Trojan.Siggen32.27274

Technical Information

Modifies file system

Creates the following files

%APPDATA%\rod\browser\chromium-1321438\chrome-win\128.0.6568.0.manifest
%APPDATA%\rod\browser\chromium-1321438\chrome-win\d3dcompiler_47.dll
%APPDATA%\rod\browser\chromium-1321438\chrome-win\first run
%APPDATA%\rod\browser\chromium-1321438\chrome-win\meipreload\manifest.json
%APPDATA%\rod\browser\chromium-1321438\chrome-win\meipreload\preloaded_data.pb
%APPDATA%\rod\browser\chromium-1321438\chrome-win\privacysandboxattestationspreloaded\manifest.json
%APPDATA%\rod\browser\chromium-1321438\chrome-win\privacysandboxattestationspreloaded\privacy-sandbox-attestations.dat
%APPDATA%\rod\browser\chromium-1321438\chrome-win\chrome.dll
%APPDATA%\rod\browser\chromium-1321438\chrome-win\chrome.exe
%APPDATA%\rod\browser\chromium-1321438\chrome-win\chrome_100_percent.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\chrome_200_percent.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\chrome_elf.dll
%APPDATA%\rod\browser\chromium-1321438\chrome-win\chrome_proxy.exe
%APPDATA%\rod\browser\chromium-1321438\chrome-win\chrome_pwa_launcher.exe
%APPDATA%\rod\browser\chromium-1321438\chrome-win\chrome_wer.dll
%APPDATA%\rod\browser\chromium-1321438\chrome-win\dxcompiler.dll
%APPDATA%\rod\browser\chromium-1321438\chrome-win\dxil.dll
%APPDATA%\rod\browser\chromium-1321438\chrome-win\elevation_service.exe
%APPDATA%\rod\browser\chromium-1321438\chrome-win\eventlog_provider.dll
%APPDATA%\rod\browser\chromium-1321438\chrome-win\icudtl.dat
%APPDATA%\rod\browser\chromium-1321438\chrome-win\interactive_ui_tests.exe
%APPDATA%\rod\browser\chromium-1321438\chrome-win\libegl.dll
%APPDATA%\rod\browser\chromium-1321438\chrome-win\libglesv2.dll
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\af.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\am.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\ar-xb.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\ar.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\bg.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\bn.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\ca.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\cs.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\da.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\de.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\el.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\en-gb.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\en-us.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\en-xa.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\es-419.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\es.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\et.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\fa.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\fi.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\fil.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\fr.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\gu.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\he.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\hi.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\hr.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\hu.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\id.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\it.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\ja.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\kn.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\ko.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\lt.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\lv.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\ml.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\mr.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\ms.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\nb.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\nl.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\pl.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\pt-br.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\pt-pt.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\ro.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\ru.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\sk.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\sl.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\sr.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\sv.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\sw.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\ta.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\te.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\th.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\tr.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\uk.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\ur.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\vi.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\zh-cn.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\locales\zh-tw.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\mojo_core.dll
%APPDATA%\rod\browser\chromium-1321438\chrome-win\notification_helper.exe
%APPDATA%\rod\browser\chromium-1321438\chrome-win\resources.pak
%APPDATA%\rod\browser\chromium-1321438\chrome-win\v8_context_snapshot.bin
%APPDATA%\rod\browser\chromium-1321438\chrome-win\vk_swiftshader.dll
%APPDATA%\rod\browser\chromium-1321438\chrome-win\vk_swiftshader_icd.json
%APPDATA%\rod\browser\chromium-1321438\chrome-win\vulkan-1.dll
%TEMP%\leakless-amd64-adb80298fa6a3af7ced8b1c9b5f18007\leakless.exe
%TEMP%\rod\user-data\2bdefb2d5d5607bb\crashpad\settings.dat
%TEMP%\rod\user-data\2bdefb2d5d5607bb\browsermetrics\browsermetrics-69a4f25a-c48.pma
%TEMP%\rod\user-data\2bdefb2d5d5607bb\variations
%TEMP%\rod\user-data\2bdefb2d5d5607bb\b3256de1-4b1b-4f8a-93c1-5ee03655c9db.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\shadercache\index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\ac876bea-668c-48fc-9572-28d765d33f47.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\shadercache\data_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\shadercache\data_1
%TEMP%\rod\user-data\2bdefb2d5d5607bb\shadercache\data_2
%TEMP%\rod\user-data\2bdefb2d5d5607bb\shadercache\data_3
%TEMP%\rod\user-data\2bdefb2d5d5607bb\last version
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\readme
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\sync data\leveldb\log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\segmentation_platform\ukm_db-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\sync data\leveldb\manifest-000001
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\history-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\wasm\index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\sync data\leveldb\000001.dbtmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\wasm\index-dir\temp-index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\webui_js\index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\webui_js\index-dir\temp-index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\sync data\leveldb\000003.log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\index-dir\temp-index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\site characteristics database\log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\site characteristics database\manifest-000001
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\power_bookmarks\powerbookmarks.db-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\history
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\site characteristics database\000001.dbtmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\power_bookmarks\powerbookmarks.db
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\site characteristics database\000003.log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\83ab77c6-6821-46d9-8e5f-ec50f4489dfb.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\favicons-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\favicons
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\web data-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\web data
%TEMP%\rod\user-data\2bdefb2d5d5607bb\devtoolsactiveport
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\web data-wal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\affiliation database-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\affiliation database
