Malware Analysis Report

2024-09-11 13:00

Sample ID 240613-rqlfxsseng
Target ChromeSetup.exe
SHA256 2d433bd6de1ad8c702c2034c07b38d87df5aac3f997894c94b26f389e76dd8b7
Tags
discovery evasion trojan
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

2d433bd6de1ad8c702c2034c07b38d87df5aac3f997894c94b26f389e76dd8b7

Threat Level: Shows suspicious behavior

The file ChromeSetup.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery evasion trojan

Checks whether UAC is enabled

Checks installed software on the system

Drops file in Program Files directory

Executes dropped EXE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 14:23

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 14:23

Reported

2024-06-13 14:24

Platform

win10v2004-20240611-en

Max time kernel

22s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"

Signatures

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\126.0.6478.57_chrome_installer.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\cs.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\uk.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\icudtl.dat C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\chrome.7z C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\es.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\nl.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\ms.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\VisualElements\SmallLogoCanary.png C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\updater.log C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\el.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\fa.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\he.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\ja.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\pl.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\ta.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google3008_1909972653\updater.7z C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe N/A
File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\metadata C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\am.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\ca.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\metadata C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\resources.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\VisualElements\Logo.png C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\0341d26c-74be-44b6-8a5f-a85e467dd59d.tmp C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\settings.dat C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\default_apps\external_extensions.json C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\ru.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\dxil.dll C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\mr.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\ro.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\chrome.dll C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\VisualElements\LogoBeta.png C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files (x86)\chrome_url_fetcher_1272_967442515\-8a69d345-d564-463c-aff1-a69d9e530f96-_126.0.6478.57_all_ac472uck2gmzhkybdylxfxfoidta.crx3 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\et.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\lt.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\lv.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\vi.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\GoogleUpdater\99d25f39-1770-498b-9b87-4c16ef0e1ef2.tmp C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\_metadata\verified_contents.json C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\SETUP.EX_ C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\126.0.6478.57_chrome_installer.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\sl.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\metadata C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\126.0.6478.57.manifest C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\ar.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\da.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\ko.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\manifest.json C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\MEIPreload\manifest.json C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\prefs.json C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\ml.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\sv.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\tr.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\VisualElements\SmallLogoDev.png C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\updater.log C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\settings.dat C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\bg.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\de.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google3008_1909972653\bin\uninstall.cmd C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe N/A
File created C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe577e38.TMP C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\es-419.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\MEIPreload\preloaded_data.pb C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\gu.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source4832_106672685\Chrome-bin\126.0.6478.57\Locales\pt-PT.pak C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\126.0.6478.57_chrome_installer.exe N/A
N/A N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib\ = "{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\TypeLib\ = "{27634814-8E41-4C35-8577-980134A96544}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\1.0 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\0\win32 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261}\1.0 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\TypeLib\Version = "1.0" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\127.0.6490.0\\updater.exe\\6" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{34527502-D3DB-4205-A69B-789B27EE0414}\1.0\0\win32 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\1.0\0\win32 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\0 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\AppID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\Version = "1.0" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\TypeLib\Version = "1.0" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34527502-D3DB-4205-A69B-789B27EE0414}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatus2" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{521FDB42-7130-4806-822A-FC5163FAD983}\ServiceParameters = "--com-service" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\ProxyStubClsid32 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B4168B26-4DAC-5948-8F80-84C2235AD469}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\TypeLib\ = "{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF978A78-4301-5160-9D81-9DA6EED2B58F}\ = "IUpdaterInternalSystem" C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\TypeLib C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\127.0.6490.0\\updater.exe\\6" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\127.0.6490.0\\updater.exe\\6" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\1.0\0\win64 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\127.0.6490.0\\updater.exe\\6" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0\0\win32 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\TypeLib\Version = "1.0" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\ProxyStubClsid32 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261}\1.0\0\win64 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib\ = "{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\TypeLib C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\TypeLib\ = "{85AE4AE3-8530-516B-8BE4-A456BF2637D3}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ = "IAppVersionWeb" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\TypeLib C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\TypeLib C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\TypeLib\Version = "1.0" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0\0 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{B4168B26-4DAC-5948-8F80-84C2235AD469}\1.0\0 C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\LocalService = "GoogleUpdaterService127.0.6490.0" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\127.0.6490.0\\updater.exe\\6" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\TypeLib\Version = "1.0" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32 C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\TypeLib C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261} C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\127.0.6490.0\\updater.exe\\6" C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe N/A
Token: 33 N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\126.0.6478.57_chrome_installer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\126.0.6478.57_chrome_installer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3008 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe
PID 3008 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe
PID 3008 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe
PID 2028 wrote to memory of 4940 N/A C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe
PID 2028 wrote to memory of 4940 N/A C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe
PID 2028 wrote to memory of 4940 N/A C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe
PID 4100 wrote to memory of 3088 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
PID 4100 wrote to memory of 3088 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
PID 4100 wrote to memory of 3088 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
PID 1272 wrote to memory of 4604 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
PID 1272 wrote to memory of 4604 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
PID 1272 wrote to memory of 4604 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
PID 1272 wrote to memory of 2472 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\126.0.6478.57_chrome_installer.exe
PID 1272 wrote to memory of 2472 N/A C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\126.0.6478.57_chrome_installer.exe
PID 2472 wrote to memory of 4832 N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\126.0.6478.57_chrome_installer.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe
PID 2472 wrote to memory of 4832 N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\126.0.6478.57_chrome_installer.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe
PID 4832 wrote to memory of 3536 N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe
PID 4832 wrote to memory of 3536 N/A C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe

"C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"

C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe

"C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={7D955970-B94C-28CA-4D5E-CC05711682B3}&lang=en&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2

C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe

"C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xd8758c,0xd87598,0xd875a4

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe

"C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --system --windows-service --service=update-internal

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe

"C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x11a758c,0x11a7598,0x11a75a4

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe

"C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --system --windows-service --service=update

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe

"C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x11a758c,0x11a7598,0x11a75a4

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\126.0.6478.57_chrome_installer.exe

"C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\126.0.6478.57_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\ec6af39f-1816-46b3-b898-1f18f54270a1.tmp"

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe

"C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\ec6af39f-1816-46b3-b898-1f18f54270a1.tmp"

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe

"C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=126.0.6478.57 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7e87b46a8,0x7ff7e87b46b4,0x7ff7e87b46c0

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 update.googleapis.com udp
GB 142.250.187.195:443 update.googleapis.com tcp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 123.35.104.34.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.107.122:443 www.bing.com tcp
US 8.8.8.8:53 122.107.17.2.in-addr.arpa udp

Files

C:\Program Files (x86)\Google3008_1909972653\bin\updater.exe

MD5 675c9a53a09d5385bbdb3a43a88f2493
SHA1 71d1c311eadd4d5949c0b48def8ad0f2186bc243
SHA256 ebb428a4c1e29192617e7699513ec78512735110bba68bbee54dee34807094ae
SHA512 e3b1d8351b6d208678673e4c69aea745de5b2576a43d2cf9e06c1ea0780dcbc2ca56d5d5fc712b80309ba7950b90130ca2780185b71c990ea6c6062bd29f5136

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

MD5 190166d1d9a591ec8b865b30aa773469
SHA1 c21255274dd12c70c9c8bdd5eb288fd775797727
SHA256 0949e972b09cd5d8efe71c3d561e4ceef1adfd86d4a6103dc2b99f0ac2303a47
SHA512 46f18aaf9a95f9429a4b63285ce1d9fdcbc8ea222631895943b964915a8031b2dfea3654046aa26a084385c04b214a1e2b1e5626ad3d3f4a9391eecd9a7e6941

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

MD5 689175ae38b16c8b9eeee222e0aa30d8
SHA1 a5be2cb7673701f4b573dcf96413beb1d4b2b1b0
SHA256 315dd85315c0b56fa5cede35ec96c5fc2ae0f74f1b1a7e8e61118b5e7bf501cb
SHA512 088f6bea4ed8004627ebbc16ecea499a59d5081f04d69c62ea0532cc89ae35280cdee730738ce9f6b90f1a98dc9e3efbb15e579df569183de295dda1d3504739

