Malware Analysis Report

2024-09-11 02:46

Sample ID 240530-ypzqgsgh71
Target 269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313
SHA256 269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313
Tags
neshta persistence spyware stealer discovery evasion trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313

Threat Level: Known bad

The file 269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313 was found to be: Known bad.

Malicious Activity Summary

neshta persistence spyware stealer discovery evasion trojan

Neshta

Neshta family

Detect Neshta payload

Modifies Installed Components in the registry

Reads user/profile data of web browsers

Registers COM server for autorun

Modifies system executable filetype association

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Checks whether UAC is enabled

Checks installed software on the system

Drops file in System32 directory

Checks system information in the registry

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Modifies data under HKEY_USERS

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-30 19:58

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A

Neshta family

neshta

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 19:58

Reported

2024-05-30 20:00

Platform

win7-20240508-en

Max time kernel

120s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe

"C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe

MD5 1d0f8aa4926e3cd2b0ad444005b7021b
SHA1 f353c2d565c7955149ca580d65cfc0f32b7ff7a1
SHA256 b361d3de4ffc97699153a66975d5251b281d7d6ea758cb0019fd326b29c5cc53
SHA512 1a9979d6221294b21898708a675ea6041009d089b59320f06de19526d79203ada3770c445b9e4e90fae051e9a78657c7b3efe63d1775965de9d8e5e3280763ac

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5 cf6c595d3e5e9667667af096762fd9c4
SHA1 9bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256 593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512 ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

memory/2108-81-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2108-83-0x0000000000400000-0x000000000041B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 19:58

Reported

2024-05-30 20:00

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\125.0.6422.113\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable" C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome" C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1" C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0" C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96} C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome" C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
N/A N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\125.0.6422.113_chrome_installer.exe N/A
N/A N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\125.0.6422.113\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A