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension rules\log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension rules\manifest-000001
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\sharedstorage-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\sharedstorage
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared dictionary\cache\index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared dictionary\db-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared dictionary\db
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared dictionary\cache\index-dir\temp-index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\safe browsing network\safe browsing cookies-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\safe browsing network\safe browsing cookies
%TEMP%\rod\user-data\2bdefb2d5d5607bb\segmentation_platform\ukm_db
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension rules\000001.dbtmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network\trust tokens-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\segmentation_platform\ukm_db-wal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension rules\000003.log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension scripts\log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension scripts\manifest-000001
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\visited links
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension scripts\000001.dbtmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension scripts\000003.log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\dips-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\dips
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\dips-wal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\gpucache\index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\top sites-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\gpucache\data_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\gpucache\data_1
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\gpucache\data_2
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\gpucache\data_3
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\dawnwebgpucache\index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\top sites
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\dawnwebgpucache\data_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\dawnwebgpucache\data_1
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\dawnwebgpucache\data_2
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\dawnwebgpucache\data_3
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\dawngraphitecache\index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\login data-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\dawngraphitecache\data_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\dawngraphitecache\data_1
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\dawngraphitecache\data_2
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\dawngraphitecache\data_3
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\login data
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\local storage\leveldb\log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension state\log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared_proto_db\metadata\log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension state\manifest-000001
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared_proto_db\metadata\manifest-000001
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\login data for account-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension state\000001.dbtmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared_proto_db\metadata\000001.dbtmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension state\000003.log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\login data for account
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared_proto_db\metadata\000003.log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared_proto_db\log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared_proto_db\manifest-000001
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\local storage\leveldb\manifest-000001
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared_proto_db\000001.dbtmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\grshadercache\index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\local storage\leveldb\000001.dbtmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\grshadercache\data_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\grshadercache\data_1
%TEMP%\rod\user-data\2bdefb2d5d5607bb\grshadercache\data_2
%TEMP%\rod\user-data\2bdefb2d5d5607bb\grshadercache\data_3
%TEMP%\rod\user-data\2bdefb2d5d5607bb\graphitedawncache\index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared_proto_db\000003.log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\graphitedawncache\data_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\graphitedawncache\data_1
%TEMP%\rod\user-data\2bdefb2d5d5607bb\graphitedawncache\data_2
%TEMP%\rod\user-data\2bdefb2d5d5607bb\graphitedawncache\data_3
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network\cookies-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network\cookies
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\data_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\data_1
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\data_2
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\data_3
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network\trust tokens
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network\10c22b48-5333-4bbe-848d-371817ff2bb6.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network\c591b08a-2e95-495d-8ef5-4fbefe1026e9.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\sessions\session_13416891231113665
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network\reporting and nel-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\f3eee632-57d7-41ec-902e-56dade36b7d6.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network\reporting and nel
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\session storage\log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\session storage\manifest-000001
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\session storage\000001.dbtmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\session storage\000003.log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000001
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000002
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000003
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000004
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000005
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\b7bd1a22fd94f67b_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000006
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000007
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\b3bb953130d4ee66_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000008
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000009
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\2e499be8c858c047_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\4b5e4797f8f5162e_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00000a
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00000b
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00000c
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00000d
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00000e
%TEMP%\026d057c-3470-44be-b31a-3409ff6debac.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\bbd4f33e3e5bfb68_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\3d3642791429e8f1_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\3215d5b21b2889d4_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\3d9634e73f2bdbee_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\36a4503d7329103a_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00000f
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\61ae43672b02b4b0_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000010
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000011
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000012
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000013
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000014
