Malware Analysis Report

2025-03-15 06:40

Sample ID 250111-x272ysyrcl
Target 32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.zip
SHA256 de405e80d59503bf1ac724e65aea61f0c6849311338fa120c9a01354228d0ef9
Tags
paydaytry remcos orcus fivem discovery evasion persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

de405e80d59503bf1ac724e65aea61f0c6849311338fa120c9a01354228d0ef9

Threat Level: Known bad

The file 32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.zip was found to be: Known bad.

Malicious Activity Summary

paydaytry remcos orcus fivem discovery evasion persistence rat spyware stealer trojan

Remcos

Orcus

Orcus main payload

Orcus family

Remcos family

UAC bypass

Orcurs Rat Executable

Adds policy Run key to start application

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious behavior: MapViewOfSection

Modifies registry key

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-11 19:22

Signatures

Remcos family

remcos

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-11 19:22

Reported

2025-01-11 19:25

Platform

win7-20240903-en

Max time kernel

69s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe"

Signatures

Orcus

rat spyware stealer orcus

Orcus family

orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A

Remcos

rat remcos

Remcos family

remcos

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ChromeUpdater = "\"C:\\ProgramData\\GoogleDat\\GoogleUpdate.exe\"" C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ChromeUpdater = "\"C:\\ProgramData\\GoogleDat\\GoogleUpdate.exe\"" C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeUpdater = "\"C:\\ProgramData\\GoogleDat\\GoogleUpdate.exe\"" C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ChromeUpdater = "\"C:\\ProgramData\\GoogleDat\\GoogleUpdate.exe\"" C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeUpdater = "\"C:\\ProgramData\\GoogleDat\\GoogleUpdate.exe\"" C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ChromeUpdater = "\"C:\\ProgramData\\GoogleDat\\GoogleUpdate.exe\"" C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeStarter = "\"C:\\Program Files (x86)\\GoogleChromeUpt\\Updater.exe\"" C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WindowsInput.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe N/A
File created C:\Windows\SysWOW64\WindowsInput.exe.config C:\Users\Admin\AppData\Local\Temp\dwn.exe N/A
File created C:\Windows\SysWOW64\WindowsInput.InstallState C:\Windows\SysWOW64\WindowsInput.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2720 set thread context of 2324 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\svchost.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\GoogleChromeUpt\Updater.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe N/A
File opened for modification C:\Program Files (x86)\GoogleChromeUpt\Updater.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe N/A
File created C:\Program Files (x86)\GoogleChromeUpt\Updater.exe.config C:\Users\Admin\AppData\Local\Temp\dwn.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dwn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2736 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe C:\Windows\SysWOW64\cmd.exe
PID 2892 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2892 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2892 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2892 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2736 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe C:\Windows\SysWOW64\WScript.exe
PID 2736 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe C:\Windows\SysWOW64\WScript.exe
PID 2736 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe C:\Windows\SysWOW64\WScript.exe
PID 2736 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe C:\Windows\SysWOW64\WScript.exe
PID 2828 wrote to memory of 3008 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2828 wrote to memory of 3008 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2828 wrote to memory of 3008 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2828 wrote to memory of 3008 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3008 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\GoogleDat\GoogleUpdate.exe
PID 3008 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\GoogleDat\GoogleUpdate.exe
PID 3008 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\GoogleDat\GoogleUpdate.exe
PID 3008 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\GoogleDat\GoogleUpdate.exe
PID 3008 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\GoogleDat\GoogleUpdate.exe
PID 3008 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\GoogleDat\GoogleUpdate.exe
PID 3008 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\GoogleDat\GoogleUpdate.exe
PID 2720 wrote to memory of 2540 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2540 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2540 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2540 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2540 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2540 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2540 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2324 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\svchost.exe
PID 2720 wrote to memory of 2324 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\svchost.exe
PID 2720 wrote to memory of 2324 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\svchost.exe
PID 2720 wrote to memory of 2324 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\svchost.exe
PID 2720 wrote to memory of 2324 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\svchost.exe
PID 2720 wrote to memory of 2324 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\svchost.exe
PID 2720 wrote to memory of 2324 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\svchost.exe
PID 2720 wrote to memory of 2324 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\svchost.exe
PID 2540 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2540 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2540 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2540 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2540 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2540 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2540 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2720 wrote to memory of 2020 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe
PID 2720 wrote to memory of 2020 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe
PID 2720 wrote to memory of 2020 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe
PID 2720 wrote to memory of 2020 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe
PID 2720 wrote to memory of 2020 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe
PID 2720 wrote to memory of 2020 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe
PID 2720 wrote to memory of 2020 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe
PID 2020 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 2020 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 2020 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 2020 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 2020 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Program Files (x86)\GoogleChromeUpt\Updater.exe
PID 2020 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Program Files (x86)\GoogleChromeUpt\Updater.exe
PID 2020 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Program Files (x86)\GoogleChromeUpt\Updater.exe
PID 2020 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Program Files (x86)\GoogleChromeUpt\Updater.exe
PID 2020 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Program Files (x86)\GoogleChromeUpt\Updater.exe
PID 2020 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Program Files (x86)\GoogleChromeUpt\Updater.exe
PID 2020 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Program Files (x86)\GoogleChromeUpt\Updater.exe
PID 1456 wrote to memory of 1128 N/A C:\Windows\system32\taskeng.exe C:\Program Files (x86)\GoogleChromeUpt\Updater.exe

Processes

C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe

"C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe"

C:\Windows\SysWOW64\cmd.exe

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\GoogleDat\GoogleUpdate.exe"

C:\ProgramData\GoogleDat\GoogleUpdate.exe

C:\ProgramData\GoogleDat\GoogleUpdate.exe

C:\Windows\SysWOW64\cmd.exe

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Users\Admin\AppData\Local\Temp\dwn.exe

"C:\Users\Admin\AppData\Local\Temp\dwn.exe"

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe" --install

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe"

C:\Program Files (x86)\GoogleChromeUpt\Updater.exe

"C:\Program Files (x86)\GoogleChromeUpt\Updater.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {2DC23DB3-8724-4F1F-858E-5DCAEC84ED9F} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]

C:\Program Files (x86)\GoogleChromeUpt\Updater.exe

"C:\Program Files (x86)\GoogleChromeUpt\Updater.exe"

C:\Users\Admin\AppData\Roaming\ChromeDEV.exe

"C:\Users\Admin\AppData\Roaming\ChromeDEV.exe" /launchSelfAndExit "C:\Program Files (x86)\GoogleChromeUpt\Updater.exe" 2160

C:\Users\Admin\AppData\Roaming\ChromeDEV.exe

"C:\Users\Admin\AppData\Roaming\ChromeDEV.exe" /watchProcess "C:\Program Files (x86)\GoogleChromeUpt\Updater.exe" 2160

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef03b9758,0x7fef03b9768,0x7fef03b9778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1100 --field-trial-handle=1272,i,18212366393874763864,11956249384966647313,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1272,i,18212366393874763864,11956249384966647313,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1272,i,18212366393874763864,11956249384966647313,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2272 --field-trial-handle=1272,i,18212366393874763864,11956249384966647313,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2280 --field-trial-handle=1272,i,18212366393874763864,11956249384966647313,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1408 --field-trial-handle=1272,i,18212366393874763864,11956249384966647313,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3324 --field-trial-handle=1272,i,18212366393874763864,11956249384966647313,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3428 --field-trial-handle=1272,i,18212366393874763864,11956249384966647313,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fdc7688,0x13fdc7698,0x13fdc76a8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3744 --field-trial-handle=1272,i,18212366393874763864,11956249384966647313,131072 /prefetch:1

Network

Country Destination Domain Proto
CA 198.50.242.157:443 tcp
CA 198.50.242.157:443 tcp
CA 198.50.242.157:443 tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
CA 198.50.242.157:3846 tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
GB 216.58.213.10:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
BE 74.125.206.94:443 beacons.gcp.gvt2.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\install.vbs

MD5 bb683902f4d897285b9eb79d71a86df6
SHA1 6ca60977902f02b72afd24caa65be77d06692b09
SHA256 1829d2480ab6bbfe942aadf34cb74ccd651427d10a9b51b222923fb921ebfc70
SHA512 edbb9b416ad84ce216ed18db11cbed0b46a079b7b2463e942b809a8a2fe5540eb1101114c5d0944da383c02617dec1017df1235949caf24eb515550f456eaeda

C:\ProgramData\GoogleDat\GoogleUpdate.exe

MD5 991e707e324731f86a43900e34070808
SHA1 5b5afd8cecb865de3341510f38d217f47490eead
SHA256 32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153
SHA512 07411dffbc6beff08a901afa8db3af4bc7d214407f7b20a8570e16b3900f512ad8ee2d04e31bb9d870585b9825e9102078f6c40eb6df292f09fffe57eea37f79

memory/2324-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2324-12-0x0000000000090000-0x000000000010F000-memory.dmp

memory/2324-15-0x0000000000090000-0x000000000010F000-memory.dmp

memory/2324-13-0x0000000000090000-0x000000000010F000-memory.dmp

\Users\Admin\AppData\Local\Temp\dwn.exe

MD5 233df6b3803532e93dc307f6739dbcfc
SHA1 33d32253477f35e01763207b59d60fdaa3f24581
SHA256 1b0f1c3f410211b515d0f61bb0c9fcdbf71287fe73a0feb2ba27a9e51ffdee02
SHA512 0d1bd2ab3a37bd3840121001097de98ec8680e79bbc3edcaf4bd77e0b115b5e9fb6945f5897172c554a44ffdbfc8af4afa9914ec11c8259322e927a8c49ef345

memory/2020-26-0x00000000011A0000-0x000000000128C000-memory.dmp

memory/2020-27-0x0000000000330000-0x000000000033E000-memory.dmp

memory/2020-28-0x0000000000FB0000-0x000000000100C000-memory.dmp

memory/2020-29-0x0000000000640000-0x0000000000652000-memory.dmp

memory/2020-30-0x00000000006A0000-0x00000000006A8000-memory.dmp

\Windows\SysWOW64\WindowsInput.exe

MD5 e6fcf516d8ed8d0d4427f86e08d0d435
SHA1 c7691731583ab7890086635cb7f3e4c22ca5e409
SHA256 8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512 c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

C:\Windows\SysWOW64\WindowsInput.exe.config

MD5 a2b76cea3a59fa9af5ea21ff68139c98
SHA1 35d76475e6a54c168f536e30206578babff58274
SHA256 f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512 b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

memory/1640-39-0x00000000002A0000-0x00000000002AC000-memory.dmp

memory/1560-43-0x0000000000FE0000-0x0000000000FEC000-memory.dmp

memory/2160-56-0x0000000001240000-0x000000000132C000-memory.dmp

memory/2160-59-0x0000000000940000-0x000000000098E000-memory.dmp

memory/2160-60-0x00000000009E0000-0x00000000009F8000-memory.dmp

memory/2160-61-0x0000000000A00000-0x0000000000A10000-memory.dmp

\Users\Admin\AppData\Roaming\ChromeDEV.exe

MD5 913967b216326e36a08010fb70f9dba3
SHA1 7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA256 8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512 c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

memory/1704-74-0x0000000000FB0000-0x0000000000FB8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabF20.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/2928-98-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2928-99-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2928-103-0x0000000140000000-0x00000001405E8000-memory.dmp

\??\pipe\crashpad_2316_XNWNZKRZXGQTUHXX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

MD5 d79b35ccf8e6af6714eb612714349097
SHA1 eb3ccc9ed29830df42f3fd129951cb8b791aaf98
SHA256 c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365
SHA512 f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6b2758fda62d5948f589a5380f9d0912
SHA1 13e40a1e267fc664f90d5e2b66012fc8ebc902f0
SHA256 daa0bae61a4bcff5f08cc4571f4e0c61abcd01222bb2e2360047704464cb4f11
SHA512 8ab3f5fdef55099c1f663c5e0fb56d2bd709f52f93911506192c50c934695bfdaeea23267c9ce2c94468878fb5302837628ce393494e002135090db9092fea34

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 6d83401da29a80d1823700bc28468138
SHA1 9406af12ab10297588f15b9b56f995d59e45815b
SHA256 4450e16ddc3f185b28f7487c4fe8420f252df28b531efa5058f0bec76fefc948
SHA512 d8a9e988e10813eef04ecdb9f228d242da649642f0c7220a62c093ceda1e620db7445daf6ae9abfba91b92c4bae81f143927f8b20206aa864210328385b121c5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 f7af4a1f500bcad2c616559ca6b05e3f
SHA1 47664085cfaea02a0d94636204827b8759b81a62
SHA256 d35794e661c2078fa4d72ebf7da0554ec8f1543e657e1f94d8d1d848d804e193
SHA512 0dbaf07b31cc2b2f5b281f241b1c0483aad4e59aa200f5b70b5fd5dcb39996db5a28c9ee16b72d7e71f637d382f3612580d9c0f0c647c4acc4e8a7475c6c4283

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

MD5 ca9e4686e278b752e1dec522d6830b1f
SHA1 1129a37b84ee4708492f51323c90804bb0dfed64
SHA256 b36086821f07e11041fc44b05d2cafe3fb756633e72b07da453c28bd4735ed26
SHA512 600e5d6e1df68423976b1dcfa99e56cb8b8f5cd008d52482fefb086546256a9822025d75f5b286996b19ee1c7cd254f476abf4de0cf8c6205d9f7d5e49b80671

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 9d62738d443a478e2f5585984d40226e
SHA1 9c52f7f7a63a54fa79cf9022748fec9c0f4cfb3b
SHA256 56c8249e51fbf032735cd6affa8950d116ba9334bbb7ebdbd05f1f97aca10159
SHA512 716993e41e6de847916886a9f983787ee76176e74b308cf82bdedda4e2689d62420e99a4023640b8767bb848afe10dd7acd57ef495720a027a1434d0e9347ca5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\190a3e0c18021212_0

MD5 ee397a6157c3aef2f974fd8e85a4e987
SHA1 8c54700831eeffe75a0336a3645cc254f02a3e27
SHA256 9d4d507205ac1d3765d2386c941f2aba6179ca6188a20ede16744fa32b848de6
SHA512 23a5d6e19aabf747f21cf6d77c84195afb7fb60b97abd01c8b8bc8fb37f9f58251a0a4bcf4cef1eb06b7dde2e8d23ad970413d2d5cda329f23422571b2f7fa09

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2d62f54a9f132af6_0

MD5 3a5f654e8f3666caa3d97359b3ae1469
SHA1 83c3c1d0063531d7440e6a74e49ba98165f9937a
SHA256 b8574d37e38237538378e3e7e50d3ad7e4f766762ce91e82854e4334ddfae5e5
SHA512 6c9accd884e9b9a05949ebf35fe3b03f01e555575673ac6a75845460f7aac85c83230206a74bc8372f7dd5a207a0006f2c10a395e00ae671c3b8ff628f2b0b69

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\4083b9ba3259033e_0

MD5 87be6bf9e9c878e487337ac86313bcd1
SHA1 02505f94c988c304e4ef08f83f03f40e37582dc2
SHA256 1382589349c1c90111e89bb3e840bb40221a605fe2d29a9248f5b34fceea2771
SHA512 1619b649a00a62702704fd3b10a43ee7c4d81119502669778f76fbd4d90370eea9f22df251d6bf128b900e91aff263b13d01a618fd1ad3922b01cdfe7e0e469f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f3ae0d23e488645b_0

MD5 0b7ef38e58b37a3ef39c2f0a73cc6254
SHA1 92766cbfd3ce958e1a1fd7642f942ae34c9409a4
SHA256 d068dc2dd762164a8b7a4667c49b4984ff7aca2f031e4cb164eb87442765a891
SHA512 e56504755bcccce1633625090fd4c380bd24ce2af70225cb2ec80c91e75daf273fb2eb0248da9f6faf29f17c7699f0f91af0a30d901efa9dee83e73672b89bb1

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-11 19:22

Reported

2025-01-11 19:25

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe"

Signatures

Orcus

rat spyware stealer orcus

Orcus family

orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A

Remcos

rat remcos

Remcos family

remcos

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ChromeUpdater = "\"C:\\ProgramData\\GoogleDat\\GoogleUpdate.exe\"" C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ChromeUpdater = "\"C:\\ProgramData\\GoogleDat\\GoogleUpdate.exe\"" C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\dwn.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChromeUpdater = "\"C:\\ProgramData\\GoogleDat\\GoogleUpdate.exe\"" C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ChromeUpdater = "\"C:\\ProgramData\\GoogleDat\\GoogleUpdate.exe\"" C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChromeUpdater = "\"C:\\ProgramData\\GoogleDat\\GoogleUpdate.exe\"" C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ChromeUpdater = "\"C:\\ProgramData\\GoogleDat\\GoogleUpdate.exe\"" C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChromeStarter = "\"C:\\Program Files (x86)\\GoogleChromeUpt\\Updater.exe\"" C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WindowsInput.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe N/A
File created C:\Windows\SysWOW64\WindowsInput.exe.config C:\Users\Admin\AppData\Local\Temp\dwn.exe N/A
File created C:\Windows\SysWOW64\WindowsInput.InstallState C:\Windows\SysWOW64\WindowsInput.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1852 set thread context of 3788 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\svchost.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\GoogleChromeUpt\Updater.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe N/A
File created C:\Program Files (x86)\GoogleChromeUpt\Updater.exe.config C:\Users\Admin\AppData\Local\Temp\dwn.exe N/A
File created C:\Program Files (x86)\GoogleChromeUpt\Updater.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dwn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2932 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe C:\Windows\SysWOW64\cmd.exe
PID 432 wrote to memory of 4484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 432 wrote to memory of 4484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 432 wrote to memory of 4484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2932 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe C:\Windows\SysWOW64\WScript.exe
PID 2932 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe C:\Windows\SysWOW64\WScript.exe
PID 2932 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe C:\Windows\SysWOW64\WScript.exe
PID 4880 wrote to memory of 1668 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4880 wrote to memory of 1668 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4880 wrote to memory of 1668 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1668 wrote to memory of 1852 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\GoogleDat\GoogleUpdate.exe
PID 1668 wrote to memory of 1852 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\GoogleDat\GoogleUpdate.exe
PID 1668 wrote to memory of 1852 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\GoogleDat\GoogleUpdate.exe
PID 1852 wrote to memory of 2804 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 1852 wrote to memory of 2804 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 1852 wrote to memory of 2804 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\cmd.exe
PID 1852 wrote to memory of 3788 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\svchost.exe
PID 1852 wrote to memory of 3788 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\svchost.exe
PID 1852 wrote to memory of 3788 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\svchost.exe
PID 1852 wrote to memory of 3788 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Windows\SysWOW64\svchost.exe
PID 2804 wrote to memory of 4976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2804 wrote to memory of 4976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2804 wrote to memory of 4976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1852 wrote to memory of 3916 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe
PID 1852 wrote to memory of 3916 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe
PID 1852 wrote to memory of 3916 N/A C:\ProgramData\GoogleDat\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\dwn.exe
PID 3916 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 3916 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 3916 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Program Files (x86)\GoogleChromeUpt\Updater.exe
PID 3916 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Program Files (x86)\GoogleChromeUpt\Updater.exe
PID 3916 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\dwn.exe C:\Program Files (x86)\GoogleChromeUpt\Updater.exe
PID 2192 wrote to memory of 892 N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe C:\Users\Admin\AppData\Roaming\ChromeDEV.exe
PID 2192 wrote to memory of 892 N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe C:\Users\Admin\AppData\Roaming\ChromeDEV.exe
PID 2192 wrote to memory of 892 N/A C:\Program Files (x86)\GoogleChromeUpt\Updater.exe C:\Users\Admin\AppData\Roaming\ChromeDEV.exe
PID 892 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe C:\Users\Admin\AppData\Roaming\ChromeDEV.exe
PID 892 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe C:\Users\Admin\AppData\Roaming\ChromeDEV.exe
PID 892 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Roaming\ChromeDEV.exe C:\Users\Admin\AppData\Roaming\ChromeDEV.exe

Processes

C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe

"C:\Users\Admin\AppData\Local\Temp\32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153.exe"

C:\Windows\SysWOW64\cmd.exe

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\GoogleDat\GoogleUpdate.exe"

C:\ProgramData\GoogleDat\GoogleUpdate.exe

C:\ProgramData\GoogleDat\GoogleUpdate.exe

C:\Windows\SysWOW64\cmd.exe

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Users\Admin\AppData\Local\Temp\dwn.exe

"C:\Users\Admin\AppData\Local\Temp\dwn.exe"

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe" --install

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe"

C:\Program Files (x86)\GoogleChromeUpt\Updater.exe

"C:\Program Files (x86)\GoogleChromeUpt\Updater.exe"

C:\Program Files (x86)\GoogleChromeUpt\Updater.exe

"C:\Program Files (x86)\GoogleChromeUpt\Updater.exe"

C:\Users\Admin\AppData\Roaming\ChromeDEV.exe

"C:\Users\Admin\AppData\Roaming\ChromeDEV.exe" /launchSelfAndExit "C:\Program Files (x86)\GoogleChromeUpt\Updater.exe" 2192

C:\Users\Admin\AppData\Roaming\ChromeDEV.exe

"C:\Users\Admin\AppData\Roaming\ChromeDEV.exe" /watchProcess "C:\Program Files (x86)\GoogleChromeUpt\Updater.exe" 2192

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
CA 198.50.242.157:443 tcp
CA 198.50.242.157:443 tcp
CA 198.50.242.157:443 tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 157.242.50.198.in-addr.arpa udp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
CA 198.50.242.157:3846 tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 206.68.20.2.in-addr.arpa udp
US 8.8.8.8:53 101.250.72.23.in-addr.arpa udp
US 8.8.8.8:53 73.250.72.23.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\install.vbs

