDATA>\google\chrome\test1\default\secure preferences
from <LS_APPDATA>\google\chrome\test1\487.tmp to <LS_APPDATA>\google\chrome\test1\local state
from <LS_APPDATA>\google\chrome\test1\default\extension rules\000001.dbtmp to <LS_APPDATA>\google\chrome\test1\default\extension rules\current
from <LS_APPDATA>\brow\rcx4b66.tmp to <LS_APPDATA>\brow\ibox32.exe
from <LS_APPDATA>\brow\rcx3e55.tmp to <LS_APPDATA>\brow\ibox32.exe
from <LS_APPDATA>\brow\rcx2f31.tmp to <LS_APPDATA>\brow\ibox32.exe
from <LS_APPDATA>\google\chrome\test1\default\secure preferences to <LS_APPDATA>\google\chrome\test1\default\secure preferences~rf1140af.tmp
from <LS_APPDATA>\google\chrome\test1\default\secure preferences to <LS_APPDATA>\google\chrome\test1\default\secure preferences~rf11aae3.tmp

Substitutes the following files

%TEMP%\scoped_dir_1864_28169\crx_install\128.png
%TEMP%\scoped_dir_1864_226\crx_install\128.png
%TEMP%\scoped_dir_1864_5394\crx_install\128.png
%TEMP%\scoped_dir_1864_5394\crx_install\16.png
%TEMP%\scoped_dir_1864_5394\crx_install\32.png
%TEMP%\scoped_dir_1864_5394\crx_install\48.png
%TEMP%\scoped_dir_1864_1064\crx_install\icon_128.png
%TEMP%\scoped_dir_1864_1064\crx_install\icon_16.png
%TEMP%\scoped_dir_1864_7791\crx_install\128.png
<LS_APPDATA>\google\chrome\test1\default\secure preferences
<LS_APPDATA>\google\chrome\test1\default\preferences
<LS_APPDATA>\google\chrome\test1\local state

Network activity

UDP

DNS ASK ip##pi.com
DNS ASK VV#####################################.#######################8.>8Q>8P>8S>8R>8TUT>8U>8U>8]]]]>8eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee...
DNS ASK google.com
DNS ASK clients2.google.com
DNS ASK clients4.google.com
DNS ASK clients3.google.com
DNS ASK ss#.#static.com
DNS ASK ad####ercheck.net
'20#.#44.104.137':123
'18#.#61.209.242':123
'18#.#6.41.183':123

Miscellaneous

Searches for the following windows

ClassName: 'Chrome_MessageWindow' WindowName: '<LS_APPDATA>\Google\Chrome\test1'
ClassName: 'Chrome_RenderWidgetHostHWND' WindowName: ''

Executes the following

'%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --disable-notifications --no-first-run --no-ping --no-sandbox --disable-low-res-tiling --enable-low-res-tilin --ignore-certificate-errors --multi-profiles --disable-translate --disable-i...
'%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="1864.0.1079024848\968874995" --no-sandbox --user-data-dir="<LS_APPDATA>\Google\Chrome\test1" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-...
'%WINDIR%\syswow64\ctfmon.exe'
'%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --disable-low-res-tiling --disable-notifications --no-sandbox --enable-deferred-image-decoding --lang=en-US --user-data-dir="<LS_APPDATA>\Google\Chrome\test1" --enable-offline-a...
'%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --disable-low-res-tiling --disable-notifications --no-sandbox --enable-deferred-image-decoding --lang=en-US --user-data-dir="<LS_APPDATA>\Google\Chrome\test1" --extension-proces...

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial