Malware Analysis Report

2024-09-23 10:31

Sample ID 240614-mk5kdszhpr
Target a9360745871d11e86208dfc05389ed87_JaffaCakes118
SHA256 654eebb38506e36b159f0dda7b316e2b726548145a179cec49b32bb030d5aba8
Tags
discovery persistence bootkit
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

654eebb38506e36b159f0dda7b316e2b726548145a179cec49b32bb030d5aba8

Threat Level: Likely malicious

The file a9360745871d11e86208dfc05389ed87_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

discovery persistence bootkit

Modifies Installed Components in the registry

Sets file execution options in registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Registers COM server for autorun

Checks installed software on the system

Writes to the Master Boot Record (MBR)

Executes dropped EXE

Checks installed software on the system

Loads dropped DLL

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Program crash

NSIS installer

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies registry class

Checks processor information in registry

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-14 10:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

151s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1027.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1140 wrote to memory of 836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3892 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3892 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1027.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecbf746f8,0x7ffecbf74708,0x7ffecbf74718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2304,8106089276365450555,9745732873345895740,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2312 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2304,8106089276365450555,9745732873345895740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2304,8106089276365450555,9745732873345895740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,8106089276365450555,9745732873345895740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,8106089276365450555,9745732873345895740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2304,8106089276365450555,9745732873345895740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4536 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2304,8106089276365450555,9745732873345895740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4536 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,8106089276365450555,9745732873345895740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,8106089276365450555,9745732873345895740,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,8106089276365450555,9745732873345895740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,8106089276365450555,9745732873345895740,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2304,8106089276365450555,9745732873345895740,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
N/A 224.0.0.251:5353 udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

\??\pipe\LOCAL\crashpad_1140_SGJVRTOZEJDUBOFH

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4d8eb8adb20cd682cac3c759027a4e28
SHA1 13d9bdc7e31800d78ed566df91bc14cbbfc0be70
SHA256 b71265e39de9b4261cb5694d08cc00a9bd2d5cd8257213779a1a5e1b5db971f1
SHA512 8d5fdb894d55dbe5474ba54d284e55896371f332e8ebc7eb9b10f169e4a8502c05ddad42788facc27f91bea0cc564c1c70d69d390bd4cc0c5bed6976ef8cce27

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b4fef333b630222bb2afd765113b2eff
SHA1 1301014e6cd509f6f8a1732f4cecf24fe44b0fa8
SHA256 299a1fc30b7ae8547d7aa3ee2c48d66ce1d514259520f1d026ff39853c5741e6
SHA512 42799b40cb5bb22fc7d2b390a07dd1a41f970121a9c5c42faab89921f6cf19253c1f5e97fd11c445e742c5162271077982aa311aaf889f27860a880ddc7a6406

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 be1c9c6544f986e395cd344098de5a0d
SHA1 cc1d00f9d68010fc0c43c1bf64afa72583350775
SHA256 45b48cf24a707b29bc37cb79fac4669823752805bc3b449ebbee2a4f29820af5
SHA512 c8d48d1e530dc4233fc5426c19932d9cd1e3c1dd089890de049c3e63895991a181db1f4cc765c95b1cd1ba6cda8304ff27fb399d260c8e22abda3fd311993e1c

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\execDos.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1552 wrote to memory of 4024 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1552 wrote to memory of 4024 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1552 wrote to memory of 4024 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\execDos.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\execDos.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4024 -ip 4024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 600

Network

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240611-en

Max time kernel

119s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 228

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240611-en

Max time kernel

124s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe"

Signatures

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_da.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_en-GB.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_et.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\psmachine.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ja.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_no.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_sk.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_te.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_zh-TW.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_fr.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_es-419.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_hi.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_id.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_iw.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_sw.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_lt.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_pl.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_pt-BR.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_bn.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ms.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ru.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\GoogleUpdateHelper.msi C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_gu.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_sl.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_th.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ro.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_vi.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File opened for modification C:\Program Files (x86)\GUME7A1.tmp\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_mr.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_is.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_it.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ca.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_am.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_fa.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_sr.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_uk.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File opened for modification C:\Program Files (x86)\GUTE7A2.tmp C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdate.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_en.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_kn.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ml.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_nl.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_pt-PT.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_el.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_fil.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ko.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_lv.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_sv.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_es.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_bg.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_cs.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_fi.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_hr.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\npGoogleUpdate3.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ar.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_de.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_hu.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ta.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3584,i,6041070687820623968,3004230300437737550,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 131.253.33.237:443 g.bing.com tcp
BE 2.17.107.105:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 84.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.33.253.131.in-addr.arpa udp
US 8.8.8.8:53 36.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 34.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 67.112.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20231129-en

Max time kernel

119s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcapi_dll.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1108 wrote to memory of 2196 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1108 wrote to memory of 2196 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1108 wrote to memory of 2196 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1108 wrote to memory of 2196 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1108 wrote to memory of 2196 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1108 wrote to memory of 2196 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1108 wrote to memory of 2196 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcapi_dll.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcapi_dll.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240220-en

Max time kernel

134s

Max time network

128s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1025.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74190551-2A39-11EF-8554-DE288D05BF47} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b21f55df55657b4197ec36ecc6b76958000000000200000000001066000000010000200000009bc80ad536303ef541724c749e1def33c4519db773a39c923a3f5ae21ec6c18c000000000e8000000002000020000000c59a6aefe647051aadad6b31f585bf6e6725bdbd0a7fa90579a5642213cf38322000000057f45f2bf372016279ce7edf7685862e7864c071dc8c8c822ce49bd2397274c640000000b6ac680bc7fbcd62c68d0bd9a5ef4348b607178a4b568402d9d77b46939a13a2cf13828f876225a83fc7ae0965fe7589014e0183f925682ae676d4f9edcfd54b C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424523039" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9044934846beda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b21f55df55657b4197ec36ecc6b769580000000002000000000010660000000100002000000082d5a0da212e028a883edafa08ab27fa31be12839355f48d82e29beefdb85a71000000000e8000000002000020000000cddd0d8387be1b2fd24ca59a1140595bafa9044c91cd0ad9c7a3c93d1f83cdc7900000002e1b479649f2ad4460e6b2c3bc795aaced68054b18baade92a0b2330cb914a43c2de69cd23570bf629ddc6fd6e83d721231e33d915f39d2230a9b47c5a3480bafdbdaf3bd879ef8c4f95eddd902ed7ce745eb3a3da8be1a61a250323c9fdc61069452a4b6d2394a2a5db42b64d86baa059172ab4a5bff7d3a020d81d64e690a751a10677951b99be9920f2fa3f6bfef9400000000c2183b1be0e00803372a01690f31636e8ab04dd422baefed4a8e9f5568bb4b40ac2e65c3c239e4386f4193d3c7cd9047ca3e7e64510b9a1d7e3d5308a634a5f C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1025.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab25BC.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar26BD.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b23b6d40819c6fb3464fc41979cc397
SHA1 d29a1dfb0ab49d01de2e159cfafd7e276d040558
SHA256 92e402012105631a760446bc8fdeec4c30c7ee0c75200ef6db691c5901552955
SHA512 c83eb0dffb2fe63d3eeb2d8e143bafe77306f28d3af863368895a4490fce750c8283a8e7c9f70035d29927575443ee2254856766ab64d0fa432b02ca50caa219

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 89f230ca00c171ab6d189425bd25dc9e
SHA1 fd4a721b7ef8b788066c5f1b8b91fa9980e23ef4
SHA256 4d0a2bc3a137befe64af9bf934e4ae38db05d339fa0baf4370ea8381e5fe6a97
SHA512 e5a55697e09522c8edf7e54346fdd91e709704b306e639d68ebc3c8be1c854ca96f9765ef9d988f744632c99eb8a5b1a62b536a4da1803b99bec7ef417b42293

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a395334391fbfec25f10f34457c051da
SHA1 b31016f795a9b972fa8dd842e2fc7cb2b135a65d
SHA256 9a94d43e43802954291cec8a90f6b326756c8191a62b503b3105f3dd87c397e2
SHA512 b74279cd829fbac15f1107a10de674242589aa35a06cc9cdaca6610b5e8009bff030d9516dcb7923c32ac4d5e194203b7f6655d3cdd3f71b31bf2f3c538a3969

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1f421870de3e64133192101ef1d7e035
SHA1 9fa78869fb4c5e9ca058223988a5021de778ff73
SHA256 559f989272666fdfcefac997a277912128f584f75d36c7937587a5fb99e74dfe
SHA512 069e8b6a837213a75365666448f3b5044bab3916c5019f917a86bb0e26fbaee0aebe9796f151230a0ec3997fc669db91cc0c763de126b19abafe5c7068dddd7f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 da7f1fef6e60b7c1d7b349824052a46c
SHA1 a44123d84de4cb4b6b223c27f34d52cbaf7c31b5
SHA256 70daefa814ebe50a351f0bf129fe94dfd8b793f01c27ee4caaefff2c10c12c30
SHA512 3ce7df763a18c110aa74ad3def5ea08209a2112eaf2d3cad2ed568ad930fce165fb9f19de6476eb52624dab25b448ade3cbc2801c2d217afd69745175031807d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 78ab27d06702bb50494fcd452e87b965
SHA1 c00fb8505227cff0a9071030d5b8ac3b0cfeeb65
SHA256 b549487f7e6f918b33b804e22bc3d176e8bb99f7c91ec9e306efcf0ff781bfd0
SHA512 9b2baac17f2397ecb3e1b390bfe051e3565ba04937b98745f68dc801f276534801985af24f508a2ee16a856440f579ab5fc894505d41d145b773f5f9c128ae0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5e325cef3514cb405edad26a71804a28
SHA1 f351382ffd2d9f72c03db07547cf2c95ed83f4ba
SHA256 cc8a56069a67dcdeb39cdb2112944537b697a2dfb60008442a2612253045f583
SHA512 e8200065e458f17cb04e29bb4082e8a44c931421d4db7f71197007a5a7654570d1ad7194262437f70468f0ffe0bd349af566790ed40f18506010a13c024a5262

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d3a44039d0d17bfc9b7c4c7367b249d7
SHA1 40ca5e263794f2d7394ac4546a0b0de3b02f11be
SHA256 a40ebc593f0f3b7146eb66989099535b76c927db8163a681eb27ba2687bd3716
SHA512 4dd04fdee0f18bf0f05d77951d30dc03e2a9a89bd2723d6a445710988c88c4d153b18dc65a0144515accadf80a0a6743ca3a8de9e5b0e14150e5677132eb1f41

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2791f6c6ec19bda44914b201be0136e7
SHA1 74d422e16fa67c2f1718f3641c7cf91d39b6918a
SHA256 0f7f26993e1eb0f218f14a61b3e2a4aa4ded77bf621ac3929c11d1d3f74c48b3
SHA512 ba71ad3f309ce768e18f9cd921650a1c8ccccc36e21eba56a5ceb79f255fb20f477a1bde90183097c0571f943a1b951ab15cf7e597ac1201ba1ca969b7b55e9d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1315e8c16fa4bda25d82acf7fcb33a9a
SHA1 e2b98f3e5a3dd99706c2f9142fe6399722e8e527
SHA256 94d10dbc69aeca938eae493301e6af5eb78391d8d5bb06f498d0195d00b3d614
SHA512 146d54d80ee15ce5398d67c90c52b4aed8a8c748148fad91f950cb6b37f6be0bc62d0b5901a3561467498f9f12393d52b5f60defad89af83e243015bd1c146f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 670c54949c92c4f5ae9c1825c96fac6b
SHA1 b6d71f7f9035c3eb2edd0310601143982b61efa3
SHA256 465e1bb8303fa593d56b1dff0339c5816e8fa8c905b913ff202282ca2af7bb34
SHA512 16b4edbb4c8e9bea32c08e841bd546741ab9469023e8a2fc9630682f0ea2c5d79bab461d499e1b04c71ca37cc898dd5c723723f9a106db8bcbfd539438d029de

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7236c5fc6c1f0a84af7b619e5330443f
SHA1 5ca31accf45b78a2f1cf11abd28cc19928d78c23
SHA256 03bf9ac5ef695453f9cdb39c992a15f2d3ca21d5a60b0f5efb8aebee98b8b24b
SHA512 0a7860a513239875ff2af8ba009782cbbbcf8011f6440944e4fde9bdbd86fd24659cbbbc23df5dc65674e59b8a30f257b4580ca2c3444f7cfd1bdfe2eab4c021

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5ca26c436b1d564536df6412a1bcdacf
SHA1 8699c94f62cf9100bfbe551725672e0108bebd61
SHA256 00929ebfd0c16b2a87f95f83d0ab402a1e268a47caf67fc2e60c54db8e5d97c1
SHA512 0c99d517eb210d270eb600c9b9c10a6572f4a212353b05eab8859fd1e8c538ac9a9b027c73888c21b6203bc77f4e80d145e21dc8f2635a854d2f4555028c6501

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3b79f2e1d58ae827d49a42371adb2730
SHA1 b3707e06d1bb4696470c2e89bd65d34dc0ce7c0e
SHA256 3e4511f0269e9cb08c1e7eba009c7f5d0ee28c2e8afb7d643e917a383754cdbb
SHA512 99e2c3b8d69789327411ac8445d575177aa9facea987cd7001abf7dac4a5817207013741ae5130b84e096435b697b30535d475627371a294850574f3d20d0bf1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f1bd7a5d23c502a965b54932327a3428
SHA1 9b04d7e6b8c9e98d2ddc4c207c1afb5f6597bc0b
SHA256 232cf38ed09c624519dc7b153a2176d0f97281573fbf7e4814ebbc3183a58567
SHA512 db40a083c98c560bb0fbd18bee0e2695eb9a3058f36d9c7498d3b308eb53f2fa7016cbc1351b1e63072976e6f83a22f5be03c21b650aab852072ed0ce57ff420

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e50eb16d8bf7d742353843f27d6031c8
SHA1 2ef540691600603b8a3dc41e61672e48c4a5255a
SHA256 fdff5a72530642928c50bebabc797402111d17ec7ac32d8d1a5f41ccb4c82670
SHA512 63d88a74bf6cd2696d321a19c216fd034fc7f7a53f5473833ce821024ed132b51c8d1d79936ecc29521bdca09b8745e7a67f82c1450e609eb9d65d905de7932d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b0795d01faf08f11cdec87308f20e3f1
SHA1 f23dbbcc8775910d4c43acf5f10bcdb83807306f
SHA256 c99deaf9a4748bc2e2c747caf65b228cc2362efc0a2e74ca125981d1e563b73c
SHA512 5dc5e919f31a463d8d9471c96884fd5782cf45c3b3faf5ee4ccfc87f00f3deb27b7b35743e8ceeba27b31cddbcfad1d469617489da34832994c3140966e498ec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3f03603390ecb781d708f5bf47006ae3
SHA1 ba25388ac206c9a5ec3d1a74d60f77f1d7647a14
SHA256 14cdada00a90f0f8977e3f20eab6926b35932ba02bc5afbef79988f2c95d3571
SHA512 c85485992860b9da1250bfa92ef5826c890f244445dcad909368b5c75ae42409e2a97bd606f66a0e0f887cec4cef7031ec3e5aa44ffd570394213fac1342f552

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3338655f2f2b70275cd0d8596c8218b3
SHA1 639d2df9a7653bfbeeafb9c34fc3b07449dfd72b
SHA256 f6a65de6148cfaef206592bc28721e5452a6a2f4d09516333b0922cc175019e1
SHA512 744a21068da1a48906354afff1e88bb8796de7d182adb8f131f23718edd605af84571b2fad94cd8469b455c6ca13d13bc3bdde73443542e672e27caa55a4365c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2b6a1ebd7a75fbce24435a315b42d489
SHA1 7c4b1ce1525434e1722da631f2ae966510682076
SHA256 bd18b10b5b82b9b3fbbe68b54054d7287f13e60515f50ba92f3277da95e7d80e
SHA512 644e63cb1bae29c96cb89a12eadef4b823de3c78c0545658a013df3a2e8d6592905db40253430a7e6085fd65c6ac0bf51eabc7029a38307c823f808eb63ae71d

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240508-en

Max time kernel

118s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 224

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240611-en

Max time kernel

140s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 224

Network

N/A

Files

memory/2464-0-0x000000006E5C0000-0x000000006E5CD000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240508-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Toolbar-2016.exe"

Signatures

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_fil.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_id.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_lt.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_ms.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\psmachine.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_fr.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_iw.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_kn.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_tr.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_zh-CN.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\GoogleUpdateHelper.msi C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_am.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\npGoogleUpdate3.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_es.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_pt-PT.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_ur.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_el.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_gu.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_hi.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_ml.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_nl.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_sk.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdate.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_de.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_et.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File opened for modification C:\Program Files (x86)\GUT344B.tmp C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_hu.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_ja.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_bn.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_mr.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_pl.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_ru.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_sl.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_no.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_ro.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_bg.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_es-419.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_fa.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_it.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_ko.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_da.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_th.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_cs.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_hr.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_vi.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_uk.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_fi.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_lv.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_sr.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_sv.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_sw.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_ar.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\psuser.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_en.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_te.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_zh-TW.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File opened for modification C:\Program Files (x86)\GUM344A.tmp\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM344A.tmp\goopdateres_ca.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
N/A N/A C:\Program Files (x86)\GUM344A.tmp\GoogleUpdate.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2240 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Toolbar-2016.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe
PID 2240 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Toolbar-2016.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe
PID 2240 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Toolbar-2016.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe
PID 2240 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Toolbar-2016.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe
PID 2240 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Toolbar-2016.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe
PID 2240 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Toolbar-2016.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe
PID 2240 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Toolbar-2016.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe
PID 2476 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe C:\Program Files (x86)\GUM344A.tmp\GoogleUpdate.exe
PID 2476 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe C:\Program Files (x86)\GUM344A.tmp\GoogleUpdate.exe
PID 2476 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe C:\Program Files (x86)\GUM344A.tmp\GoogleUpdate.exe
PID 2476 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe C:\Program Files (x86)\GUM344A.tmp\GoogleUpdate.exe
PID 2476 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe C:\Program Files (x86)\GUM344A.tmp\GoogleUpdate.exe
PID 2476 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe C:\Program Files (x86)\GUM344A.tmp\GoogleUpdate.exe
PID 2476 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe C:\Program Files (x86)\GUM344A.tmp\GoogleUpdate.exe

Processes

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Toolbar-2016.exe

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Toolbar-2016.exe"

C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe

C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe /silent /install "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&appname=Google%20Toolbar&needsadmin=True&brand=PRFD&usagestats=0" /appargs "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&installerdata=d%3Dask%26h%3Dask2"

C:\Program Files (x86)\GUM344A.tmp\GoogleUpdate.exe

"C:\Program Files (x86)\GUM344A.tmp\GoogleUpdate.exe" /silent /install "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&appname=Google%20Toolbar&needsadmin=True&brand=PRFD&usagestats=0" /appargs "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&installerdata=d%3Dask%26h%3Dask2"

Network

Country Destination Domain Proto
US 8.8.8.8:53 tools.google.com udp
US 8.8.8.8:53 tools.google.com udp
US 8.8.8.8:53 tools.google.com udp
US 8.8.8.8:53 tools.google.com udp
US 8.8.8.8:53 tools.google.com udp
US 8.8.8.8:53 tools.google.com udp
US 8.8.8.8:53 tools.google.com udp
US 8.8.8.8:53 tools.google.com udp
US 8.8.8.8:53 tools.google.com udp
US 8.8.8.8:53 tools.google.com udp

Files

\Users\Admin\AppData\Local\Temp\nsy33ED.tmp\System.dll

MD5 301a9c8739ed3ed955a1bdc472d26f32
SHA1 a830ab9ae6e8d046b7ab2611bea7a0a681f29a43
SHA256 6ec9fde89f067b1807325b05089c3ae4822ce7640d78e6f32dbe52f582de1d92
SHA512 41d88489ecb5ec64191493a1ed2ed7095678955d9fa72cccea2ae76dd794e62e7b5bd3aa2c313fb4bdf41c2f89f29e4cafe43d564ecad80fce1bf0a240b1e094

\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe

MD5 7abad5635830cb8af3ea5b88e76f728d
SHA1 7809cb7c62fb6c95e7dd244bc480f3f93e695a25
SHA256 27785c7b3825d73149794527a8be2dbdedd737ad3d47ecc6eb30be7546c1bdff
SHA512 09c3e2b4726974db4ffd46c58f7177a52fcea2c85a8a22196555cfeefda7c6f4cb453de196f919a1e2ca2441379a36a9b40bb3d70d64c4148c31b58d0ce50be3

\Program Files (x86)\GUM344A.tmp\GoogleUpdate.exe

MD5 506708142bc63daba64f2d3ad1dcd5bf
SHA1 d30e8c7543adbc801d675068530b57d75cabb13f
SHA256 9c36a08d9e7932ff4da7b5f24e6b42c92f28685b8abe964c870e8d7670fd531a
SHA512 a6e16f0de64b1500fbb2c7974a5efd40e8768b6c133f8ef367725a5c82b3b38c300dd65fa159b4a5f15413b0843a1e37416550ec89749ec1cf5cfae73dcc01ab

\Program Files (x86)\GUM344A.tmp\goopdate.dll

MD5 44a7beb360488d6595de0ec0c6e8248b
SHA1 ff424defecead2e1ceb7762a78366cb7c424b9b2
SHA256 934bced969e0f50ed647289e8469308a54d8dc5a6ab5c81c66f5899798564d76
SHA512 f06a153d03444151983ac5932dde05a6f9de2093001ee3588f4abeba1b0564c407c163b705a8f24c2501e26b4860eb92f17f2de0a7b0893f6b6f9b00950f4105

C:\Program Files (x86)\GUM344A.tmp\goopdateres_en.dll

MD5 8f324a0dac8e8d61faff2cde53eb4af0
SHA1 d0573eae2aa53b3fc0e584126b457a618002feb7
SHA256 f8f90894b9f942d4453dc3c532784f9ee301611726f7ca08bd71fa6f339267ca
SHA512 1ccfb6211b6936b2f51a5a5d3a25eccc31466a64a316aba00faead3b77e59083a5ab190bc6fd77e14c57c4ceedfd5a1bb2d3816fe9af7ac9a336ab46f57f8f91

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240508-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe"

Signatures

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\GUM164E.tmp\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\psmachine.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_es.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_fil.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_hr.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_is.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_ml.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\GoogleUpdateHelper.msi C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_th.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_mr.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\psuser.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_ar.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_fi.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_pt-PT.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_zh-CN.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\npGoogleUpdate3.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_el.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_da.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_es-419.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_it.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_lt.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_tr.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_bn.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_sr.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_uk.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_bg.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_ko.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_lv.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_sw.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_te.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_cs.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_am.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_et.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_no.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_en-GB.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_fr.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_id.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdate.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_fa.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_ja.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_sl.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_ur.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_vi.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File opened for modification C:\Program Files (x86)\GUT164F.tmp C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_sk.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_ms.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_nl.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_ta.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_zh-TW.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_de.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_ca.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_en.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_pl.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_iw.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_pt-BR.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_ro.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File opened for modification C:\Program Files (x86)\GUM164E.tmp\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_hu.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\goopdateres_hi.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUM164E.tmp\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe"

Network

N/A

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240611-en

Max time kernel

146s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcapi_dll.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4636 wrote to memory of 2136 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4636 wrote to memory of 2136 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4636 wrote to memory of 2136 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcapi_dll.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcapi_dll.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.226:443 www.bing.com tcp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 226.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\a\$_110_.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1920 wrote to memory of 764 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1920 wrote to memory of 764 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1920 wrote to memory of 764 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\a\$_110_.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\a\$_110_.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4040,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8

Network

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240611-en

Max time kernel

94s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe"

Signatures

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome" C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1" C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0" C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96} C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome" C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\126.0.6478.62\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable" C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0" C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
N/A N/A C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\126.0.6478.62_chrome_installer.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

Registers COM server for autorun

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\psmachine_64.dll" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32 C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32 C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\126.0.6478.62\\notification_helper.exe" C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\psmachine_64.dll" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\126.0.6478.62\\notification_helper.exe\"" C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\psmachine_64.dll" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\psmachine_64.dll" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\psmachine_64.dll" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\psmachine_64.dll" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\ar.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\optimization_guide_internal.dll C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Extensions\external_extensions.json C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\goopdateres_pl.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\pt-PT.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\chrome.dll.sig C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\goopdateres_fi.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\goopdateres_lv.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\goopdateres_mr.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\goopdateres_ur.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_is.dll C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\pl.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\VisualElements\Logo.png C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\npGoogleUpdate3.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_es-419.dll C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\MEIPreload\manifest.json C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_el.dll C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_sv.dll C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\am.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\goopdateres_gu.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_pt-PT.dll C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateWebPlugin.exe C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_am.dll C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\psmachine.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\ko.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\VisualElements\SmallLogo.png C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\126.0.6478.62.manifest C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_pt-BR.dll C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\goopdateres_kn.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\fa.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\goopdateres_tr.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\kn.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\tr.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\libEGL.dll C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_hi.dll C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\hi.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\ro.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\sr.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\vi.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\fi.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\126.0.6478.62_chrome_installer.exe N/A
File opened for modification C:\Program Files\Crashpad\settings.dat C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_ro.dll C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_ms.dll C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_sr.dll C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateHelper.msi C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\hu.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\VisualElements\SmallLogoDev.png C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\goopdateres_sv.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\goopdateres_ro.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\goopdateres_th.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\chrome_100_percent.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\it.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\dxcompiler.dll C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\goopdateres_am.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_id.dll C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\icudtl.dat C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\el.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_hr.dll C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source5020_1579445161\Chrome-bin\126.0.6478.62\Locales\en-US.pak C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
File created C:\Program Files (x86)\GUM4100.tmp\goopdateres_cs.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55} C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\AppName = "GoogleUpdateWebPlugin.exe" C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\Policy = "3" C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\AppName = "GoogleUpdateBroker.exe" C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\AppPath = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17" C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\Policy = "3" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\CLSID = "{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\AppPath = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17" C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D} C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\Policy = "3" C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{4FA480D8-32A4-4849-B774-DE8BD5242A4C}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71D2697F-5C53-4AAD-98E8-7FAEA818C36B} C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13} C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ = "IApp2" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods\ = "6" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ = "IProcessLauncher2" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\LOCALSERVER32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{4FA480D8-32A4-4849-B774-DE8BD5242A4C}" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\126.0.6478.62\\notification_helper.exe" C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32\ = "{4FA480D8-32A4-4849-B774-DE8BD5242A4C}" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36} C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\AppID C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe\AppID = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71D2697F-5C53-4AAD-98E8-7FAEA818C36B}\InprocHandler32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32\ = "{4FA480D8-32A4-4849-B774-DE8BD5242A4C}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\PROGID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods\ = "43" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\Elevation C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\goopdate.dll,-3000" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}\NumMethods C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc\CLSID\ = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ = "IProgressWndEvents" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\VersionIndependentProgID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ = "IAppCommandWeb" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods\ = "6" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\psmachine.dll" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32\ = "{4FA480D8-32A4-4849-B774-DE8BD5242A4C}" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837} C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36} C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{4FA480D8-32A4-4849-B774-DE8BD5242A4C}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\LOCALSERVER32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\NumMethods C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32\ = "{4FA480D8-32A4-4849-B774-DE8BD5242A4C}" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods\ = "41" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ = "IGoogleUpdate" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods\ = "4" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ = "ICoCreateAsyncStatus" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1028 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe
PID 1028 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe
PID 1028 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe
PID 1304 wrote to memory of 2708 N/A C:\Program Files (x86)\Google\GoogleUpdateSetup.exe C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe
PID 1304 wrote to memory of 2708 N/A C:\Program Files (x86)\Google\GoogleUpdateSetup.exe C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe
PID 1304 wrote to memory of 2708 N/A C:\Program Files (x86)\Google\GoogleUpdateSetup.exe C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe
PID 2708 wrote to memory of 4432 N/A C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2708 wrote to memory of 4432 N/A C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2708 wrote to memory of 4432 N/A C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2708 wrote to memory of 3964 N/A C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2708 wrote to memory of 3964 N/A C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2708 wrote to memory of 3964 N/A C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3964 wrote to memory of 4380 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 3964 wrote to memory of 4380 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 3964 wrote to memory of 676 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 3964 wrote to memory of 676 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 3964 wrote to memory of 4268 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 3964 wrote to memory of 4268 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 2708 wrote to memory of 3304 N/A C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2708 wrote to memory of 3304 N/A C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2708 wrote to memory of 3304 N/A C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2708 wrote to memory of 3884 N/A C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2708 wrote to memory of 3884 N/A C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2708 wrote to memory of 3884 N/A C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1252 wrote to memory of 5116 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\126.0.6478.62_chrome_installer.exe
PID 1252 wrote to memory of 5116 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\126.0.6478.62_chrome_installer.exe
PID 5116 wrote to memory of 5020 N/A C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\126.0.6478.62_chrome_installer.exe C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe
PID 5116 wrote to memory of 5020 N/A C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\126.0.6478.62_chrome_installer.exe C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe
PID 5020 wrote to memory of 3744 N/A C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe
PID 5020 wrote to memory of 3744 N/A C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe
PID 5020 wrote to memory of 4052 N/A C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe
PID 5020 wrote to memory of 4052 N/A C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe
PID 4052 wrote to memory of 3592 N/A C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe
PID 4052 wrote to memory of 3592 N/A C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe
PID 1252 wrote to memory of 4484 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
PID 1252 wrote to memory of 4484 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
PID 1252 wrote to memory of 4484 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
PID 1252 wrote to memory of 3088 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
PID 1252 wrote to memory of 3088 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
PID 1252 wrote to memory of 3980 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1252 wrote to memory of 3980 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1252 wrote to memory of 3980 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Processes

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe"

C:\Program Files (x86)\Google\GoogleUpdateSetup.exe

GoogleUpdateSetup.exe /silent /install "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&appname=Google%20Chrome&needsadmin=True&brand=PRFI" /appargs "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&installerdata=%7B%22distribution%22%3A%7B%22do_not_launch_chrome%22%3Atrue%2C%22make_chrome_default%22%3Atrue%7D%2C%22first_run_tabs%22%3A%5B%22chrome%3A%2F%2Fwelcome%2Dwin10%22%2C%22https%3A%2F%2Fpiriform.com%22%2C%22https%3A%2F%2Fwww.google.com%22%5D%2C%22session%22%3A%7B%22restore_on_startup%22%3A4%2C%22startup_urls%22%3A%5B%22http%3A%2F%2Fwww.google.com%22%5D%7D%7D"

C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe

"C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe" /silent /install "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&appname=Google%20Chrome&needsadmin=True&brand=PRFI" /appargs "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&installerdata=%7B%22distribution%22%3A%7B%22do_not_launch_chrome%22%3Atrue%2C%22make_chrome_default%22%3Atrue%7D%2C%22first_run_tabs%22%3A%5B%22chrome%3A%2F%2Fwelcome%2Dwin10%22%2C%22https%3A%2F%2Fpiriform.com%22%2C%22https%3A%2F%2Fwww.google.com%22%5D%2C%22session%22%3A%7B%22restore_on_startup%22%3A4%2C%22startup_urls%22%3A%5B%22http%3A%2F%2Fwww.google.com%22%5D%7D%7D"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver

C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMy4xNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjMzLjE3IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezhGQTgzQUU1LUJGNkItNEMzRi1CNjc0LUU0NTQ0ODc5ODM2M30iIHVzZXJpZD0ie0E2Qzk4MEU5LTBDQUEtNDM1QS1CRjA2LUY3QzFFNTg1QzEwNX0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7NEQxOUZBODEtMjM1Qy00QjEwLTlCMTAtQzU5QjQ1QzUxREZFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzYuMTUxIiBuZXh0dmVyc2lvbj0iMS4zLjMzLjE3IiBsYW5nPSIiIGJyYW5kPSJQUkZJIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI5NjgiLz48L2FwcD48L3JlcXVlc3Q-

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&appname=Google%20Chrome&needsadmin=True&brand=PRFI" /appargs "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&installerdata=%7B%22distribution%22%3A%7B%22do_not_launch_chrome%22%3Atrue%2C%22make_chrome_default%22%3Atrue%7D%2C%22first_run_tabs%22%3A%5B%22chrome%3A%2F%2Fwelcome%2Dwin10%22%2C%22https%3A%2F%2Fpiriform.com%22%2C%22https%3A%2F%2Fwww.google.com%22%5D%2C%22session%22%3A%7B%22restore_on_startup%22%3A4%2C%22startup_urls%22%3A%5B%22http%3A%2F%2Fwww.google.com%22%5D%7D%7D" /installsource otherinstallcmd /sessionid "{8FA83AE5-BF6B-4C3F-B674-E45448798363}" /silent

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc

C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\126.0.6478.62_chrome_installer.exe

"C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\126.0.6478.62_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\gui9589.tmp"

C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\gui9589.tmp"

C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=126.0.6478.62 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff623b746a8,0x7ff623b746b4,0x7ff623b746c0

C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1

C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{713B76EC-2349-4C45-A5BE-DD8AC0A4461F}\CR_982D6.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=126.0.6478.62 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff623b746a8,0x7ff623b746b4,0x7ff623b746c0

C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe

"C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe"

C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe

"C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMy4xNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjMzLjE3IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezhGQTgzQUU1LUJGNkItNEMzRi1CNjc0LUU0NTQ0ODc5ODM2M30iIHVzZXJpZD0ie0E2Qzk4MEU5LTBDQUEtNDM1QS1CRjA2LUY3QzFFNTg1QzEwNX0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7NzcxM0RBMkYtNjQwNi00ODkzLUIxNkEtMUNBRjA3MjgyNkQwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M0MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjYuMC42NDc4LjYyIiBsYW5nPSIiIGJyYW5kPSJQUkZJIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMiIgY29ob3J0PSIxOmd1L2kxOToiIGNvaG9ydG5hbWU9IlN0YWJsZSBJbnN0YWxscyAmYW1wOyBWZXJzaW9uIFBpbnMiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi9jaHJvbWUvaDZ5dTM3eDRpeHFtMzU3cHhxNmo3c2FpZmVfMTI2LjAuNjQ3OC42Mi8xMjYuMC42NDc4LjYyX2Nocm9tZV9pbnN0YWxsZXIuZXhlIiBkb3dubG9hZGVkPSIxMTA0NzUzMTIiIHRvdGFsPSIxMTA0NzUzMTIiIGRvd25sb2FkX3RpbWVfbXM9IjEzNDIyIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMjM1IiBkb3dubG9hZF90aW1lX21zPSIxNDE4OCIgZG93bmxvYWRlZD0iMTEwNDc1MzEyIiB0b3RhbD0iMTEwNDc1MzEyIiBpbnN0YWxsX3RpbWVfbXM9IjI4OTM3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.204.67:443 update.googleapis.com tcp
GB 216.58.204.67:443 update.googleapis.com tcp
BE 88.221.83.202:443 www.bing.com tcp
BE 88.221.83.202:443 www.bing.com tcp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 202.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 123.35.104.34.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
GB 216.58.204.67:443 update.googleapis.com tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsc40B3.tmp\System.dll

MD5 8e050192b6b98d8adfffc297e7d6ecaa
SHA1 bd1f7591c36a172caad81ef1b3ea51e998e1cce4
SHA256 4177e765eed3bba3794cd21b50779c097e8a943bc92c3621f2f51a85cef46def
SHA512 12d7694987fbb6aea59102a25498291ea0f8e44ac57ad2ac744199123534b8cb3c373b5fdeecc0e09f971db63f543bbb2809d24be29a0c03deaf4dfd5e463f33

C:\Program Files (x86)\Google\GoogleUpdateSetup.exe

MD5 53baee50f7a69bf3bc0fffe25341a923
SHA1 0b7998f5517ed4e7c5aeea3a89d73b60d2a2d102
SHA256 f91e258ea71dcbfc82371b2ee3e20852e45bef0cb946223d1141a6ef1dfb793f
SHA512 0eb28032849f775f604b7064a4f00f7d802c8c2fd5c7bc21b48298e6c3d316286963794b4c6c4981199c21f56b08d9aa466a470d40738d1b633b7feddc8e6241

C:\Program Files (x86)\GUM4100.tmp\GoogleUpdate.exe

MD5 92ee791a630830452485e8e375f8db35
SHA1 8c0d2a1cf79e9e34107e2e1aaafa818ecf1f6943
SHA256 542294724926b0e156224b9ebd33e6354d79da4c828fb52f7f4233df45e3f624
SHA512 73e04cb7cc96aab8fa20731e1a709f0623b0118ea4015976e5ff072ff6afb54f1c723e49a2dc93b040c07fd7137d9d453e39f17bc9a16bdafc85b6df1b2f1194

C:\Program Files (x86)\GUM4100.tmp\goopdate.dll

MD5 463a426da94fc2418a713ceebb799e22
SHA1 bbae2b098e49540c599f8b76a106ef4ab8e8dde2
SHA256 eaf6ede3cc4efb047cedad32a9b3c2a138ad872991e3bee4f66dd8fbe08133b2
SHA512 389aa2a2c2ea72bfea2a57b8ce37da03641c7e742bb96793115a0bb83ee603e337fd96e45f0fca21bf4e77d6cc0502c38363ebb45f398c433a517a0f413916fd

C:\Program Files (x86)\GUM4100.tmp\goopdateres_en.dll

MD5 9c2a3eec41cd4effd6ffecaa910dd7da
SHA1 451eadb82e288a6158ade6a827f00e0f213eb30b
SHA256 1f2a19782eb0eee7d0820987a233947ebbc33abc6cc234cb74ddfcac3f901165
SHA512 792e62a61411d87649294b655102082789b5affa5bfbfe01ce535ab7dcb1dde4e72e11165f44701363c517ec17e0caf76fbfcc26c23259d8a855a4658f59cb3f

C:\Program Files (x86)\GUM4100.tmp\GoogleUpdateCore.exe

MD5 678dd73ca364411bcf431892b8f878da
SHA1 844b9872addc3b1ea9548aef12d771211ab57e3d
SHA256 0853a5fb66ddb187947bf9a51789728b75e34885592f51c2bbbc583729b23e40
SHA512 19203598b47e076ec6c333023d63d005bf517e4698705e7d60e6818a76680c1f39a8920015c9cffbb7a8b4c93caa8fd3f9121282d39d0ea82944057b196e3b58

C:\Program Files (x86)\GUM4100.tmp\goopdateres_am.dll

MD5 e433408ca45786f9b6b7873709f57eba
SHA1 1b29247472993837bf5451651c698d9e3c78a7e7
SHA256 702b1f2b48041334b94e5529a27823518544fca6abd51f64c2d90c09685d3459
SHA512 5ece94dc54fc5127b554116f5e86645cdb564643893423b639683191902986655ae35f5fede0c6244ca1eb1a44dd5d2dfbe6be6f748f5d023a0b91de477b77cc

C:\Program Files (x86)\GUM4100.tmp\GoogleUpdateComRegisterShell64.exe

MD5 03b587bfaf6dd67b330ccb6fb99ca59a
SHA1 de0aefdc64b39783909b578bdc37dbabe5cf61c6
SHA256 bb1c60e4f365c2a13db9612dee6d46ce9b6a6bd42a9a7e650ba3b2e911957419
SHA512 724927ab7e81bab13703a0c5acfe28e5df1a75998d6997ab5a630f298b49f0ea28ce1405bdcd8a96f72a01689c1ebe6491c64860c83107584e8b06c0a9f4718f

C:\Program Files (x86)\GUM4100.tmp\GoogleCrashHandler64.exe

MD5 d2f56e366f1cb26866a6f43bd53b46c3
SHA1 a84063a7544d8031912d76a00a90dd058bc8d49c
SHA256 e881b1e5151886d85d4a690b3b41cb3e5dfbd24759b660c3554187f66a3c0825
SHA512 89892cdffdd5e78f80441b500a247c2e8b3bf073e8a8dbdf6519d4d4ef1c897cc38c69751f9b3752d018e7c104ea30394d44e20b5c1d3229d142449e947b644a

C:\Program Files (x86)\GUM4100.tmp\GoogleCrashHandler.exe

MD5 6c718849d436a7ccebed72538f8bd04b
SHA1 e8217efafc6a679eaa9fcd5e9c46e2975f60997e
SHA256 617def10fb5cd04434532e2803f07489a82494f76dc177e0ce7e8c70f66729c0
SHA512 f96617438c4703dc1df79a136dbee87187fbcba19f9ddb31900600652c335d65a39c2e5bcfeae08aa9243f4dc70d5561f0f3b56de98624bf6215e8855f5a786f

C:\Program Files (x86)\GUM4100.tmp\goopdateres_ca.dll

MD5 230fe7b526bde7aff33b616618a8d05a
SHA1 679acd3bba2d34297dd7009ca3cf9797e0dcae52
SHA256 411d01fa6bee8659ee2f7dc4975f33deaaead02d2f9c783e8adaf07a4a6333a1
SHA512 fee6792e41f0e564c9156e83c6dcfe8bccbcba66a3a972e88c0ea737b008ce5a0ac221f3b748a85ddec77d10ee0fe56956307be452d013be4e2879fae69e6916

C:\Program Files (x86)\GUM4100.tmp\goopdateres_de.dll

MD5 e5ea4068551b3ac782d955a699222067
SHA1 929d0babbe496b5383c03fd71f0f8844ce27800c
SHA256 e482ba26e04e59899c7140ab0f35d6ad233f5dfa001d0def9a29c131a731210b
SHA512 62008e055d27274ed37863ccf2b40c8b045a8ed1babeb676915b39938e2f4e55b69f6c1f65aca1223c612f0dc11a4d132f3fd066bd2dad63977cefeb286e5784

C:\Program Files (x86)\GUM4100.tmp\goopdateres_el.dll

MD5 68cf3b8fef6b56cd583e8c30ae8ca563
SHA1 598d3e4853aeeec4564829a061485a7b40d8e1c5
SHA256 0674cf0c9c0d30440ce548536a6f1b59f9250e4dc992c93249dabba34491a574
SHA512 13379e87d4c9a0f11d99247fba0ff1a6567851acd6782d68b2c9f3a7be779026afad89640ce8378ecbc6f33088c98f2b5f513d45b124daffa328a3722feb8fae

C:\Program Files (x86)\GUM4100.tmp\goopdateres_da.dll

MD5 b1bd2d1889f42f20aeac5f1998d8b21b
SHA1 cce15b2060bf80ea7e06056a9dcd43cf65739787
SHA256 21c36ff76333c7363bd62c76a136f841ae13a667691536e9bf3609e49abc6e27
SHA512 26f66bc5e2b065d41dede5377eacbe4cf8b61c3d0d40bbd7b2b1f2948ea8ef951ce07c00a8cf13bf157f0b383e1ad5704af94f71d71c8f550e826618ddbf42cd

C:\Program Files (x86)\GUM4100.tmp\goopdateres_cs.dll

MD5 9b598c6a4d3d9586f93feca20f51da70
SHA1 1290b07e2909a1fa4b9992581b3e36208a44354d
SHA256 4afb1aa42cbc501b28e2f5b27db2552ab3445d18134ae643812fde5bbebd8414
SHA512 d3c6d6d55e1d85b60351bc9405330fe6a82cef54f7b330169ff2687d9fb18cbac14382a029aaa9df19681a8c873f36fc57f5078c0822ae2679be9a3d261f548c

C:\Program Files (x86)\GUM4100.tmp\goopdateres_bn.dll

MD5 4a5e2fac15b93b43a2ee673e2e111478
SHA1 7091318dfcf74c571aaac04dd30b0c600128c4af
SHA256 9465122ddaf8298cc8560a55d28952b0098eb7236cdfe52f62509a528f44dd26
SHA512 17a0c2ca46f4a44e97ceb23c46a062487dcbc0c9442c7789eac419bc1be64674545a057cd8856842cf63efd961bc4cc9c29949d9f6797b6d1fafb1e13225da7b

C:\Program Files (x86)\GUM4100.tmp\goopdateres_bg.dll

MD5 f376765117f5b82123ec1f4fd352fb9c
SHA1 e24349888cc65382555e072cfa3f4ce970692d19
SHA256 709d7d08dffc672ef3053e29fd86e86413af60ab41a43959b4108538819a189e
SHA512 dc5a2a18e8710fa2b0dc182a856cee0fffcfc9fef8e380cf5ca4b4e3fe76827c14b7c9f0815aa75bb78adb512813b527ea95d4f8c59c256097f96c68d000adcd

C:\Program Files (x86)\GUM4100.tmp\goopdateres_ar.dll

MD5 9d85c8517de4db2380aa14593d8a899a
SHA1 0af85f47d293d8f08a8d484644289ba3e8a0094e
SHA256 b5e4b6bc7e821ec1c652557777e7f1a06156da6c411752e1e66f47e8b6bff3f5
SHA512 84bcdbcc6d953b0b03204d3356a79c80771f336638315c02f99bb21a1ef9c1211416b8bba1e9de60d2d418073320738ccca3827f4abc6eb09c5e2e02e8cc6d25

C:\Program Files (x86)\GUM4100.tmp\goopdateres_fil.dll

MD5 6cec555d88a69bdb910188c2b53b19a3
SHA1 7ef052c8fbbccb4f4948d3ccdb19bf90fcb685eb
SHA256 c7174cae6039a1dd4a7de2603d10d610650984ea2f1020d6ecf04364e789eb9f
SHA512 397779b0b465c21db2991865271d7ac2d55e112b0b10147ad3b4abdd684e2f3861f6bcb1aa468dba4bc72fc213719ea45424fc644c2812fc82227a9e875d32ea

C:\Program Files (x86)\GUM4100.tmp\goopdateres_fi.dll

MD5 81f8d0fbff693910fedc808047cdf156
SHA1 f4b7829d9d1b953352df626f65e16daca041170d
SHA256 1175be38d7adf1d26d7abae3704b488a4700e874149cbcab487e0343d26349ce
SHA512 f1865ba2f09fe6803fcce53f9e1b69011dcb575c8eeb7a88f4f6d5560f7cdc93c2d79d025cb2706ea7ebbe7253c30f7cebfc1a291e5311c6ba5b881a7d058a1e

C:\Program Files (x86)\GUM4100.tmp\goopdateres_fa.dll

MD5 1d688c7571f047a36b585d810e02067f
SHA1 ec30a90b036297baac9b4577c99862641ddc865b
SHA256 db059681f11fb56e46bb89f80330e02f95a09ebb30dd20c5f12156e92c0667c3
SHA512 2470a12d386f7611ea7b785bb0bf27f19a8ea013f5d2e751262e603e593c64e0d7a3d4e14bbe5e13a587097a3591d53b6eba8b65d07ca67c52f989c08525a492

C:\Program Files (x86)\GUM4100.tmp\goopdateres_et.dll

MD5 a2cb2c0b126c87336bc2b29a3e995dc5
SHA1 30a03a41622ab3038c792ca748eca9cb599d2d80
SHA256 6fcd31b49672cbca59062e90f36213fb99aef317fc1f12494e1715e5a591e891
SHA512 d387e7b1d86394c40371fe7b888a002ead956b7a8585ef6c9dec972195b2dfab3ac8aab9169948b0a705d54957399e2e03e3ae089b96603d0b849b23f447df58

C:\Program Files (x86)\GUM4100.tmp\goopdateres_es-419.dll

MD5 7c7c2b897c7107e910eab8b669c93738
SHA1 aaacb00f3641e3f369a3422022f746d9dadaa57d
SHA256 8a4acb09fb53d2846780f10bebdf95bb33eddc0dfcd18195be228b1211deb509
SHA512 cdb16c5ce0d42326554c30b799af7c50f92ca8283127c9e712321ab63ca5686dc98ad9df43a8c065a7cfb64d94ea1eec3295fdea4568750d66fc2cbec9edadda

C:\Program Files (x86)\GUM4100.tmp\goopdateres_es.dll

MD5 73ccbf92e13acc6389bb9f7dd04935b6
SHA1 23c81f83ab26aa3647601617e850e3f8c8240096
SHA256 6a060c7a90a95f2cab5e111ded3d4f618c10a200cfc7dd1a0e5be5fe35d66416
SHA512 60b5e67aacfc93cb8d2c04e02c69f21fa39e5db2b920d39e27e3168436a3e8b3d90245809938f301148d5d2b5b84093880541d410c10711b5df7e2ef3f18b687

C:\Program Files (x86)\GUM4100.tmp\goopdateres_en-GB.dll

MD5 2087af32c82c00e32094ae86dcf35607
SHA1 8ebd4a5467ffaed71641274e962dcb7a34d8fd7e
SHA256 86af29e76c77093b312b4ff20eb330ce9806d76afc69f754e5eea90425430cbc
SHA512 db4e0773dae02a6667780148d3b19aa38a3ea4751ff6d0ce7025f35a5ab50a4475e91b339521e07745f055f0461cf8b41ecdcd12bb08006d6060cf95c6d57bb8

C:\Program Files (x86)\GUM4100.tmp\goopdateres_fr.dll

MD5 598294ce0043943aa4cc04edc139e6c8
SHA1 d1015ab73b0a1bb09a190be72e32314517e5a99f
SHA256 78cde3ce8c755cf54f05103dcf4438bdeebe819573738678a8e8bb0850faceb2
SHA512 d9934b69879b79efb33b1bc8208b8862a603084fcd0d3effc18e3bf94b9f9d0bc9fb182234471275440a7eee78bfe701f4f1230bb0984cbdf2970f89d1e14853

C:\Program Files (x86)\GUM4100.tmp\goopdateres_hr.dll

MD5 de931037c2f487efa900aa6590cac9e0
SHA1 eb797b036f6923150a687d8654210a2750e6c0e2
SHA256 816e024e0485983f6820fa54b1cb037ef875b8a98dd3e2fe2a5ea0771d0ff67f
SHA512 dce357b45f738ae3582596bb1f0d6d41eaa4b968544840e242e29278026b1e947a1cffa71182b939e28e2b64d429aadb6bf60354a3667e4054ae650c5d1d6ca9

C:\Program Files (x86)\GUM4100.tmp\goopdateres_hi.dll

MD5 0a9a7354a95c559a4093f24fff784911
SHA1 6e918750b48a63171d1f896282621ea6d56d7448
SHA256 0ce08563cab2fd4050714d671b5d09b26e9b00dced01a1ccba031e301897b93f
SHA512 46b355e5890282098d02e86a2db0c8889fb10ec7cde320a060a4085d8ddf1f84b4f019757ac9100e69002bf8156bd603012fe7f5dd8987d60ec696ab1f8dfa46

C:\Program Files (x86)\GUM4100.tmp\goopdateres_gu.dll

MD5 7d3a8a7aec219fcbecacd04f1ad66053
SHA1 d4cde2992d3e675884a3156caf29b4674f729fec
SHA256 fd78649babc724f85e17e11d487d04812d83f70cd9fb45e2374360d779c8e5ab
SHA512 1bacd9f769f9a09393201dda2a5dd9a845cd43d8357b82f4a8f27413a5deafeb6ad37aa057954b7fec911158d9b3484e847e8238e9a4d7c3af359f1f5cc1369c

C:\Program Files (x86)\GUM4100.tmp\goopdateres_hu.dll

MD5 456664b46a1948b0df8785bd5b87f858
SHA1 52a031312d6fbc0380bdebbfcbf1400f19e8b189
SHA256 dffa27c56881121fe57701373ffb27dc754450d880fdd5ead0d34360a188d361
SHA512 d5f8303b494ced7c756bf2fdf4e866469e80268f3001a491ab41d806efcba264740d4538ac79b9ac57fdba205fea34fe3e610f2ed49998a50d36f91b6ceaa40c

C:\Program Files (x86)\GUM4100.tmp\goopdateres_it.dll

MD5 d002a3352574a6e6999a6f2c23566745
SHA1 917517d8f2d54fa45cc6d1fee66f7f118f298816
SHA256 fcbedf3497a065f616874e7d9868a0bc6c5a109ebeaa825a35a9c5ca92347e00
SHA512 451ce3563ab9438cae487046997c56ccc14549903488807fc13f4a9f6b43bfed869c5d72ff061afd616db86c322ca3775fd14ae0a87198ce53b420fe2ade262d

C:\Program Files (x86)\GUM4100.tmp\goopdateres_is.dll

MD5 5e609c7d0ab38fa244949da75da04a1b
SHA1 5d9109c889688eca32102d40368dd0632e507763
SHA256 077ed1a8fb7ccaea614a4c80df3d7e7b140a94d650b2d22c2e827d175b033217
SHA512 a2a4d4064a963e95fc12b6609abc63383ed1aacec2e70bc7613e7cadccb826c2c0d053f08f1c2f8ba4f1643785efe588c5b41ddfb16dfdcedce3e20d4b095491

C:\Program Files (x86)\GUM4100.tmp\goopdateres_id.dll

MD5 43a73db8674c025026ed4cad9359a574
SHA1 4069cf27827b01b41052d3d85ff4cdab455450de
SHA256 8b41b93852cd849aba5c5751280edc01292f7fa74c7803ee280e1ee65d05886b
SHA512 649068550f96f15c02faa7b8fc678d9c75b2a08912111747c8dadfd98c51f1ddab135587512318b7facd68201c2d6e8e171d60fe06656376b70e9ca60104d924

C:\Program Files (x86)\GUM4100.tmp\goopdateres_lt.dll

MD5 3b033e1092474acd6b7cfcf01a999d34
SHA1 ecaddbd1f5fb5f29a9889e0cd45b62bd79eecf01
SHA256 886ca5ed38effeca6c91a29356f1240ecf6f2904769aee5dc6641cf6f3ccb021
SHA512 2c59774ef32602dfeb59df6bd4aabe9349fb103b49361982c769fcc7a81281e56856a6ef470c7bd0bc7b6c4d4bbafc94751ac8299c2c153a83d979d10eaf55a6

C:\Program Files (x86)\GUM4100.tmp\goopdateres_ms.dll

MD5 225c45af996ebf983800025ea32f6c18
SHA1 427e9b872bb17653e8bbcbc1a0cf299a63b2c90f
SHA256 4f5777a81dd8ef79db086b9cb5a3bcc7915f85dc4e3bb3c437660bf68df1b679
SHA512 baba4b5a34fae2539468875f278e500c133fc15e6ec6e79c85f0676dff8d5d7ffdba27f61dbff3301079faeb0a2bf7b40b5e89aa6b9a96a5cb5e19e219029dc4

C:\Program Files (x86)\GUM4100.tmp\goopdateres_mr.dll

MD5 7c864e8d77ebe0bc8451ade4f67f68b3
SHA1 59b0403657f3225ec617123f48aa9d5359e0caad
SHA256 c567185abfac41c2f72c22de2ee26d0dd8704109dd90f2acc527a61c8693138f
SHA512 72b784e866a84f97d797136446bb856848660ba3c1986452e56cbed904f3c53f32daf22d1a23ba1feaa9afe0c7e2a54adc041ae3597f8c2cb70f62da42d3fdda

C:\Program Files (x86)\GUM4100.tmp\goopdateres_ml.dll

MD5 157bf7b8eca4bc66d5c7fb3e358d5c58
SHA1 2b96270e36d2309e48169616e834ce8afe60af1c
SHA256 18e7dbb973d11d9f3eed7fc7ba73364904547431ce6d527dfe23baf6e3135a08
SHA512 019bca95bd9253d843a980c7dd8080441ec138b9c518657c787c02d2fe652f4ddb5f2e7c120be72f595ea5ff1f8d2895e30c55ee4bc23f86907fab757e4dd93d

C:\Program Files (x86)\GUM4100.tmp\goopdateres_lv.dll

MD5 3b00a99d877881ba0fc786fdd8e3b426
SHA1 b060e4b772df2609b461ab02830e1c08f2d6e586
SHA256 5208f544888b471725e6347a40dc8639acac5ac8b530e848f7326d410fd0f4ca
SHA512 36868a69a9aa961cfe17520d021fb85b075eaa9c042b0403f899ee2c173a8c445c8259a563edee915b8c366a4f29d2a881785de36d593aa8f65155aacc90e71c

C:\Program Files (x86)\GUM4100.tmp\goopdateres_ko.dll

MD5 fb58fffc04f44137610caae567cfaf6a
SHA1 d8be7e77c2bbbe87eac884c2d0ce0bac7c71ca70
SHA256 42cd719344a6084b697ecdad10893064ca0806c2a248ef11689c3212da5969a8
SHA512 7ebeb07da85e8a7be2e46d255fbeeafe04de5e795467e5801cab07e7a98d4a08dbc41721feae0da419ce3eecdad7b647d4ec16e9b74277d2e238f9af57322eff

C:\Program Files (x86)\GUM4100.tmp\goopdateres_kn.dll

MD5 c6a1c2e334df66970a03b30539757f36
SHA1 82f3a4ae6135f33c0baa4f959edf275a030e9279
SHA256 fe3398258f7b32cf85c61a08e0bc90792fd111f0f30905457988c8bea5e98492
SHA512 30f086dfd594aaf444b7498e7eae9cb6ec2992d50c9c4da3914ab68f9fe85cf9907810a05d4eb69d8ce13d5ef9f6ca991c1b409d63aa489443e186dabf9279f1

C:\Program Files (x86)\GUM4100.tmp\goopdateres_no.dll

MD5 38651bcc330768d3e74763452a8e46e2
SHA1 5fff02b68bdecceb3055d001bc5bbfcfcf7cbcb8
SHA256 9ea9600d3febeb551daf4d522747b9417b97a95a3fe37e910011c232ceff1a64
SHA512 33b8bebaa098ae381cf33ed5edc6e61fb3748d4f0c809f2f9f7379bb634a863aaa1bef8c49b040f8c9d39aa5957cc3d66275e644bd4415d2fc793ea781455ab1

C:\Program Files (x86)\GUM4100.tmp\goopdateres_nl.dll

MD5 2b04cd187acac2019e13195a3cc53a31
SHA1 f24ddc0bfc589dc3ef0ff3dc6cbdea89090026f7
SHA256 f7cef610be3cbc64f6ade5f95696f726b96a70fa4d33a2a42843ab2799b0fade
SHA512 1e28948ebaada7648e9fc8fdb2fc2cd03574c976fdce959b2cba1b54f254b1d958b1d0828b5b7b4056e8a40caa3be714ac51c955edef6694ac9b497a13d56fbe

C:\Program Files (x86)\GUM4100.tmp\goopdateres_pl.dll

MD5 531e1fca96b1cc6dfbb74c2e96d990c7
SHA1 60e1fb8ec56803b908f14c0792d99f8d1bf673df
SHA256 454535103929b110baec377b339941038f5e29337456a4aa2f69812bdb13e3be
SHA512 537778ab481ab805cce3540871c666c3bc63f29e88e1486bec831f7be6f07f8316f38f1ec4a6587b4b95e1cdbdfba2705edefd1e09ad58996b4ca95f3619031b

C:\Program Files (x86)\GUM4100.tmp\goopdateres_ja.dll

MD5 b71ff4a60875f30db7e492d4806f0c92
SHA1 a51556aef5079e0f70a68ce876d1ffd846b16400
SHA256 a851b4abd2e152c9743bf84d292a662bee0fe8d4080e13a62ac482f44ce67b21
SHA512 03583121f93806f51f7375b292006f7234890eb1adc824c5d1de0faaad56ab5fec49a66e74c892e6eb74d1d937c41e0b3db070c000e1a5acfbe45b7d959c265b

C:\Program Files (x86)\GUM4100.tmp\goopdateres_iw.dll

MD5 ffef2d63908222cacee0e40c138d5986
SHA1 e096faa1be2fc4c75f48c2b340eae24217f2a8a3
SHA256 64b90c73bd24d247a3afbece81bd1c81b77ade6631dae71807b4b6fcb5c21da4
SHA512 f1225438d812b903a38d16887d960b9481baf0055e93b3b4d7336d9025c7fbca79f541f9af02ddf6785518661b74c4ab65ff82b54f92f85e3c2727103ef7a73b

C:\Program Files (x86)\GUM4100.tmp\goopdateres_pt-BR.dll

MD5 237642b8bddfe765e073a3aa6c29ca0a
SHA1 ac74db67559d95fcd00bf67c6af513eee699f1a5
SHA256 e0d80999557e6c9d227f96ab0a7e831c19ad50fa39a995b885eb13273cdd0f07
SHA512 50db6961d47a7da14cf13a890b6260e109b17b9edbe50be997ceb8d96003cd52158140a2cae032c6d4d4299ea054875ec3a39066bae26c8f3ad7fa08cc11fb29

C:\Program Files (x86)\GUM4100.tmp\goopdateres_sk.dll

MD5 6ffd62c9d080288bcc95816afd018048
SHA1 f916c75bc6c7551fa65c2bc70659151342ea8291
SHA256 1e55431ad423cae1cc7580f6de7ca6a8215f0392a8831a9b0cb94ba73640d54c
SHA512 9b338f0c21fbef09dade72636cd69a08dcbc5e46cb79f039155e8e13d93ac80726b7adea470e4dce54fb2ccff2d99270d3b6465470d1e219b39ec042ed99801d

C:\Program Files (x86)\GUM4100.tmp\goopdateres_ru.dll

MD5 774b5644ad40e4d3863d81a7d30d4fae
SHA1 9a8736b91ff2b8af5e1fc7afa7aab18ae6b60e3f
SHA256 aa30ebd6e3e7b932b4b31218745b22097d442da1842f6080e1c338d647b3873c
SHA512 43783a810b0b0e700bf9fc96ed8c34a7c8b2d2e55162968990de0344028e414899a6a00d71d9aa104a5946b7dab403c6af4cdf92108f5c1ac32265b35aa78448

C:\Program Files (x86)\GUM4100.tmp\goopdateres_sw.dll

MD5 2f111d7785bfcd6b4228df0cdf353407
SHA1 0a04b176cd3a46097e9bcaa448f3c0c44ea45c22
SHA256 016ebb34ac432a47d68d6d0493978c864cca6e6dcf54c8c426274a88ad4ab86d
SHA512 52cdaf4ebd904032fef43d6311078ef08d8010e727367e2b20a06056ec710476ff493145cbd8a599cd1c963ccfcf5950297a03f539ad99ccd2a60412eec663eb

C:\Program Files (x86)\GUM4100.tmp\goopdateres_sv.dll

MD5 e645c5eb4401b5e443a9744fc141b2f5
SHA1 db8fcd617d792b23e67f244d08180a819b58ed96
SHA256 e5ae2947b950d5340af1684c7cb3545724984e18b1c0fce8f02a4148847e56bb
SHA512 6b0a7193dabd04fdbc9e8d8d78dbf2930438c5cf0352093002fa83e656a3a34b4e177845a7345a59b1b659393395088b1b06610e2f206113cc2545c90407d37d

C:\Program Files (x86)\GUM4100.tmp\goopdateres_sr.dll

MD5 25bbd03fc02f7daa9168dce7dfaef624
SHA1 b4d7e5206fbd0de543f46dfddb11f79d0df0dd1e
SHA256 5c1fe4d8dc0bbfdda7e399f2229ad6bf0caef291eb25ba43f1b436ec2eb22166
SHA512 c0ea8b7d4a463e373d044181c6c5f20665cda2644f8de304e46b878ee0485f0873ebc3699b08cdc544aac16b67357bdcde1060796085c5aff60de2ae1e31d14a

C:\Program Files (x86)\GUM4100.tmp\goopdateres_sl.dll

MD5 d7b41237faca93b3d0666e4fd38092b8
SHA1 e5b451241357aa1ff19c32119cd03d3dde41184a
SHA256 805770f94a3a02b3ea10364f1024ae2397449f0a681c71dfe4c517b85063e441
SHA512 af63c1fd8f2710ad9999474ba91b197003f7845dd36b1ab4ed4ebaab4367f32d15f6adf4a47b74b48c2cbe481151b91b5f94fc063de68bde59a1987aca2786bc

C:\Program Files (x86)\GUM4100.tmp\goopdateres_ro.dll

MD5 ea1ef744fb8ba02148b362adeac70952
SHA1 a911f11aa39edee054c88b89501cffea35bdf873
SHA256 00288fb45728a960a02040e339003bed334da5945951f45b9b4711dc885d015a
SHA512 899227266c54a69b6a1a0283c0c603fdb12623da02456c4178db44210c5186e5a5a4d7c4728be6ffd66fe5b333b6a7629167b76f162ffaa631712b56201afa39

C:\Program Files (x86)\GUM4100.tmp\goopdateres_pt-PT.dll

MD5 298f4f2bd4e7b962615bcf0ed3d673ca
SHA1 7479ffb24e63e09d440030fe5b8caa75e75a3169
SHA256 67a711907649fb0aa1866732286d0e382573558fce2c376cdb1a49329bd62e28
SHA512 40da45e14061f21d800c02e4edf980790615c226cbf45cf1988f57f89f94a7e8875a35e191cc36a018c049a7a67fcb7cce1999e2971e6ef3828588cd028abae3

C:\Program Files (x86)\GUM4100.tmp\goopdateres_te.dll

MD5 2f40316ac456b383c58be478daf69ce9
SHA1 01c07b362667e8525193d8fa2d689391033e5411
SHA256 2e8a3fa40ee1a9e7286938e85bdc142ec27652362d37ed5a5244ee9dbeb5221f
SHA512 a49644cffb638f500c173f9850ffe0d38a67171cc2f798c0f6e55fbc39c892fcd68118b29861a2053ce2edb4dbd950e60287a3790009fb36c79a2a5821fb9111

C:\Program Files (x86)\GUM4100.tmp\goopdateres_tr.dll

MD5 811ac46d616f94ae885175863e0ce95d
SHA1 737112f05fa7623bf92a03aa7599a42a34bb14a6
SHA256 d9c2721c9c31a3751c8bf15b3d045835b6c02013c87fbedb689d41b007fd6e30
SHA512 ec6b1f79bbf681d660fbb4b8b64fbd406707d0337ea10b95ae3182ca99cad0dfdb3258dd62bb4480ce5bff115db6e96b8232dc619243ab335f156b2326226147

C:\Program Files (x86)\GUM4100.tmp\goopdateres_ur.dll

MD5 3edc8f630a94d57674097194540a9f6a
SHA1 8a4e4ddc397225795953765c2d7ca964fe11853e
SHA256 6cb52423494321cacd6a6a4f4d8be9ef627c32c39e971555e1579ebdbac3463e
SHA512 c2b760b3d8e9c2094a5c412c11e78a779bf74a6de337e36a3e39dd68dddb084341c9ef9fc40e60c6cb491dc4f71aa4cafd09a27b24d0229f0d9842b775edbdba

C:\Program Files (x86)\GUM4100.tmp\goopdateres_uk.dll

MD5 23725511dd277f08993bbfbaf27123c1
SHA1 97f184f76abb501e052a0e99713f35a265cf1910
SHA256 87c946b16ee96c3051ac9c5beda67cac2b371c760eb1d5cca4c1928bc40bce50
SHA512 191720d736d8af46fe1062f4b60c9139825e8535b19f87f1276caca59cafd2eb81addd193debd42735e4307b84148bbb4fb4ab9a5434d80904b6579b90f11b8d

C:\Program Files (x86)\GUM4100.tmp\goopdateres_th.dll

MD5 cdc5e8fdba12f79c056bcf3085335ac5
SHA1 e074d1183e670d88a15d458dc685b12285d2a9d1
SHA256 024d8cacfb70b5adeb12cc9f8aa6490c127b6fa1aaac0925ee1a7a664238bfec
SHA512 032adfa4fe7e25f52e313bda3ac6c277182ed6ba431771aca2c5c4be78d5bcd360e3df437d4c4b5f003f31d9d74ae28e5b2fd1ad41b3f9017b6c54dec57ce727

C:\Program Files (x86)\GUM4100.tmp\goopdateres_ta.dll

MD5 8bb63ae799037b02a89c42408abf755a
SHA1 88f62e141a5074319f547c79be6b36531268cf40
SHA256 1d8ca36c54857407b364649dd916b42118785e0febab8762b506abd4adfdcffb
SHA512 b45f8f2ea03a1f1602c9f2b8f3fa64eb8bc0f67c28c13bdc8e31dc0f3c8beecaa46100ffe6d329702a28396bf2038ae3d2938823585658200ee2dc7e1ad31212

memory/1028-314-0x0000000000400000-0x0000000000447000-memory.dmp

memory/1028-315-0x000000006E5C0000-0x000000006E5CD000-memory.dmp

C:\Program Files\Google\Chrome\Application\126.0.6478.62\Installer\setup.exe

MD5 33a9ee74a3571ec0d75fa46bbb8434e8
SHA1 f2354d603c692783f6e720890edbd72711a83a8f
SHA256 27f07efb3517c821ad9075490f8926f448b1f21442e5b43180e6ce47bd402d39
SHA512 a5f5f050e7225ef720eafd9605a3abb97a49f35ad39641dc16842e62d3e75b158d3140fc38dc49f461828bf0d36c406593b18b1a0a112845ccdd358c4d6c5f53

memory/1028-372-0x0000000000400000-0x0000000000447000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240508-en

Max time kernel

143s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Users\Admin\AppData\Local\Temp\a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1320,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 analytics.ff.avast.com udp
US 8.8.8.8:53 ipm-provider.ff.avast.com udp

Files

C:\Users\Admin\AppData\Local\Temp\nsoE9A6.tmp\System.dll

MD5 41a3c964232edd2d7d5edea53e8245cd
SHA1 76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206
SHA256 8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5
SHA512 fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

C:\Users\Admin\AppData\Local\Temp\nsoE9A6.tmp\UserInfo.dll

MD5 c1f778a6d65178d34bde4206161a98e0
SHA1 29719fffef1ab6fe2df47e5ed258a5e3b3a11cfc
SHA256 9caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87
SHA512 9c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d

C:\Users\Admin\AppData\Local\Temp\nsoE9A6.tmp\p\pfBL.dll

MD5 6f7e7f72f9a53c48dffdd70dfec4f88c
SHA1 655d4791f4bffe14dbaf68b5bb8270e93fadbef7
SHA256 22abd21cd2fe21133ec7329a71effe4d4b3181661f1e5cc5e269434c91b0a7b4
SHA512 af0a9e6d0568ae388c93dc33660b1968390fa69ec796079b340a17ec6b7dfa06b70f537c18d6db61784d71f4feec13ac93fcd9735a49635f7689ab206cd43827

C:\Users\Admin\AppData\Local\Temp\nsoE9A6.tmp\g\gtapi_signed.dll

MD5 61bc40d1fad9e0faa9a07219b90ba0e4
SHA1 5b5c3badedba915707000d2047eaf13f27b8925e
SHA256 89e157a4f61d7d18180cb7f901c0095da3b7a5cc5a9fd58d710099e5f0ee505a
SHA512 fa341aa975c471082b4b6c380f794d1e9ab3939382972cfb9e1dbb3491f68296ad1cedc8f03736921c8e133f62432997de29642e223c2a97f1cab5ce91d68af9

C:\Users\Admin\AppData\Local\Temp\nsoE9A6.tmp\g\gcapi_dll.dll

MD5 2973af8515effd0a3bfc7a43b03b3fcc
SHA1 4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee
SHA256 d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0
SHA512 b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

C:\Users\Admin\AppData\Local\Temp\nsoE9A6.tmp\a\asdk.dll

MD5 5b4a90d8d2c61f0e6fe2ffef347696e9
SHA1 23a45252deeba6f0faff3e8a17d503d1ccc42009
SHA256 89a90ef4e7db39e6c89f37527c66ca3ba14eee3ac3dc4fb40aae347fb2ed98b1
SHA512 accbd10c1d7698c19db170ec0e42a955a71e9a6b3286307778969d581f6f1f27c6825d73caf8e9ec8e93208115659c1522a69923ac47ea9603b907f4843ae166

C:\Users\Admin\AppData\Local\Temp\nsoE9A6.tmp\ui\pfUI.dll

MD5 fb812a42fe0f4a54918fabf21b66f29a
SHA1 3e7d2434f5d62df838c15c4c4c0382a58f2b1819
SHA256 54d26ce44c6c5482ede4d3d64b02f2c8fbd58cb51d9be50fc3889bc3769ae2a0
SHA512 2950a32d38dea4465bc8949a6b39bba1854cb04e3b79164ef0e55c54510d60cf2aa24161b9fe256a6fb4b27bb5b1ea61110442a712681cc7d51630ae66f7666a

C:\Users\Admin\AppData\Local\Temp\nsoE9A6.tmp\nsDialogs.dll

MD5 2aba8f16eca82517460013a3de7cbf67
SHA1 3812192fa7b873f426c4b0d0d822b3c9d51aa164
SHA256 60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d
SHA512 4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

C:\Users\Admin\AppData\Local\Temp\nsoE9A6.tmp\ui\res\PF_computer.png

MD5 7f4f45c9393a0664d9d0725a2ff42c6b
SHA1 b7b30eb534e6dc69e8e293443c157134569e8ce7
SHA256 dbd8b6fdb66604a0a5e8efe269fbfa598e4a94dc146006036409d905209da42b
SHA512 0c27f9ce615cbff3e17fd772ce3929ab4419d7432d96223b7eec1ba70953f2ac993404b954020247b52d7f7499212d44eb6f85da2e2676773cafe1ce89b390f9

C:\Users\Admin\AppData\Local\Temp\nsoE9A6.tmp\ui\res\PF_logo.png

MD5 079cca30760cca3c01863b6b96e87848
SHA1 98c2ca01f248bc61817db7e5faea4a3d8310db50
SHA256 8dd37d3721e25c32c5bf878b6dba9e61d04b7ce8aec45bdf703a41bc41802dfa
SHA512 3e25c10e3a5830584c608b9178ab062e93e0e9009a7d897bb5e3561180b0b0910bd4178063d982eb33806a005c93931ae2ec5be520ec0d0c9a7c452cb78fd6a8

C:\Users\Admin\AppData\Local\Temp\nsoE9A6.tmp\ui\res\CC_logo_72x66.png

MD5 a736159759a56c29575e49cb2a51f2b3
SHA1 b1594bbca4358886d25c3a1bc662d87c913318cb
SHA256 58e75de1789c90333daaf93176194d2a3d64f2eecdf57a4b9384a229e81f874f
SHA512 4da523a36375b37fa7bc4b4ccf7c93e1df7b2da15152edf7d419927aa1bb271ef8ba27fe734d2f623fcc02b47319e75333df014bed01eb466e0cd9ec4111ef53

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240611-en

Max time kernel

124s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Toolbar-2016.exe"

Signatures

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_es-419.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_fa.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_gu.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_ko.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_nl.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_sw.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_en.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_ja.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_pt-BR.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_sr.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_zh-TW.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_es.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_ca.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_it.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_lt.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_pl.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_sk.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\psuser.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_ar.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_bg.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_da.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_ml.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_no.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_pt-PT.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_sv.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdate.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_bn.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_zh-CN.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\psmachine.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_id.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_sl.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\GoogleUpdateHelper.msi C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\npGoogleUpdate3.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_tr.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_te.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_iw.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_kn.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_mr.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_th.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_en-GB.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_cs.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_fi.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_fr.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_ro.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_hr.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_hu.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_ms.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_ta.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_hi.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_ur.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_am.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_de.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_fil.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_ru.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File opened for modification C:\Program Files (x86)\GUTE4B4.tmp C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_is.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_lv.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
File created C:\Program Files (x86)\GUME4B3.tmp\goopdateres_et.dll C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe N/A
N/A N/A C:\Program Files (x86)\GUME4B3.tmp\GoogleUpdate.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files (x86)\GUME4B3.tmp\GoogleUpdate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Toolbar-2016.exe

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Toolbar-2016.exe"

C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe

C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe /silent /install "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&appname=Google%20Toolbar&needsadmin=True&brand=PRFJ&usagestats=0" /appargs "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&installerdata=d%3Dask%26h%3Dask2"

C:\Program Files (x86)\GUME4B3.tmp\GoogleUpdate.exe

"C:\Program Files (x86)\GUME4B3.tmp\GoogleUpdate.exe" /silent /install "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&appname=Google%20Toolbar&needsadmin=True&brand=PRFJ&usagestats=0" /appargs "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&installerdata=d%3Dask%26h%3Dask2"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4084,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 88.221.83.210:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 210.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 tools.google.com udp
GB 172.217.169.46:80 tools.google.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 46.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 131.83.221.88.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nshE456.tmp\System.dll

MD5 301a9c8739ed3ed955a1bdc472d26f32
SHA1 a830ab9ae6e8d046b7ab2611bea7a0a681f29a43
SHA256 6ec9fde89f067b1807325b05089c3ae4822ce7640d78e6f32dbe52f582de1d92
SHA512 41d88489ecb5ec64191493a1ed2ed7095678955d9fa72cccea2ae76dd794e62e7b5bd3aa2c313fb4bdf41c2f89f29e4cafe43d564ecad80fce1bf0a240b1e094

C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_1.3.21.169.exe

MD5 7abad5635830cb8af3ea5b88e76f728d
SHA1 7809cb7c62fb6c95e7dd244bc480f3f93e695a25
SHA256 27785c7b3825d73149794527a8be2dbdedd737ad3d47ecc6eb30be7546c1bdff
SHA512 09c3e2b4726974db4ffd46c58f7177a52fcea2c85a8a22196555cfeefda7c6f4cb453de196f919a1e2ca2441379a36a9b40bb3d70d64c4148c31b58d0ce50be3

C:\Program Files (x86)\GUME4B3.tmp\GoogleUpdate.exe

MD5 506708142bc63daba64f2d3ad1dcd5bf
SHA1 d30e8c7543adbc801d675068530b57d75cabb13f
SHA256 9c36a08d9e7932ff4da7b5f24e6b42c92f28685b8abe964c870e8d7670fd531a
SHA512 a6e16f0de64b1500fbb2c7974a5efd40e8768b6c133f8ef367725a5c82b3b38c300dd65fa159b4a5f15413b0843a1e37416550ec89749ec1cf5cfae73dcc01ab

C:\Program Files (x86)\GUME4B3.tmp\goopdate.dll

MD5 44a7beb360488d6595de0ec0c6e8248b
SHA1 ff424defecead2e1ceb7762a78366cb7c424b9b2
SHA256 934bced969e0f50ed647289e8469308a54d8dc5a6ab5c81c66f5899798564d76
SHA512 f06a153d03444151983ac5932dde05a6f9de2093001ee3588f4abeba1b0564c407c163b705a8f24c2501e26b4860eb92f17f2de0a7b0893f6b6f9b00950f4105

C:\Program Files (x86)\GUME4B3.tmp\goopdateres_en.dll

MD5 8f324a0dac8e8d61faff2cde53eb4af0
SHA1 d0573eae2aa53b3fc0e584126b457a618002feb7
SHA256 f8f90894b9f942d4453dc3c532784f9ee301611726f7ca08bd71fa6f339267ca
SHA512 1ccfb6211b6936b2f51a5a5d3a25eccc31466a64a316aba00faead3b77e59083a5ab190bc6fd77e14c57c4ceedfd5a1bb2d3816fe9af7ac9a336ab46f57f8f91

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ButtonEvent.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3952 wrote to memory of 740 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3952 wrote to memory of 740 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3952 wrote to memory of 740 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ButtonEvent.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ButtonEvent.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 740 -ip 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 88.221.83.203:443 www.bing.com tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 131.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 203.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 129.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 24.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3496 wrote to memory of 3436 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3496 wrote to memory of 3436 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3496 wrote to memory of 3436 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3436 -ip 3436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 612