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000015
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000016
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000017
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000018
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000019
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00001a
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00001b
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00001c
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00001d
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00001e
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00001f
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000020
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\mediadevicesalts-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\mediadevicesalts
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\local storage\leveldb\000003.log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\c7f4dec8445918ef_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\23ed4ca2c0caf7d1_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000021
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000022
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\b456e5246ede471c_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\39546931e742fa18_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\bd4104b535da0970_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000023
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000024
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000025
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000026
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\webstorage\quotamanager-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000027
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\webstorage\quotamanager
%TEMP%\rod\user-data\2bdefb2d5d5607bb\b629db50-c336-4060-b954-5e14f002f76a.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\service worker\scriptcache\index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\service worker\database\log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\service worker\database\manifest-000001
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\service worker\database\000001.dbtmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\service worker\database\000003.log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\service worker\scriptcache\index-dir\temp-index
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\45834a0d-22f6-4a2e-ab75-be9b3633f214.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\1889adbc-3101-4f50-8656-4f796b61c8fe.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\service worker\scriptcache\2cc80dabc69f58b6_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\7bfc7bc0a0d37ce3_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000028
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\38683fc47907b9bb_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\91394cea09a41395_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\4722086b0c5a2e95_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\8beb3b1b1b2ab9a4_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\2fb7649027fd7bb1_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000029
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\e040701aa745acc7_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00002a
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\1ddac5fdd72ca352_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\d658548313c04175_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00002b
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network\5571abc4-0883-4f19-b27d-19032d10a778.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00002c
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00002d
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00002e
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00002f
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000030
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000031
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000032
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000033
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000034
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000035
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000036
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000037
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\6518d2048fb9c3b1_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000038
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000039
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00003a
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00003b
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00003c
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00003d
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00003e
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00003f
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000040
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000041
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\fe2e24104073f80c_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\9ae578ec9ba4bc34_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000042
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\ae27a720a799a232_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000043
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\4bffb0b60bbfddc5_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\f9e92180aabc8b02_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000044
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000045
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000046
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000047
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000048
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000049
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00004a
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00004b
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00004c
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00004d
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00004e
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\ea5d7f84dc9eb966_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\e69c72ca87e6b983_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\f018d386e0af81f2_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\9b6113ee97c63d7d_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\1b21605f773cdb03_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\8145ba2c50d3181d_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\40fe14be23b42cf4_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\a2c0b048ccd81d6e_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00004f
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\file system\origins\log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\file system\origins\manifest-000001
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\file system\origins\000001.dbtmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\file system\origins\000003.log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\4a4643ef-3635-473f-857b-9bc6fcf2c658.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\heavy_ad_intervention_opt_out.db-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\heavy_ad_intervention_opt_out.db
%TEMP%\rod\user-data\2bdefb2d5d5607bb\last browser
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shortcuts-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shortcuts
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network action predictor-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network action predictor
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\preferredapps
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\browsingtopicssitedata-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\browsingtopicssitedata
%TEMP%\rod\user-data\2bdefb2d5d5607bb\first_party_sets.db-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\first_party_sets.db
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\9d79454d-92e0-4ea2-a964-7c45aade4fed.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\47ee4dac-9eda-4c89-ae2a-ffda7461fafb.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\5e5a4f0a-0f57-47c7-9053-3a2526dfe549.tmp