MD5 bb683902f4d897285b9eb79d71a86df6
SHA1 6ca60977902f02b72afd24caa65be77d06692b09
SHA256 1829d2480ab6bbfe942aadf34cb74ccd651427d10a9b51b222923fb921ebfc70
SHA512 edbb9b416ad84ce216ed18db11cbed0b46a079b7b2463e942b809a8a2fe5540eb1101114c5d0944da383c02617dec1017df1235949caf24eb515550f456eaeda

C:\ProgramData\GoogleDat\GoogleUpdate.exe

MD5 991e707e324731f86a43900e34070808
SHA1 5b5afd8cecb865de3341510f38d217f47490eead
SHA256 32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153
SHA512 07411dffbc6beff08a901afa8db3af4bc7d214407f7b20a8570e16b3900f512ad8ee2d04e31bb9d870585b9825e9102078f6c40eb6df292f09fffe57eea37f79

memory/3788-8-0x0000000000370000-0x00000000003EF000-memory.dmp

memory/3788-9-0x0000000000370000-0x00000000003EF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dwn.exe

MD5 233df6b3803532e93dc307f6739dbcfc
SHA1 33d32253477f35e01763207b59d60fdaa3f24581
SHA256 1b0f1c3f410211b515d0f61bb0c9fcdbf71287fe73a0feb2ba27a9e51ffdee02
SHA512 0d1bd2ab3a37bd3840121001097de98ec8680e79bbc3edcaf4bd77e0b115b5e9fb6945f5897172c554a44ffdbfc8af4afa9914ec11c8259322e927a8c49ef345

memory/3916-22-0x0000000000210000-0x00000000002FC000-memory.dmp

memory/3916-23-0x0000000002750000-0x000000000275E000-memory.dmp

memory/3916-24-0x0000000004B60000-0x0000000004BBC000-memory.dmp

memory/3916-25-0x0000000005480000-0x0000000005A24000-memory.dmp

memory/3916-26-0x0000000004CD0000-0x0000000004D62000-memory.dmp

memory/3916-27-0x00000000051D0000-0x00000000051E2000-memory.dmp

memory/3916-28-0x00000000051E0000-0x00000000051E8000-memory.dmp

memory/3916-29-0x0000000005230000-0x0000000005252000-memory.dmp

C:\Windows\SysWOW64\WindowsInput.exe

MD5 e6fcf516d8ed8d0d4427f86e08d0d435
SHA1 c7691731583ab7890086635cb7f3e4c22ca5e409
SHA256 8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512 c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

C:\Windows\SysWOW64\WindowsInput.exe.config

MD5 a2b76cea3a59fa9af5ea21ff68139c98
SHA1 35d76475e6a54c168f536e30206578babff58274
SHA256 f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512 b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

memory/2432-43-0x0000000000210000-0x000000000021C000-memory.dmp

memory/2432-44-0x00000000009F0000-0x0000000000A02000-memory.dmp

memory/2432-45-0x0000000002310000-0x000000000234C000-memory.dmp

memory/3108-50-0x000000001ACD0000-0x000000001ADDA000-memory.dmp

memory/2192-66-0x0000000005C60000-0x0000000005CAE000-memory.dmp

memory/2192-68-0x0000000005D20000-0x0000000005D38000-memory.dmp

memory/2192-69-0x00000000067C0000-0x0000000006982000-memory.dmp

memory/2192-70-0x00000000065F0000-0x0000000006600000-memory.dmp

memory/2192-71-0x00000000069C0000-0x00000000069CA000-memory.dmp

C:\Users\Admin\AppData\Roaming\ChromeDEV.exe

MD5 913967b216326e36a08010fb70f9dba3
SHA1 7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA256 8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512 c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

memory/892-85-0x0000000000F90000-0x0000000000F98000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ChromeDEV.exe.log

MD5 4eaca4566b22b01cd3bc115b9b0b2196
SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

memory/2192-93-0x00000000079B0000-0x0000000007A16000-memory.dmp

memory/2192-94-0x0000000008040000-0x0000000008658000-memory.dmp

memory/2192-95-0x0000000007A20000-0x0000000007A32000-memory.dmp

memory/2192-96-0x0000000007A80000-0x0000000007ABC000-memory.dmp

memory/2192-97-0x0000000007AC0000-0x0000000007B0C000-memory.dmp

memory/2192-98-0x0000000007C40000-0x0000000007D4A000-memory.dmp