Reads user/profile data of web browsers

spyware stealer

Registers COM server for autorun

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\125.0.6422.113\\notification_helper.exe" C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32 C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32 C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\125.0.6422.113\\notification_helper.exe\"" C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\settings.dat C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\cs.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\ko.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\updater.log C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\58963209-c468-4d65-956d-5316cad967e4.tmp C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\en-US.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\sl.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\sk.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\VisualElements\LogoCanary.png C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\VisualElements\LogoDev.png C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\chrome.VisualElementsManifest.xml C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2780_2000010445\_metadata\verified_contents.json C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.29\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\elevation_service.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\am.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\pl.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\uk.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Extensions\external_extensions.json C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\ta.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\libEGL.dll C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\updater.log C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files (x86)\Google\GoogleUpdater\3d8df9ac-6f0c-4da8-a302-028a5eb8e8bf.tmp C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\fil.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\ja.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\mr.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\pt-BR.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\metadata C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\MEIPreload\preloaded_data.pb C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File created C:\Program Files (x86)\chrome_url_fetcher_4844_1008669728\-8a69d345-d564-463c-aff1-a69d9e530f96-_125.0.6422.113_all_aogspox4cotu6xggqyym7s5hye.crx3 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\bn.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\vi.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\dxcompiler.dll C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\lv.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\125.0.6422.113.manifest C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\el.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\v8_context_snapshot.bin C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\notification_helper.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\optimization_guide_internal.dll C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
File created C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe576002.TMP C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\chrome_elf.dll C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4084_16460019\Chrome-bin\125.0.6422.113\Locales\hu.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2780_2000010445\LICENSE C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Google\Chrome\InstallerPinned = "0" C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133615727558839293" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-19 C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\SOFTWARE C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Google C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Google\Chrome C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\GoogleUpdate.Update3WebMachine C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\ = "ICurrentStateSystem" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\TypeLib C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\ = "IProcessLauncherSystem" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\TypeLib C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}\1.0 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\TypeLib\Version = "1.0" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\ProxyStubClsid32 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\1.0\0 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\TypeLib\ = "{8476CE12-AE1F-4198-805C-BA0F9B783F57}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\Version = "1.0" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ = "IAppWeb" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B4168B26-4DAC-5948-8F80-84C2235AD469}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\ = "IUpdaterAppStatesCallbackSystem" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ = "IAppCommandWeb" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\127.0.6490.0\\updater.exe\\6" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\TypeLib\Version = "1.0" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\TypeLib\ = "{F258BE54-7C5F-44A0-AAE0-730620A31D23}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib\ = "{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0 C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B4168B26-4DAC-5948-8F80-84C2235AD469}\ = "IUpdaterInternalCallbackSystem" C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{521FDB42-7130-4806-822A-FC5163FAD983}\LocalService = "GoogleUpdaterService127.0.6490.0" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ProxyStubClsid32 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\TypeLib\ = "{85AE4AE3-8530-516B-8BE4-A456BF2637D3}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\ProxyStubClsid32 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\127.0.6490.0\\updater.exe\\6" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\TypeLib\Version = "1.0" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\TypeLib\Version = "1.0" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{699F07AD-304C-5F71-A2DA-ABD765965B54}\1.0\0 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\127.0.6490.0\\updater.exe\\6" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0\ = "GoogleUpdater TypeLib for IUpdaterAppStateSystem" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\1.0\0\win64 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0\win32 C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\1.0\0 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib\Version = "1.0" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\ProxyStubClsid32 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\ = "TypeLib for Interface {463ABECF-410D-407F-8AF5-0DF35A005CC8}" C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\AppID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\ = "IPolicyStatusValueSystem" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\1.0\0\win64 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7AA668AD-44C9-562C-B3B0-104376A71AFE} C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine\CLSID\ = "{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\1.0\0\win64 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\TypeLib C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\ProxyStubClsid32 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\TypeLib C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatus4System" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{F258BE54-7C5F-44A0-AAE0-730620A31D23} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ = "IAppVersionWeb" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe N/A
Token: 33 N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\125.0.6422.113_chrome_installer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\125.0.6422.113_chrome_installer.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4672 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe
PID 4672 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe
PID 4672 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe
PID 1872 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe
PID 1872 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe
PID 1872 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe
PID 4360 wrote to memory of 880 N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe
PID 4360 wrote to memory of 880 N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe
PID 4360 wrote to memory of 880 N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe
PID 5064 wrote to memory of 4484 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
PID 5064 wrote to memory of 4484 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
PID 5064 wrote to memory of 4484 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
PID 4844 wrote to memory of 2116 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
PID 4844 wrote to memory of 2116 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
PID 4844 wrote to memory of 2116 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
PID 4844 wrote to memory of 4452 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\125.0.6422.113_chrome_installer.exe
PID 4844 wrote to memory of 4452 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\125.0.6422.113_chrome_installer.exe
PID 4452 wrote to memory of 4084 N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\125.0.6422.113_chrome_installer.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe
PID 4452 wrote to memory of 4084 N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\125.0.6422.113_chrome_installer.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe
PID 4084 wrote to memory of 3540 N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe
PID 4084 wrote to memory of 3540 N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe
PID 4084 wrote to memory of 3056 N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe
PID 4084 wrote to memory of 3056 N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe
PID 3056 wrote to memory of 848 N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe
PID 3056 wrote to memory of 848 N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe
PID 4360 wrote to memory of 2780 N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4360 wrote to memory of 2780 N/A C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 4640 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 4640 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 1552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 60 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 60 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 2544 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 2544 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2780 wrote to memory of 2544 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe

"C:\Users\Admin\AppData\Local\Temp\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe"

C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe

"C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={23A7DCBA-3DC8-8227-DCB7-8843240A3E58}&lang=hu&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&brand=WHAR&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2

C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe

"C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xca758c,0xca7598,0xca75a4

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe

"C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --system --windows-service --service=update-internal

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe

"C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x87758c,0x877598,0x8775a4

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe

"C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --system --windows-service --service=update

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe

"C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x27c,0x280,0x284,0x254,0x288,0x87758c,0x877598,0x8775a4

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\125.0.6422.113_chrome_installer.exe

"C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\125.0.6422.113_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\1304ec0e-fa61-4e7d-bcc0-78fc3b025830.tmp"

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe

"C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\1304ec0e-fa61-4e7d-bcc0-78fc3b025830.tmp"

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe

"C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=125.0.6422.113 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7beb52698,0x7ff7beb526a4,0x7ff7beb526b0

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe

"C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe

"C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=125.0.6422.113 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7beb52698,0x7ff7beb526a4,0x7ff7beb526b0

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=125.0.6422.113 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe63b41c70,0x7ffe63b41c7c,0x7ffe63b41c88

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1992,i,13530243792698005866,13745119094044567683,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1896,i,13530243792698005866,13745119094044567683,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2140,i,13530243792698005866,13745119094044567683,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,13530243792698005866,13745119094044567683,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,13530243792698005866,13745119094044567683,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1