Deletes following files that it created itself

%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\83ab77c6-6821-46d9-8e5f-ec50f4489dfb.tmp
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\web data-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\sharedstorage-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\segmentation_platform\ukm_db-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\dips-journal
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000001
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\2e499be8c858c047_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\3d3642791429e8f1_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\3215d5b21b2889d4_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_000006
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\b7bd1a22fd94f67b_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\38683fc47907b9bb_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\browsermetrics\browsermetrics-69a4f25a-c48.pma
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\local storage\leveldb\000003.log
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\cache\cache_data\f_00004f

Moves the following files

from %TEMP%\rod\user-data\2bdefb2d5d5607bb\b3256de1-4b1b-4f8a-93c1-5ee03655c9db.tmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\local state
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\sync data\leveldb\000001.dbtmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\sync data\leveldb\current
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\wasm\index-dir\temp-index to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\wasm\index-dir\the-real-index
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\webui_js\index-dir\temp-index to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\webui_js\index-dir\the-real-index
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\index-dir\temp-index to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\index-dir\the-real-index
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\site characteristics database\000001.dbtmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\site characteristics database\current
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared dictionary\cache\index-dir\temp-index to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared dictionary\cache\index-dir\the-real-index
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension rules\000001.dbtmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension rules\current
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension scripts\000001.dbtmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension scripts\current
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension state\000001.dbtmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\extension state\current
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared_proto_db\metadata\000001.dbtmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared_proto_db\metadata\current
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared_proto_db\000001.dbtmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\shared_proto_db\current
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\local storage\leveldb\000001.dbtmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\local storage\leveldb\current
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network\10c22b48-5333-4bbe-848d-371817ff2bb6.tmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network\sct auditing pending reports
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\f3eee632-57d7-41ec-902e-56dade36b7d6.tmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\trusted_vault.pb
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\session storage\000001.dbtmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\session storage\current
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\service worker\database\000001.dbtmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\service worker\database\current
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\service worker\scriptcache\index-dir\temp-index to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\service worker\scriptcache\index-dir\the-real-index
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\45834a0d-22f6-4a2e-ab75-be9b3633f214.tmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\secure preferences
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\1889adbc-3101-4f50-8656-4f796b61c8fe.tmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\preferences
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network\5571abc4-0883-4f19-b27d-19032d10a778.tmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\network\network persistent state
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\file system\origins\000001.dbtmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\file system\origins\current
from %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\9d79454d-92e0-4ea2-a964-7c45aade4fed.tmp to %TEMP%\rod\user-data\2bdefb2d5d5607bb\default\browsingtopicsstate

Substitutes the following files

%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\b7bd1a22fd94f67b_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\2e499be8c858c047_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\3d3642791429e8f1_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\3215d5b21b2889d4_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\code cache\js\38683fc47907b9bb_0
%TEMP%\rod\user-data\2bdefb2d5d5607bb\default\service worker\scriptcache\index-dir\temp-index

Network activity

Connects to

'st#####.googleapis.com':443
'pl######ht.azureedge.net':443
're#####y.npmmirror.com':443
'ca####s.digicert.cn':80
'playwright.download.prss.microsoft.com':443
'localhost':49706
'localhost':49708
'accounts.google.com':443
'xi###ongshu.com':443
'sn######ar-qc.xhscdn.com':443
'sn######ic-qc.xhscdn.com':443
'sn#####eo-qn.xhscdn.com':443
'dn#.google':443
'2.##.21.72':443
'64.##3.161.95':443
'43.##2.215.99':443
'21#.#39.32.223':443
'2.##.21.74':443
'43.##5.163.4':443
'localhost':9222
'localhost':54345
'23.##6.236.59':443

TCP

HTTP GET requests

http://ca####s.digicert.cn/DigiCertGlobalRootCA.crt
http://12#.#.0.1:49708/json/version
http://12#.#.0.1:49708/devtools/browser/612f68f1-132d-4fd9-8ff1-c7aca81c2dd2

Other

'st#####.googleapis.com':443
'pl######ht.azureedge.net':443
'ca####s.digicert.cn':443
'playwright.download.prss.microsoft.com':443
'localhost':49707
'localhost':49706
'localhost':49709
'localhost':49710
'localhost':49708
'accounts.google.com':443
'xi###ongshu.com':443
'as.###ohongshu.com':443
'pi#######tatic.xiaohongshu.com':443
'sn######ic-qc.xhscdn.com':443
'dn#.google':443
'2.##.21.72':443
'64.##3.161.95':443
'43.##2.215.99':443
'21#.#39.32.223':443
'2.##.21.74':443
'43.##5.163.4':443
'23.##6.236.59':443

UDP

DNS ASK re#####y.npmmirror.com
DNS ASK pl######ht.azureedge.net
DNS ASK st#####.googleapis.com
DNS ASK ca####s.digicert.cn
DNS ASK playwright.download.prss.microsoft.com
DNS ASK accounts.google.com
DNS ASK xi###ongshu.com
DNS ASK as.###ohongshu.com
DNS ASK fe#####ic.xhscdn.com
DNS ASK sn######ic-qc.xhscdn.com
DNS ASK sn######ar-qc.xhscdn.com
DNS ASK pi#######tatic.xiaohongshu.com
DNS ASK sn#####eo-hw.xhscdn.net
DNS ASK sn#####eo-qn.xhscdn.com
DNS ASK sn#####eo-bd.xhscdn.com
DNS ASK google.com
DNS ASK sn#####eo-hw.xhscdn.com
DNS ASK sn#####eo-qc.xhscdn.com
DNS ASK dn#.google
'google.com':443
'dn#.google':443
'xi###ongshu.com':443
'64.##3.161.95':443
'43.##5.163.4':443

Miscellaneous

Searches for the following windows

ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\rod\user-data\2bdefb2d5d5607bb'

Creates and executes the following

'%TEMP%\leakless-amd64-adb80298fa6a3af7ced8b1c9b5f18007\leakless.exe' 8e8e504b29461b0b893b0bf576ea91b8 127.0.0.1:49706 %APPDATA%\rod\browser\chromium-1321438\chrome.exe --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-...

Executes the following

'<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s NgcSvc

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial