Malware Analysis Report

2025-03-15 03:50

Sample ID 250221-2rslqstqt5
Target Chrome.msi
SHA256 1924b09ff1e25fe9d39bad70f094766863f366543658627fe94f435b07da6109
Tags
blackmoon fatalrat banker discovery infostealer persistence privilege_escalation rat spyware stealer trojan vmprotect
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1924b09ff1e25fe9d39bad70f094766863f366543658627fe94f435b07da6109

Threat Level: Known bad

The file Chrome.msi was found to be: Known bad.

Malicious Activity Summary

blackmoon fatalrat banker discovery infostealer persistence privilege_escalation rat spyware stealer trojan vmprotect

Blackmoon, KrBanker

Fatalrat family

Blackmoon family

FatalRat

Detect Blackmoon payload

Fatal Rat payload

VMProtect packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Event Triggered Execution: Image File Execution Options Injection

Drops file in System32 directory

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Loads dropped DLL

Checks system information in the registry

Drops file in Windows directory

Checks installed software on the system

Drops file in Program Files directory

Executes dropped EXE

System Network Configuration Discovery: Internet Connection Discovery

System Location Discovery: System Language Discovery

Reads user/profile data of web browsers

Enumerates physical storage devices

Browser Information Discovery

Event Triggered Execution: Installer Packages

Modifies data under HKEY_USERS

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Uses Volume Shadow Copy service COM API

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Checks processor information in registry

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-21 22:49

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-21 22:49

Reported

2025-02-21 22:51

Platform

win7-20240903-en

Max time kernel

149s

Max time network

150s

Command Line

C:\Windows\system32\svchost.exe -k DcomLaunch

Signatures

Blackmoon family

blackmoon

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

FatalRat

stealer trojan fatalrat

Fatalrat family

fatalrat

Fatal Rat payload

rat infostealer
Description Indicator Process Target
N/A N/A N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96} C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome" C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome" C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1" C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0" C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A

Event Triggered Execution: Image File Execution Options Injection

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0" C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Checks installed software on the system

discovery

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\Locales\sr.pak C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\SETUP.EX_ C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\109.0.5414.120_chrome_installer.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\Locales\nl.pak C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\Locales\sl.pak C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_fr.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_et.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_hi.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\default_apps\external_extensions.json C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\icudtl.dat C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\Locales\ar.pak C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\VisualElements\SmallLogoCanary.png C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\psuser_64.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_el.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_th.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_es-419.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_ml.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_vi.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ko.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_no.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\libEGL.dll C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdate.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_bn.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_da.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_es-419.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_it.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\Locales\ru.pak C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_ar.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_gu.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_uk.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\chrome_100_percent.pak C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\chrome.dll C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdateOnDemand.exe C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\Locales\uk.pak C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\109.0.5414.120_chrome_installer.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_en.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ru.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\chrome.exe.sig C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_ja.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_kn.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_gu.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ta.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\elevation_service.exe C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdateComRegisterShell64.exe C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_fi.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\psuser.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\Locales\nb.pak C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_es.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_ro.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_zh-CN.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_bg.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\vulkan-1.dll C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_is.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_lt.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\psmachine_64.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\chrome.VisualElementsManifest.xml C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_te.dll C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\CHROME.PACKED.7Z C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\109.0.5414.120_chrome_installer.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\Locales\sk.pak C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2592_1612945372\Chrome-bin\109.0.5414.120\VisualElements\LogoCanary.png C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI2CAF.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2D7A.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2E17.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev3 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev1 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\Installer\f772acb.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f772acb.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f772ac8.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f772ac8.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2B16.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2BE2.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2C21.tmp C:\Windows\system32\msiexec.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\setup\aa.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe N/A
N/A N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe N/A
N/A N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe N/A
N/A N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\setup\setup.exe N/A
N/A N/A C:\ProgramData\Smart\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\109.0.5414.120_chrome_installer.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\ProgramData\Smart\setup.exe N/A
N/A N/A C:\ProgramData\Smart\setup.exe N/A
N/A N/A C:\ProgramData\Smart\setup.exe N/A
N/A N/A C:\ProgramData\setup\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\ProgramData\Smart\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\ProgramData\Smart\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\ProgramData\Smart\setup.exe N/A
N/A N/A C:\ProgramData\Smart\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\ProgramData\Smart\setup.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\ProgramData\Smart\setup.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\109.0.5414.120_chrome_installer.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

persistence privilege_escalation
Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A

Reads user/profile data of web browsers

spyware stealer

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Smart\setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\NVIDIARV\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\NVIDIARV\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\NVIDIARV\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\setup\setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\DrvInst.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Group = "Fatal" C:\ProgramData\NVIDIARV\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\ C:\ProgramData\NVIDIARV\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\InstallTime = "2025-02-21 22:49" C:\ProgramData\NVIDIARV\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\DrvInst.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ = "IAppVersionWeb" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0 C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\LocalService = "gupdatem" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\GoogleUpdateOnDemand.exe\"" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods\ = "24" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods\ = "10" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\ProgID\ = "GoogleUpdate.CredentialDialogMachine.1.0" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods\ = "8" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\goopdate.dll,-3000" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithProgIds\ChromeHTML C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass\CurVer\ = "GoogleUpdate.CoreClass.1" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods\ = "10" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CredentialDialogMachine.1.0\CLSID\ = "{25461599-633D-42B1-84FB-7CD68D026E53}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods\ = "10" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\.xhtml C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{27634814-8E41-4C35-8577-980134A96544}\ = "IPolicyStatusValue" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E}\InprocHandler32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoCreateAsync.1.0\ = "CoCreateAsync" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ = "ICurrentState" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreMachineClass\CLSID\ = "{9B2340A0-4068-43D6-B404-32E27217859D}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\Elevation C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\ProgID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML\Application\AppUserModelId = "Chrome" C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods\ = "11" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\Elevation C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.ProcessLauncher\ = "Google Update Process Launcher Class" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ = "IApp" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\VersionIndependentProgID\ = "GoogleUpdate.OnDemandCOMClassMachineFallback" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\.shtml C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\.xht\OpenWithProgids C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\ProgramData\Smart\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\ProgramData\Smart\setup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1100 wrote to memory of 3068 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1100 wrote to memory of 3068 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1100 wrote to memory of 3068 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1100 wrote to memory of 3068 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1100 wrote to memory of 3068 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1100 wrote to memory of 3068 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1100 wrote to memory of 3068 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3068 wrote to memory of 1836 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 1836 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 1836 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 1836 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\cmd.exe
PID 1836 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1836 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1836 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1836 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1836 wrote to memory of 1628 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\aa.exe
PID 1836 wrote to memory of 1628 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\aa.exe
PID 1836 wrote to memory of 1628 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\aa.exe
PID 1836 wrote to memory of 1628 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\aa.exe
PID 1836 wrote to memory of 2260 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Packas\scrok.exe
PID 1836 wrote to memory of 2260 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Packas\scrok.exe
PID 1836 wrote to memory of 2260 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Packas\scrok.exe
PID 1836 wrote to memory of 2260 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Packas\scrok.exe
PID 2260 wrote to memory of 600 N/A C:\ProgramData\Packas\scrok.exe C:\Windows\system32\svchost.exe
PID 1836 wrote to memory of 2984 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 1836 wrote to memory of 2984 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 1836 wrote to memory of 2984 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 1836 wrote to memory of 2984 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 1836 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 1836 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 1836 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 1836 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 1836 wrote to memory of 1544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1836 wrote to memory of 1544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1836 wrote to memory of 1544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1836 wrote to memory of 1544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1836 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 1836 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 1836 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 1836 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 1836 wrote to memory of 1336 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Packas\scrok.exe
PID 1836 wrote to memory of 1336 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Packas\scrok.exe
PID 1836 wrote to memory of 1336 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Packas\scrok.exe
PID 1836 wrote to memory of 1336 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Packas\scrok.exe
PID 1336 wrote to memory of 600 N/A C:\ProgramData\Packas\scrok.exe C:\Windows\system32\svchost.exe
PID 1836 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\setup.exe
PID 1836 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\setup.exe
PID 1836 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\setup.exe
PID 1836 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\setup.exe
PID 1836 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\setup.exe
PID 1836 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\setup.exe
PID 1836 wrote to memory of 2292 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\setup.exe
PID 1348 wrote to memory of 2168 N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe C:\ProgramData\Smart\setup.exe
PID 1348 wrote to memory of 2168 N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe C:\ProgramData\Smart\setup.exe
PID 1348 wrote to memory of 2168 N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe C:\ProgramData\Smart\setup.exe
PID 1348 wrote to memory of 2168 N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe C:\ProgramData\Smart\setup.exe
PID 1348 wrote to memory of 2168 N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe C:\ProgramData\Smart\setup.exe
PID 1348 wrote to memory of 2168 N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe C:\ProgramData\Smart\setup.exe
PID 1348 wrote to memory of 2168 N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe C:\ProgramData\Smart\setup.exe
PID 2292 wrote to memory of 2940 N/A C:\ProgramData\setup\setup.exe C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe
PID 2292 wrote to memory of 2940 N/A C:\ProgramData\setup\setup.exe C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe
PID 2292 wrote to memory of 2940 N/A C:\ProgramData\setup\setup.exe C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe
PID 2292 wrote to memory of 2940 N/A C:\ProgramData\setup\setup.exe C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe
PID 2292 wrote to memory of 2940 N/A C:\ProgramData\setup\setup.exe C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Chrome.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\DrvInst.exe

DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005D4" "00000000000005D0"

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 24DB81810547B727DC96C94686501518

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\SysWOW64\cmd.exe" /c timeout /nobreak /t 7 & C:\ProgramData\setup\aa.exe x C:\ProgramData\setup\ddd. -key 000000 -f -to C:\ProgramData & C:\ProgramData\Packas\scrok.exe & C:\ProgramData\Smart\TjNkNpAilaYvt.exe install & C:\ProgramData\Smart\TjNkNpAilaYvt.exe install & timeout /nobreak /t 2 & C:\ProgramData\Smart\TjNkNpAilaYvt.exe start & C:\ProgramData\Packas\scrok.exe & del C:\ProgramData\Packas\scrok.exe & C:\ProgramData\setup\setup.exe

C:\Windows\SysWOW64\timeout.exe

timeout /nobreak /t 7

C:\ProgramData\setup\aa.exe

C:\ProgramData\setup\aa.exe x C:\ProgramData\setup\ddd. -key 000000 -f -to C:\ProgramData

C:\ProgramData\Packas\scrok.exe

C:\ProgramData\Packas\scrok.exe

C:\ProgramData\Smart\TjNkNpAilaYvt.exe

C:\ProgramData\Smart\TjNkNpAilaYvt.exe install

C:\ProgramData\Smart\TjNkNpAilaYvt.exe

C:\ProgramData\Smart\TjNkNpAilaYvt.exe install

C:\Windows\SysWOW64\timeout.exe

timeout /nobreak /t 2

C:\ProgramData\Smart\TjNkNpAilaYvt.exe

C:\ProgramData\Smart\TjNkNpAilaYvt.exe start

C:\ProgramData\Smart\TjNkNpAilaYvt.exe

"C:\ProgramData\Smart\TjNkNpAilaYvt.exe"

C:\ProgramData\Packas\scrok.exe

C:\ProgramData\Packas\scrok.exe

C:\ProgramData\setup\setup.exe

C:\ProgramData\setup\setup.exe

C:\ProgramData\Smart\setup.exe

"C:\ProgramData\Smart\setup.exe"

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9F0C1F44-1C50-396A-483A-08DA4896FF0B}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver

C:\ProgramData\NVIDIARV\svchost.exe

"C:\ProgramData\NVIDIARV\svchost.exe"

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"

C:\ProgramData\NVIDIARV\svchost.exe

"C:\ProgramData\NVIDIARV\svchost.exe"

C:\ProgramData\NVIDIARV\svchost.exe

"C:\ProgramData\NVIDIARV\svchost.exe"

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkMwQ0MzQUEtQzg2Qi00MjYyLTlBNzAtMDY5QzlEMzc2ODI0fSIgdXNlcmlkPSJ7NzQwMjkyNTMtRTA2MC00OUIyLTlCMTUtNTE4NzNDNzJEN0E1fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0JENDc5NEFDLUNDRTMtNEZBRS05NkUxLTMzMjBGNUNGMTIxNX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjE1MSIgbmV4dHZlcnNpb249IjEuMy4zNi4zMTIiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7OUYwQzFGNDQtMUM1MC0zOTZBLTQ4M0EtMDhEQTQ4OTZGRjBCfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMjk1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9F0C1F44-1C50-396A-483A-08DA4896FF0B}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{2C0CC3AA-C86B-4262-9A70-069C9D376824}"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc

C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\109.0.5414.120_chrome_installer.exe

"C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\109.0.5414.120_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\guiE590.tmp"

C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\guiE590.tmp"

C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13ff31148,0x13ff31158,0x13ff31168

C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=2 --install-level=1

C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{652AE1F2-94A9-46B0-8D31-A5BDAE10E44B}\CR_4C856.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13ff31148,0x13ff31158,0x13ff31168

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe"

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkMwQ0MzQUEtQzg2Qi00MjYyLTlBNzAtMDY5QzlEMzc2ODI0fSIgdXNlcmlkPSJ7NzQwMjkyNTMtRTA2MC00OUIyLTlCMTUtNTE4NzNDNzJEN0E1fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0Q4MTVBMDkyLUNDREEtNDI3MS1CNjQwLUI3RERCMUU5QzZFMH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTA5LjAuNTQxNC4xMjAiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTcxIiBpaWQ9Ins5RjBDMUY0NC0xQzUwLTM5NkEtNDgzQS0wOERBNDg5NkZGMEJ9IiBjb2hvcnQ9IjE6MWc4eDoiIGNvaG9ydG5hbWU9IldpbmRvd3MgNyI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9lZGdlZGwubWUuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL2Nocm9tZS9jemFvMmhydnBrNXdncXJrejRra3M1cjczNF8xMDkuMC41NDE0LjEyMC8xMDkuMC41NDE0LjEyMF9jaHJvbWVfaW5zdGFsbGVyLmV4ZSIgZG93bmxvYWRlZD0iOTMxMjI2MDAiIHRvdGFsPSI5MzEyMjYwMCIgZG93bmxvYWRfdGltZV9tcz0iMjM1MjUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjMyNzYiIGRvd25sb2FkX3RpbWVfbXM9IjI1MjQxIiBkb3dubG9hZGVkPSI5MzEyMjYwMCIgdG90YWw9IjkzMTIyNjAwIiBpbnN0YWxsX3RpbWVfbXM9IjI3MzYyIi8-PC9hcHA-PC9yZXF1ZXN0Pg

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe" -Embedding

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef58b6b58,0x7fef58b6b68,0x7fef58b6b78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1396 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1564 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2124 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2132 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3068 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3356 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1532 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3440 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3580 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3704 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3820 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3700 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3656 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3640 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3680 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4004 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4028 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4104 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1280,i,1408452129378636806,5105475971879753943,131072 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 a17.nbdsnb2.top udp
US 8.8.8.8:53 a17.yydsnb1.top udp
HK 47.76.184.172:1080 a17.yydsnb1.top tcp
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.201.99:443 update.googleapis.com tcp
GB 216.58.201.99:443 update.googleapis.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 216.58.201.99:80 o.pki.goog tcp
HK 47.76.184.172:1080 a17.yydsnb1.top tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.117.171:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
NL 23.200.189.225:80 www.microsoft.com tcp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 accounts.google.com udp
HK 47.76.184.172:1080 a17.yydsnb1.top tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 172.217.169.78:443 clients2.google.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.187.206:80 redirector.gvt1.com tcp
US 8.8.8.8:53 r5---sn-aigl6nzk.gvt1.com udp
GB 74.125.175.106:80 r5---sn-aigl6nzk.gvt1.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.200.4:443 www.google.com tcp
GB 142.250.200.4:443 www.google.com tcp
GB 142.250.200.4:443 www.google.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 216.58.212.234:443 ogads-pa.googleapis.com tcp
GB 216.58.201.99:443 o.pki.goog tcp
GB 216.58.212.234:443 ogads-pa.googleapis.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.178.14:443 play.google.com tcp
GB 142.250.178.14:443 play.google.com udp
HK 47.76.184.172:1080 a17.yydsnb1.top tcp
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.201.99:443 update.googleapis.com tcp

Files

C:\Windows\Installer\MSI2B16.tmp

MD5 c7fbd5ee98e32a77edf1156db3fca622
SHA1 3e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256 e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA512 8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

C:\Windows\Installer\MSI2C21.tmp

MD5 ae463676775a1dd0b7a28ddb265b4065
SHA1 dff64c17885c7628b22631a2cdc9da83e417d348
SHA256 83fbfcaff3da3eb89f9aec29e6574cf15502fd670cbb2ab0c8a84451b2598b22
SHA512 e47c2db249e7a08c5d2864671fbc235e48aebecbe0b2c2334d1a4cba1b5b3037522ff89408589f3559b3a1eaf507bd338645387d55800029bb3b941d4c7744d6

C:\Config.Msi\f772acc.rbs

MD5 ffa14f7ea01e7faf77a6e0112ac0c002
SHA1 97edf68ba61f78b08487aa05c34b4352c274a734
SHA256 e310d947ed250cd9c18543636b24243f7faffb207046fc91c861a048368a30b8
SHA512 6f754065c3eef63a5a43800cd7b20ca7009fe16f066c94233ab76711ece04371439f5095327de084853352d37b1273f384fb4db1cb5dca5a877b9e25c70e8d9e

\ProgramData\setup\aa.exe

MD5 09c448be7e7d84e6e544cc03afbb05d8
SHA1 ddc13e71a72bc49c60f89b98cbb79c2449cfa07e
SHA256 a0f127a70943b0262060498c1723c795a8e2980f1acf0c42ee8c1dae72ae54b5
SHA512 e5f7a988a999e7e34d0aa2d2a5b2fbb22689588d3def4bed4518ceed38710e3714c5614bab192b0ce6bcac5172a87ebf3b3b923e495eb7344c70bd11f4bf1c12

C:\ProgramData\setup\ddd

MD5 9bd359e3956d119811c3a6abef58e644
SHA1 9f221781f406ebcb15fc2c02d5d259116155c734
SHA256 ead38673817c84de77a4d2fe6118e6a96f863e3db38f73518007caa2af676146
SHA512 7f817794728e532da07424c621eeef161501644d137068895391505d7110f1f8ee9dc76944946e3960f84e462c66fd82ee61b619ca91a07166aed5d3434f618b

memory/1628-56-0x0000000000400000-0x0000000000510000-memory.dmp

\ProgramData\Packas\scrok.exe

MD5 a03b2eaa4d517fd935bb0032d444f22d
SHA1 014864aac638b7c04b4d50e6c39d7266eafda773
SHA256 6fd145b1de7d0a143fd25274544d5e3c4ecee06cf3e31631d51cae8ca3e25f01
SHA512 68a253fcdb3cd1a086fe93fa7c8a7500d6b5414bdfc0dad555973697d4fb552e09088b849573f705ca91b1652ddd4572842b82d40f5821761b3ac299e465be51

memory/2260-63-0x0000000076EF0000-0x0000000076EF2000-memory.dmp

memory/2260-61-0x0000000076EF0000-0x0000000076EF2000-memory.dmp

memory/2260-65-0x0000000076EF0000-0x0000000076EF2000-memory.dmp

memory/2260-66-0x000000013FD00000-0x00000001402B9000-memory.dmp

memory/600-69-0x0000000000210000-0x0000000000239000-memory.dmp

\ProgramData\Smart\TjNkNpAilaYvt.exe

MD5 d305d506c0095df8af223ac7d91ca327
SHA1 679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a
SHA256 923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66
SHA512 94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

memory/2984-75-0x0000000000B50000-0x0000000000C26000-memory.dmp

C:\ProgramData\Smart\TjNkNpAilaYvt.xml

MD5 2c706293a3cfff8cc184a8e9a3b3da08
SHA1 873d7c9f51aa6cebd4ad3ae5930d1de84bb4437d
SHA256 ed28baf8be3a588d50ed246c2cd741bbd498aee74ea0675d57e0b33236e22067
SHA512 4aba3e25507ba5c29219ff51553f3616d07aeeb30f7465f9e921eea94cdcb411d1f48d1eefed647c22405df275e7f9d7506aac52202aae137391c6831463b043

C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

MD5 7137572a7b9b4cdf42ca8c4526ff6f1e
SHA1 507d687b3350fd9af20cdd25898de99088653ed9
SHA256 6a78846e35b4ef743a9ac8289146e61d44e18aee1b39da782af9ab491c8b6724
SHA512 1ee49410900a0b5f02f99f826efe5b2ca3df57282db59ab31b27723b5ed6214e49a4606001b90a72d5b45f986dee9e8f12ef470695781cc9bb5a41eeb932770c

C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

MD5 2633a38e1f0c167f48cbd545adf92004
SHA1 1e3c0cca9c1341f64479f5823695fd730282140f
SHA256 45e7c7a4fbbb936346bafe8f160191152c40f3d5f759e3564c78e32f4775d78c
SHA512 be4e55267541816b9635940e8393371a1025bfa2aeea0bee5454d6ca5aa152bd80e34f7f82774033c6a708790670f1f89a4df340c1d7de983bba489fb05a8738

C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

MD5 77b23a95a41c51694e187c7db99142b0
SHA1 c522c6a3453c83e1bb0cee92a61836ddf2fc5e60
SHA256 6cb25a616c5f5193d35721eaa470f8d1cb14874bdf06d302e228f626c8de63c8
SHA512 dfd6a7fa75e0a97efec265cc49f39816b45148d578e311211603b39aaca7a010ddffb327a5780b8ad51e96632fc35b4c631df4c1c2f24478904dc9f18cc0d7de

C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

MD5 738728272c2c7809d4975030407931bc
SHA1 a9478c0c0991f0aad16890795b7a9612e0bf62f2
SHA256 7ab27cecac04b6d407a45736093be3d9da274dd5b5670bc0e0b2a2d199f80007
SHA512 c11308cc2dda9b14170ecf01873ee3911ba9b3aa1cf84afff79a61818a7fc8c039690f30f5c6f5045a7c662d4ff3ca56178e035bde0412ad83edb24a5d2dfb32

memory/1336-106-0x0000000076EF0000-0x0000000076EF2000-memory.dmp

memory/1336-107-0x000000013FA10000-0x000000013FFC9000-memory.dmp

C:\ProgramData\setup\setup.exe

MD5 4a94844260d6a08828d781d488cef61d
SHA1 de8169fdb5ab8a120df577d92eb25a2767431738
SHA256 46d7a8abe3bb9d7302529246cd8ee6e7d0360d1045fe92662cc7580e72ef5132
SHA512 82549c1e525a90003fb0174ebba2bc3b4f58706ef9fd5e6ee07d489ab536ef286e408db6c15a52b039d3f59c09bd55e35d045def79007da5d414d5d589d34f4f

C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

MD5 7ff7a13f9d4030ed07eb18cd8b1106d6
SHA1 fd8f9d79cef846b4508ad5938cb417f38e3c34ca
SHA256 bad65ebab1e6f471189ebbfafc6223e9c84336a590ad9000058c979d5ef5a024
SHA512 5bee88ad154f3053f3a9fc6674a4f81eb350422487719f363b7fd6d319e31d2b9127f15499acddb335e6f0021b4d4d7a85d1a9b1b3e483cd7c2ae5dea6072c9d

C:\ProgramData\Smart\setup.exe

MD5 118a9a9f6280e177fdac16989b8aa1a5
SHA1 fc37316439372be17a982d02cd0d294f7aaca751
SHA256 b995e6a0299f2465fd5881157aab1c6c9753c8e459efd661b9cd1e83be7e53f6
SHA512 14c731e7f7e9736f39d6c79a98bf1a3264da9dc76bab4faca82ec64f276f3d39c9bc4638991e30a06f52bf6204619f5da8c3168d11afe058e0c1d21a89d42878

\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdate.exe

MD5 cdf152e23a8cbf68dbe3f419701244fc
SHA1 cb850d3675da418131d90ab01320e4e8842228d7
SHA256 84eaf43f33d95da9ab310fc36dc3cfe53823d2220946f021f18cf3f729b8d64e
SHA512 863e1da5bc779fa02cf08587c4de5f04c56e02902c5c4f92a06f2e631380ecabcc98e35d52609f764727e41b965c0786d24ea23fc4b9776d24d9f13e0d8ae0c2

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdate.dll

MD5 dae72b4b8bcf62780d63b9cbb5b36b35
SHA1 1d9b764661cfe4ee0f0388ff75fd0f6866a9cd89
SHA256 b0ca6700e7a4ea667d91bcf3338699f28649c2e0a3c0d8b4f2d146ab7c843ab6
SHA512 402c00cab6dac8981e200b6b8b4263038d76afe47c473d5f2abf0406222b32fff727b495c6b754d207af2778288203ce0774a6200b3e580e90299d08ce0c098f

\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_zh-CN.dll

MD5 ca52cc49599bb6bda28c38aea1f9ec4e
SHA1 494f166b530444f39bca27e2b9e10f27e34fc98a
SHA256 f9f144aa2dc0de21b24c93f498a9b4a946b7da42819a776b3283a0bcae18544b
SHA512 05e2d5711eef8f57737b2512de2e73744f17e0a34de0bfd2a06c9cc60a08ebadbafe38e30b66a2ede7fa61d5b9571adddcfbd7e1cafcee1ab2168a563d2d3f0d

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleCrashHandler64.exe

MD5 b659663611a4c2216dff5ab1b60dd089
SHA1 9a14392a5bdb9ea6b8c3e60224b7ff37091d48b5
SHA256 cad4aa1cf58f6b2e2aceb789d53b18418e67066ec406b2fac786cb845ef89d2b
SHA512 1065f9072cd6f1f4364f1354108f2647ee1d89f87e908a22fcd63bd3149c864c457e62268067a439d0486d8d4aa150aa984ad8ac8b51cae49014b67b80496040

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleCrashHandler.exe

MD5 a11ce10ac47f5f83b9bc980567331a1b
SHA1 63ee42e347b0328f8d71a3aa4dde4c6dc46da726
SHA256 101dbf984c4b3876defe2699d6160acbf1bb3f213e02a32f08fdcdc06821c542
SHA512 ff2f86c4061188ead1bfeebd36de7dbc312adcc95267537697f2bfcbb0c53e7c4ab0cd268cef22f0182391796c4612c97cbdc1266d9ee1960cdd2610d8c2bcb3

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdateCore.exe

MD5 af51ea4d9828e21f72e935b0deae50f2
SHA1 c7fe57c2a16c9f5a5ebdd3cc0910427cba5308bd
SHA256 3575011873d0f6d49c783095dae06e6619f8f5463da578fbe284ca5d1d449619
SHA512 ec9828d0bade39754748fb53cfc7efdc5e57955198bac3c248ea9b5a9a607182bb1477819f220549a8e9eadbe6bf69a12da6c8af3761980d2dd9078eaeaa932f

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\GoogleUpdateComRegisterShell64.exe

MD5 be535d8b68dd064442f73211466e5987
SHA1 aa49313d9513fd9c2d2b25da09ea24d09cc03435
SHA256 c109bcb63391ac3ea93fb97fbdf3f6ed71316cacb592ef46efaea0024bc9ed59
SHA512 eb50eebeaf83be10aea8088e35a807f9001d07d17d2bc1655c3bc0cb254d0f54303348988514ba5590ebd9d3bde3f1149c3f700f62fbce63c0199ea3cfb1f638

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_bn.dll

MD5 dafa45a82ce30cf2fd621e0a0b8c031f
SHA1 e39ed5213f9bb02d9da2c889425fab8ca6978db7
SHA256 d58e5f0fa894123de1d9b687a5b84826e095eca128ee5df8870f2db74f4233a2
SHA512 2b772ebc128eb59d636eec36583329962ead8e0a399fd56394b1244486bf815f4e033ceef74a62a9930ab2bf6ec1ba5e2d3c942183f7cb2355a716a3e2c6c7a1