Network

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240221-en

Max time kernel

133s

Max time network

129s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1026.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{737D80D1-2A39-11EF-A293-4AADDC6219DF} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205d0e4846beda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000083d4f74db6a7064c917d107b5826538300000000020000000000106600000001000020000000e84ba2a5dfba749c549162f074f8b45fb3fd1594afe613082c2cae52b160e3bb000000000e8000000002000020000000bbc9bb225d62fc8f3acf1beb28105eafb127d987d35fa9bf777c3809a95259c320000000cc8679dddd4585c7673c64d55ba8891d253a6a39a99f29e86f14564a3c62ea2d40000000ad35438c7511fc9dff85371c78697b7c2e414875663fcdcd97f417c7b81e7d5875d8e092ecdf4590adaee573fe59252156a81d91238362564d1a0b513a2db517 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000083d4f74db6a7064c917d107b58265383000000000200000000001066000000010000200000000e7a8ae1259c7e7736cd168c22e50a1b283418f3d1ec1055bb0f1e048aed1af3000000000e8000000002000020000000759c9853ac5fd9a2e4e502908b2661a860000e5ea889defe8a41ec929481886490000000094fc9fc681a0e3983165d993c4e5df68582d490614f7d5019bd548504c89f6b7ed1d95ee003a5845961ad3f496b91595ec394bc1dee8e41d1c98482092ca8e487bbb455391bbdf0ca56a7417134f46ac7866b9c959c47573cb23ef0c39c094f4cd57252a8e345b6ed4fc0bd908cc9951abe8de890146375d3abed737a5ccf19e76f5cebf971c04ee486c4907707ef664000000038d853b10a6883cb3aa962626c32eabb1916dadc6e11fbf034516ed2adedb5ef52d1bf7d94bed42bc8cb42462ba6d90103bc5f270bd3422b97e5fec611f5fe6a C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424523038" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1026.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab30E3.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar31E4.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f59751d152994dc3fe99f6fb67107639
SHA1 482e8f0500e6fbed9e372f6fffcdba9377c844de
SHA256 c77583c4d39fbf9c9266455f73f93567552390c0b513c37a54851edfbf248e26
SHA512 a97840be496906aacb7d3df680289b4d553e5f8e0fbebabaa2feaec621c2d86904f2a85d7d234c0d86e3ebb8c27b64c6e6fd89cfc8275ca633b29ca073bfe412

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 befb72bf61c755a482f89287b356034f
SHA1 1dfc744311d22f8e2cfd0f749f6a7818aa59c691
SHA256 93e79fd23a594fddce2a0a1ebd83645c5eb5c95a1af1d753b85fa64435d3297f
SHA512 bae1b576c210cb3eb34ddb9e41af59cab8f4b0c99c1bbd7cd870fa1740e618e58377cb5b252e2695fa126d1cfd0c280a5635bd91c1bfb6450869deda38b3bafe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0fb00039a24d9b360864dbcfc2de441e
SHA1 b7e180dd0453718758089e29fa9776f3f560cd86
SHA256 9a6d63a7427bea1761b7d0a98d4527ec3d79f2138e01d42306058e54e23a3cb5
SHA512 0a193e0120d965a9324aad3e94f3d032289c97f752b97c2171dfb1ba7bad2de4a2977d4b552dde4c1fa4305ab6aab7b71deff8c051a98d68c255dd029b60f43c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 198cc644bcaff24e61a787f96024d805
SHA1 0a919946a83577d695edc0c57784506f73a8379e
SHA256 7e5cd1def0425395df7d77c40a2655e65288572b1e3d66cfd03a57d61fe84fe5
SHA512 7fed447d24924daf805d4d70008036038b812e0fdc5088cfe3bbef9c1bc5b5c63ff465c38c7c2b8cdf7520ef337e8154219b1d3ffff50bba6c903b82c0e0248e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9d79274b969d5b1c9ba661d4d62dd529
SHA1 fdce18f8efcdd56591f6348c9986ec92cf3068a5
SHA256 9022b1373406c4be6b12fff607534bf39ff7bea9107d62c775e3d476bfda8589
SHA512 22f9e235a59a231debb2c0eabeec66f74d36fb5e09ce29edc256f4e5e0b0b9f4a8b8d81ed886276936bc7e913eaadf994cf98a588819981fab5d5e7bf0457fc8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 52152912202f274a0edfc777ff71db41
SHA1 d7a26c79263aa72f5bc704da304f4bcf7ee8cbee
SHA256 809b218f1073da51f6f81878b4fbc1c5a95bc6d1a5c57dc840f88db90738fbb3
SHA512 2307b8a8e36e9554752493b2efceae1015f612b892393844404fddb7c04c8fd452556de91d5250158542d781c0d76c45529134a42fcb92df27d510a0c8e78c50

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ac381a6fb2486048158e9fac534b12c2
SHA1 271391d24b4f649c2e7695af805aabd6fb72a077
SHA256 4970a45dfc0e7d51c4acec9b3e5dbfd7a6ac1b91558861abc9466478dff8fce5
SHA512 7cbd9864737a00885147ec7f013cc3f36c8e15a3fb1522f297694f37475cfc8a4561591b29d1d485b2f927c11d50c2e3c5b09c5179ca0f987f0ae30af9431330

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b3aa66132868103a5871faf4ceae26ff
SHA1 ef2134213ca8164123e6b38e62acad96653e3343
SHA256 a4b1ea82aca59501b6ad7633e1f94aa6b194244681003d2437b2406e9c707b3d
SHA512 68532dc4288232fd34031a4d967ff2e4f155216288ab511e5fd295a741e4afc84fe69741e042caed48f416dc7ffafbd76e986b1872ca2d59fdc976cc2a2df792

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1b6f7353ae7a74291fdb19f8b7314bf7
SHA1 d780efd20f853acd18ca096f891b78aa795ace12
SHA256 80cb7a4c9b406ee625fac9438826f98e43abbd1cc3c70573094ce2c18b585559
SHA512 a00ba4e1f8fdcade4a6d071b7c3b434bf011ab2fcc329b3ef2c17729c18c8b44f5b1ad33a927a5fb79b150ab0e2b2e0f984b7ec6b4b0297db8789163bc93fd2d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bbfef135320e40f874909b384f051f96
SHA1 4ee49e85d5e5023520f48ecdcd174e80863dfd31
SHA256 ae4fcc72edf6a6a62202e40bac5311f92f11ef664e87003d647f852a11377e53
SHA512 5ac154fbe0009d3cc7fcafe53f899eb99b7c081d4d4be8f2f9b5c6459ad59e03d31411ba2e4f60b681ec211a32fb2e4a630fc1a18fd00c200d1424c2b795ab81

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1b6187465a42e21321daed81d0347042
SHA1 380a5855f9de8c89de3cc4b9ab2305344b5edb3d
SHA256 31f2a8d33db62d3866254a3c95f06f644f84dac6ced7c05d8b06824a670a523d
SHA512 31243e7628c88bad27c8c9489159976642bf00ba333effd2b1a6df11022813798007a1cbc0291a578374140a3e7939b40e8287557d7f6d21ff65c08f6be8e31b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7ed79fe5fbfdc25db84036b6bea968e4
SHA1 af5d3dc89e9ad414390a19c0651342a5f98dba0a
SHA256 44e226b179cd1d63a989d88b2181d779885c979f054626c27ff76232bb023316
SHA512 39b52303aefa8f8c458278ccb5a6cb0a91eaaf7efc628e90a07cccb461c38af86be154f04c480b4c4f60483b702ecf9c813ddfd9e430117f573b48171f61d0f8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d4b6c5ce775d86df59c69996fee1bde6
SHA1 417b52b280f687a8d2b0b2149ef2807d4016a256
SHA256 664500d3e5843a573032751a6105e28375c88f212d20f52a87e8648a78623440
SHA512 dbfcd416ccfed4312e8724b6c56b622a66d1930547e9ccd3aa1f7d76b034ca18d941feea90f74e327dde29eae2a286fd051dd6dd18d01eee6f0a072408bf5cbf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d0e2de902fe72bcbdc2230bcfe7a5c3c
SHA1 da2f857892b70d23dae7622685df06e2fdeeaa20
SHA256 0f321ac4453b53dd7e335f28058158e73d4a3fcdea6d2c07be0fb0ccc973e2eb
SHA512 53444d475aedc0b86f11571cef8b23b8d11045537f5b5f53589354653b5a761451faef4eb09a802210284fa889a064ac6e449f6058e07a35a38cfdb0ffc591ec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 62170fa858026cba8d9ae7cd161fc86a
SHA1 ebbd9d5d8dc796935f03868e68c565519f51b526
SHA256 602c290e7c08695da48762e5859a3320bac590b8a79a7a86c70d6656651eb74d
SHA512 9442edbb4076be85adebdb065d05c550c33c481f1197f9cffb762a975c0f57527d99ff84a778f7a6be88f0592948d5aebee04c761a12c0b6954d99366b1a69d4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6c7a2f99d640c052a955499c69a822da
SHA1 ceee26649ffb70ffc5a1dd959d8ef8220405cdf3
SHA256 ee3de810df04fd742a79433f382d95d95ee20be032c96d96a7af78c05e447092
SHA512 d117f15c61ac42abc94f80d36ae596af73a926cd0ca72d15309eeb12340b4dd2c8b3c20ee8c4cd121561ef83e40c8c3ae4036b202e45f0c81a8e0cc96f9e20cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e2fd2439025d691441303d6be2e297a9
SHA1 7a6f95e4592e5b3ac69238527aaf7c9ebdf83e0a
SHA256 c163d72f6671cb093ee7a0867a828df71694d75c54af31f9b85378a4e9a03818
SHA512 404703e6a58bdf8b7d34f5ba9c067159d45ad92fcdaae48dacd0a8e62f9b2fee0d27250db08d9a7beb492bdd550dd4c2a7a8a8d04ff4f538bd7b51f9bc22ae1f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0217cfc74e32a8e4803ba32544212091
SHA1 9d83000c3ab4d35866d8d5c3b1881a11ba22a846
SHA256 3a8ffef16ae5087bcda6fd106cc6ad2d223ba1ab3253da52a45d3ec687ad6a18
SHA512 575744b14d02c308136c4ffd9f0a2af41d763dc981c938f827e668ae7b8b69bdf7b15df1eaeeac5cc8c1424f0892b1cfbbc84e581643d9318ffb9a0072fa5eab

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c925d9297b6ff68dc0436ba3f012e4af
SHA1 82f22afa051aa49c3a70f3f2763e817655d19609
SHA256 5e802b4f3f01046378af27e0186d4619e00c40c07a0b0c91d1c88d6e170e48cc
SHA512 94ef6cdef2997db90bdee51e17f11e0679d958d6391c4d3d8d189732f7ab21a0fa97687c47aecd3fac2def66082e228d49b2d4d53f95485c07c28884342973e6

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

129s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1026.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3608 wrote to memory of 5072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 5072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 2572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 2572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3608 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1026.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb884446f8,0x7ffb88444708,0x7ffb88444718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,59555611308284457,10274910226868115006,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,59555611308284457,10274910226868115006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,59555611308284457,10274910226868115006,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,59555611308284457,10274910226868115006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,59555611308284457,10274910226868115006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,59555611308284457,10274910226868115006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,59555611308284457,10274910226868115006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,59555611308284457,10274910226868115006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,59555611308284457,10274910226868115006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,59555611308284457,10274910226868115006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,59555611308284457,10274910226868115006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,59555611308284457,10274910226868115006,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4968 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
N/A 224.0.0.251:5353 udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

\??\pipe\LOCAL\crashpad_3608_PJUDCUWPDWFNMTBY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ac9f417bc6e87b55a74f72e726a5dc83
SHA1 be347e706b681a1225fb2c91a7b8d6829b868ec4
SHA256 60b23a7c51c705a839c1a360635300618d84cfcbe5be440f7f7d9791a73a9f28
SHA512 563445cde25b634d4b018df4358cc2d71c8e207f36ed9ec977bb354fc7e65ba93d131e146fdf8deff798b5ee243d2764541fa2aafb6153dd9df3efc7e056e572

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c6112b7576c9f33b86e4394d06ad4979
SHA1 8e50bceaa5e823f06ef11b33bd9d09f3b3f8217b
SHA256 0a64daade7dda5484277c6b7309bd080133f91ad7ffa522ec76e2982e82a4461
SHA512 691b4cb9c5eca9eb5a97b837ca6fa12217502d74da58a61487df8e600ea098c275a01de720c9d7bcfcc2604125e9026eec90c5b5ca2bcc3ea260029d3bb360ca

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d7016339bd4a01dc66515ed37b8a3c74
SHA1 481ae3f20d0ffc4c5b16db8c3a60512204d196c1
SHA256 9f69fdc95d30bceb66c237e007cbc363d07cec3b08fb02b2d0d44c20859a9f9f
SHA512 a37260db59ac28396d669837e5901fac4ef5d1f3025f6ddd55b1395b2f8a8d9d7038318a771190dc1cded476cdf7f8d2bec9953092c83780598698e59aefcb73

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240611-en

Max time kernel

134s

Max time network

128s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1027.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73F65281-2A39-11EF-A381-7EE57A38E3C7} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424523039" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000006cba331100a282d2695c40fe62ed9eb7ac1ddf79a6f0282c708857294fe0e7f2000000000e800000000200002000000035167c98606facb348c1bae44136e054a70f35589d90fc661511bf7632dcd064900000004fd6b5f6bfc0fb3bb6ef126de07b6bc412ebc44c183bfeb79dc090f0d27fd7fbebca2dfc1e2054497698541bc9daf244e8b3fd3219c3b4bf6a9c9e024bc2024fa0d4a4a99aee26fc526d588d8cbf137a597a1f184460637201cb371420d00b7480f21d9549bb284f382fe68e7a1a55b4c889e821ae9e909aeb71fe91568c6c820f75e9bf5f5ef59015b622df06a0086040000000871bfc8f574bf5d1657efc8a69ecc63b14f35956d3bc4090f6033b0899ea4f6bd961c159a11694068d4a328829cd7e3666cdee43e7c227bf2fa7317279b85a06 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000edd3f8dd02e972a1ddd7d3005434f920950f4a18d3b77859db559815f4f68458000000000e8000000002000020000000a27406bd7919af631064a63919208f0689ea2441311ecc8e39643940ea18dba1200000008f263ccf02aee88729bb6e3772468ac48cf531cda0edaa69f6a79fc028d10ce440000000962d29c8ea44c58ab542695073da43e1c0af66cdd4b2f24ded2dc875a7927b1e9edb110d645c6604f0bd3498dd0b65bd4cba94823891fb310a2b8455f9e9d2c2 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c0744846beda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1027.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1572 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab408A.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar411C.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2d115418b3b69abee0fa413f52057bf9
SHA1 d6fb40f903b5351192fbea90a535aeb09fda4664
SHA256 e5cdfef8c1aae69ae19a5808a1fb953bb01cdb68024423426c4e08714ab8f285
SHA512 3d50beb28a7bb5fb01bddf3b84ad55a81f1a6a7af54bf80d609f54b2bd537430a3aac91ecd800de9baa6e96f57ea998f0e83c6bb3bfe6d26090dbf64dd16c476

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 09a46b7f9972e6ea673c960f5c0510c1
SHA1 3964cab4e4e1164448ca50c970f24289d280fe4c
SHA256 f79b48195eca3a744b8f87ef3428bd4e2392e7cdab3e91adde95b905cc2d1a84
SHA512 ab987210e55e04b54c26f50c6d95bb8e3c88cc2f8099f2e9ea22cbdfc271e177959d4f2b9d15933b276c96e0b0aefd3499ac85f1f7cd541ca0d6aaf517489c66

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ae9ec2fdf65b22306fe88fb50694ad57
SHA1 2693bf1fa8077f7d501227079ca26a8835a4fd33
SHA256 4b1dde407b63ac56429fd113243a10d80c0af4cecca0b2d54de5fd5ee3e2c961
SHA512 0cab54afce698ee2267c0ff69c2c4a67c6a56abee5114afc41e46e681d29b4f1527aa0c49caa7457298eee39adf614d3db7ba05dbc1808f23c33170e50dceaa8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f7b7c0e1974d764de576cd016bfc1afe
SHA1 2ed7ce235c2b41f639c416cd2d9313a670e93b8a
SHA256 62bbc42dcbfcb2a7f236915ac9a3d36057bb9ebee750345710bd4a24f68e8f0e
SHA512 34f9a43491c3bcd2fa814e6e3c3ab82ce217b4c7d0ac474d45c3bc6004a5156f10a752f26ab47d786f52ac146e5a36da3a6317212123250a037d43c28240f9ee

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9d72c8bd4e13eb0e135de561102232c6
SHA1 87a8a6d92ec93ed2b7012cd430237f87f3f876ea
SHA256 508eece45e52692e2e4d18ddbc41a62d0debd5940e0336959947625c8e823b73
SHA512 f0a52dc694085eef1c1355f6ea422ae3da63366cd6cafa5fe64573a3ef4f0b14a6a12158a7e0ccfd0ef9200d034b758ddafa9e927dc6ec5bdf6dd9c24911bf1c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3a6d227cf06f9c89560dc8fbe758b5e2
SHA1 bd217355b840d6589b76251b5345cd6afd5e7370
SHA256 c78cd3e8932a1090cd72861e617296c03f9c24152d328db7e1cc29da9ad1d4b5
SHA512 bac6b3a56f54802f9be78eea504ef2ba40c829696bd0e92e639159da90fa853f278b0033703ec5aa44b79bba8e7acc67d38dc22b5bf9cdeabb21c17f9fcaea68

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a1b9d06cb005a3d18f1367c4d33351d4
SHA1 dc9fbeb3aa042372025f7fe40c4bf488e10cff50
SHA256 0b1d1b764c6f8089733c83899686e7b9e1a9eb1a53ec38812a40410a461bb55f
SHA512 e00df2bc877e42144d12248a3b4d60c261afde3a46cf05301b7fe1745ab361262e91d2d1605dad7b50fa41f093380ce324554714efc1057412938484eaaab81b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1768e5154b176c626c71599325418d3b
SHA1 b8a0c5786198e3e1f47751ddf124e9583a4a11c2
SHA256 ee1aed2cab3ad8a6aec4a9f074b2b7d7dfe48c673aba220b8485df5ead678659
SHA512 b9eb151e193ee72af57e87d5f1c27cdaed15fff45f4dc26db71d16a16e543edaf687a14048cd2a06c781ad3724f490d20892fdd2136ba5940f189f86bc6285e3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7fddda05820488c3f6cab1ea2074d265
SHA1 7c8056a09a64686e0c650b45275c8e5db5740e89
SHA256 c657a8ecbc69a2e689e0bba42c4dddc3cef6ee8bc21392a49528916f9823b5a7
SHA512 941c6ad17d6be60485fc0084c04491e34c069595fe310952209859928ed4225a7e44319102cffe9dfad5573d5d514c9b520d16b3168fd96fb44b3a049649863c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 903b4a5b69d327321a4058096e3b2f57
SHA1 a56a6b66261bf2c3e357cd3f6af960750fd14bdc
SHA256 89d957bba91260bc7a40f5c1fe64b8c2f00e871765f1d6e3dd4572a9ac3f6026
SHA512 217f155bbbab7f4780809e43d5d05af5b01b737df8c341fbe1ebbf3847e0ea307bb14c7f0d7ad764edcea9b25b5ed8041df0926170b92ca7c115d8c1d3815636

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f36314b34fb5b7054a40d37e614ccd4d
SHA1 322e86c3f9c8a96b806e2c712b1ce62b627fb062
SHA256 40a4f18eeae8caea226b5ffcd4346aa6ba05e1cecdb8d35ce24205340a970d42
SHA512 6e43e8b5bdf390cbd64bbecaaa185b7c3e153adb9461060746fa4a4212f7417ca9595c877949c9079e25c0aa190a121728553bb74974ce8a1f1f86d72e6fc867

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 07a748a3348454566079c4897d396ff6
SHA1 5919e602ffdf42599475ce0f6d5e30b9d04a48d3
SHA256 777f2df5379b8f2e620eee6032789c97ded51ebffbfffc2b914c89434e654e08
SHA512 a81fdc674c51546ac1ce088278c4f677ee75b46869019d39861f67de5d7b6b0ab42dce83a6c446831082b30950c986ec2007b1ae42de690b8f736934e172df8b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8aecc936c38b1e6b7093ff73e9e9bd69
SHA1 87cd74fe8afe0c8043753b12bdb7674c0e4a6f91
SHA256 26aeb6bbc344bcf7a16c9a0642cd5f3027721cba49723d09bb8d4650f1c36d98
SHA512 1b8dfead5bd02339f9e4f3dd28dced88cb64fbfc839559e72109cac816072fef8d017d883bf530357a988eded286dd4e39ba0c436250f80b4b5c71b074bd2606