C:\Program Files\Google\Chrome\Application\125.0.6422.113\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\125.0.6422.113\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4560,i,13530243792698005866,13745119094044567683,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4776,i,13530243792698005866,13745119094044567683,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4416,i,13530243792698005866,13745119094044567683,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5032,i,13530243792698005866,13745119094044567683,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --field-trial-handle=5152,i,13530243792698005866,13745119094044567683,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=5484,i,13530243792698005866,13745119094044567683,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=5516,i,13530243792698005866,13745119094044567683,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.204.67:443 update.googleapis.com tcp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 14.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 123.35.104.34.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.204.67:443 update.googleapis.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
GB 216.58.204.67:443 update.googleapis.com tcp
GB 216.58.204.67:443 update.googleapis.com udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\3582-490\269dc303ca42603e6be851d243581c69f48fba562b45000f7931eb499dea0313.exe

MD5 1d0f8aa4926e3cd2b0ad444005b7021b
SHA1 f353c2d565c7955149ca580d65cfc0f32b7ff7a1
SHA256 b361d3de4ffc97699153a66975d5251b281d7d6ea758cb0019fd326b29c5cc53
SHA512 1a9979d6221294b21898708a675ea6041009d089b59320f06de19526d79203ada3770c445b9e4e90fae051e9a78657c7b3efe63d1775965de9d8e5e3280763ac

C:\Program Files (x86)\Google1872_1822517064\bin\updater.exe

MD5 675c9a53a09d5385bbdb3a43a88f2493
SHA1 71d1c311eadd4d5949c0b48def8ad0f2186bc243
SHA256 ebb428a4c1e29192617e7699513ec78512735110bba68bbee54dee34807094ae
SHA512 e3b1d8351b6d208678673e4c69aea745de5b2576a43d2cf9e06c1ea0780dcbc2ca56d5d5fc712b80309ba7950b90130ca2780185b71c990ea6c6062bd29f5136

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

MD5 d67a390e688c2293b2fadfecc4e7a83a
SHA1 e019752b96bfa1e1d9fde988a5e69a46877d9a93
SHA256 ebc317ab89b217f7eb398565f8a47a0a6b09b74d62db191a13a597708e695d8a
SHA512 a114c0bf0ec5c583776a84f213c19180d808d836f5fe0fec34b61a99aa9ee97ce6f1717976f0af008aa690723be250f03ccec4dc3c139d9fe2c8742a393d94da

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

MD5 d0e546a5f116b8b0e4b22adbdeca4557
SHA1 a0fc7023929e18d9a85cc4fa65dcb308df19c480
SHA256 2ae6341b7aa6f917c16ac6fcb8a5eff2d475456f648cbd9287e24b86f52355ed
SHA512 28e7bcfc6f20262b2214c3a2482a3d201d58e83783137b7dbeb6c95e3df013524b5a08119bbfc756fc57fddbb7d1b1270afbb9e0d2bb5d550d4aa3df9213eadb

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

MD5 536eeffcad9c9fc74ad377f8e0ca5c25
SHA1 2dc8cc16ad83f2c65164be4a46329872d116bd1f
SHA256 1aea8e71363bce9729d19446b078f3fbf0e3fe4aec2ad72ea5169aed049be9cb
SHA512 51192c6868541f54d72c74677c664f240711ff65ae1532d8dea03a404325973b1e6a6cb9b794f992945674a84a4c925b0a61f70fedec5ef80e6a24cb6982d8aa

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

MD5 2ea19fb13a29704615cbaa51e8c9228d
SHA1 26ab2377c3353677093481b0d1765d06fe518146
SHA256 28801ec6b290b6e8df073f840cfb7543da6000bee0bc52e7123e1d47d25c2f13
SHA512 2c642b19993696f57c9bc9b189f0348e9e1b23a548239cec394a30e828d79f3657927b1f81e3df6dabb2fc7de0e09ad2d9827d9f1ce8793c8e43b014176e67ec

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

MD5 bdce395b453a0a3ffcf742feb2a210ae
SHA1 8bfc909ac17238d49d93a3668256b92766391452
SHA256 82f7226a5b6be7356507c368ca2468c5d9b7d4a4036fa18d85c6a99e2f0eae41
SHA512 cf4d12cecd6d749990265779d1f9ec5e505b54cf283580f611cd346aaca17816b4c58547bb61c451190c07b651d967f2d03c13b74e2210195514f8087b92288e

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\settings.dat

MD5 b6ca262a4b40356060cb2eb338c121ec
SHA1 1e9ecb9539c90a5fb060900ca96f18c6f3beeac6
SHA256 ecef3f464db2a0c680197c6698abed321cb25a86d81b08de49cb9d358c923eac
SHA512 e38e9434d3f4ac9abbd35f78c611f9e8466501dbf4986a28496bfc6907f451f6a0526d7532689ed5972c3f7d9d0b38d4384a5a3872e297b6072246a1928a0a36

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

MD5 7136b45ffcac6b52d6873f2864471ea9
SHA1 7afb956fccbfa48ec7fcac07cde0f6059a51a534
SHA256 78f60448736dd9d298a2bc503571a91a8f0c342e95ff8cc589d546e84e7384c2
SHA512 66755a95e16371a527df8b702ba8d686a08678aa0d3257ec4775c5fef8c81d422d7a6ce8aa1fa1c150ebe02f14a0df23776dabc42b6da5ed83b79be956fc2ac7

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

MD5 466c904d4f9a368a7728e72b51080953
SHA1 98b9f451e12e6ee50b195fe3219124dec717acf4
SHA256 1133fa729937965296080fc2b83f16a0fa116351a2837543caf8498a9ac20931
SHA512 f6f103045ec89e7ff1de4cda436aead997e17a80fe9026ab9a75cdfe3e92416a62b81bf188c5a84a98c81c91f7ea375edddf297fc60b0341d283fc304cecaf98

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

MD5 0c90f363388e13bdd72a97ff0773c098
SHA1 39879c0d47a1b11cc8452e8a1a7672e0f897b930
SHA256 68012d55af21821b1fb2ff2609ab16ef07044533c40b8d25f34687719a790c25
SHA512 b807bcf1cf294242ce14e6a6b644509958c26afeb2da50470ae6c13f1acf3917d66f52247b07aea8b50d1c0f9e18b6a025b106d83735dd49fc7083827025e3d5

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

C:\PROGRA~2\Google\Update\GOOGLE~1.EXE

MD5 f105215fade8cdcf904f831e045ab372
SHA1 534ab3fd60e4e1619702aa012d16f0068ea5d6e8
SHA256 6d78ef3c777cbdf29c104057dae2e8d4555729de001167c0f727fb724c442f91
SHA512 697323eeb555c61753e614e55b66fef2bd0b1b2cb7f8b2f09c261e3e56f3c9ca33d66b3873126c539b18ad911db914d2829e83db1ac3564557cc26b2f8d7ba16

memory/4672-145-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

MD5 f8c1dfdffdf4a5ac2d99f08e8ff451e5
SHA1 5103de7c57032fa21b9552d73b302d3892a9b738
SHA256 fe6c7f1f41093bc49b36658cd7d364fe35466302dd44e8358c1c575a1677131f
SHA512 19910b5fab77aa01988a7cefce77746647c84e4b5b98d48da0001744323b17cef7a4aa1c614a0e3d14a12f6903167be69c5f1485768d6c76d1bfcb942882164d

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\CR_7E157.tmp\setup.exe

MD5 e8e4e8f66fa72b10eacc18ff5ce000ba
SHA1 9064de09632d155e2acf236d54c343f276bdf79a
SHA256 ac03c7f78bc590bf6b400c5078a7fa6b1e61d3935cd591868f7f73fff930e4b3
SHA512 7fa4768d6043a4fbe38ba70947e9b5bd8e4111606ce673f8b0ee7dd3d95ea9b3e6dcf0f96bc55634c85a1a3f6a4120ff7461a3463ca36133f57a607bef49b158

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4844_708378151\1304ec0e-fa61-4e7d-bcc0-78fc3b025830.tmp

MD5 c089c4384640b0c4adfc8efd6e9bd7bb
SHA1 6493eae2a45cddb77fcfd86a6e9fc5023566c461
SHA256 ff5435bc9b547ef318d0b7fe3f9d8240ba437f1b207859dcb516c15553effbd0
SHA512 6f258bc5921c6bc742cae2e4575f4fee23b2e602476c19b6633ce56918dd6dd21b8ee1350cbf6b65b1f58008cf1e0e0362a01a79ae4c9f06905e710d412337ca

memory/4672-179-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\TEMP\chrome_installer.log