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_es-419.dll

MD5 1c0b1c3625c9ccace1b23e0c64095ee9
SHA1 3904a80d016e0a9a267c0b5feb8e6747b44b5fa1
SHA256 f030757e1911e9efde0d74a02c22694fa5ef139f73897a7f97acab9da05f7c8b
SHA512 0a988edef8d67cd83c2be65cbfa07059df311732ee92ad73fb9411d7cf7d853a2b8d2ab801733d05ab6afaccab33a2684117bbc1d80b362b677cc53ae9de42f0

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_es.dll

MD5 dae64d49ee97339b7327b52c9f720848
SHA1 15f159c4808f9e4fe6a2f1a4a19faa5d84ac630b
SHA256 e76400e62ae0ab31565e50b05d1001b775a91aa487a54dc90e53c0e103c717c2
SHA512 9ae72e5a658aa0e1fb261d62ccef474cd42d9bec2b4a50f71925d131ffea22b8f60fb961772587ce71cb30a32da3b7986e7483ecea960a509e0450d3983c84b0

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_en-GB.dll

MD5 f82ccf890c3ae14bfd7a263d07276e60
SHA1 6a915d6eb8c99d065e36a721d721d556b74bb377
SHA256 6b07a4fd3039541e30c68a8c31c371cda2cea480787f95e0ddbca3cc2fbff0cc
SHA512 4cbf9e6728e08de8d61f34b17bb20d92b6a699969edb9afa013fe962c8fd39238288adcd826134c9bca459904d8574a804c519daac6b301e0d38f68722c0359e

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_en.dll

MD5 741211652c66a8a6790396e1875eefa9
SHA1 2ccd5653b5fc78bcc19f86b493cef11844ba7a0c
SHA256 e0945deacdb6b75ff2587dea975774b9b800747e2ee3f3917e5b40ddb87eda10
SHA512 b70f847d8ca8828c89bbb67b543950fbd514c733cf62b52ad7fc0dab7b2168fe56d1f21bef3210f5c7f563f72831455d870a5f9aa6c557f1e3543ef7329c42f9

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_el.dll

MD5 ecdd26049573614b6f41d8a102ffcf21
SHA1 5140c6cff5d596267a64df1559ac36c4e8f49e42
SHA256 a3377520f2a95b8cc06bd30e493962c07f97eebf4661a69d03efb36b2ca515c5
SHA512 933c181d7575f20480c8deadac3f3e9190081456169122216c72e7b9a04aa75612140fc37697098c7c20b77001a67966fa1661cdc9110c40634c944f833a65b1

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_de.dll

MD5 96d92500b9a763f4b862c511c17e0a47
SHA1 2fd441eb8685d15e14fa6405e82359adea3e7148
SHA256 58829d135ff41e574ed5fc5e0421e4aa204267b02ca3ffaf08d8efb0a70fdd4c
SHA512 a1014584f1f278160d579848fa188f627676aee819e9395517490b00e273db6f583d7ddd31af6e35c9d251021df7fb26c88512aaa1c865c2ee3ba60c0a2db49a

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_da.dll

MD5 9f2e018a4f9a1d278983d0b677b91218
SHA1 c58ee1fc0d8ef9d99f85426b48c7f28f381a2c17
SHA256 d0dcdc68236eecd6b5f0b437eb92b8935741dabf1fa276a552399815af22edec
SHA512 20b74b6a9f81527d4a5fe30671d2559261fb682576f4ab04da7856280fbbaeb6af83894009c9d7cb83deeae988d0ac5ec7ec32b277b7eb45829faec2857d7014

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_cs.dll

MD5 b9033db8d0e5bf254979b0f47d10e93d
SHA1 2859de0d851b5f4fd3056e8f9015cece2436c307
SHA256 12c41c2f472b6a05fd6392e9d4f8aeb9a40840c2cbefd68b39d20f9d1d4d77ed
SHA512 52075df4ae5c86ebb0bac20604ea072a163761ae058c1473211bf4bb0eeed043cfc5a92386f876b53484cdf4e3f8a7b75d8f4bf9894c24f8c22ec23a50b70b7c

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_ca.dll

MD5 39e25ba8d69f493e6f18c4ef0cf96de8
SHA1 5584a94a85d83514a46030c4165e8f7a942e63e2
SHA256 1f66ebdcaae482a201a6e0fab9c1f4501c23a0d4ad819ccd555fdca9cc7edb94
SHA512 773c995b449d64e36eb8cab174db29e29e29985bcfd714799d6b05b01bb7d4a0fc2aefaf2e27ff02b0e105fbe0d34d7efe29b193a1bc3365ec47e1f1003bed26

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_bg.dll

MD5 c523ec13643d74b187b26b410d39569b
SHA1 46aff0297036c60f22ad30d4e58f429890d9e09d
SHA256 80505863866bcd93a7e617dd8160531401d6d05f48d595348cd321cf7d97aeac
SHA512 ecf98e29a3481b05ab23c3ff89fa3caf054b874ed15462a5e33022aacf561d8fea4a0de35cc5f7450f62110ca4ace613e0c67f543ad22eb417e79eb3ebf24ed7

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_ar.dll

MD5 163695df53cea0728f9f58a46a08e102
SHA1 71b39eec83260e2ccc299fac165414acb46958bd
SHA256 f89dddda3e887385b42ea88118ba8fb1cc68fde0c07d44b851164564eb7c1ec8
SHA512 6dfb70a175097f3c96ae815a563c185136cb5a35f361288cc81570facfa1f1d28f49eaa61172d1da4982ebb76bd3e32c4de77cf97dedfb79f18113d7594d0989

C:\Program Files (x86)\Google\Temp\GUM5E66.tmp\goopdateres_am.dll

MD5 849bc7e364e30f8ee4c157f50d5b695e
SHA1 b52b8efa1f3a2c84f436f328decd2912efeb1b18
SHA256 f1384a25a6f40e861455c62190d794415f3e9bfca6317c214847e9535dfc3fb9
SHA512 6fd7f542a7073b3bbf1b0c200bb306b30f1b35a64a1fb013f25c7df76f63ef377d9bd736e8da2e9372f1c994785eaeedb6b60e3a0d4a4e8734c266ad61782d3b

memory/2168-357-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2168-362-0x0000000000400000-0x0000000000BA0000-memory.dmp

memory/2168-361-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2168-359-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2580-365-0x0000000000400000-0x000000000090B000-memory.dmp

memory/2116-369-0x0000000000400000-0x000000000090B000-memory.dmp

memory/1572-371-0x0000000000400000-0x000000000090B000-memory.dmp

memory/2580-373-0x0000000010000000-0x000000001002D000-memory.dmp

C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\setup.exe

MD5 b42b8ac29ee0a9c3401ac4e7e186282d
SHA1 69dfb1dd33cf845a1358d862eebc4affe7b51223
SHA256 19545e8376807bce8a430c37cab9731e85052103f769dd60a5da3d93ca68c6ec
SHA512 b5269e7392e77a0fa850049ff61e271c5aab90d546945b17a65cc2ea6420432ae56321e1e39cfd97ccdb3dfc37ddbd6ff77907f5685cc2323b8635c8cdb4a84f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