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

MD5 4fe3949748eac6d6b93c88baeb102a1c
SHA1 6ac903aab9bea32ca1e3f6e2822383ed9538326f
SHA256 4f7585c9f4e2325f850a8083824f7ba65e57c8fd83190ede6a23e051056dea4d
SHA512 23622f368bf5343d9d106c9c5c45a2e38cac23c419550555d9acbdc90fee77ebcb5c5110b6acdf682291f0db017e8f0279f58b5c344ac038c6f04634b89eb446

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\settings.dat

MD5 a9758deae5b85215228493c450051979
SHA1 ad02dbc170452ac3ec53e79756781bc4cf2595a4
SHA256 9569a052696a9b46699fbde52b7856ba8b7cac62afabd6cf2c997a4cad3ba8db
SHA512 9720a2c729c89d7969e4330a8bf1161d370956e6be01ab54a4073ddfa6115229ad037125e08d533a480230f46b8d9a58d7666e35a2478aab9d5fda32597870c1

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

MD5 bdce395b453a0a3ffcf742feb2a210ae
SHA1 8bfc909ac17238d49d93a3668256b92766391452
SHA256 82f7226a5b6be7356507c368ca2468c5d9b7d4a4036fa18d85c6a99e2f0eae41
SHA512 cf4d12cecd6d749990265779d1f9ec5e505b54cf283580f611cd346aaca17816b4c58547bb61c451190c07b651d967f2d03c13b74e2210195514f8087b92288e

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

MD5 7136b45ffcac6b52d6873f2864471ea9
SHA1 7afb956fccbfa48ec7fcac07cde0f6059a51a534
SHA256 78f60448736dd9d298a2bc503571a91a8f0c342e95ff8cc589d546e84e7384c2
SHA512 66755a95e16371a527df8b702ba8d686a08678aa0d3257ec4775c5fef8c81d422d7a6ce8aa1fa1c150ebe02f14a0df23776dabc42b6da5ed83b79be956fc2ac7

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

MD5 37bb74f1381daefae39b10ad4ad2a1ef
SHA1 95679411c25f1833c855e7a9f7b423e35567cf8f
SHA256 a922576567b621cf54bb13773db3ca7db2390b89ffa691ca8de1311d9e2547e5
SHA512 055ccddec5356a29323a9d4fcfa4bb52dcad9973b888306444d7c860651566d5b6f60f29b8e8cd2f4717db7e443f2803c2ee46e82717a584d98e8322977695e3

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

MD5 8a0da18cb624641375c39a654eead249
SHA1 962b077b7e9ee3f8421b2c68798fe92a04e26789
SHA256 f06a48832cb880df2af74900d3a382510d29c5bb84259d888eedd1b26708230e
SHA512 576fa0b985526f260e121820d45cb861d6446f21122c3b4f69e76586d4663acbbfc5d639a22043320339d6802d5f6eb6b2aea027490c96f8d2e9c5d2d4661f87

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

MD5 7392c7ef1db8fb5faab620d1a8d78ce6
SHA1 dd98934897fcabde2b2205b355d25b83980da81b
SHA256 eea1c984955e41b162c08d6283bd43007b43e6fb9ad8e87803c6f5e3302b216d
SHA512 c7d19bef95ac7f9f7bbbeab1424a32b5ebc708351bc01aa2edb41ec33f612b10db66ff60f1d090dcb5e83938f13d1631d888658658d3bdc2140bf85f69a83639

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\CR_81A9D.tmp\setup.exe

MD5 09ba2c4154f599d13685aab590b74194
SHA1 64625a9a2cb44a7281486b98c44952b785146280
SHA256 c8471a651c778d6221ab09362a399b30e0e40a959fad0bb1a84eb10ad6e16189
SHA512 9ee665db8e757f32caa711ae03f34152743a7890c83917fe37d51ec1285921fbc8f0ce9dbcff515ec112291e368d661ffc27e039f7e2e58808822d4ab4830996

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1272_1148519520\ec6af39f-1816-46b3-b898-1f18f54270a1.tmp

MD5 314a3819f90af93bc51ee4794fe31764
SHA1 7ef4700158312badb70eb1ae187c05832067ef8f
SHA256 df3c1390b922a16285e7a8482c526c89dea16b7c0f425cb057b6d2d8563682c8
SHA512 51df2ac2ff486386bbcfaa3094f1310fd3a5266a11d8919bf84432c59f00e0036aeb486e155885eff436d623812563b6cee724ea462c9dfb5afd06279bce414d