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 49f8cf5ab96474a771fc6c1e7c930433
SHA1 135ae63f7ae7a3548862e5a7ed69ee92f1146ead
SHA256 e87fd4cac97fed369231880d77ddab6f4d774e34794c7bdfb72f1e3ab7c1688a
SHA512 0412c419c8bb79d48d5737de45668ce0a18771413224aec43a49c6765db040236b1bec30625ff748ee9017258be3f453a0b4ddd9b6f1a5a99ac6f1aa1223b9b5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e2d5ef641dd6885ef78c0998fcb291c2
SHA1 0b32850333a68c6ca17017a7c160edc5c8976625
SHA256 af666cac1d33701dc0186d47481fdfe597f9317c5dfbeee8072cba0adaf7a41a
SHA512 0f961bf6702d42b1410d55ef3da45b0c6ee6dfb8b8dd8d513935ebd89c2d8465f6fd7d52bfbe685f7b545a84b75d66d5dcfad63a47219df149d9ff92edb0aa68

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dc8e72cc039f81acf2d5c7322f09736a
SHA1 3392ff683d9e66eb883acb4cbfe108411837773f
SHA256 72012a11698b0659e94976974caa11ec7645236ad551d355b4b153f30170525e
SHA512 688150f08a282fef554df5f1038129ca77214227c647751ae1392f30c3981a53b4186ec0619e4aa13cc7c16ac391f2eb1f15709b228a1f8de6dde2a39206245b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 69f87ee3440a36c61bcd99e14599ecdf
SHA1 373ba25d480ebb91ccf35ef33ea0ee1461932240
SHA256 da842cc912635f6bf7713ecdef04f1c554e9802a5d00db3bd4a228e9f2d50e04
SHA512 295b35e587c72967f774a03587a2eb875dd497a0daad543babe64340ec457e0ddc2d24bc580d61ba74a794f88e4812fb364da9ace1e888277377a0719e6bdf0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 86d07867275d17c37af1f57397fbbb48
SHA1 a873964e96413b5d4945d187727dcda3dd7cccad
SHA256 adfdc9f5d801bef1ff379743a2d7763332a62e3eec858bde07bd8094df5576c3
SHA512 ff37d89911617fe521acaba2e5627293129ad28be0bd3bddb02205cbde9e2518464c67c77ef132aa6845c7c595e3b490de26c556cf78a851025e5dd7aafdf75b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 db91964ad6f041dbb465c184c272100f
SHA1 122f92051b46afbab804477eb820830d896e6d03
SHA256 b8733799eeb6adf339b311f61878be01b0a0aa8dd943ad881ee6fb52381f9a31
SHA512 ec7dc1148b9532c8bc30d4d5aeda5f88173a05e23adeea0eeb90d43d48f95cae0c82c2cd182edcbf5c7c738156b48fb6483ade3208a2b8f10dc0aa16fbd5670f

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240221-en

Max time kernel

119s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ButtonEvent.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ButtonEvent.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ButtonEvent.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 220

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240611-en

Max time kernel

93s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4116 wrote to memory of 3648 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4116 wrote to memory of 3648 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4116 wrote to memory of 3648 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3648 -ip 3648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 2.17.107.128:443 www.bing.com tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 45.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 128.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 131.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240220-en

Max time kernel

122s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\a\$_110_.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1856 wrote to memory of 1588 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1856 wrote to memory of 1588 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1856 wrote to memory of 1588 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1856 wrote to memory of 1588 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1856 wrote to memory of 1588 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1856 wrote to memory of 1588 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1856 wrote to memory of 1588 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\a\$_110_.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\a\$_110_.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240611-en

Max time kernel

118s

Max time network

139s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1028.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e2e04e46beda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79DF52A1-2A39-11EF-B489-E681C831DA43} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c8334fed00a6d6749b4eb3e24bfe6a8a863bdbe7c34851a8e31defcf1d214d64000000000e80000000020000200000007d0423ed1d466bbfb28b32cbd829032482536d245ace5eb7cc6011d0ae8d756820000000f4a27895b52632224ade80321f351ac4152cf9f8e5ee9ad5ac69dafb0078765840000000a0f81ec8135a85b7af159a7040fdbd2bb2bfb9d9f93c6a529c2bd58c2baa2ea61f2d6e241d25b3e84fbc3025b8fd4a5ef4fd7e1b3e8487776f7a57d7fc2f2ad0 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000104aec3969cbc1668fb1e3c5d288b94abd1536771619e9bac509cdf8da48d26a000000000e80000000020000200000002494400e53de8e81141b5637995becdbcdac92a2702822a6d4fb269e53ab68199000000088d6c7ec30488869dbcc29fcf9f735f2e921c86efe73e4a23e479c78e18d3b909815882c31a816bf8b46973eea7465bd6a3a387a1066e6b07b14410b025a6edbd0c2eb35f229b182625de3ccb39041881786dd3b750ec66edf9880457f6d3acd7a621b782307f65f8b0561cbd51db813917cf075eff92780a2f0e61a0f92925a04c7471f47adb11fb76fb0244c9f3cd8400000007e233c09dd9907c3f46745c0335c16d97a9c2b38a4c1de3392b65a4e3aee0fc380629fc37b5789602cd5870427214e880edc0b3f5b7a3829bcfaea9744d936e0 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424523050" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1028.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\CabA556.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarA5F6.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 51bab9904d3260d1d9716a293f0cbbe9
SHA1 feef43f906f6f232833cbf00d08678862d741464
SHA256 2eb815ace4ccf3327191a4c77464ad67e9e72cc621c3a924caf873b582ff056c
SHA512 746b8b20ea173980f091c9f71e51b7c6121f25324c748c4c68ff6a5e266364f187bba446408d141d594261bb1c4c26604a917d1917c93a15cb563115d5e8ffd9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1f9a0f138523733edf5445ce984bf3bb
SHA1 9600d5776c8ca2a5695dd5581d8d6aea43c0e298
SHA256 853938fcc6fed4d4c7fd9570a5bf0406706f959875a1bf5cb7075b80d843ed37
SHA512 0ca6a16d0f4a6977a607f8f4e3fa38a7d32bd7a2c460446738b913cc670dfd7bd01af9914859e952e7d3955b6b02a6d4dc6fb07bc50e642ee120ee593ce51893

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8abd719d9a91dda710897cfdaa4b80a9
SHA1 10cb3b63371d7203d371b706aacde4e8af038b90
SHA256 b7bd6f160a423a879fcdc3e897098da2130881376cd260d8b422abe199fef3cd
SHA512 594a338b175dcac11fe43b1693a17a510b3b2b738f111f0997e576d8404396c45b3e9ba4bcc794e6151491b65a91b5bdaa897bcf9d70dc1b2779df1747c0be9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53ac958ebbec79a45cd070d774b0263d
SHA1 82f0ca9c5feec6f52634150f458890fb33500da1
SHA256 2ae047027c6bb1576c406ceaf76ef4373a7ca4417dbec408ab8739331156e14a
SHA512 7432b49d31b56c6c1b5b8ae3cfa606c44afda93e56fa4c3890af7cdb2eebb2c146dbe9e1a09140d1357fdfef7b7c25dbdb07c80c9af90d7e727c43fc6c5b1d2b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 03d5336a088fa423b1b79f1954acfe6e
SHA1 969442c4a21db21878dc26908090eb169183528e
SHA256 04d914c86415f12c0de2e6f97b94eb66d76ce4855b2d0aafa11906027beb46de
SHA512 8d2c7a61b895049dc0dc7092988166a1280fc2786006ed322f356b19d33a3f3b82969b225aca857542183b298c27185374caa88bde366bc0381151182accea29

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 460c0404cb3d102afc0e134143b03aae
SHA1 cdcc104bc201e39ed4a2bb3551fe895ef8f83819
SHA256 c1b7e4e31e62b3e8b5c29a54965c9e4035212c46da799b10b1d29a67688cfcea
SHA512 48a250ab330759222bd3387a3bd3cc51bad2e9311f3f05fc91806d5e0df94db9a5145393400843aa8d68b57b17efb346a5dfbe60659f1b0d6afef9b611146cff

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4a4e05c15b3f21074db105242bbdb2b1
SHA1 4216e40ecaa5ded7ffe0b8789c7bb8b53958b767
SHA256 c827de45109f228af483bdedad6362ceed4bdb7e4d881e49a1468d6f0042bece
SHA512 fffded6d7f264ce7af2a598915fd7e91817fdaf5772324defc393a654f24b788f51f395e3efd75f27deb680ae5ba66d40c5086813ffb3a935c2ee0184b31302d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e87ed5f29a90084b5be7ac3487e446c9
SHA1 40cc33ab9af58106df69f59164e9b8fc7ef8a663
SHA256 57f9ad91592f19154694fe7e809c9c9de5c30e35c2340a142bacccba24b0f38f
SHA512 dcc6e3e9dd925a1297ac920dbc0be894940c5bd7be61226ed84828be273dd7b77d85b97a5cb8a0d8afade429afd14250594a9e46860ab2217540afec7eaf443f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 57a6718e05af18d129ec3ef1cbfba90d
SHA1 3816d1a2971a3034241b6314105ef050b61a4113
SHA256 9871c298f4d2bd4a6835d60dad071e4a418b6e556ef1f925d06549b4b30dace9
SHA512 7b303960af36a960ac7a9e8331c47d287213325338c0fe69d4aceb71eb3e49cdc252a2a059df42819f2a9b90fd1390cec5a315b4e37323040b3aa0bb1579f971

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d2e027945e049264a59a230b5f5bdaf1
SHA1 17f699e99703510f798bbe6b5760ac8fc72e7db3
SHA256 25425c327ba7b8596c1f48398a80b8633774c18086e3a46a323951bb097c7963
SHA512 2a2bf7b4862c4ac346db6bf11a89421860603cbbaeb03e73526ea145cfda75950d134a6095f2b5602be40e7f79736081bde46838a528d99ff5111a41e263447f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 63d3458cd45382ed4df1a23accb159a9
SHA1 1f7c5e4c78ebb6094257206d974fde84d11fc7c9
SHA256 2a6d80da09bc8c169928497255f85abecbb4a2784a23654ef33dfb77cd690078
SHA512 cca4aeebe4a294b78421c57b0d7f0c7c27658c910f62b3bf0989eeb0b979db159929e8119c7f75caa2270cdaa456c40e2ed70a4aa5ea7ce6089dd687e8c177ab

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 be07767ec2e6c9a249d590e6555874fc
SHA1 83c699d284454f06b807bd717e483fdd72b4569a
SHA256 b0bb4d3338eb72bb96cf7c881afe5b722f8826742379239b7270485c13a939d3
SHA512 c3151adcf8694c028a7fb94f6d57c0e7927fa163863c125236ecff00affcf36b207cea089dbf489bb3abab3b94dae8ec35bf56acb2aeecb3a9ba55cb935b01c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 97fec906b497ee98340be8a73b500e16
SHA1 3acdeeb1ae921d5ea40b98864174538f3cbf4cc0
SHA256 ccec9a27385a7baad26cdab35463f6d380a5269276c8f8ae4c101601a98dddbb
SHA512 c78cce3604ac95547963cfb6d251a3a7d8215d746a39709b99a6d438a0456ffd15c66b398e71b18e2d59f89124f4112068c928bc785a59ceab6e17866daec8cf

Analysis: behavioral32

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

126s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1028.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3000 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 2172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3252 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3252 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1028.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf86a46f8,0x7ffbf86a4708,0x7ffbf86a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,12958435788097530929,8178004055645523055,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,12958435788097530929,8178004055645523055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,12958435788097530929,8178004055645523055,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12958435788097530929,8178004055645523055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12958435788097530929,8178004055645523055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,12958435788097530929,8178004055645523055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,12958435788097530929,8178004055645523055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12958435788097530929,8178004055645523055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12958435788097530929,8178004055645523055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12958435788097530929,8178004055645523055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12958435788097530929,8178004055645523055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,12958435788097530929,8178004055645523055,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5008 /prefetch:2

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 52.111.227.11:443 tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

\??\pipe\LOCAL\crashpad_3000_KXVDHASCQXHPTVFZ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d9d60208-4517-47f1-8e1f-cf266515778b.tmp

MD5 a8c1f7c81b8b29c6813fac8503282a8f
SHA1 b09b48677076b9d0b59ca373956f5b8f9f4ce27b
SHA256 14d53f63a1828a1ad3636d2c2d981f669d99d158ecac219be19bc4b6d96c4fea
SHA512 f288497ebf95cc85b3c974f5be756c619d8c89a942cc2680d26e3ff93036860da7c49646693b75cec930d6b5ae987066f113226b2424aea043ca310265e163c7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3a2aca60c748d75c00625050fea124b0
SHA1 8b113197c6c5ab80d824888d17b640dcbb3b58e2
SHA256 b643b1f0333cc0af08935491f8dc65e329c8718180cf921e42bfc629df1d43e6
SHA512 248c72fe09166466182846fb06594eef50307f2f9bb651e2a5e84c76cb63a8e984f39b176d2b55276cf9257f092138c11d06c2d5290be862028224dc5017e271

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240221-en

Max time kernel

119s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe"

Signatures

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1" C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0" C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96} C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome" C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome" C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0" C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
N/A N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe N/A
N/A N/A C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
N/A N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

Registers COM server for autorun

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\psmachine_64.dll" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\psmachine_64.dll" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\psmachine_64.dll" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\psmachine_64.dll" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32 C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\psmachine_64.dll" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FA480D8-32A4-4849-B774-DE8BD5242A4C}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\psmachine_64.dll" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdateComRegisterShell64.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\icudtl.dat C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\chrome_pwa_launcher.exe C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\goopdateres_ja.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_lt.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\Locales\es.pak C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_hi.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\109.0.5414.120.manifest C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_pt-PT.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\Locales\af.pak C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\Locales\sr.pak C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\vulkan-1.dll C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_en.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_it.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\goopdateres_mr.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\vk_swiftshader_icd.json C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\Locales\el.pak C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\Locales\nb.pak C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\GoogleCrashHandler.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\goopdateres_iw.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdateSetup.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\goopdateres_da.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\goopdateres_pt-BR.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\goopdateres_pt-PT.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\Locales\fa.pak C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\Locales\nl.pak C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\Locales\ur.pak C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\goopdateres_ar.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\goopdateres_is.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\psuser.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll.sig C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\chrome_wer.dll C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\optimization_guide_internal.dll C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_is.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_pt-BR.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_ro.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_vi.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdateWebPlugin.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_el.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\goopdateres_en.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_ur.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\goopdateres_fi.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\chrome.VisualElementsManifest.xml C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\chrome.7z C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\Locales\mr.pak C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\Locales\zh-CN.pak C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdateSetup.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_ja.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_fil.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_sr.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\109.0.5414.119.manifest C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\goopdateres_ru.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\goopdateres_uk.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\goopdateres_nl.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_mr.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_ta.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\npGoogleUpdate3.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\psuser_64.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\chrome_100_percent.pak C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2644_576738818\Chrome-bin\109.0.5414.120\nacl_irt_x86_32.nexe C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
File created C:\Program Files (x86)\GUM14B9.tmp\psuser.dll C:\Program Files (x86)\Google\GoogleUpdateSetup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.33.17\goopdateres_hu.dll C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\Policy = "3" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55} C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\AppPath = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17" C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D} C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\AppName = "GoogleUpdateBroker.exe" C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\AppPath = "C:\\Program Files (x86)\\Google\\Update\\1.3.33.17" C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\Policy = "3" C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\AppName = "GoogleUpdateWebPlugin.exe" C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\Policy = "3" C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\CLSID = "{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\https\shell\open\ddeexec\ C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ = "IAppWeb" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\VersionIndependentProgID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ = "IJobObserver2" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ = "IApp2" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ = "IAppBundle" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32\ = "{4FA480D8-32A4-4849-B774-DE8BD5242A4C}" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachineFallback.1.0\CLSID\ = "{598FE0E5-E02D-465D-9A9D-37974A28FD42}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods\ = "24" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Google.OneClickProcessLauncherMachine\CurVer\ = "Google.OneClickProcessLauncherMachine.1.0" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32\ = "{4FA480D8-32A4-4849-B774-DE8BD5242A4C}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32\ = "{4FA480D8-32A4-4849-B774-DE8BD5242A4C}" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ = "IGoogleUpdate3Web" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CredentialDialogMachine.1.0\CLSID\ = "{25461599-633D-42B1-84FB-7CD68D026E53}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ = "IJobObserver" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ = "IPackage" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}\ = "IOneClickProcessLauncher" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\ELEVATION C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\ProgID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36} C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\ = "Google Update Core Class" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\PROGID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ = "IAppVersion" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32\ = "{4FA480D8-32A4-4849-B774-DE8BD5242A4C}" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.33.17\\goopdate.dll,-3000" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Google.Update3WebControl.3\ = "Google Update Plugin" C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine\CurVer\ = "GoogleUpdate.Update3WebMachine.1.0" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ = "IAppWeb" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods\ = "9" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\NumMethods\ = "10" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964} C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32\ = "{4FA480D8-32A4-4849-B774-DE8BD5242A4C}" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ = "IAppVersionWeb" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CredentialDialogMachine.1.0\ = "GoogleUpdate CredentialDialog" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Google.OneClickCtrl.9\CLSID\ = "{C442AC41-9200-4770-8CC0-7CDB4F245C55}" C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.shtml\ = "ChromeHTML" C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32\ = "{4FA480D8-32A4-4849-B774-DE8BD5242A4C}" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods\ = "8" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2964 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe
PID 2964 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe
PID 2964 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe
PID 2964 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe
PID 2964 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe
PID 2964 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe
PID 2964 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe C:\Program Files (x86)\Google\GoogleUpdateSetup.exe
PID 3016 wrote to memory of 1932 N/A C:\Program Files (x86)\Google\GoogleUpdateSetup.exe C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe
PID 3016 wrote to memory of 1932 N/A C:\Program Files (x86)\Google\GoogleUpdateSetup.exe C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe
PID 3016 wrote to memory of 1932 N/A C:\Program Files (x86)\Google\GoogleUpdateSetup.exe C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe
PID 3016 wrote to memory of 1932 N/A C:\Program Files (x86)\Google\GoogleUpdateSetup.exe C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe
PID 3016 wrote to memory of 1932 N/A C:\Program Files (x86)\Google\GoogleUpdateSetup.exe C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe
PID 3016 wrote to memory of 1932 N/A C:\Program Files (x86)\Google\GoogleUpdateSetup.exe C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe
PID 3016 wrote to memory of 1932 N/A C:\Program Files (x86)\Google\GoogleUpdateSetup.exe C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe
PID 1932 wrote to memory of 2116 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 2116 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 2116 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 2116 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 2116 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 2116 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 2116 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 1784 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 1784 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 1784 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 1784 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 1784 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 1784 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 1784 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1784 wrote to memory of 984 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 1784 wrote to memory of 984 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 1784 wrote to memory of 984 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 1784 wrote to memory of 984 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 1784 wrote to memory of 1768 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 1784 wrote to memory of 1768 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 1784 wrote to memory of 1768 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 1784 wrote to memory of 1768 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 1784 wrote to memory of 1044 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 1784 wrote to memory of 1044 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 1784 wrote to memory of 1044 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 1784 wrote to memory of 1044 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe
PID 1932 wrote to memory of 1404 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 1404 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 1404 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 1404 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 1404 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 1404 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 1404 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 2984 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 2984 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 2984 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 2984 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 2984 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 2984 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1932 wrote to memory of 2984 N/A C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1624 wrote to memory of 2504 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe
PID 1624 wrote to memory of 2504 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe
PID 1624 wrote to memory of 2504 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe
PID 1624 wrote to memory of 2504 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe
PID 1624 wrote to memory of 2504 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe
PID 1624 wrote to memory of 2504 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe
PID 1624 wrote to memory of 2504 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe
PID 2504 wrote to memory of 2644 N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe
PID 2504 wrote to memory of 2644 N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe
PID 2504 wrote to memory of 2644 N/A C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe

Processes

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PF-Chrome-2018.exe"

