f32577eab95110b79ff52dfa923b8fdfe2aee0cd7cdc73cc383cb666d0bddaf5

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
Size

906KB
MD5

c2be7dc6537418700d312f6b8175c855
SHA1

3d181ec6b208e9f8177e9c9b91faf9769f7b93f3
SHA256

f32577eab95110b79ff52dfa923b8fdfe2aee0cd7cdc73cc383cb666d0bddaf5
SHA512

6d242d244532c817cc8bde9ab5ec50af84c2b374b341c8a1c7e2349d50201c63163aa786567add192f4059e135e9637112c6d40f371a081958294d39afb7c3b7
SSDEEP

24576:f+T4iax8jaE1O4x2h6MIc3IMoqUYE+QYL+uZtU8:mTQWjaE44w6MIc3I87L+uZtb

Score

8^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\127.0.6533.100\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	GoogleUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	chrome.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 32 IoCs

pid	Process
1404	GoogleUpdate.exe
620	GoogleUpdate.exe
1400	GoogleUpdate.exe
1876	GoogleUpdateComRegisterShell64.exe
4596	GoogleUpdateComRegisterShell64.exe
3252	GoogleUpdateComRegisterShell64.exe
2464	GoogleUpdate.exe
4416	GoogleUpdate.exe
232	GoogleUpdate.exe
1228	127.0.6533.100_chrome_installer.exe
4640	setup.exe
4732	setup.exe
3516	setup.exe
5104	setup.exe
4636	GoogleCrashHandler.exe
3568	GoogleCrashHandler64.exe
2784	GoogleUpdateOnDemand.exe
448	GoogleUpdate.exe
4628	GoogleUpdate.exe
2980	chrome.exe
2940	chrome.exe
112	chrome.exe
4984	chrome.exe
1588	chrome.exe
3192	chrome.exe
2644	chrome.exe
3680	elevation_service.exe
4208	chrome.exe
2724	chrome.exe
2108	chrome.exe
1220	chrome.exe
1856	chrome.exe

Loads dropped DLL 47 IoCs

pid	Process
1404	GoogleUpdate.exe
620	GoogleUpdate.exe
1400	GoogleUpdate.exe
1876	GoogleUpdateComRegisterShell64.exe
1400	GoogleUpdate.exe
4596	GoogleUpdateComRegisterShell64.exe
1400	GoogleUpdate.exe
3252	GoogleUpdateComRegisterShell64.exe
1400	GoogleUpdate.exe
1404	GoogleUpdate.exe
2464	GoogleUpdate.exe
4416	GoogleUpdate.exe
232	GoogleUpdate.exe
232	GoogleUpdate.exe
4416	GoogleUpdate.exe
448	GoogleUpdate.exe
448	GoogleUpdate.exe
4628	GoogleUpdate.exe
2980	chrome.exe
2940	chrome.exe
2980	chrome.exe
112	chrome.exe
112	chrome.exe
112	chrome.exe
112	chrome.exe
112	chrome.exe
4984	chrome.exe
4984	chrome.exe
1588	chrome.exe
112	chrome.exe
112	chrome.exe
112	chrome.exe
2644	chrome.exe
2644	chrome.exe
1588	chrome.exe
3192	chrome.exe
3192	chrome.exe
4208	chrome.exe
4208	chrome.exe
2724	chrome.exe
2724	chrome.exe
2108	chrome.exe
2108	chrome.exe
1220	chrome.exe
1220	chrome.exe
1856	chrome.exe
1856	chrome.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_sv.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\Locales\sw.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\Locales\th.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\chrome.exe	setup.exe
File created	C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_ar.dll	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
File created	C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_no.dll	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\Locales\lv.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\Locales\sr.pak	setup.exe
File created	C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_pl.dll	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_ml.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_mr.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\WidevineCdm\manifest.json	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_hr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_hu.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_vi.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\VisualElements\LogoCanary.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\eventlog_provider.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\Locales\et.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\Locales\hu.pak	setup.exe
File created	C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_iw.dll	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
File created	C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_kn.dll	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_en-GB.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_fr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_iw.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\MEIPreload\preloaded_data.pb	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\Locales\cs.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\Locales\tr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2980_634328632\_metadata\verified_contents.json	chrome.exe
File created	C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_gu.dll	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
File created	C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_zh-CN.dll	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\chrome.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\libEGL.dll	setup.exe
File created	C:\Program Files (x86)\GUMBE3F.tmp\GoogleUpdateWebPlugin.exe	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
File created	C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_hu.dll	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
File created	C:\Program Files (x86)\Google\Update\Install\{CE1956CB-9426-4A88-9C72-8B3262E409E4}\CR_9D640.tmp\CHROME.PACKED.7Z	127.0.6533.100_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\Locales\ro.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\Locales\vi.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\Install\{CE1956CB-9426-4A88-9C72-8B3262E409E4}\CR_9D640.tmp\SETUP.EX_	127.0.6533.100_chrome_installer.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\dxil.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\Locales\he.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\psuser.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\Locales\zh-CN.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\optimization_guide_internal.dll	setup.exe
File created	C:\Program Files (x86)\GUMBE3F.tmp\psuser_64.dll	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
File created	C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_es-419.dll	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateOnDemand.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Application\127.0.6533.100\Installer\chrmstp.exe	setup.exe
File created	C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_sv.dll	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_sk.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\psmachine.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\Locales\bg.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\chrome_proxy.exe	setup.exe
File created	C:\Program Files (x86)\Google\Update\Install\{CE1956CB-9426-4A88-9C72-8B3262E409E4}\CR_9D640.tmp\setup.exe	127.0.6533.100_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source4640_218891451\Chrome-bin\127.0.6533.100\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2980_634328632\manifest.fingerprint	chrome.exe
File created	C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_ta.dll	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
File created	C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_uk.dll	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\GoogleUpdateTaskMachineCore{42411B32-09A3-4888-8B8C-2514180544E5}.job	GoogleUpdate.exe
File created	C:\Windows\Tasks\GoogleUpdateTaskMachineUA{09CDA59F-FF70-4CD4-A3BB-9DDB8093FA7D}.job	GoogleUpdate.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleCrashHandler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdateOnDemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4628	GoogleUpdate.exe
2464	GoogleUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\CLSID = "{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}"	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\Policy = "3"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\AppName = "GoogleUpdateWebPlugin.exe"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\AppPath = "C:\\Program Files (x86)\\Google\\Update\\1.3.29.1"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\AppName = "GoogleUpdateBroker.exe"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\AppPath = "C:\\Program Files (x86)\\Google\\Update\\1.3.29.1"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\Policy = "3"	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\Policy = "3"	GoogleUpdate.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133675073432468550"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods\ = "17"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Google.Update3WebControl.3	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ = "IGoogleUpdate3"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods\ = "43"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ = "IProcessLauncher"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.29.1\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ = "IGoogleUpdate3"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Google.OneClickProcessLauncherMachine.1.0	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ = "IGoogleUpdate3Web"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc.1.0\CLSID\ = "{534F5323-3569-4F42-919D-1E1CF93E5BF6}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine.1.0\ = "Google Update Broker Class Factory"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\Elevation	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ = "IApp"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods\ = "24"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ = "IAppWeb"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\VersionIndependentProgID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\Elevation\Enabled = "1"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\ = "CATID_AppContainerCompatible"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ = "IApp2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ = "IGoogleUpdate"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ = "IApp"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\ = "Google Update Core Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc\CurVer\ = "GoogleUpdate.Update3WebSvc.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ = "IAppCommand2"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods\ = "24"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\ProgID\ = "GoogleUpdate.CoCreateAsync.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachine\CurVer\ = "GoogleUpdate.OnDemandCOMClassMachine.1.0"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\127.0.6533.100\\notification_helper.exe"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B032B7-F027-4274-BFB1-A0418EB9D0D9}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\Elevation\IconReference = "@C:\\Program Files (x86)\\Google\\Update\\1.3.29.1\\goopdate.dll,-1004"	GoogleUpdate.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1404	GoogleUpdate.exe
1404	GoogleUpdate.exe
1404	GoogleUpdate.exe
1404	GoogleUpdate.exe
1404	GoogleUpdate.exe
1404	GoogleUpdate.exe
4416	GoogleUpdate.exe
4416	GoogleUpdate.exe
4628	GoogleUpdate.exe
4628	GoogleUpdate.exe
1404	GoogleUpdate.exe
1404	GoogleUpdate.exe
1404	GoogleUpdate.exe
1404	GoogleUpdate.exe
2980	chrome.exe
2980	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1404	GoogleUpdate.exe
Token: SeDebugPrivilege	1404	GoogleUpdate.exe
Token: SeDebugPrivilege	1404	GoogleUpdate.exe
Token: 33	1228	127.0.6533.100_chrome_installer.exe
Token: SeIncBasePriorityPrivilege	1228	127.0.6533.100_chrome_installer.exe
Token: 33	3568	GoogleCrashHandler64.exe
Token: SeIncBasePriorityPrivilege	3568	GoogleCrashHandler64.exe
Token: 33	4636	GoogleCrashHandler.exe
Token: SeIncBasePriorityPrivilege	4636	GoogleCrashHandler.exe
Token: SeDebugPrivilege	4416	GoogleUpdate.exe
Token: SeDebugPrivilege	4628	GoogleUpdate.exe
Token: SeDebugPrivilege	1404	GoogleUpdate.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeCreatePagefilePrivilege	2980	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 1404	4044	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe	87
PID 4044 wrote to memory of 1404	4044	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe	87
PID 4044 wrote to memory of 1404	4044	2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe	87
PID 1404 wrote to memory of 620	1404	GoogleUpdate.exe	89
PID 1404 wrote to memory of 620	1404	GoogleUpdate.exe	89
PID 1404 wrote to memory of 620	1404	GoogleUpdate.exe	89
PID 1404 wrote to memory of 1400	1404	GoogleUpdate.exe	90
PID 1404 wrote to memory of 1400	1404	GoogleUpdate.exe	90
PID 1404 wrote to memory of 1400	1404	GoogleUpdate.exe	90
PID 1400 wrote to memory of 1876	1400	GoogleUpdate.exe	91
PID 1400 wrote to memory of 1876	1400	GoogleUpdate.exe	91
PID 1400 wrote to memory of 4596	1400	GoogleUpdate.exe	92
PID 1400 wrote to memory of 4596	1400	GoogleUpdate.exe	92
PID 1400 wrote to memory of 3252	1400	GoogleUpdate.exe	93
PID 1400 wrote to memory of 3252	1400	GoogleUpdate.exe	93
PID 1404 wrote to memory of 2464	1404	GoogleUpdate.exe	94
PID 1404 wrote to memory of 2464	1404	GoogleUpdate.exe	94
PID 1404 wrote to memory of 2464	1404	GoogleUpdate.exe	94
PID 1404 wrote to memory of 4416	1404	GoogleUpdate.exe	95
PID 1404 wrote to memory of 4416	1404	GoogleUpdate.exe	95
PID 1404 wrote to memory of 4416	1404	GoogleUpdate.exe	95
PID 232 wrote to memory of 1228	232	GoogleUpdate.exe	98
PID 232 wrote to memory of 1228	232	GoogleUpdate.exe	98
PID 1228 wrote to memory of 4640	1228	127.0.6533.100_chrome_installer.exe	99
PID 1228 wrote to memory of 4640	1228	127.0.6533.100_chrome_installer.exe	99
PID 4640 wrote to memory of 4732	4640	setup.exe	100
PID 4640 wrote to memory of 4732	4640	setup.exe	100
PID 4640 wrote to memory of 3516	4640	setup.exe	101
PID 4640 wrote to memory of 3516	4640	setup.exe	101
PID 3516 wrote to memory of 5104	3516	setup.exe	102
PID 3516 wrote to memory of 5104	3516	setup.exe	102
PID 232 wrote to memory of 4636	232	GoogleUpdate.exe	108
PID 232 wrote to memory of 4636	232	GoogleUpdate.exe	108
PID 232 wrote to memory of 4636	232	GoogleUpdate.exe	108
PID 232 wrote to memory of 3568	232	GoogleUpdate.exe	109
PID 232 wrote to memory of 3568	232	GoogleUpdate.exe	109
PID 2784 wrote to memory of 448	2784	GoogleUpdateOnDemand.exe	111
PID 2784 wrote to memory of 448	2784	GoogleUpdateOnDemand.exe	111
PID 2784 wrote to memory of 448	2784	GoogleUpdateOnDemand.exe	111
PID 232 wrote to memory of 4628	232	GoogleUpdate.exe	112
PID 232 wrote to memory of 4628	232	GoogleUpdate.exe	112
PID 232 wrote to memory of 4628	232	GoogleUpdate.exe	112
PID 448 wrote to memory of 2980	448	GoogleUpdate.exe	113
PID 448 wrote to memory of 2980	448	GoogleUpdate.exe	113
PID 2980 wrote to memory of 2940	2980	chrome.exe	114
PID 2980 wrote to memory of 2940	2980	chrome.exe	114
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115
PID 2980 wrote to memory of 112	2980	chrome.exe	115

C:\Users\Admin\AppData\Local\Temp\2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-07_c2be7dc6537418700d312f6b8175c855_bkransomware_karagany.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Program Files (x86)\GUMBE3F.tmp\GoogleUpdate.exe
  "C:\Program Files (x86)\GUMBE3F.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9B713BFF-BE57-3C57-6306-BE2A9048F010}&lang=en&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&installdataindex=defaultbrowser"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:620
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:1876
  - - C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:4596
  - - C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:3252
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjkuMSIgc2hlbGxfdmVyc2lvbj0iMS4zLjI5LjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODExNzQyRjktQjdBQy00MTMzLUJDMEYtQjQ4MjRBQkM5NzA4fSIgdXNlcmlkPSJ7NjVEQzBGOEItQkYzRC00OUJCLUFCNDItQTc5NkQ5QjJBOEMzfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezVBRTkwODNCLTE4ODktNDk0Ri1BQjgxLUU1NzA5MzA3MkI1RX0iIGRlZHVwPSJjciI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzYuMzcxIiBuZXh0dmVyc2lvbj0iMS4zLjI5LjEiIGxhbmc9ImVuIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7OUI3MTNCRkYtQkU1Ny0zQzU3LTYzMDYtQkUyQTkwNDhGMDEwfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI3MDMiLz48L2FwcD48L3JlcXVlc3Q-
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2464
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9B713BFF-BE57-3C57-6306-BE2A9048F010}&lang=en&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&installdataindex=defaultbrowser" /installsource taggedmi /sessionid "{811742F9-B7AC-4133-BC0F-B4824ABC9708}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4416

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:232
- C:\Program Files (x86)\Google\Update\Install\{CE1956CB-9426-4A88-9C72-8B3262E409E4}\127.0.6533.100_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{CE1956CB-9426-4A88-9C72-8B3262E409E4}\127.0.6533.100_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\guiFD8A.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Program Files (x86)\Google\Update\Install\{CE1956CB-9426-4A88-9C72-8B3262E409E4}\CR_9D640.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{CE1956CB-9426-4A88-9C72-8B3262E409E4}\CR_9D640.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{CE1956CB-9426-4A88-9C72-8B3262E409E4}\CR_9D640.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\guiFD8A.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Program Files (x86)\Google\Update\Install\{CE1956CB-9426-4A88-9C72-8B3262E409E4}\CR_9D640.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{CE1956CB-9426-4A88-9C72-8B3262E409E4}\CR_9D640.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=127.0.6533.100 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff697df41f8,0x7ff697df4204,0x7ff697df4210
      4⤵
      Executes dropped EXE
      PID:4732
  - - C:\Program Files (x86)\Google\Update\Install\{CE1956CB-9426-4A88-9C72-8B3262E409E4}\CR_9D640.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{CE1956CB-9426-4A88-9C72-8B3262E409E4}\CR_9D640.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3516
    - - C:\Program Files (x86)\Google\Update\Install\{CE1956CB-9426-4A88-9C72-8B3262E409E4}\CR_9D640.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{CE1956CB-9426-4A88-9C72-8B3262E409E4}\CR_9D640.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=127.0.6533.100 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff697df41f8,0x7ff697df4204,0x7ff697df4210
        5⤵
        Executes dropped EXE
        
        PID:5104
- C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4636
- C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3568
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjkuMSIgc2hlbGxfdmVyc2lvbj0iMS4zLjI5LjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODExNzQyRjktQjdBQy00MTMzLUJDMEYtQjQ4MjRBQkM5NzA4fSIgdXNlcmlkPSJ7NjVEQzBGOEItQkYzRC00OUJCLUFCNDItQTc5NkQ5QjJBOEMzfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0E1Q0ZGQzMzLUFDQTItNDQ1RC04N0YwLTRBQ0E5REUzOTFENn0iIGRlZHVwPSJjciI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M0MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjcuMC42NTMzLjEwMCIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpaWQ9Ins5QjcxM0JGRi1CRTU3LTNDNTctNjMwNi1CRTJBOTA0OEYwMTB9IiBjb2hvcnQ9IjE6Z3UvaTE5OiIgY29ob3J0bmFtZT0iU3RhYmxlIEluc3RhbGxzICZhbXA7IFZlcnNpb24gUGlucyI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9lZGdlZGwubWUuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL2Nocm9tZS9hZHh4NmRianB3dmhibnZicWxqa2phcGNzc3ZxXzEyNy4wLjY1MzMuMTAwLzEyNy4wLjY1MzMuMTAwX2Nocm9tZV9pbnN0YWxsZXIuZXhlIiBkb3dubG9hZGVkPSIxMDY2OTI5ODQiIHRvdGFsPSIxMDY2OTI5ODQiIGRvd25sb2FkX3RpbWVfbXM9Ijg1MTUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI1OTQiIGRvd25sb2FkX3RpbWVfbXM9IjkyMTkiIGRvd25sb2FkZWQ9IjEwNjY5Mjk4NCIgdG90YWw9IjEwNjY5Mjk4NCIgaW5zdGFsbF90aW1lX21zPSIyODMxMyIvPjxkYXRhIG5hbWU9Imluc3RhbGwiIGluZGV4PSJkZWZhdWx0YnJvd3NlciIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4628

C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateOnDemand.exe
"C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateOnDemand.exe" -Embedding
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=127.0.6533.100 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd4857e790,0x7ffd4857e79c,0x7ffd4857e7a8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2068,i,2059230478774852012,14106456820308765117,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2000 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1748,i,2059230478774852012,14106456820308765117,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2156 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4984
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=1240,i,2059230478774852012,14106456820308765117,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2756 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1588
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3012,i,2059230478774852012,14106456820308765117,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3088 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:3192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3020,i,2059230478774852012,14106456820308765117,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3204 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:2644
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4412,i,2059230478774852012,14106456820308765117,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4456 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4668,i,2059230478774852012,14106456820308765117,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4660 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:2724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4984,i,2059230478774852012,14106456820308765117,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4992 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4652,i,2059230478774852012,14106456820308765117,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5180 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5184,i,2059230478774852012,14106456820308765117,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5216 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1856

C:\Program Files\Google\Chrome\Application\127.0.6533.100\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\127.0.6533.100\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GUMBE3F.tmp\GoogleCrashHandler.exe

Filesize
239KB

MD5
7dc16faea44c8d96a1c113305a4059a2

SHA1
c2ec609d2cbeec9c4f15d5497b221a9a5bb4535f

SHA256
9feda3752a98aec53b8e1aa8ca7416e84fe01954b2b40404fa925b7e099d733e

SHA512
e32529445acc1825db8e8c5824487c9dab30581fc13e4ce4a54fce4230c29b6b0b922b6eebe1e6bb141964a5d89e179eeebedf35396d7a430b4d7b7823c78447

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\GoogleCrashHandler64.exe

Filesize
299KB

MD5
73f542663fd48b49a798a56daa18c136

SHA1
017dfabde52be0b33089e38c40ed20e59d3b0373

SHA256
0fb06831bc0b8d32d1c41648bb3318df5fed8ff839ed0222b62937d0d3eb1874

SHA512
01a08765103186ff259555de466827f7b649a4a6bb556d8d67341634b01346c4b316f78fd1ea4fd4836cbed2b21bbe79e077ba62d4a0e9a60f2e4bc3f5fbba8e

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\GoogleUpdate.exe

Filesize
140KB

MD5
88fbbb1c601a6bc42054e57c2897fa45

SHA1
e025a9721b37725e6dc6e069a9335239437b3e7c

SHA256
928c5bab515035de659c4255c209d33c407716da325798951b2e8da9bb230a9f

SHA512
f8858437408fc162b9330c6e04f2ff1b8237e1894d8972b2b2a87573edf04e86aaf49eeffaa4a816289e8a00c0b8befc7d4dd6203bbadda4b9465966e8eadc09

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\GoogleUpdateComRegisterShell64.exe

Filesize
127KB

MD5
5424fdf3776f5458eafaabfb87aa9285

SHA1
5f7a8c5ff1582257d356a404cd6f12c4a6a82aa9

SHA256
bffe720c49c36535b99fee62567118219a304273994fdd3c281dbf504bee6d34

SHA512
cf175d397d18d0c05e7639c99ac4cc4a3ae83dd091f442ba4ccde74d7f0947510b7fb6e09d03cd6ee2d2ac921acee8f7c5508cca7a38193649f457e319dd3663

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\GoogleUpdateHelper.msi

Filesize
44KB

MD5
24bf312f1645b5b5cd4b32adf0b7c773

SHA1
05afbf8067a003028aecaf178cbaf62bd4e0bd3e

SHA256
f49d335308480fa3e22c050dd69e85afbfa2817bbd5a5ec4de8c8b1d6402fe80

SHA512
0db027fe65efd0e24398d2d7a68e47f4d516b3795f43cf7b15283c9602e453367c30fb20f528fc68188c115a627331b563eee2005e4ada44ad9b541f59a56572

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdate.dll

Filesize
1.6MB

MD5
56a9edf0ecef72b4eb446d46808c4bac

SHA1
987b9b497503360f764c306ec6540304716fa48e

SHA256
fd138050b4939a5cab11d160829b80dbbe30f8d8999f8d602b0fdb8c3bac1c78

SHA512
37ce8a64e556f2fb7923c30ef62cdedee3d1954d4a02f7b3102d1c3056afd70f7970aca582ef1b13b499c1b609933d434fcad7502f22ef9064d8799afc2f6a27

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_am.dll

Filesize
37KB

MD5
949cbdd7a39f11c0472089cbde74fecf

SHA1
7a7d4c720099f05ea273fadff162c6407a792b29

SHA256
9c0d513acbcb9ee61e4e388d4a3c158b0a2b2cea9f9cc7851d842ff16483489e

SHA512
30cc095b1886dcea0a04cd308887790f8f8d395e2d7b3a80fd77808e086899197c3ad9a750a8a532401ebf96576f8af37e884203e01fe83b2cd55081da2d2b95

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_ar.dll

Filesize
36KB

MD5
d7fe95e5b8b682b89108c4f1e6231ebb

SHA1
e344291e0ad682ec309c40dd06ab209dc6cf6706

SHA256
3180750de22f2606d51700a53bb5b88c321037103dfb7d88e3ce10e58d79a33f

SHA512
5b57646f7559dd49cd948dacdaa4e35cf410bb68fcb07e0842f5407b50e06bc29d2832aca79970e3b29b3ab83573da5a8b2a14e5bebcc15e019cf0fed788935c

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_bg.dll

Filesize
39KB

MD5
e8da477e6457882058c71182088c92b9

SHA1
c9b427de5e66ec7952e9f815ae9f7a325b43d7e3

SHA256
6e38ee9f780303620bef28a23704651223d2bc158d212a7e3f66f70f0b8ce44c

SHA512
04792dd737e29d092d80b4ae2d0698f307a44507248f967ecdbd7e19470f367267655d4aa6b560573508e8484098420a096d9cd8069ef27b7414a3ec284366cd

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_bn.dll

Filesize
39KB

MD5
cf80cbd346d07fab17e587223be09be0

SHA1
f6868a10a7a79b63e22df7a0ff0be893aea921a2

SHA256
c7d626ca0a2bf3c97a107676b3508e051ffd74ea149290d28a39f27b0880f1ba

SHA512
5f0a12520048a0bafb07867d5f2ea056856565f7a67d004e5a049a49046a559484d1f2724570defd6f57122b985afdbc49830b9ca5e7e9ebe5c4a59f9fbbadf8

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_ca.dll

Filesize
39KB

MD5
48a5e78a7b7e760f1c450cfe98068f7f

SHA1
8ed89dc3d3121d4b12521b1e387d7caf572dda17

SHA256
795fc0cfe8e44e75ac054abc089a8e7865a0a106ccf84551eff547f2447352e4

SHA512
8eabeb943ec167c3f176ce4ad672b37d9c93db851fbf4a2ccb5f33a909b64dc2347c3bc15d02106216dc4efe595e5cfe4400d9de3949e409155ad8ea257d637c

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_cs.dll

Filesize
38KB

MD5
1cc0144a40ebb98a6a56e46c113b5942

SHA1
ed4d434a4fb8945b132e4b29078a29cc93e58dee

SHA256
a7835f9c8bf94a5bd42c0928847e41c79e740fe35b4c2d1fdf5236fef64a99dc

SHA512
1e63c55a8efc37583bc82a777a575c0961bc906d0829697e7685b3ed5950c0ed784c5a38c19167d9b8a2a84bb93f176d4cc9bf6f2ccdc2c639569ce2e673b0ba

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_da.dll

Filesize
38KB

MD5
794b9152881d5adaabc433d078c18995

SHA1
d56200d8635bd62f717820efc28ad36106c9e09c

SHA256
f9692696d0e452a753ba157af10ef9eb70d55ec2880229d0a6ec59cc58c543aa

SHA512
7c15cb35a3b54b1d50ceff5602e3c1a5b3a81bd46dfbac6624e93c59461481214a22dc41c322e84dd59ae88a6b1dbbd785de64fcada0cf1b79a7562df15effc4

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_de.dll

Filesize
40KB

MD5
13f431929b2d1fa8772ebe3b77e0a95a

SHA1
d80ea155362ce810c096bf7e62c3e938e1736eb0

SHA256
3994380cfe6a5b2e4e299f3516226040f4b6b9392faa36efa83a020df2288c54

SHA512
fa862b4fe7412c8c73435aba46371bcf76b0169611cf295ebaddf3030c85f7e603cbe8413004c98edbca41fbb5805c2137d23b649785e9b24885b12950813e39

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_el.dll

Filesize
39KB

MD5
c8224a92933be8a7c6f45a32fe69b24d

SHA1
15ceb922f9bf4605952a3e13b8b12c0ad0baa65f

SHA256
0dbac07b603c1a14b04beb0bf0868df99ec2de47a3494655a057fd98d4b54058

SHA512
27a65d0f079bf483d0e7fa7879cc730fcd5f62b67f89936c21badbb9c64e881496411e4a61fdd8aef8fe97dbc02590045033ec8ee3fd15058d90ad21a4f79379

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_en-GB.dll

Filesize
37KB

MD5
6f6a8775f89f24ef22300c8181da78b8

SHA1
bf7e9bbb85f72e566e3118ff469757d658125e42

SHA256
adc3226e2893d7855a575dc84cc87f180dab45a35e83e82944c0cba0756d4705

SHA512
a73cd8deba133faa736204476461af657fc733433398e6b6744e6e06d38a8183be22768ab3842d90b8858f1c8aa5cdee212f1aefdf55e05f9709d61d3801c584

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_en.dll

Filesize
37KB

MD5
a96f428b9219faf6698c914d7a465d15

SHA1
cac29ba25e9c614b06f642526588c892d54290b9

SHA256
11e531a22bc5cad48a7e1d63b8ec15830c598d30f38c2dc992d362f555aa0b37

SHA512
3967154759d845aa6a3bba7dfec29553790f080fc07ab79a83b4b6ac3e0dbc3ca50fa6d83079832d095ccca586577f9656651e97955cd40b2bd0146ae202d3f9

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_es-419.dll

Filesize
38KB

MD5
1e22b3094af9a935c60c49535686a6ba

SHA1
258b7d36760873074a904179dcffb7cab8b195bb

SHA256
610d9a4567af3da0e9ab12eddb2f5446c66528158aba22d892cc9f0f39c3e851

SHA512
3987332c3b08d8147d1c7d87843704812a111d080e8e8c062a363c40f421bc5dd07b4338dc62bba725f523d978c5e7b3c13db4723c7e25a13efb8caa92c71748

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_es.dll

Filesize
40KB

MD5
575eca90e1d4c16ccc15492c6f0b1679

SHA1
76b0d669aa8881c85daad740d885eb7a6f00d29b

SHA256
d7db60c5d5a3dbb4deb8faa3f769f7e735f5f7f47ca08f4813f4fc7b7d78859d

SHA512
ca7c72854872dc3b12f4cdc66df86c1df9fabd469276fe8a61159a56b44f2500417499dd3b03430d44fc015fec4eb18cfc2881eaa4558cfc6f5c974dfb749087

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_et.dll

Filesize
37KB

MD5
a6d480ba1bd4cf7ac0c0b0f56a3ff0ff

SHA1
aa97867cd16a21e0ecd20779235d7d2c87f6ae3a

SHA256
e41acbc8ea404e0374d7df0d855e467bfad8f9abd7d33df16168860bd807a337

SHA512
126b74d70f23ff462d194466a64bdffcb86d2511445420ac27b8aebd339aeeb8741f36d6bcbbd7e209fee875175360dd7e195091f5a79cf284b549dda9c6f4da

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_fa.dll

Filesize
37KB

MD5
7723919eb0bd3ef37d753ce50fa58a41

SHA1
a456d7de5448b389591c4ec7aafafebcf515d21a

SHA256
d9b9614ec7d25aecdcdc1de3fcf1a48c889dd0e43651eaeb0b5310466ea8d8d9

SHA512
176022e0a1fd3cfd9711ef958c0fec1d0f1400750e6fb132f2caa6537325bbf0e4c1468be8bb5b2c4b6f8e238c318dd5fb737fdd847be10cbfb7890e305f2dab

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_fi.dll

Filesize
38KB

MD5
136657ea12652d31bab3f5b9a264e81e

SHA1
73425e3323d0c19ea5074e0f2244e7afe6cef4e0

SHA256
4f1aaa0d73d6140b167f5be01fa779ca5c5126c56a64f97d2ff1df8e8d360830

SHA512
08b5d13508821ad382bc29b5e96afe79045f4c8f69a548e08859fa2ec543db4e6ffdc0e4d6d7e8b1bf59978487609603daba1f31052c83802d7dd60eb4561387

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_fil.dll

Filesize
39KB

MD5
1c857dd9b882d048e6bead17a34fe158

SHA1
faf2bc953a8d6aab5cdbce808b5ddaf279047de6

SHA256
3f36f76fe9ef6294f0f74c030e4246de5033156c347c78f560f6c01ffb3f80ba

SHA512
972acb2ebd65974cbe2356e0027ce89d3e2fdeb90b5c8d498e952166731d34f5c636f035c879832c46b049e0737b6de9ac52ede8fcd186b44aeeec816fbfc208

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_fr.dll

Filesize
39KB

MD5
271c77932ac715f1afaad0e62f589960

SHA1
5b4c47ac06238fe36871b04bc46c41164b8d3729

SHA256
6aeca6aeceb9ffdd4d336b3a6e6085574134c1dc43a6a4dea5e107f230a7b6c0

SHA512
16dc7df8fca7f70208eb038989d45b14d820e1c91c0270c374148a62d3a40aa02c7f3d62edb998fc9f7548d4b863d9a3af0d39306dc0e1ad732f6170e2bd5954

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_gu.dll

Filesize
39KB

MD5
2cc1d463aa06f6b5f52e3bd899d68487

SHA1
250912f5f8e42039753d23309b790f4897f306f7

SHA256
10b28942c2b1332ce332cefba426ada83f5edf0a742cc84e12062ec614200795

SHA512
041af21e6a7573b8dbc649817cdf1d44f2a6ebeb4c15f42442e7d86986baa394b1db56b7479210a9a91d7762079f0f0b1e470b63738ee97b681e864ac5e04bf6

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_hi.dll

Filesize
38KB

MD5
5693ceb953641059ebcbae48c2352136

SHA1
e272a5bea6a37dd049b045da7afea039b6595982

SHA256
2659f5944739b65af1ede517c3f7ea891b7108cb711f863916ff4e0ab95fa3cf

SHA512
61996c285a3543e370b87985154d93e042d9348c7a115193c8fde35689cbdcc89cf2e05dcbfef1d9ebf2d669b1421e8e424c73be51146d774c6d9fcc9ac88b16

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_hr.dll

Filesize
38KB

MD5
66ef2e938824dbb7235271f1078de85d

SHA1
6775dd3af801f9732cea6a0971c13e7d5d2b79c4

SHA256
0ee944d0f28efd972cb0f9c9f74f77f271f7fc6601fd4c26c47aadae22f55af9

SHA512
d96670fc1c150cf1a6f2ba056ead1e9d3be84e3f2f22cef998c1d89d7b598a282329f05e04e1bee9b1dc6831e0e277e5df72a25829dbc84770c126cc00a714ab

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_hu.dll

Filesize
38KB

MD5
de8ce5c14938e792583904af942957a6

SHA1
248735b31e418819f49ab6e6143e0421cb541e0e

SHA256
cf7ea4616c0133cea443ceb9ba18fe5be29496c2690a6d157048cbdfcc58c006

SHA512
00934dbec015fa66424473d086c77b8fed7474b95f596a26502a21944eedfeeb2ce3fedb0bdff39661513d215fcae6265b96ff4baec6e7c2321c68c2637865eb

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_id.dll

Filesize
37KB

MD5
7a28097be0a4c2a5c3f4adabf1e39a77

SHA1
2e3fbaf0ad99721a1a26edd434e02b7da3961afc

SHA256
2cfcd743e935763e6d4c6e38fa59c66156fa5509c481a682f46d213ee53e303d

SHA512
f09d9aff1235d448b9eac4fdbee97dfdc43c2fddc19219ef9cca464f8e99f3bb74e56eb0460a3e89c57c1e2904f6c96c5e976e196f6be28366b80131f3fb2437

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_is.dll

Filesize
38KB

MD5
64c26403ccab9824c347d471e39fdc26

SHA1
42f61b152d1370aa6a0f0a7ac878d4c8dccc5453

SHA256
519e0040b44b7ae7b25372ff3ca61b508378d98d2f2a324925cf9241d05c2cfd

SHA512
f527dfa5709e90faf87debb43b7bd62f43ac7a1d4adcad9de05c21abd7cd6eafe5d1aaebf408a341bf4681fb025ae2e899feba1fc2569af57e595ace3fff5644

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_it.dll

Filesize
39KB

MD5
0d6766b2dc0b6e757e4db21f18cf8e93

SHA1
5578dc20e1ec3c8c03a00311205c10b0cc7f16ae

SHA256
2c51e3db1da14244ebf92538d5d0d39da73f4dc3e1eac1913f860e8e1783fd0b

SHA512
a05fe06a5ed6a5519c48384d9c16014f0c1f10b97caa064a9cbc99870f51161a04a13760c8fd6642d4c8a9f4af65b6849b7244f19998bad9e6f759c7abffecf7

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_iw.dll

Filesize
35KB

MD5
9acb33ef5dd1ec154d70d424f927f0f0

SHA1
79c76279699678a23c4df9be1af088fef599a6cb

SHA256
483a6793e59cc27f3b711d0fd9e94f6b7ff5d749f819d800fd971a593e6c9d8b

SHA512
a83889f101a63659df14013091e204a57f64f83982012469810a5dbf7c8274f8ee93826ac346c7678791aa8c699c158d4395aa88de1d6d6e6c7814399d6d8ecb

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_ja.dll

Filesize
34KB

MD5
57ae4d67067d45ff30e8e668f4299654

SHA1
5bf26a45199ff75b2712800b522f140fc6ca20f4

SHA256
06b2d0c9b449e0f5386a83ee7aaf9741583918c023445052f0e733c81accf541

SHA512
0926e4efb241f1f0ca38f29972d0fae30cad254e70f4bb5dc6d364c84d0734a95a1b104b4250e7a1b03b771fd1ac8c2d2962f511de5eb9970600d412e00d2539

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_kn.dll

Filesize
39KB

MD5
c6b120e1dc145cdd9c20466fb4f41d59

SHA1
29b6c5678323f00919af7d893cfceaf4441ff8c4

SHA256
cd4f29a02dcd6c040113234fe685fc08ff728850a158319aa49aac346d76b193

SHA512
a61861633d298bd7b597cbbfa760118628548642774b9783bfd4350a2bca5f4fec1f26fc13d42bf7b175a6956da00e944d06af6d8ec0ae6079231d1f37a4917c

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_ko.dll

Filesize
34KB

MD5
8bea945ac0072425751e62d67af193cf

SHA1
ccac417f8864822a7e28a9011993525a63903d87

SHA256
a75abfb69b7a9980a0325a3b0ef13cf6e1cc08e5c660f69b4f445b243ecdbc36

SHA512
21aa8d26cffde22a4c82accb9b61a7885d4ea9fbf9cf85440dc7ed31d3b615d7e196d1d9cbd482ffe784bb5d5e1e6534031d2b4beda517616aabadb470bae490

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_lt.dll

Filesize
37KB

MD5
b9f817aa59e7f216990e28bb2b322822

SHA1
0d87ee49c035a80ed177024fc0a7dc0524591ac1

SHA256
29709aaf8cc71abf20a67137740ec69cccf55775ce1d84b0ed2c1ad726568bfe

SHA512
2bbcfda213022d2c1e4da221c924dbf8250e46562c3c9815792b47238be2d2f33385d868d693557c63cfe377e41bb8419a5eb1b6cc6c064375cd1b662fd3a135

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_lv.dll

Filesize
38KB

MD5
dbe4d2ce3f565621e72e8d51323464c3

SHA1
b92501a3fe3c524712e1e542f09840cafe084390

SHA256
b0ccbf0055df6ac3a65a51b31a80a1be3073e533ceca46ee44b80aa90aec99f4

SHA512
6a8b830643c85c08356da4031b54a4588ebccd850afaa741b553580c9cfb637736e3895a06b01fb49f9e26909ef402988ef3915aea37660b31055c7a99718537

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_ml.dll

Filesize
41KB

MD5
5f94b40090c67f22a3cbc179637d98ff

SHA1
f7d0fdc2115bb5d90aa23ca0ba295cce90cf02f6

SHA256
66fec298e9ac00098b7bb6008c25520b0d86574a2d92f84a5bae383e73e4286f

SHA512
d36a21acae7e5a90ed80e15db0f9202709578356767192a217618367abe7d855b6b9d45ca40541fefd401019a9a6064b50d27c9a164aacd5a230d1ab6ecdb657

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_mr.dll

Filesize
39KB

MD5
736126bc41a068fef010ffdb32161f82

SHA1
737cadaf7ed78b029dbdb188f5065885be4b6f9b

SHA256
d786900a2633b6f1c31d0b710811a6d6ca445513b9a618dba383d0776ed44b86

SHA512
087c9d85ef2060e96d03f6d17358cdc9902d50258be4c18b6c8c1ed755c8eb5e39b0a8c99184709f40c4e375d0713c18b6a9b6838006821ae404d2e6e9dba8df

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_ms.dll

Filesize
37KB

MD5
73866aeee02ec7b1daee1769db41fdcc

SHA1
e51007210ec629b6919ac7ae45f393420c29d43d

SHA256
f58ef79dfd1e74fafcfa291b4c11575a124be1f496e4268823cc21b87332b8df

SHA512
bfe3da23999fd90b22388042b8c0d7297d69f202ebd9b307702d876d6863f981541a234a9b209be7b0c793d67553a74bcc73de34788bc71e3fc92365ca0bd7ac

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_nl.dll

Filesize
39KB

MD5
5b33b8147fa51c3561b8210752ae1535

SHA1
2decd54043009bc46ac059cf31ed6b855df830ff

SHA256
088f0b1d5b1bb3c01e57b6103723e061927ec2af7f8e9bddb29a72dfce86886d

SHA512
88533929c17476d084b678990a1c46f4c8bf8a91d98388b30a1a971dd4a22f09dd5cf63264cc754cdb1cab7ca38bf9b3efe20cc0fcb853c0c7b94e5f7caaebbe

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_no.dll

Filesize
38KB

MD5
86ac9b5b3b0146ec66208453d5bbbad2

SHA1
1980a09a47553d90b2af67551e84cb6000cfb64e

SHA256
b15dcc6bc551bb7b1e2b394eb782794fc165965135180c06dd3582323fd7c4f5

SHA512
5ed2a0899d5eb896fed3a09e698ff57f3a1ae41ab89e906b588f294f6aa0dff01c4257bec13ad31e0362e7520bb07e68ef47e802930bd41ae766955e297eee8f

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_pl.dll

Filesize
38KB

MD5
8d2234c272199bb271300476ebf78b6a

SHA1
039f539d23dfaaabe6520cd5f83f1d638a4f46a1

SHA256
52d9c9582f53dc4574bd8aa502ecc3d7e76317ba996e3813c0aaea56a55ca531

SHA512
8474ef64b767e6f88e3c04734c444122bd12fd49e8c05e5851ba60b89e7b14b9263771644b2e4df9a828f0dd8196fe6d5ce824001ed6d066a9a356a5e43647bc

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_pt-BR.dll

Filesize
38KB

MD5
2ff041fbf7c188568f815f7fb097abe3

SHA1
c4c60c72b5c0369c042738e9136c858bcf74f7a0

SHA256
4006c3460b4f6c3fc4f63f16578e9b599211540874bc615ef341ab06312b136e

SHA512
f6ef39eaa82524bc67450c4cb908af72c9c113452025ef8c5cae3f4bb3ee14a1abae8f96221e36d8d06325733cb955994d64d7adcda911b3398a259a88595811

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_pt-PT.dll

Filesize
38KB

MD5
047eaa80646d93c7b608986cc5c8f492

SHA1
e13d7f084bd8274b24b91f0a5cf580fdd5697e42

SHA256
be321f8e9343b4892d4eb1b86f3a15f4fbe25b90cc3e1381cf05be7bd8990f57

SHA512
0e464b82709041612dabcb54f425aea2d72c0ec73035a18c8424ed25847abc57256aa2e47cd45820593e7007c6cd5896cad616ba082bf21c1899d2265db60494

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_ro.dll

Filesize
38KB

MD5
c0782d9740811e5fef9e2500c7de747f

SHA1
dc8e512407079f60940148db119c49680fbcb3d4

SHA256
37f0d2e905e2314980e1ce573db4a5db3c21d881a495011b731c535086ffa24f

SHA512
0ae3e08795eccfd54e86df8562c8b28bdfc854385f18796871442c7790345d19944b9cba51f25e635e9662b257a876fa6dc1497b9bfe1b9a642bc503b6a82bfd

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_ru.dll

Filesize
37KB

MD5
15c83c84b3771e803b93c33e89c90951

SHA1
f7c49cb987bb25e8535fc02f913d2d9e325ceb4a

SHA256
d680efd7d70374124c7ba3a8f0a229c34717fa0d3302a8ca3a4c6cf0a85e0b7f

SHA512
a25ee6cb2a1de8f4e08c3bd6f55b985687ac5efe9b99658841271a00c49c92d1a2cb2a2ca7bf404672740d650f3c5a66fb05ea84f51f9f10c11d7b24cc749a49

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_sk.dll

Filesize
38KB

MD5
ce675a9fa01132b6028205845537782a

SHA1
cee76d13eb350664c67c30196f0d3a8d90b41f07

SHA256
7cd1408adef514b1f999947766c85497b4f7844ddb61ee767f4b5f70684ab9c3

SHA512
2108baa7365074bf3d00b86008a0d6951f7c7c56d8504b9b1a02d4cbfe4d89e1ca00cd07b4991c56ad52e933776b9147c611d012b5d817d4434cd57700e6ce05

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_sl.dll

Filesize
38KB

MD5
7e353417712ebd0eeb7820f8193aeb3d

SHA1
baac5ab8e5afa79cacbe27dc932b5a36604e9b12

SHA256
0fb51c67042c316139fa0cb423716fc543b161a41cc8c6267e5e06d3d950703f

SHA512
07daf7c3286eaccae419f0eaf5696b21a245ff1399f2d694b070aea3f5dfc8322e1216331be6ed1ca17fb7f282ab4092a62c381d77271fdd80a7faa6aaa4dd92

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_sr.dll

Filesize
38KB

MD5
6583ebd9d5de4b34a38d33d76f7be9fd

SHA1
3513714b396909b455e4657ea7a921254bcda8a9

SHA256
15744393ee61c3b80502ceeb3539512d647585ca4b0d41b1ca0f294b70d497b0

SHA512
0f6aaddd3117a57e8c9728d48105813a8b61f34b4eb5d0f2daa95050484d8da4b09a0bdc2718cf14fedd74cc9cc222ed58fd58d2eb0ab30bb02f2240b92f4940

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_sv.dll

Filesize
38KB

MD5
a81609331cca7de48bc73759ba49f8e1

SHA1
0f44746841d6edaade192fec6779e368b36eb1cf

SHA256
3c318f1ba1f9a22b27be22f71aa14a2ffd143f3c5950c815b459eb4ce9d38c99

SHA512
dfef19dccec8e4c498206052841a9847f860dc831a0ba10ff96961a129a525648223b1eea66d293e8cdf5dbbe5814e56e1094335f047650f9d03091506e2c297

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_sw.dll

Filesize
39KB

MD5
02a8291af1ea81e83d582207bbf6a507

SHA1
1dddaaf8a1768a4dc334887d849fe7b194eb5d2a

SHA256
bf0dfabab8aba1a7245732648582690726ed8477a338deb69b71e1c4f96aa193

SHA512
befbe2fc91cd1c0154a02f410a641ffd5fbea23a2b0e5a2de4c0648db4934c8dccb997466f95fbde6ac39131b812badd124fd2c64348db212d262e65accee5c8

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_ta.dll

Filesize
40KB

MD5
41c8270d368ee70faaa09c68a740f374

SHA1
5336158f5ad120a3f13009726c7658819c19b384

SHA256
1a69b26392f957b9fb2c4b5d89428d8f7adbce6c5a2099c2bc0f13386f5329d0

SHA512
3730a39c90c8fc8eca042318117d5912f80d4780c7a04e7cf7d1f3e839fb02aca7da40a44c2d94cd8436ae4c77068d92137eb13b8edf014a6cb0beecbbbc0db1

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_te.dll

Filesize
39KB

MD5
906338580d30032217acfe7878e0c4ee

SHA1
232a7363e7737c89a3ebf4592575d708083a719c

SHA256
d60d0eb31e988c28311999918f085a054e434fae73714ee46ef5f1595f91735b

SHA512
75eda5dc3efc8f98b7353bce5662d93cabf821aa7e6183872be6115260d805c9c8eb02a085c5f2378364a73cfb44298939fb11bdb3307b02aa8f3b656d1e7186

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_th.dll

Filesize
37KB

MD5
752c0f6f229df85ac24dc097e2f299a9

SHA1
017853b09123bde697e7037d4d369825ca361d75

SHA256
24cc596085ff60228290b1d2aca944856a003db25374ab07409fbb4d8ce8c0c1

SHA512
43de9beb7d73d878b7528dc94edf992c1e7b9ba588bb5753a6f6c18431404d208094d9bdc835cc4a8f212b1b68fdd317a6a23104387ea9c7fe2ba9eaab9c9bc0

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_tr.dll

Filesize
38KB

MD5
a08d5d788adf592857e6518c58d2058f

SHA1
e4487a6a1ae1ee3b661a350626d048b63a09f8c2

SHA256
9659fdcc4c1553071b51af4de21ed14113b6bee6d62a14168d6b595243f8c1c9

SHA512
fd35efabe90758cea5ce204c7b306209390195327f75ebaf94df30e913d68bceb9fd26374a4d9d33e1abceb173fff1eb7b1be43b4bc99fd91db4a944a7aba629

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_uk.dll

Filesize
38KB

MD5
3a44fa2404b4705d95f5b76e2722d877

SHA1
583e73528dccf4159561064693a8436e3a7d6006

SHA256
e3cadfa3da53a8a4b591b919f5d4866d69c14406bdf482a2051b46fb60350917

SHA512
82197b3a5e66821f24a0e1c5f17d610355ed09e268ac5f5fcfc4639327b30c3f2a6c8ea36555f6887e7de87ea32dbcf1779ccf0a5fd727a628d5dcad90691cc7

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_ur.dll

Filesize
38KB

MD5
c7b389dcdcbf45c959a1904edd76eaf7

SHA1
e9d2e54f991dd65b231205808b33484c5d034c76

SHA256
a642cd042b3ab4a7a3f108573d1e6a7d3a766f6d895bca83b7499c6a3d3ac5b6

SHA512
e3763eec8819082280e1f025cc496cce94ed0ad41fde2392212462b29af846ce047baa9747ebb989f4a44d563559dc970b0f4b1d3ca21bb7efb2b99528d4f3eb

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_vi.dll

Filesize
37KB

MD5
082bef93b1f95c8c905e57737b6bdb2e

SHA1
22a1ff4d2487fab3cbdfeae19e5c2ce648942254

SHA256
40b8016613d9b48abcdb6ce2c19928f2a6c114610fe9b0ace90740773a46ed09

SHA512
937663b94534acb09e2578a56179e2ca4c3c1b323e17dfca1edad3c345235577cc6689fe86d20a43cc28a4156a002d3aa148f9774e53de9888125b2c258b3aec

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_zh-CN.dll

Filesize
32KB

MD5
00daa25a9933cd655f4a93685a811bc1

SHA1
f7862de7d192821fda41b153a34069baa5610665

SHA256
3904ab6c2961c55ab9295c2d3a2ea8ca748dcfb379e527af8139b3300ab6cef3

SHA512
9868440f2d3bdf108a7ad37fcabe7e969a5941c2927bea1db48216b5138f7f881267648130994ed85e6dbebcfb378b5334aaf5ca1f16a37ea520bd67f1fdaab1

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\goopdateres_zh-TW.dll

Filesize
32KB

MD5
2d054293e035e00cea8901ae8dabf531

SHA1
daed6cf274c0e34c2f9cc5aae259d43355a61b7e

SHA256
5fa9ca4af42b0e735ad42627c3a002fce6b4e24df9dd185af751795b50ee0ac7

SHA512
abd472655e081c5793514c8aabc52ff6fd83341aabd510279294224c17ed1865a3a861a2c186751035024d060f7b0fd7188defb8f34c74ef084bbc551e7aad90

Download Submit
C:\Program Files (x86)\GUMBE3F.tmp\psuser.dll

Filesize
180KB

MD5
65802ca6026ec0adaf1ac7d550b6b245

SHA1
7b3d40d3cd3cb773b2c86d798e4c1178bcd0032b

SHA256
e55f485b6604f84c22e709f889ad7418ca13136157fce2992b6a8b23a7e52aed

SHA512
ac1fe940ecece4722eb150d2921002140c0d32163698e3c354596b4005f122e9f436c70a043336abbc8ebc87a0266fcfa91c8f9e9690228da0d4801f7628cbdc

Download Submit
C:\Program Files\Google\Chrome\Application\127.0.6533.100\Installer\setup.exe

Filesize
3.9MB

MD5
b499c472671954ea2e05ebb0bf36a9e1

SHA1
56ab7b8252650c96bc32a78a7501d865a95f49bc

SHA256
f575182c29331b37a74a3bce16d11c4a2c9d53794117ea75d09de45f88a22deb

SHA512
d2120bd35ebdc5109d4709d65601527a6eb1f69baf1ae9aaae5d96e708b91944df5cde18d3b5c65d24a0502718ba1a552f18d7a7a2b1af484f1288d4bdd1c504

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2980_164749808\manifest.json

Filesize
95B

MD5
bd035c7120e73a0af34bb632ebfb3a0c

SHA1
6df6c4157bb651a94ec13a503a576104d66204b5

SHA256
3596c6dabff147c2e971f2cce34a96124aae0f6e25861f4d7722e4f460323aa1

SHA512
d2100d63b7b4b9150a63737bb2220aaaa64a741572abce9c03afad18a23adb1b59d82039295014bc94479b48f2aa0b62c4745097d66b7b3cbc0eeea40bb8fc7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation\9008\crl-set

Filesize
21KB

MD5
9c4c48e26677994381daf3a0fe648927

SHA1
68191dcd3a0c3cef9359cfc68e0e1d4384e05d37

SHA256
642cc5788a5b5ed31452d57d9f18d42c9f4576033f6af2c702ca4d9e0174d951

SHA512
ab6d87a7fb6e1f0042aaa30786fac67b7069b4107d3c6b57171267397c793065cd1d34809c8f0a2d8e497c446f803fba6c444a4e812869455c70e0916e2ee607

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b002ac9f8ce115445c6fd819d8fea3a3

SHA1
fee4c2f7b4787c19845ba569abcaeb274c1f8466

SHA256
0e2ff21c386b1a7783c8b078122507221a2eba759627cd3e08cf175f47f010e9

SHA512
5cb8a02df86bd5ec1b2731c77d7770db9370976c01def457cf151bbd38e7d496786281d9fff0d51cf03905adbb579af0154af17d0be15a78bf52031855816211

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
49b26a7d9a815190a53725a843f4fc5b

SHA1
18c9751f98dfd7e3e4138d8fe39f00bca8856065

SHA256
117686361dec3537ace253376cfe6c2133bf89cb373aa98c22a88c31b7bbef48

SHA512
69cb5b081ae711be9c1d2d1d850be948339064c9487ecaa6dd2ad301ef809e52e161283ef4e1502bac02b5b3d04c5f4dd0a5780ec643df1428e0e87d4a075a64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b2c90311372078286db8a2480869e47d

SHA1
be62ac7107fc2a92fb22c5fa2bef509f2d2679b8

SHA256
e2a2503eb719f4ea8f777f675b4a75c28cd0f9221c86826604e6a412a275507f

SHA512
5ac86b5b4c9bc99efdbe9764d608f8906b8613ea8c13296c68c3b558ab6b964ac369073c02e910d3e388a8ed5c893f84fff5ada5a8971b492189037b3426d533

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
b6e08f7803966b16ece0626318d61fd3

SHA1
b9c6f1454e6eaa2be3959f0afd6b6fbb87bcef09

SHA256
289095064103dfb2da553bbb04d1c805871700e2b77df4753ed232828f2d4d32

SHA512
a804106e821ef05512cca4026e2e4773863e6edf517a050fff53ee944b970a949b6ff3408dccbe5d14d168b6ad0ce8bc6e9a8d0504f5826d270e83770f1bcc2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
e3b7c1e7fb0b8120bb43dd98e6a4d31a

SHA1
8c9adb82268b740ba4e5484ffcc9575c093838b2

SHA256
5215b03ad49b395da013eb02d7db9e9b2c08a07c3225905067c5eb95fc185604

SHA512
5798d60c73dfff0ae4e0c9c2206f7c08480efd38e7cc0862d7cd26a1d9d5a30a8a6ccfb31e6807d47218aca9b218079c5a9893ec2f32b039937811f809fec395

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
181KB

MD5
fe39729a12d3a4063fe92ea27f3647c4

SHA1
a481a60c50d200f5daa6f261f53e698a2db0da28

SHA256
932e6225cc3cf62feaeec79b6cb2e541bc9202b3618dd4d6368405b8e9b353af

SHA512
4397697a443ff3dc674eb6ba6f20b60a2a5d65ed8f21b9971ba74ef320b9576dfa782a8ccd751387f1360fb049d25a6537af5976546dd5fb35a6394b1d96061b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
181KB

MD5
c3d91091aa165554b0e9a3dff21f58cf

SHA1
f97e2f315cd5cb41fa42824587388f02d78719aa

SHA256
eebea6d3364bf3da3c2240f56e5497a6af77e76390e98d5b73a064b5d0a763fc

SHA512
f1ed77fee1dabc5b9d15e8f7901d76fe83e599f5112147ded742aa79c5ef3a90c33806547bbd006ff98fb4a319c67ad2c24628303e1fda082c800c50ee61a3df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
6e39a472a6eb643079c76f14ff2fae2c

SHA1
664bd6fd7c7acaec72a68bf23dd42e9d9fb6bb7e

SHA256
dabb97d9b6b7c024b92ad47c6fcf123653d000719ce47aeca9a76245bcb56355

SHA512
826c11636f92df10e552205258e7f88d595debda2c8b88d47465e6594a5512e8d738133cd553ae15ade7660e50f321d795964c19f3e9ef14cad8879da783894a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
184KB

MD5
9e2b871cb75e48c52252bfe9f07ddf46

SHA1
5f5044ad6664876bc52aae250c99bd284d2eae59

SHA256
796224f028047cd440e506c03fe2f520b705c76eeddb1366f1076802b2897265

SHA512
ace1c86aad3d07da9684cf3e926dbe5bfbfb31b1bb6bf3246ce48f18bdf029cdbffe8d2a81f5bc12bf53bd9618ac9552f423e88f13d7ea9f4c095a7788b02349

Download Submit
C:\Windows\Tasks\GoogleUpdateTaskMachineUA{09CDA59F-FF70-4CD4-A3BB-9DDB8093FA7D}.job

Filesize
914B

MD5
df469e8cae0132c1c7a9e35a32266109

SHA1
66c4d06e9d5bb815ff116201c8bb7df9c9d1e910

SHA256
7c1c6ed0f4244450ec663ce32927d330913747cfe0a969f61171f46c1aef55a3

SHA512
c8263f8bba0e36109726b7bc0d94cef8650f50950a6dfc016b01acb5cdacbdbd5687d5ce31acef5e419fe381eadb4cb4600ffaae390504e9a97f4bb37815ce3b

Download Submit
memory/1404-346-0x00000000037D0000-0x00000000037D1000-memory.dmp

Filesize
4KB

Download
memory/1404-75-0x00000000037D0000-0x00000000037D1000-memory.dmp

Filesize
4KB

Download