MD5 3433ccf3e03fc35b634cd0627833b0ad
SHA1 789a43382e88905d6eb739ada3a8ba8c479ede02
SHA256 f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d
SHA512 21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Temp\scoped_dir2624_521612621\64d66e96-c4c7-430d-8d8f-eeed9d8f7569.tmp

MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

C:\Users\Admin\AppData\Local\Temp\scoped_dir2624_521612621\CRX_INSTALL\_locales\en\messages.json

MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json

MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\CURRENT~RFf786ed9.TMP

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000002.dbtmp

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 d3d0eb4ffee2a62e8606e466c916729f
SHA1 37b881f09523ff010d4cc37ca1d58389658d4a35
SHA256 e722d8e98da22cbc0ecef95a60c8e38f5fc902ff9c1664979986a9b458f40b25
SHA512 21e918832ed471a54fd79e98968b5f13c2aa4db6d7fc84af78fb05047e7c9835bc065fede4778e04af9fae39e59f2780bdc9145aeee14f3396cc68a5b38f3be5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5a11a09a-321c-468c-91a3-a6a9dbc7ac21.tmp

MD5 5ec76dcd245749571e520c3a641fc606
SHA1 35fc6177aafa697dfe9d88466f5856498bd7a194
SHA256 fd2183ad8c5854b67c62c738bd71dd95384e86921c54547659cc06ce9695582d
SHA512 30c4ae52d455929785550dc88fc924961d69e52ab8debfeb4951fc0cbe308fa0171195aa4e22da8ce9e4daabfc82983b1cce9e81bd0d3240b8c0a13f12d94496

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 28d13930af2d0893a9a07a84fba21344
SHA1 afcc42dbc648951ba2513c6c3f648c6e4b6c14ca
SHA256 bd7afb0ce1446963f68cc44c97b2afc603bd5b7ccc875378f3f60fdeb265f5e5
SHA512 44edaaddcaec16c57a66912ff168585e794ce9afb43a7b2314d70a7565b91b933f2ce15e4a7dc3db723ce6206ddd3c991c7b9820c2787d25c16754718363ae3f

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-21 22:49

Reported

2025-02-21 22:51

Platform

win10v2004-20250217-en

Max time kernel

149s

Max time network

151s

Command Line

C:\Windows\system32\svchost.exe -k DcomLaunch -p

Signatures

Blackmoon family

blackmoon

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

FatalRat

stealer trojan fatalrat

Fatalrat family

fatalrat

Fatal Rat payload

rat infostealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\133.0.6943.127\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable" C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome" C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1" C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0" C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96} C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome" C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A

Event Triggered Execution: Image File Execution Options Injection

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0" C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TjNkNpAilaYvt.exe.log C:\ProgramData\Smart\TjNkNpAilaYvt.exe N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Checks installed software on the system

discovery

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\lt.pak C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File opened for modification C:\Program Files\Crashpad\metadata C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\PrivacySandboxAttestationsPreloaded\manifest.json C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_it.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_tr.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_vi.dll C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_zh-CN.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdateBroker.exe C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_fa.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_fa.dll C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_sv.dll C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\ar.pak C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_pt-BR.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_pt-PT.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_lv.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\133.0.6943.127_chrome_installer.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\fa.pak C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\MEIPreload\manifest.json C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_th.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_te.dll C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\psuser_64.dll C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\fr.pak C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\VisualElements\SmallLogo.png C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_en-GB.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_fr.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_hi.dll C:\ProgramData\setup\setup.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\133.0.6943.127_chrome_installer.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdateOnDemand.exe C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_iw.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_am.dll C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\mr.pak C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_gu.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\he.pak C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\hi.pak C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\ur.pak C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\psmachine.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_de.dll C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_nl.dll C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\bn.pak C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\pt-PT.pak C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\v8_context_snapshot.bin C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_nl.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\optimization_guide_internal.dll C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\zh-TW.pak C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\vulkan-1.dll C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_ms.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_hu.dll C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\VisualElements\LogoDev.png C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\elevated_tracing_service.exe C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_sr.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\chrome_proxy.exe C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\chrome_pwa_launcher.exe C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\chrome.exe.sig C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\133.0.6943.127_chrome_installer.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\sw.pak C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\resources.pak C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleCrashHandler64.exe C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_en.dll C:\ProgramData\setup\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_id.dll C:\ProgramData\setup\setup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\e57c89f.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSICBF0.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSICC2F.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{DBB56E52-B2C8-4BD0-96DC-EE1D75DE3BAC} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSICD3A.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e57c89f.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIC8FD.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSICA08.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSICA76.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSICB04.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSICB91.tmp C:\Windows\system32\msiexec.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\setup\aa.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe N/A
N/A N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe N/A
N/A N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe N/A
N/A N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Smart\setup.exe N/A
N/A N/A C:\ProgramData\setup\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\ProgramData\NVIDIARV\svchost.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\133.0.6943.127_chrome_installer.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.127\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

persistence privilege_escalation
Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A

Reads user/profile data of web browsers

spyware stealer

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\setup\aa.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Smart\setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\NVIDIARV\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\setup\setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\NVIDIARV\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\NVIDIARV\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000924b2722e829c64b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000924b27220000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900924b2722000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d924b2722000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000924b272200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM C:\ProgramData\NVIDIARV\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet C:\ProgramData\NVIDIARV\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services C:\ProgramData\NVIDIARV\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\ C:\ProgramData\NVIDIARV\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133846518492531805" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\ C:\ProgramData\NVIDIARV\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Group = "Fatal" C:\ProgramData\NVIDIARV\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\InstallTime = "2025-02-21 22:49" C:\ProgramData\NVIDIARV\svchost.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods\ = "9" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\133.0.6943.127\\notification_helper.exe\"" C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ = "IJobObserver2" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ = "IGoogleUpdateCore" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods\ = "4" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\Elevation\IconReference = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\goopdate.dll,-1004" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ = "IAppCommand" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ = "IBrowserHttpRequest2" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods\ = "24" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\VersionIndependentProgID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\CurVer\ = "GoogleUpdate.Update3COMClassService.1.0" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods\ = "4" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\PROGID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ = "IJobObserver2" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib\Version = "1.0" C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML\Application\ApplicationName = "Google Chrome" C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\.webp\OpenWithProgids C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\psmachine_64.dll" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods\ = "4" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachine\CurVer\ = "GoogleUpdate.OnDemandCOMClassMachine.1.0" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe N/A
N/A N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Packas\scrok.exe N/A
N/A N/A C:\ProgramData\Smart\setup.exe N/A
N/A N/A C:\ProgramData\Smart\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Packas\scrok.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\ProgramData\Smart\setup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5020 wrote to memory of 1952 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 5020 wrote to memory of 1952 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 5020 wrote to memory of 640 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 5020 wrote to memory of 640 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 5020 wrote to memory of 640 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 640 wrote to memory of 3604 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\cmd.exe
PID 640 wrote to memory of 3604 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\cmd.exe
PID 640 wrote to memory of 3604 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\cmd.exe
PID 3604 wrote to memory of 968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3604 wrote to memory of 968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3604 wrote to memory of 968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3604 wrote to memory of 3396 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\aa.exe
PID 3604 wrote to memory of 3396 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\aa.exe
PID 3604 wrote to memory of 3396 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\aa.exe
PID 3604 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Packas\scrok.exe
PID 3604 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Packas\scrok.exe
PID 2748 wrote to memory of 776 N/A C:\ProgramData\Packas\scrok.exe C:\Windows\system32\svchost.exe
PID 2748 wrote to memory of 776 N/A C:\ProgramData\Packas\scrok.exe C:\Windows\system32\svchost.exe
PID 2748 wrote to memory of 776 N/A C:\ProgramData\Packas\scrok.exe C:\Windows\system32\svchost.exe
PID 3604 wrote to memory of 4024 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 3604 wrote to memory of 4024 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 3604 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 3604 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 3604 wrote to memory of 3840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3604 wrote to memory of 3840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3604 wrote to memory of 3840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3604 wrote to memory of 4008 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 3604 wrote to memory of 4008 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Smart\TjNkNpAilaYvt.exe
PID 3604 wrote to memory of 3464 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Packas\scrok.exe
PID 3604 wrote to memory of 3464 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Packas\scrok.exe
PID 4316 wrote to memory of 4508 N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe C:\ProgramData\Smart\setup.exe
PID 4316 wrote to memory of 4508 N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe C:\ProgramData\Smart\setup.exe
PID 4316 wrote to memory of 4508 N/A C:\ProgramData\Smart\TjNkNpAilaYvt.exe C:\ProgramData\Smart\setup.exe
PID 3464 wrote to memory of 776 N/A C:\ProgramData\Packas\scrok.exe C:\Windows\system32\svchost.exe
PID 3464 wrote to memory of 776 N/A C:\ProgramData\Packas\scrok.exe C:\Windows\system32\svchost.exe
PID 3464 wrote to memory of 776 N/A C:\ProgramData\Packas\scrok.exe C:\Windows\system32\svchost.exe
PID 3604 wrote to memory of 4388 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\setup.exe
PID 3604 wrote to memory of 4388 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\setup.exe
PID 3604 wrote to memory of 4388 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\setup\setup.exe
PID 4388 wrote to memory of 4048 N/A C:\ProgramData\setup\setup.exe C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe
PID 4388 wrote to memory of 4048 N/A C:\ProgramData\setup\setup.exe C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe
PID 4388 wrote to memory of 4048 N/A C:\ProgramData\setup\setup.exe C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe
PID 4048 wrote to memory of 812 N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 4048 wrote to memory of 812 N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 4048 wrote to memory of 812 N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 4048 wrote to memory of 1816 N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 4048 wrote to memory of 1816 N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 4048 wrote to memory of 1816 N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 4508 wrote to memory of 920 N/A C:\ProgramData\Smart\setup.exe C:\ProgramData\NVIDIARV\svchost.exe
PID 4508 wrote to memory of 920 N/A C:\ProgramData\Smart\setup.exe C:\ProgramData\NVIDIARV\svchost.exe
PID 4508 wrote to memory of 920 N/A C:\ProgramData\Smart\setup.exe C:\ProgramData\NVIDIARV\svchost.exe
PID 4508 wrote to memory of 2416 N/A C:\ProgramData\Smart\setup.exe C:\ProgramData\NVIDIARV\svchost.exe
PID 4508 wrote to memory of 2416 N/A C:\ProgramData\Smart\setup.exe C:\ProgramData\NVIDIARV\svchost.exe
PID 4508 wrote to memory of 2416 N/A C:\ProgramData\Smart\setup.exe C:\ProgramData\NVIDIARV\svchost.exe
PID 4508 wrote to memory of 4608 N/A C:\ProgramData\Smart\setup.exe C:\ProgramData\NVIDIARV\svchost.exe
PID 4508 wrote to memory of 4608 N/A C:\ProgramData\Smart\setup.exe C:\ProgramData\NVIDIARV\svchost.exe
PID 4508 wrote to memory of 4608 N/A C:\ProgramData\Smart\setup.exe C:\ProgramData\NVIDIARV\svchost.exe
PID 1816 wrote to memory of 4988 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 1816 wrote to memory of 4988 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 1816 wrote to memory of 400 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 1816 wrote to memory of 400 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 1816 wrote to memory of 3600 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 1816 wrote to memory of 3600 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 4048 wrote to memory of 3440 N/A C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Chrome.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 0B4DCD91304AD65485ED86173044F268

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\SysWOW64\cmd.exe" /c timeout /nobreak /t 7 & C:\ProgramData\setup\aa.exe x C:\ProgramData\setup\ddd. -key 000000 -f -to C:\ProgramData & C:\ProgramData\Packas\scrok.exe & C:\ProgramData\Smart\TjNkNpAilaYvt.exe install & C:\ProgramData\Smart\TjNkNpAilaYvt.exe install & timeout /nobreak /t 2 & C:\ProgramData\Smart\TjNkNpAilaYvt.exe start & C:\ProgramData\Packas\scrok.exe & del C:\ProgramData\Packas\scrok.exe & C:\ProgramData\setup\setup.exe

C:\Windows\SysWOW64\timeout.exe

timeout /nobreak /t 7

C:\ProgramData\setup\aa.exe

C:\ProgramData\setup\aa.exe x C:\ProgramData\setup\ddd. -key 000000 -f -to C:\ProgramData

C:\ProgramData\Packas\scrok.exe

C:\ProgramData\Packas\scrok.exe

C:\ProgramData\Smart\TjNkNpAilaYvt.exe

C:\ProgramData\Smart\TjNkNpAilaYvt.exe install

C:\ProgramData\Smart\TjNkNpAilaYvt.exe

C:\ProgramData\Smart\TjNkNpAilaYvt.exe install

C:\Windows\SysWOW64\timeout.exe

timeout /nobreak /t 2

C:\ProgramData\Smart\TjNkNpAilaYvt.exe

C:\ProgramData\Smart\TjNkNpAilaYvt.exe start

C:\ProgramData\Smart\TjNkNpAilaYvt.exe

"C:\ProgramData\Smart\TjNkNpAilaYvt.exe"

C:\ProgramData\Packas\scrok.exe

C:\ProgramData\Packas\scrok.exe

C:\ProgramData\Smart\setup.exe

"C:\ProgramData\Smart\setup.exe"

C:\ProgramData\setup\setup.exe

C:\ProgramData\setup\setup.exe

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9F0C1F44-1C50-396A-483A-08DA4896FF0B}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"

C:\ProgramData\NVIDIARV\svchost.exe

"C:\ProgramData\NVIDIARV\svchost.exe"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver

C:\ProgramData\NVIDIARV\svchost.exe

"C:\ProgramData\NVIDIARV\svchost.exe"

C:\ProgramData\NVIDIARV\svchost.exe

"C:\ProgramData\NVIDIARV\svchost.exe"