C:\Program Files (x86)\Google\GoogleUpdateSetup.exe

GoogleUpdateSetup.exe /silent /install "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&appname=Google%20Chrome&needsadmin=True&brand=PRFC" /appargs "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&installerdata=%7B%22distribution%22%3A%7B%22do_not_launch_chrome%22%3Atrue%2C%22make_chrome_default%22%3Atrue%7D%2C%22first_run_tabs%22%3A%5B%22chrome%3A%2F%2Fwelcome%22%2C%22https%3A%2F%2Fpiriform.com%22%2C%22https%3A%2F%2Fwww.google.com%22%5D%2C%22session%22%3A%7B%22restore_on_startup%22%3A4%2C%22startup_urls%22%3A%5B%22http%3A%2F%2Fwww.google.com%22%5D%7D%7D"

C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe

"C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe" /silent /install "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&appname=Google%20Chrome&needsadmin=True&brand=PRFC" /appargs "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&installerdata=%7B%22distribution%22%3A%7B%22do_not_launch_chrome%22%3Atrue%2C%22make_chrome_default%22%3Atrue%7D%2C%22first_run_tabs%22%3A%5B%22chrome%3A%2F%2Fwelcome%22%2C%22https%3A%2F%2Fpiriform.com%22%2C%22https%3A%2F%2Fwww.google.com%22%5D%2C%22session%22%3A%7B%22restore_on_startup%22%3A4%2C%22startup_urls%22%3A%5B%22http%3A%2F%2Fwww.google.com%22%5D%7D%7D"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver

C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMy4xNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjMzLjE3IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0Q5OEIyNTMwLTVEMEEtNDU3MS05RTAwLURDRDVCRkZGMzBFNn0iIHVzZXJpZD0ie0IwQUE3Q0IxLTcyOTUtNERDNy04N0RFLUYxOTQ3MjQ3NkNEQX0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7QzcxRjE4RkEtMkYyRi00QTc0LUIzNUUtOUVDRjI2RDJCQzFBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzYuMTUxIiBuZXh0dmVyc2lvbj0iMS4zLjMzLjE3IiBsYW5nPSIiIGJyYW5kPSJQUkZDIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI5MjAiLz48L2FwcD48L3JlcXVlc3Q-

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&appname=Google%20Chrome&needsadmin=True&brand=PRFC" /appargs "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&installerdata=%7B%22distribution%22%3A%7B%22do_not_launch_chrome%22%3Atrue%2C%22make_chrome_default%22%3Atrue%7D%2C%22first_run_tabs%22%3A%5B%22chrome%3A%2F%2Fwelcome%22%2C%22https%3A%2F%2Fpiriform.com%22%2C%22https%3A%2F%2Fwww.google.com%22%5D%2C%22session%22%3A%7B%22restore_on_startup%22%3A4%2C%22startup_urls%22%3A%5B%22http%3A%2F%2Fwww.google.com%22%5D%7D%7D" /installsource otherinstallcmd /sessionid "{D98B2530-5D0A-4571-9E00-DCD5BFFF30E6}" /silent

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc

C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe

"C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\109.0.5414.120_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Windows\TEMP\gui65A6.tmp"

C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Windows\TEMP\gui65A6.tmp"

C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x1b0,0x1b4,0x1b8,0x184,0x1bc,0x1388ba8,0x1388bb8,0x1388bc4

C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=2 --install-level=1

C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{D93823A7-3943-4BDA-A98D-F8B1E491772B}\CR_7A13E.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x1b0,0x1b4,0x1b8,0x184,0x1bc,0x1388ba8,0x1388bb8,0x1388bc4

C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe

"C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe"

C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe

"C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMy4xNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjMzLjE3IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0Q5OEIyNTMwLTVEMEEtNDU3MS05RTAwLURDRDVCRkZGMzBFNn0iIHVzZXJpZD0ie0IwQUE3Q0IxLTcyOTUtNERDNy04N0RFLUYxOTQ3MjQ3NkNEQX0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7MzkwOEIyQjctQTlDRi00OEJCLTlFODgtQkZFOEM0MjQzQTQ3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M0MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMDkuMC41NDE0LjEyMCIgbGFuZz0iIiBicmFuZD0iUFJGQyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjExMyIgY29ob3J0PSIxOjFnOHg6IiBjb2hvcnRuYW1lPSJXaW5kb3dzIDciPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi9jaHJvbWUvYWNpaHRrY3VleXllM3ltb2oyYWZ2djd1bHp4YV8xMDkuMC41NDE0LjEyMC8xMDkuMC41NDE0LjEyMF9jaHJvbWVfaW5zdGFsbGVyLmV4ZSIgZG93bmxvYWRlZD0iODkyNjgyNjQiIHRvdGFsPSI4OTI2ODI2NCIgZG93bmxvYWRfdGltZV9tcz0iMTUxNDciLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIyODI0IiBkb3dubG9hZF90aW1lX21zPSIxNTc0MCIgZG93bmxvYWRlZD0iODkyNjgyNjQiIHRvdGFsPSI4OTI2ODI2NCIgaW5zdGFsbF90aW1lX21zPSIyOTEwOSIvPjwvYXBwPjwvcmVxdWVzdD4

Network

Country Destination Domain Proto
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.204.67:443 update.googleapis.com tcp
GB 216.58.204.67:443 update.googleapis.com tcp
GB 216.58.204.67:443 update.googleapis.com tcp

Files

\Users\Admin\AppData\Local\Temp\nso144D.tmp\System.dll

MD5 8e050192b6b98d8adfffc297e7d6ecaa
SHA1 bd1f7591c36a172caad81ef1b3ea51e998e1cce4
SHA256 4177e765eed3bba3794cd21b50779c097e8a943bc92c3621f2f51a85cef46def
SHA512 12d7694987fbb6aea59102a25498291ea0f8e44ac57ad2ac744199123534b8cb3c373b5fdeecc0e09f971db63f543bbb2809d24be29a0c03deaf4dfd5e463f33

\Program Files (x86)\Google\GoogleUpdateSetup.exe

MD5 53baee50f7a69bf3bc0fffe25341a923
SHA1 0b7998f5517ed4e7c5aeea3a89d73b60d2a2d102
SHA256 f91e258ea71dcbfc82371b2ee3e20852e45bef0cb946223d1141a6ef1dfb793f
SHA512 0eb28032849f775f604b7064a4f00f7d802c8c2fd5c7bc21b48298e6c3d316286963794b4c6c4981199c21f56b08d9aa466a470d40738d1b633b7feddc8e6241

\Program Files (x86)\GUM14B9.tmp\GoogleUpdate.exe

MD5 92ee791a630830452485e8e375f8db35
SHA1 8c0d2a1cf79e9e34107e2e1aaafa818ecf1f6943
SHA256 542294724926b0e156224b9ebd33e6354d79da4c828fb52f7f4233df45e3f624
SHA512 73e04cb7cc96aab8fa20731e1a709f0623b0118ea4015976e5ff072ff6afb54f1c723e49a2dc93b040c07fd7137d9d453e39f17bc9a16bdafc85b6df1b2f1194

C:\Program Files (x86)\GUM14B9.tmp\goopdate.dll

MD5 463a426da94fc2418a713ceebb799e22
SHA1 bbae2b098e49540c599f8b76a106ef4ab8e8dde2
SHA256 eaf6ede3cc4efb047cedad32a9b3c2a138ad872991e3bee4f66dd8fbe08133b2
SHA512 389aa2a2c2ea72bfea2a57b8ce37da03641c7e742bb96793115a0bb83ee603e337fd96e45f0fca21bf4e77d6cc0502c38363ebb45f398c433a517a0f413916fd

\Program Files (x86)\GUM14B9.tmp\goopdateres_en.dll

MD5 9c2a3eec41cd4effd6ffecaa910dd7da
SHA1 451eadb82e288a6158ade6a827f00e0f213eb30b
SHA256 1f2a19782eb0eee7d0820987a233947ebbc33abc6cc234cb74ddfcac3f901165
SHA512 792e62a61411d87649294b655102082789b5affa5bfbfe01ce535ab7dcb1dde4e72e11165f44701363c517ec17e0caf76fbfcc26c23259d8a855a4658f59cb3f

C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdateCore.exe

MD5 678dd73ca364411bcf431892b8f878da
SHA1 844b9872addc3b1ea9548aef12d771211ab57e3d
SHA256 0853a5fb66ddb187947bf9a51789728b75e34885592f51c2bbbc583729b23e40
SHA512 19203598b47e076ec6c333023d63d005bf517e4698705e7d60e6818a76680c1f39a8920015c9cffbb7a8b4c93caa8fd3f9121282d39d0ea82944057b196e3b58

C:\Program Files (x86)\GUM14B9.tmp\GoogleCrashHandler.exe

MD5 6c718849d436a7ccebed72538f8bd04b
SHA1 e8217efafc6a679eaa9fcd5e9c46e2975f60997e
SHA256 617def10fb5cd04434532e2803f07489a82494f76dc177e0ce7e8c70f66729c0
SHA512 f96617438c4703dc1df79a136dbee87187fbcba19f9ddb31900600652c335d65a39c2e5bcfeae08aa9243f4dc70d5561f0f3b56de98624bf6215e8855f5a786f

C:\Program Files (x86)\GUM14B9.tmp\GoogleCrashHandler64.exe

MD5 d2f56e366f1cb26866a6f43bd53b46c3
SHA1 a84063a7544d8031912d76a00a90dd058bc8d49c
SHA256 e881b1e5151886d85d4a690b3b41cb3e5dfbd24759b660c3554187f66a3c0825
SHA512 89892cdffdd5e78f80441b500a247c2e8b3bf073e8a8dbdf6519d4d4ef1c897cc38c69751f9b3752d018e7c104ea30394d44e20b5c1d3229d142449e947b644a

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_es.dll

MD5 73ccbf92e13acc6389bb9f7dd04935b6
SHA1 23c81f83ab26aa3647601617e850e3f8c8240096
SHA256 6a060c7a90a95f2cab5e111ded3d4f618c10a200cfc7dd1a0e5be5fe35d66416
SHA512 60b5e67aacfc93cb8d2c04e02c69f21fa39e5db2b920d39e27e3168436a3e8b3d90245809938f301148d5d2b5b84093880541d410c10711b5df7e2ef3f18b687

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_en-GB.dll

MD5 2087af32c82c00e32094ae86dcf35607
SHA1 8ebd4a5467ffaed71641274e962dcb7a34d8fd7e
SHA256 86af29e76c77093b312b4ff20eb330ce9806d76afc69f754e5eea90425430cbc
SHA512 db4e0773dae02a6667780148d3b19aa38a3ea4751ff6d0ce7025f35a5ab50a4475e91b339521e07745f055f0461cf8b41ecdcd12bb08006d6060cf95c6d57bb8

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_el.dll

MD5 68cf3b8fef6b56cd583e8c30ae8ca563
SHA1 598d3e4853aeeec4564829a061485a7b40d8e1c5
SHA256 0674cf0c9c0d30440ce548536a6f1b59f9250e4dc992c93249dabba34491a574
SHA512 13379e87d4c9a0f11d99247fba0ff1a6567851acd6782d68b2c9f3a7be779026afad89640ce8378ecbc6f33088c98f2b5f513d45b124daffa328a3722feb8fae

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_es-419.dll

MD5 7c7c2b897c7107e910eab8b669c93738
SHA1 aaacb00f3641e3f369a3422022f746d9dadaa57d
SHA256 8a4acb09fb53d2846780f10bebdf95bb33eddc0dfcd18195be228b1211deb509
SHA512 cdb16c5ce0d42326554c30b799af7c50f92ca8283127c9e712321ab63ca5686dc98ad9df43a8c065a7cfb64d94ea1eec3295fdea4568750d66fc2cbec9edadda

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_de.dll

MD5 e5ea4068551b3ac782d955a699222067
SHA1 929d0babbe496b5383c03fd71f0f8844ce27800c
SHA256 e482ba26e04e59899c7140ab0f35d6ad233f5dfa001d0def9a29c131a731210b
SHA512 62008e055d27274ed37863ccf2b40c8b045a8ed1babeb676915b39938e2f4e55b69f6c1f65aca1223c612f0dc11a4d132f3fd066bd2dad63977cefeb286e5784

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_da.dll

MD5 b1bd2d1889f42f20aeac5f1998d8b21b
SHA1 cce15b2060bf80ea7e06056a9dcd43cf65739787
SHA256 21c36ff76333c7363bd62c76a136f841ae13a667691536e9bf3609e49abc6e27
SHA512 26f66bc5e2b065d41dede5377eacbe4cf8b61c3d0d40bbd7b2b1f2948ea8ef951ce07c00a8cf13bf157f0b383e1ad5704af94f71d71c8f550e826618ddbf42cd

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_cs.dll

MD5 9b598c6a4d3d9586f93feca20f51da70
SHA1 1290b07e2909a1fa4b9992581b3e36208a44354d
SHA256 4afb1aa42cbc501b28e2f5b27db2552ab3445d18134ae643812fde5bbebd8414
SHA512 d3c6d6d55e1d85b60351bc9405330fe6a82cef54f7b330169ff2687d9fb18cbac14382a029aaa9df19681a8c873f36fc57f5078c0822ae2679be9a3d261f548c

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_ca.dll

MD5 230fe7b526bde7aff33b616618a8d05a
SHA1 679acd3bba2d34297dd7009ca3cf9797e0dcae52
SHA256 411d01fa6bee8659ee2f7dc4975f33deaaead02d2f9c783e8adaf07a4a6333a1
SHA512 fee6792e41f0e564c9156e83c6dcfe8bccbcba66a3a972e88c0ea737b008ce5a0ac221f3b748a85ddec77d10ee0fe56956307be452d013be4e2879fae69e6916

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_bn.dll

MD5 4a5e2fac15b93b43a2ee673e2e111478
SHA1 7091318dfcf74c571aaac04dd30b0c600128c4af
SHA256 9465122ddaf8298cc8560a55d28952b0098eb7236cdfe52f62509a528f44dd26
SHA512 17a0c2ca46f4a44e97ceb23c46a062487dcbc0c9442c7789eac419bc1be64674545a057cd8856842cf63efd961bc4cc9c29949d9f6797b6d1fafb1e13225da7b

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_bg.dll

MD5 f376765117f5b82123ec1f4fd352fb9c
SHA1 e24349888cc65382555e072cfa3f4ce970692d19
SHA256 709d7d08dffc672ef3053e29fd86e86413af60ab41a43959b4108538819a189e
SHA512 dc5a2a18e8710fa2b0dc182a856cee0fffcfc9fef8e380cf5ca4b4e3fe76827c14b7c9f0815aa75bb78adb512813b527ea95d4f8c59c256097f96c68d000adcd

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_ar.dll

MD5 9d85c8517de4db2380aa14593d8a899a
SHA1 0af85f47d293d8f08a8d484644289ba3e8a0094e
SHA256 b5e4b6bc7e821ec1c652557777e7f1a06156da6c411752e1e66f47e8b6bff3f5
SHA512 84bcdbcc6d953b0b03204d3356a79c80771f336638315c02f99bb21a1ef9c1211416b8bba1e9de60d2d418073320738ccca3827f4abc6eb09c5e2e02e8cc6d25

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_am.dll

MD5 e433408ca45786f9b6b7873709f57eba
SHA1 1b29247472993837bf5451651c698d9e3c78a7e7
SHA256 702b1f2b48041334b94e5529a27823518544fca6abd51f64c2d90c09685d3459
SHA512 5ece94dc54fc5127b554116f5e86645cdb564643893423b639683191902986655ae35f5fede0c6244ca1eb1a44dd5d2dfbe6be6f748f5d023a0b91de477b77cc

C:\Program Files (x86)\GUM14B9.tmp\GoogleUpdateComRegisterShell64.exe

MD5 03b587bfaf6dd67b330ccb6fb99ca59a
SHA1 de0aefdc64b39783909b578bdc37dbabe5cf61c6
SHA256 bb1c60e4f365c2a13db9612dee6d46ce9b6a6bd42a9a7e650ba3b2e911957419
SHA512 724927ab7e81bab13703a0c5acfe28e5df1a75998d6997ab5a630f298b49f0ea28ce1405bdcd8a96f72a01689c1ebe6491c64860c83107584e8b06c0a9f4718f

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_et.dll

MD5 a2cb2c0b126c87336bc2b29a3e995dc5
SHA1 30a03a41622ab3038c792ca748eca9cb599d2d80
SHA256 6fcd31b49672cbca59062e90f36213fb99aef317fc1f12494e1715e5a591e891
SHA512 d387e7b1d86394c40371fe7b888a002ead956b7a8585ef6c9dec972195b2dfab3ac8aab9169948b0a705d54957399e2e03e3ae089b96603d0b849b23f447df58

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_fa.dll

MD5 1d688c7571f047a36b585d810e02067f
SHA1 ec30a90b036297baac9b4577c99862641ddc865b
SHA256 db059681f11fb56e46bb89f80330e02f95a09ebb30dd20c5f12156e92c0667c3
SHA512 2470a12d386f7611ea7b785bb0bf27f19a8ea013f5d2e751262e603e593c64e0d7a3d4e14bbe5e13a587097a3591d53b6eba8b65d07ca67c52f989c08525a492

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_fil.dll

MD5 6cec555d88a69bdb910188c2b53b19a3
SHA1 7ef052c8fbbccb4f4948d3ccdb19bf90fcb685eb
SHA256 c7174cae6039a1dd4a7de2603d10d610650984ea2f1020d6ecf04364e789eb9f
SHA512 397779b0b465c21db2991865271d7ac2d55e112b0b10147ad3b4abdd684e2f3861f6bcb1aa468dba4bc72fc213719ea45424fc644c2812fc82227a9e875d32ea

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_fi.dll

MD5 81f8d0fbff693910fedc808047cdf156
SHA1 f4b7829d9d1b953352df626f65e16daca041170d
SHA256 1175be38d7adf1d26d7abae3704b488a4700e874149cbcab487e0343d26349ce
SHA512 f1865ba2f09fe6803fcce53f9e1b69011dcb575c8eeb7a88f4f6d5560f7cdc93c2d79d025cb2706ea7ebbe7253c30f7cebfc1a291e5311c6ba5b881a7d058a1e

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_fr.dll

MD5 598294ce0043943aa4cc04edc139e6c8
SHA1 d1015ab73b0a1bb09a190be72e32314517e5a99f
SHA256 78cde3ce8c755cf54f05103dcf4438bdeebe819573738678a8e8bb0850faceb2
SHA512 d9934b69879b79efb33b1bc8208b8862a603084fcd0d3effc18e3bf94b9f9d0bc9fb182234471275440a7eee78bfe701f4f1230bb0984cbdf2970f89d1e14853

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_gu.dll

MD5 7d3a8a7aec219fcbecacd04f1ad66053
SHA1 d4cde2992d3e675884a3156caf29b4674f729fec
SHA256 fd78649babc724f85e17e11d487d04812d83f70cd9fb45e2374360d779c8e5ab
SHA512 1bacd9f769f9a09393201dda2a5dd9a845cd43d8357b82f4a8f27413a5deafeb6ad37aa057954b7fec911158d9b3484e847e8238e9a4d7c3af359f1f5cc1369c

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_hi.dll

MD5 0a9a7354a95c559a4093f24fff784911
SHA1 6e918750b48a63171d1f896282621ea6d56d7448
SHA256 0ce08563cab2fd4050714d671b5d09b26e9b00dced01a1ccba031e301897b93f
SHA512 46b355e5890282098d02e86a2db0c8889fb10ec7cde320a060a4085d8ddf1f84b4f019757ac9100e69002bf8156bd603012fe7f5dd8987d60ec696ab1f8dfa46

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_hr.dll

MD5 de931037c2f487efa900aa6590cac9e0
SHA1 eb797b036f6923150a687d8654210a2750e6c0e2
SHA256 816e024e0485983f6820fa54b1cb037ef875b8a98dd3e2fe2a5ea0771d0ff67f
SHA512 dce357b45f738ae3582596bb1f0d6d41eaa4b968544840e242e29278026b1e947a1cffa71182b939e28e2b64d429aadb6bf60354a3667e4054ae650c5d1d6ca9

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_hu.dll

MD5 456664b46a1948b0df8785bd5b87f858
SHA1 52a031312d6fbc0380bdebbfcbf1400f19e8b189
SHA256 dffa27c56881121fe57701373ffb27dc754450d880fdd5ead0d34360a188d361
SHA512 d5f8303b494ced7c756bf2fdf4e866469e80268f3001a491ab41d806efcba264740d4538ac79b9ac57fdba205fea34fe3e610f2ed49998a50d36f91b6ceaa40c