MD5 3f0e5bd571eb1c53d62b92d2e6323afc
SHA1 fc4c799e0486b08960baeaa6e5997e12fc8d3e57
SHA256 2eaecd8917529905ca7e816a03da77ce3dd9f53f2ad0b62e00c3b9b519110c9f
SHA512 cf5dd2a3d14008aaf6ba33970fa939e358b2cf364e6d1cb758013be4481eb5bcad8d8841a8b4345bc020fb2691366730970ab9ad18bf34da9bdd7954e7bbf055

C:\Program Files\Crashpad\settings.dat

MD5 2a44615f63da88b1a92ade7e41dee74d
SHA1 c73d2a27d3d1ea994d5513f9625c120369efcee8
SHA256 4c86da68a8f4ced99e704c3825737c5d78e7381e44df2d2cb123c8915fa5c8f9
SHA512 a51ce99cbb8ae1ed2c89016eb131a08e450a8eafcba49fd1cb5dd26b614b934140bf95485fbc7962cd0a6f6589fb7b01af44a3b1c146575103bfca9d7e80087e

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 3998300d42dfa46c534071833137a1e4
SHA1 cd881ee067bce496a7d271b3dc1c0ebfef923d4b
SHA256 9841226f3175588c51e60e828dc8e3c16c42f9f7af15f363963fc230ce7bf4ad
SHA512 a25eb0bcebcc874548b49c8e3d58e64da2e7c79c01e3bf372d005f56db571c830bc6081a89169fc45e3f7a6aafa3239f9ea64ebf7fc233b80d0ea27fbb532c8f

memory/4672-205-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

MD5 0182e5a6ac1d4b4459a9f8e6f2d4d6bc
SHA1 5c4a0eb76e6f57555f9004fe2e07829218e9ceeb
SHA256 f3618a9f643b5481eb2b5f0280ca21603f92e32182c3042268836e57fec323fb
SHA512 6b0dc93f57e14cd33b0923dc06cf17a213ec3b0a02ac37999d5de8f15f446bc2a463dbeaf136af5eba5922c5270321081ad5dd14aec7594d6684fdbfe6d087db

C:\Program Files\Google\Chrome\Application\125.0.6422.113\chrome_elf.dll

MD5 d8e75711fa2b3dc467acc8a4b9d8c54f
SHA1 560d442ca0773a28e082de55b7fa0be2b9d0ed51
SHA256 c66cbcde3a049b9ce780a6bb78fed467471943cb78d3c83ae28f9f9fa37715ce
SHA512 978384dfe0f9dbf80f9deeeb3bd3d59d39592789329cfb0ab41e12b2a4e34a0f498fdcb26b189e57f2a4160f4337ff09ed7b66d5f0a1d28199ce7939fdd813a0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 a1944ffbc4cb6f4e543f4c3053e370e4
SHA1 3d01021b32278af10bc5fe37b43e48c46ad5e233
SHA256 d5458bcf79d6e754c8d7bc0f86478214aa7e0b790acad30e73c9781760f1e360
SHA512 9f7b740896a97e5fe3b80050b6118f70c7b578a3f138350151ef6597ef2b6d3c74e83159bb098310ac190972c6049d6e9cb418100df3d7148dea18a800f159b8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 031ee893f77d6ddb2c159aa3a886dbb5
SHA1 5b886bfbf4571b3aa4c5a901cc84d4bc8a896f6d
SHA256 1a37116a1c30d4df68b3283ffe6d785d0749895980b1a2196b6ab066d4771a21
SHA512 cd6e476134784bde70240ba76d279282a621c454307fed5319de240e8527ddd083db96f45d98ab25eeef2851cbea27fbcdb56f83040a1d06d89450e7d322391d

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

MD5 04833dab734b7cddf0e8e1c9a48cb4a8
SHA1 880bdee8881032730e1411f3f2b64fce6b048b20
SHA256 d9907a4d1dc5324c31d1f7673e82295a8276fbad8db3ec195e2fd0f18da00178
SHA512 e43ef19a15d6bab4e1afef52d4f77d74b857afde43e26489b802e23a903ca8b3a0a827a23e9c0edea0d38025e7edbf80c5c8c9560b4b49a485ffa6b99b3e2394