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_id.dll

MD5 43a73db8674c025026ed4cad9359a574
SHA1 4069cf27827b01b41052d3d85ff4cdab455450de
SHA256 8b41b93852cd849aba5c5751280edc01292f7fa74c7803ee280e1ee65d05886b
SHA512 649068550f96f15c02faa7b8fc678d9c75b2a08912111747c8dadfd98c51f1ddab135587512318b7facd68201c2d6e8e171d60fe06656376b70e9ca60104d924

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_is.dll

MD5 5e609c7d0ab38fa244949da75da04a1b
SHA1 5d9109c889688eca32102d40368dd0632e507763
SHA256 077ed1a8fb7ccaea614a4c80df3d7e7b140a94d650b2d22c2e827d175b033217
SHA512 a2a4d4064a963e95fc12b6609abc63383ed1aacec2e70bc7613e7cadccb826c2c0d053f08f1c2f8ba4f1643785efe588c5b41ddfb16dfdcedce3e20d4b095491

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_it.dll

MD5 d002a3352574a6e6999a6f2c23566745
SHA1 917517d8f2d54fa45cc6d1fee66f7f118f298816
SHA256 fcbedf3497a065f616874e7d9868a0bc6c5a109ebeaa825a35a9c5ca92347e00
SHA512 451ce3563ab9438cae487046997c56ccc14549903488807fc13f4a9f6b43bfed869c5d72ff061afd616db86c322ca3775fd14ae0a87198ce53b420fe2ade262d

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_iw.dll

MD5 ffef2d63908222cacee0e40c138d5986
SHA1 e096faa1be2fc4c75f48c2b340eae24217f2a8a3
SHA256 64b90c73bd24d247a3afbece81bd1c81b77ade6631dae71807b4b6fcb5c21da4
SHA512 f1225438d812b903a38d16887d960b9481baf0055e93b3b4d7336d9025c7fbca79f541f9af02ddf6785518661b74c4ab65ff82b54f92f85e3c2727103ef7a73b

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_ja.dll

MD5 b71ff4a60875f30db7e492d4806f0c92
SHA1 a51556aef5079e0f70a68ce876d1ffd846b16400
SHA256 a851b4abd2e152c9743bf84d292a662bee0fe8d4080e13a62ac482f44ce67b21
SHA512 03583121f93806f51f7375b292006f7234890eb1adc824c5d1de0faaad56ab5fec49a66e74c892e6eb74d1d937c41e0b3db070c000e1a5acfbe45b7d959c265b

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_kn.dll

MD5 c6a1c2e334df66970a03b30539757f36
SHA1 82f3a4ae6135f33c0baa4f959edf275a030e9279
SHA256 fe3398258f7b32cf85c61a08e0bc90792fd111f0f30905457988c8bea5e98492
SHA512 30f086dfd594aaf444b7498e7eae9cb6ec2992d50c9c4da3914ab68f9fe85cf9907810a05d4eb69d8ce13d5ef9f6ca991c1b409d63aa489443e186dabf9279f1

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_ko.dll

MD5 fb58fffc04f44137610caae567cfaf6a
SHA1 d8be7e77c2bbbe87eac884c2d0ce0bac7c71ca70
SHA256 42cd719344a6084b697ecdad10893064ca0806c2a248ef11689c3212da5969a8
SHA512 7ebeb07da85e8a7be2e46d255fbeeafe04de5e795467e5801cab07e7a98d4a08dbc41721feae0da419ce3eecdad7b647d4ec16e9b74277d2e238f9af57322eff

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_lt.dll

MD5 3b033e1092474acd6b7cfcf01a999d34
SHA1 ecaddbd1f5fb5f29a9889e0cd45b62bd79eecf01
SHA256 886ca5ed38effeca6c91a29356f1240ecf6f2904769aee5dc6641cf6f3ccb021
SHA512 2c59774ef32602dfeb59df6bd4aabe9349fb103b49361982c769fcc7a81281e56856a6ef470c7bd0bc7b6c4d4bbafc94751ac8299c2c153a83d979d10eaf55a6

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_lv.dll

MD5 3b00a99d877881ba0fc786fdd8e3b426
SHA1 b060e4b772df2609b461ab02830e1c08f2d6e586
SHA256 5208f544888b471725e6347a40dc8639acac5ac8b530e848f7326d410fd0f4ca
SHA512 36868a69a9aa961cfe17520d021fb85b075eaa9c042b0403f899ee2c173a8c445c8259a563edee915b8c366a4f29d2a881785de36d593aa8f65155aacc90e71c

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_ml.dll

MD5 157bf7b8eca4bc66d5c7fb3e358d5c58
SHA1 2b96270e36d2309e48169616e834ce8afe60af1c
SHA256 18e7dbb973d11d9f3eed7fc7ba73364904547431ce6d527dfe23baf6e3135a08
SHA512 019bca95bd9253d843a980c7dd8080441ec138b9c518657c787c02d2fe652f4ddb5f2e7c120be72f595ea5ff1f8d2895e30c55ee4bc23f86907fab757e4dd93d

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_mr.dll

MD5 7c864e8d77ebe0bc8451ade4f67f68b3
SHA1 59b0403657f3225ec617123f48aa9d5359e0caad
SHA256 c567185abfac41c2f72c22de2ee26d0dd8704109dd90f2acc527a61c8693138f
SHA512 72b784e866a84f97d797136446bb856848660ba3c1986452e56cbed904f3c53f32daf22d1a23ba1feaa9afe0c7e2a54adc041ae3597f8c2cb70f62da42d3fdda

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_ms.dll

MD5 225c45af996ebf983800025ea32f6c18
SHA1 427e9b872bb17653e8bbcbc1a0cf299a63b2c90f
SHA256 4f5777a81dd8ef79db086b9cb5a3bcc7915f85dc4e3bb3c437660bf68df1b679
SHA512 baba4b5a34fae2539468875f278e500c133fc15e6ec6e79c85f0676dff8d5d7ffdba27f61dbff3301079faeb0a2bf7b40b5e89aa6b9a96a5cb5e19e219029dc4

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_nl.dll

MD5 2b04cd187acac2019e13195a3cc53a31
SHA1 f24ddc0bfc589dc3ef0ff3dc6cbdea89090026f7
SHA256 f7cef610be3cbc64f6ade5f95696f726b96a70fa4d33a2a42843ab2799b0fade
SHA512 1e28948ebaada7648e9fc8fdb2fc2cd03574c976fdce959b2cba1b54f254b1d958b1d0828b5b7b4056e8a40caa3be714ac51c955edef6694ac9b497a13d56fbe

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_pl.dll

MD5 531e1fca96b1cc6dfbb74c2e96d990c7
SHA1 60e1fb8ec56803b908f14c0792d99f8d1bf673df
SHA256 454535103929b110baec377b339941038f5e29337456a4aa2f69812bdb13e3be
SHA512 537778ab481ab805cce3540871c666c3bc63f29e88e1486bec831f7be6f07f8316f38f1ec4a6587b4b95e1cdbdfba2705edefd1e09ad58996b4ca95f3619031b

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_no.dll

MD5 38651bcc330768d3e74763452a8e46e2
SHA1 5fff02b68bdecceb3055d001bc5bbfcfcf7cbcb8
SHA256 9ea9600d3febeb551daf4d522747b9417b97a95a3fe37e910011c232ceff1a64
SHA512 33b8bebaa098ae381cf33ed5edc6e61fb3748d4f0c809f2f9f7379bb634a863aaa1bef8c49b040f8c9d39aa5957cc3d66275e644bd4415d2fc793ea781455ab1

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_pt-BR.dll

MD5 237642b8bddfe765e073a3aa6c29ca0a
SHA1 ac74db67559d95fcd00bf67c6af513eee699f1a5
SHA256 e0d80999557e6c9d227f96ab0a7e831c19ad50fa39a995b885eb13273cdd0f07
SHA512 50db6961d47a7da14cf13a890b6260e109b17b9edbe50be997ceb8d96003cd52158140a2cae032c6d4d4299ea054875ec3a39066bae26c8f3ad7fa08cc11fb29

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_pt-PT.dll

MD5 298f4f2bd4e7b962615bcf0ed3d673ca
SHA1 7479ffb24e63e09d440030fe5b8caa75e75a3169
SHA256 67a711907649fb0aa1866732286d0e382573558fce2c376cdb1a49329bd62e28
SHA512 40da45e14061f21d800c02e4edf980790615c226cbf45cf1988f57f89f94a7e8875a35e191cc36a018c049a7a67fcb7cce1999e2971e6ef3828588cd028abae3

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_ro.dll

MD5 ea1ef744fb8ba02148b362adeac70952
SHA1 a911f11aa39edee054c88b89501cffea35bdf873
SHA256 00288fb45728a960a02040e339003bed334da5945951f45b9b4711dc885d015a
SHA512 899227266c54a69b6a1a0283c0c603fdb12623da02456c4178db44210c5186e5a5a4d7c4728be6ffd66fe5b333b6a7629167b76f162ffaa631712b56201afa39

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_ru.dll

MD5 774b5644ad40e4d3863d81a7d30d4fae
SHA1 9a8736b91ff2b8af5e1fc7afa7aab18ae6b60e3f
SHA256 aa30ebd6e3e7b932b4b31218745b22097d442da1842f6080e1c338d647b3873c
SHA512 43783a810b0b0e700bf9fc96ed8c34a7c8b2d2e55162968990de0344028e414899a6a00d71d9aa104a5946b7dab403c6af4cdf92108f5c1ac32265b35aa78448

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_sk.dll

MD5 6ffd62c9d080288bcc95816afd018048
SHA1 f916c75bc6c7551fa65c2bc70659151342ea8291
SHA256 1e55431ad423cae1cc7580f6de7ca6a8215f0392a8831a9b0cb94ba73640d54c
SHA512 9b338f0c21fbef09dade72636cd69a08dcbc5e46cb79f039155e8e13d93ac80726b7adea470e4dce54fb2ccff2d99270d3b6465470d1e219b39ec042ed99801d

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_sl.dll

MD5 d7b41237faca93b3d0666e4fd38092b8
SHA1 e5b451241357aa1ff19c32119cd03d3dde41184a
SHA256 805770f94a3a02b3ea10364f1024ae2397449f0a681c71dfe4c517b85063e441
SHA512 af63c1fd8f2710ad9999474ba91b197003f7845dd36b1ab4ed4ebaab4367f32d15f6adf4a47b74b48c2cbe481151b91b5f94fc063de68bde59a1987aca2786bc

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_sr.dll

MD5 25bbd03fc02f7daa9168dce7dfaef624
SHA1 b4d7e5206fbd0de543f46dfddb11f79d0df0dd1e
SHA256 5c1fe4d8dc0bbfdda7e399f2229ad6bf0caef291eb25ba43f1b436ec2eb22166
SHA512 c0ea8b7d4a463e373d044181c6c5f20665cda2644f8de304e46b878ee0485f0873ebc3699b08cdc544aac16b67357bdcde1060796085c5aff60de2ae1e31d14a

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_sv.dll

MD5 e645c5eb4401b5e443a9744fc141b2f5
SHA1 db8fcd617d792b23e67f244d08180a819b58ed96
SHA256 e5ae2947b950d5340af1684c7cb3545724984e18b1c0fce8f02a4148847e56bb
SHA512 6b0a7193dabd04fdbc9e8d8d78dbf2930438c5cf0352093002fa83e656a3a34b4e177845a7345a59b1b659393395088b1b06610e2f206113cc2545c90407d37d

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_sw.dll

MD5 2f111d7785bfcd6b4228df0cdf353407
SHA1 0a04b176cd3a46097e9bcaa448f3c0c44ea45c22
SHA256 016ebb34ac432a47d68d6d0493978c864cca6e6dcf54c8c426274a88ad4ab86d
SHA512 52cdaf4ebd904032fef43d6311078ef08d8010e727367e2b20a06056ec710476ff493145cbd8a599cd1c963ccfcf5950297a03f539ad99ccd2a60412eec663eb

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_ta.dll

MD5 8bb63ae799037b02a89c42408abf755a
SHA1 88f62e141a5074319f547c79be6b36531268cf40
SHA256 1d8ca36c54857407b364649dd916b42118785e0febab8762b506abd4adfdcffb
SHA512 b45f8f2ea03a1f1602c9f2b8f3fa64eb8bc0f67c28c13bdc8e31dc0f3c8beecaa46100ffe6d329702a28396bf2038ae3d2938823585658200ee2dc7e1ad31212

C:\Program Files (x86)\GUM14B9.tmp\goopdateres_te.dll

MD5 2f40316ac456b383c58be478daf69ce9
SHA1 01c07b362667e8525193d8fa2d689391033e5411
SHA256 2e8a3fa40ee1a9e7286938e85bdc142ec27652362d37ed5a5244ee9dbeb5221f
SHA512 a49644cffb638f500c173f9850ffe0d38a67171cc2f798c0f6e55fbc39c892fcd68118b29861a2053ce2edb4dbd950e60287a3790009fb36c79a2a5821fb9111

memory/2964-301-0x0000000000400000-0x0000000000447000-memory.dmp

memory/2964-302-0x000000006E5C0000-0x000000006E5CD000-memory.dmp

C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\setup.exe

MD5 d2831e067bffeb3ee62fbc170feb494b
SHA1 f635f462b6665616d8291bd71c021d7036c65019
SHA256 a5e1bd30c5d14bd8e8fa5037a5682d7c8e70505e0ddc5d4bcd6cb3dfcb048e16
SHA512 c5f8212e8c7f6a811aaa465d88888c36d02ddf12e9a5b151238aa686aef2dc5f01440071973857c9cab56546e4246dfbe82ce08b18d79716a60abd8ba06c03ff

memory/2964-355-0x0000000000400000-0x0000000000447000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5088 wrote to memory of 4256 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 5088 wrote to memory of 4256 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 5088 wrote to memory of 4256 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4256 -ip 4256

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 57.234.16.2.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 172.217.169.10:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 10.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 29.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 131.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240508-en

Max time kernel

132s

Max time network

143s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1025.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcombo\ComboOffer_1025.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=1016,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --field-trial-handle=3428,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --field-trial-handle=5180,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5348,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5380,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=5176,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=5828,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 business.bing.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.4.4:53 google.com udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

51s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4540 wrote to memory of 2460 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4540 wrote to memory of 2460 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4540 wrote to memory of 2460 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2460 -ip 2460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 612

Network

Files

memory/2460-0-0x000000006E5C0000-0x000000006E5CD000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240611-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Users\Admin\AppData\Local\Temp\a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 analytics.ff.avast.com udp
US 34.117.223.223:443 analytics.ff.avast.com tcp
US 8.8.8.8:53 ipm-provider.ff.avast.com udp
US 34.111.24.1:443 ipm-provider.ff.avast.com tcp

Files

\Users\Admin\AppData\Local\Temp\nsd1AC3.tmp\System.dll

MD5 41a3c964232edd2d7d5edea53e8245cd
SHA1 76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206
SHA256 8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5
SHA512 fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

\Users\Admin\AppData\Local\Temp\nsd1AC3.tmp\UserInfo.dll

MD5 c1f778a6d65178d34bde4206161a98e0
SHA1 29719fffef1ab6fe2df47e5ed258a5e3b3a11cfc
SHA256 9caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87
SHA512 9c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d

\Users\Admin\AppData\Local\Temp\nsd1AC3.tmp\p\pfBL.dll

MD5 6f7e7f72f9a53c48dffdd70dfec4f88c
SHA1 655d4791f4bffe14dbaf68b5bb8270e93fadbef7
SHA256 22abd21cd2fe21133ec7329a71effe4d4b3181661f1e5cc5e269434c91b0a7b4
SHA512 af0a9e6d0568ae388c93dc33660b1968390fa69ec796079b340a17ec6b7dfa06b70f537c18d6db61784d71f4feec13ac93fcd9735a49635f7689ab206cd43827

\Users\Admin\AppData\Local\Temp\nsd1AC3.tmp\g\gtapi_signed.dll

MD5 61bc40d1fad9e0faa9a07219b90ba0e4
SHA1 5b5c3badedba915707000d2047eaf13f27b8925e
SHA256 89e157a4f61d7d18180cb7f901c0095da3b7a5cc5a9fd58d710099e5f0ee505a
SHA512 fa341aa975c471082b4b6c380f794d1e9ab3939382972cfb9e1dbb3491f68296ad1cedc8f03736921c8e133f62432997de29642e223c2a97f1cab5ce91d68af9

\Users\Admin\AppData\Local\Temp\nsd1AC3.tmp\g\gcapi_dll.dll

MD5 2973af8515effd0a3bfc7a43b03b3fcc
SHA1 4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee
SHA256 d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0
SHA512 b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

\Users\Admin\AppData\Local\Temp\nsd1AC3.tmp\a\asdk.dll

MD5 5b4a90d8d2c61f0e6fe2ffef347696e9
SHA1 23a45252deeba6f0faff3e8a17d503d1ccc42009
SHA256 89a90ef4e7db39e6c89f37527c66ca3ba14eee3ac3dc4fb40aae347fb2ed98b1
SHA512 accbd10c1d7698c19db170ec0e42a955a71e9a6b3286307778969d581f6f1f27c6825d73caf8e9ec8e93208115659c1522a69923ac47ea9603b907f4843ae166

\Users\Admin\AppData\Local\Temp\nsd1AC3.tmp\ui\pfUI.dll

MD5 fb812a42fe0f4a54918fabf21b66f29a
SHA1 3e7d2434f5d62df838c15c4c4c0382a58f2b1819
SHA256 54d26ce44c6c5482ede4d3d64b02f2c8fbd58cb51d9be50fc3889bc3769ae2a0
SHA512 2950a32d38dea4465bc8949a6b39bba1854cb04e3b79164ef0e55c54510d60cf2aa24161b9fe256a6fb4b27bb5b1ea61110442a712681cc7d51630ae66f7666a

\Users\Admin\AppData\Local\Temp\nsd1AC3.tmp\nsDialogs.dll

MD5 2aba8f16eca82517460013a3de7cbf67
SHA1 3812192fa7b873f426c4b0d0d822b3c9d51aa164
SHA256 60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d
SHA512 4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

memory/2868-117-0x00000000009C0000-0x00000000009C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsd1AC3.tmp\ui\res\CC_logo_72x66.png

MD5 a736159759a56c29575e49cb2a51f2b3
SHA1 b1594bbca4358886d25c3a1bc662d87c913318cb
SHA256 58e75de1789c90333daaf93176194d2a3d64f2eecdf57a4b9384a229e81f874f
SHA512 4da523a36375b37fa7bc4b4ccf7c93e1df7b2da15152edf7d419927aa1bb271ef8ba27fe734d2f623fcc02b47319e75333df014bed01eb466e0cd9ec4111ef53

C:\Users\Admin\AppData\Local\Temp\nsd1AC3.tmp\ui\res\PF_computer.png

MD5 7f4f45c9393a0664d9d0725a2ff42c6b
SHA1 b7b30eb534e6dc69e8e293443c157134569e8ce7
SHA256 dbd8b6fdb66604a0a5e8efe269fbfa598e4a94dc146006036409d905209da42b
SHA512 0c27f9ce615cbff3e17fd772ce3929ab4419d7432d96223b7eec1ba70953f2ac993404b954020247b52d7f7499212d44eb6f85da2e2676773cafe1ce89b390f9

C:\Users\Admin\AppData\Local\Temp\nsd1AC3.tmp\ui\res\PF_logo.png

MD5 079cca30760cca3c01863b6b96e87848
SHA1 98c2ca01f248bc61817db7e5faea4a3d8310db50
SHA256 8dd37d3721e25c32c5bf878b6dba9e61d04b7ce8aec45bdf703a41bc41802dfa
SHA512 3e25c10e3a5830584c608b9178ab062e93e0e9009a7d897bb5e3561180b0b0910bd4178063d982eb33806a005c93931ae2ec5be520ec0d0c9a7c452cb78fd6a8

memory/2868-135-0x00000000009C0000-0x00000000009C1000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240611-en

Max time kernel

119s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 224

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-14 10:32

Reported

2024-06-14 10:35

Platform

win7-20240508-en

Max time kernel

121s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\execDos.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\execDos.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\execDos.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 220

Network

N/A

Files

N/A