C:\Program Files\Google\Chrome\Application\125.0.6422.113\libEGL.dll

MD5 916ba1465ae826fa94c715227e70b625
SHA1 ae3281c9bfa530df6e42bdf070fbb5895a9b205a
SHA256 2315b8e49dda72a6f73004769d4c422a9ed157c6046099db7745bc11b0243d52
SHA512 97da6f751f6afb498dd09c7538955320df87699c271881ab968aee2f9e30ab4b162fb0284c7954056f4a5de50ebc359eefeea48203e0a6f289a12c02de9e4918

C:\Program Files\Google\Chrome\Application\125.0.6422.113\libGLESv2.dll

MD5 d29011fd0d464f424cf26cc5f67d207d
SHA1 9feb6324b6402f545ef8f9e13ff58f4c30560598
SHA256 59b391a6a1ca1647a41fdd4182e95073bcab94558dba7e6d0598e4f802108e0a
SHA512 fa2d47a8c58e90aa32a528c1e733c56e5ed2ea6477a995ef2296e22f8681af1df76fbb9335f9339d7bbb366e7f5913f45b76398948e789b8a0b222fae292027b

C:\Program Files\Google\Chrome\Application\125.0.6422.113\d3dcompiler_47.dll

MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

\??\pipe\crashpad_2780_DVPRNDYYGPPGHEJD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Program Files\Google\Chrome\Application\125.0.6422.113\dxcompiler.dll

MD5 2d85f8fce028fc1a7cce5cc198f7e7a9
SHA1 eb6ab7c16ce3d9e8675299935b087a1e5e24abb4
SHA256 b567286cc299f492a3879d2e7b162d0767bfbfb13de448e72b44e3d42f70d304
SHA512 7d32a8639d9294ccecb1e4d10ab32fadd91bed2c53a4eaead216a18f90d8475bc9cf686b95ac867df40a14631db33302706e7070b5779432f629aafc6c9bbb66

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

MD5 505a174e740b3c0e7065c45a78b5cf42
SHA1 38911944f14a8b5717245c8e6bd1d48e58c7df12
SHA256 024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d
SHA512 7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

C:\Program Files\Google\Chrome\Application\125.0.6422.113\dxil.dll

MD5 30da04b06e0abec33fecc55db1aa9b95
SHA1 de711585acfe49c510b500328803d3a411a4e515
SHA256 a5fe1d8d9caa2ff29daffd53f73a9a4e19c250351b2abe4fc7b57e60ce67ac68
SHA512 67790874377e308d1448d0e41df9dd353a5f63686df4eb9a8e70a4da449b0c63a5d3655ab38d24b145ad3c57971b1c6793ea6c5ac2257b6eb2e8964a44ab0f08

C:\Program Files\Google\Chrome\Application\125.0.6422.113\vk_swiftshader.dll

MD5 3f41bfdec6263198a1052353e44f0ef3
SHA1 1dad97372e9a715af9029a1f6a4fdf2760a1c590
SHA256 3775a2391025bab98e8dbc0ae6e2b8bcebc113ba65705eef011827a99438aff8
SHA512 759d00d15f6f2b48580b007a6a0e3182806bc42e94e107832d76c7d529b79711bdf69a792fd09f48b4a0b15393277a69af74f22429c93f90844cf841fd621749

C:\Program Files\Google\Chrome\Application\125.0.6422.113\elevation_service.exe

MD5 05472bb56813c11872a1b7e934fa9f3e
SHA1 2a62b33207e3836208e3d5c46bb8dfde04b09d16
SHA256 f12a1e99ddd7552742fef5827e9d581a70215fa0f31fd344898063e1cc4ceb39
SHA512 cc6359e6d24c350a4b864ce76ed270d08ed7631912f294bc943aa5f877b84a7de8d93dd971e3c35b1811ace7ed8223745d06049cd1ac690f0d67b7e3bc4a0394

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

MD5 3433ccf3e03fc35b634cd0627833b0ad
SHA1 789a43382e88905d6eb739ada3a8ba8c479ede02
SHA256 f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d
SHA512 21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 98d958b9b08a284683423d0e5d4bd3a6
SHA1 bdfff710d3e124b282286a145dac8ea8026cd08e
SHA256 5350fb5152effba7d8ae513bd655020e65e2614371087dc734c7332fad33881a
SHA512 9fcc03ec947281aeb8d9f6abb585179da8ee2df7a362137273b9e3c4e2fa88cd47d7b3470778051e2de925c488f0bf1ea60d3167bcc7246d806a885ab739555c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 f8da58d8ac3d10e7db878fbdbf6feb57
SHA1 5c5f2df7650c7f55db69e608245a8d9a115a5138
SHA256 30d8d4bff009fa8c285e73e992a2cf3f45779ca4cfea29ae72556a7791fe1c2f
SHA512 55ced5945a862ab4dce3b147d77e03b55ecab770161aacd7d6e8c2a6c643f580104f922338a39de1d84c7dd2c0df244d1abffba2a25659566dbe4295c22505ea

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 811e648b04b797cc8a9a31174523f190
SHA1 eb36289f8ba1ce9525e9b08e51b64fb4723fa869
SHA256 aba0377fbafb947bb54c12982c03bd846477af6ee0a34671681afc7bb71c9099
SHA512 d2e682506743a4753de1cb286a7f20f0e50adec1b22b629b0fd22c964348058e31f97f79404c28b7231d39bf87ad583d2d2d54897c02f460e56ef0d2ae3dd399

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 559f302f9149a0691100f291f69636cd
SHA1 8a7b6f4f32fe43e89187ee7836926083b97a2c62
SHA256 a06f9e64346feb25d964e0de5780f045c1e53c806cff31f3bd9d3da30df9f175
SHA512 2c0f962894b0cb3cf05935375a01b7760e8045aa1956932cbe5311f0d3c7405ead21506a9aa7a62401720210d6c4059246f575dbcb5ebbece3258057c869af91

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 eeded5973fcf285e2385a2270ae6fc4d
SHA1 bef6f5c2b16cdc564a74ba323f2c99df926d6bcc
SHA256 bf9f74c3792ed6ed0b6efbac2fe6cbd814c83dacf23d992ca7df47842f882cc8
SHA512 68020201e7b1871212c77f31fd3214eaebeb09bb4e154fc2c498ed20e17e470c81f1812f7f65436e2f20d363d7aa6a858f3cb8c6684e8f17e78c1ed1d574608a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 2480b05fe61107b81509dc75a4269e6b
SHA1 542f075597b2154960d47000eb81f94883ef693e
SHA256 8192bc55706a090da6bc876437ac451c877ee44f7a3b683a1f7f0491eea3faf0
SHA512 d9adaa46f8f94de4ebfbd94bee8eb4dbc5007df013b04ea485a701f94672612a6ed03c060bca13eaa8d2e9a99c9298690fab6081b5163eb5bc3e98d5e34e892c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 251d19d28ca771971bfd96166708cac7
SHA1 884aec6840a0fd5e844d84fbbcb45a9448e447f4
SHA256 274a753826c9d65bf56bfe1000e0b2aa0963e4443523599016e6c769b07e749a
SHA512 fea5ca9de7e55c2636e0891176f7d283fac3ced6afe976622f44f5c6702e8c28a6e009cd766be8da2b90b8e2c41f5cd32115529b37a60ca422370284f83d56e4

C:\Program Files\chrome_Unpacker_BeginUnzipping2780_2000010445\crl-set

MD5 2fc9fce96a2d825f83d9c2ded23508f1
SHA1 b8d23b1e23e36261b2bf983cfb90c148ade4576e
SHA256 e9cff6481a3dde6c4b4d737eef8686eef01ee06fddb85e32827666fd59477866
SHA512 f4ded164b3e4cd770ba723daf9da0611ea8291637d4b375cd491bfed7d2c1bd0ae0ec83cb8dbeb52c109cc80cbb8f6486020d6da8f5cc26d39969e954053cec7

C:\Program Files\chrome_Unpacker_BeginUnzipping2780_2000010445\manifest.json

MD5 4aee9a12e34afd1311213ec2ced5d419
SHA1 83b550896a23ca5400a4f866ceb112bea43a72ae
SHA256 841ab1f4cda1c65140bf1b3a6818e583ce4f25268b5a6389e8710768efcc1383
SHA512 31055d42b857abb7d8756352a26f3233e8738189a16afb4c9aeb755e68f6e34293aa7b8987d83509e782daf1b613addd57da972e8e8a1ab535eb586719c4b6c2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 df6039247f945f2d004db0df511d56c6
SHA1 991b17d45818f9293feabae323de377d7d8a9534
SHA256 c6f4226a578e2c7bf67adf69a210a279b0d5d7c69843cf64ab516e5d7916100f
SHA512 19a0c353159408cbd95f5f551c1e434c4189ab981ab635f7341bf6f3f1d0051eb7e0194f0589cd4b11cf7511856dd02674c69e9b2a13759109e11d97be8813b9