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUQxMzBGQTktNkE2Qi00OEIyLTg0RjktRjdCQ0I4NzJGQ0MxfSIgdXNlcmlkPSJ7MzdENkVEQ0YtRUUyOC00MUVBLUI4QjctMzkwQjg0ODY2MTk5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0Q0NURERDlGLUVFM0UtNEUxQS05NUYzLTBENjg3MzQxNDNFN30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjM3MSIgbmV4dHZlcnNpb249IjEuMy4zNi4zMTIiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7OUYwQzFGNDQtMUM1MC0zOTZBLTQ4M0EtMDhEQTQ4OTZGRjBCfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMTA5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9F0C1F44-1C50-396A-483A-08DA4896FF0B}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{5D130FA9-6A6B-48B2-84F9-F7BCB872FCC1}"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc

C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\133.0.6943.127_chrome_installer.exe

"C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\133.0.6943.127_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\gui660A.tmp"

C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\gui660A.tmp"

C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.127 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff71983bed8,0x7ff71983bee4,0x7ff71983bef0

C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1

C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.127 --initial-client-data=0x268,0x26c,0x270,0x248,0x274,0x7ff71983bed8,0x7ff71983bee4,0x7ff71983bef0

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe"

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUQxMzBGQTktNkE2Qi00OEIyLTg0RjktRjdCQ0I4NzJGQ0MxfSIgdXNlcmlkPSJ7MzdENkVEQ0YtRUUyOC00MUVBLUI4QjctMzkwQjg0ODY2MTk5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezE1OENEQjdGLUQzOUItNDQ0Mi1BQ0VBLUJEQzIxMUEwOTc4Qn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMzLjAuNjk0My4xMjciIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNCIgaWlkPSJ7OUYwQzFGNDQtMUM1MC0zOTZBLTQ4M0EtMDhEQTQ4OTZGRjBCfSIgY29ob3J0PSIxOmd1L2kxOToiIGNvaG9ydG5hbWU9IlN0YWJsZSBJbnN0YWxscyAmYW1wOyBWZXJzaW9uIFBpbnMiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi9jaHJvbWUvYXUybjMyaDNobmNuYzVrY241Mnd4YXh6eGFfMTMzLjAuNjk0My4xMjcvMTMzLjAuNjk0My4xMjdfY2hyb21lX2luc3RhbGxlci5leGUiIGRvd25sb2FkZWQ9IjExODkyOTI2NCIgdG90YWw9IjExODkyOTI2NCIgZG93bmxvYWRfdGltZV9tcz0iMTgyMzQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjUwMCIgZG93bmxvYWRfdGltZV9tcz0iMTkyNTAiIGRvd25sb2FkZWQ9IjExODkyOTI2NCIgdG90YWw9IjExODkyOTI2NCIgaW5zdGFsbF90aW1lX21zPSIyOTk1MyIvPjwvYXBwPjwvcmVxdWVzdD4

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe" -Embedding

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.127 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff1642fff8,0x7fff16430004,0x7fff16430010

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1968,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1956 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2212,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2244 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2360,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2660 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2956,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3144 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2968,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3172 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3732,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3748 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3772,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3796 /prefetch:2

C:\Program Files\Google\Chrome\Application\133.0.6943.127\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.127\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4592,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4648 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4796,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4840 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5572,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5524 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5628,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5644 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5636,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5700 /prefetch:1

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=208,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4764 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3800,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4032 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4080,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5788 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 a17.yydsnb1.top udp
US 8.8.8.8:53 a17.nbdsnb2.top udp
HK 47.76.184.172:1080 a17.yydsnb1.top tcp
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.201.99:443 update.googleapis.com tcp
GB 216.58.201.99:443 update.googleapis.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 216.58.201.99:80 o.pki.goog tcp
US 8.8.8.8:53 a17.nbdsnb2.top udp
HK 47.76.184.172:1080 a17.yydsnb1.top tcp
US 8.8.8.8:53 a17.nbdsnb2.top udp
US 8.8.8.8:53 a17.nbdsnb2.top udp
GB 216.58.201.99:443 o.pki.goog tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.200.4:443 www.google.com udp
NL 142.250.27.84:443 accounts.google.com udp
GB 216.58.212.234:443 ogads-pa.googleapis.com udp
GB 216.58.212.234:443 ogads-pa.googleapis.com tcp
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.201.99:443 update.googleapis.com tcp
HK 47.76.184.172:1080 a17.yydsnb1.top tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.178.14:443 play.google.com udp
N/A 224.0.0.251:5353 udp
GB 142.250.178.14:443 play.google.com tcp
GB 142.250.178.14:443 play.google.com udp
US 8.8.8.8:53 a17.nbdsnb2.top udp
US 150.171.28.10:443 tcp
US 150.171.28.10:443 tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 a17.nbdsnb2.top udp
HK 47.76.184.172:1080 a17.yydsnb1.top tcp
US 8.8.8.8:53 a17.nbdsnb2.top udp
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.201.99:443 update.googleapis.com tcp

Files

C:\Windows\Installer\MSIC8FD.tmp

MD5 c7fbd5ee98e32a77edf1156db3fca622
SHA1 3e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256 e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA512 8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

C:\Windows\Installer\MSICB91.tmp

MD5 ae463676775a1dd0b7a28ddb265b4065
SHA1 dff64c17885c7628b22631a2cdc9da83e417d348
SHA256 83fbfcaff3da3eb89f9aec29e6574cf15502fd670cbb2ab0c8a84451b2598b22
SHA512 e47c2db249e7a08c5d2864671fbc235e48aebecbe0b2c2334d1a4cba1b5b3037522ff89408589f3559b3a1eaf507bd338645387d55800029bb3b941d4c7744d6

C:\Config.Msi\e57c8a2.rbs

MD5 74af9654d8a16004d4fc58a528d91022
SHA1 e18554b9dfd67d1fe76b275eb6fed69d74d516b1
SHA256 20a4221cb2cc7aced510669513b9b8d2b752e6ccd38d705196a925149ce82153
SHA512 8a77d7eaeae4259c83b2ae1d23fb5399883392403988278b1b368a60de4954300da17f6a64400c37c8585f75c293e763c9cf6f1826153553fa550b4a21584995

C:\ProgramData\setup\aa.exe

MD5 09c448be7e7d84e6e544cc03afbb05d8
SHA1 ddc13e71a72bc49c60f89b98cbb79c2449cfa07e
SHA256 a0f127a70943b0262060498c1723c795a8e2980f1acf0c42ee8c1dae72ae54b5
SHA512 e5f7a988a999e7e34d0aa2d2a5b2fbb22689588d3def4bed4518ceed38710e3714c5614bab192b0ce6bcac5172a87ebf3b3b923e495eb7344c70bd11f4bf1c12

C:\ProgramData\setup\ddd

MD5 9bd359e3956d119811c3a6abef58e644
SHA1 9f221781f406ebcb15fc2c02d5d259116155c734
SHA256 ead38673817c84de77a4d2fe6118e6a96f863e3db38f73518007caa2af676146
SHA512 7f817794728e532da07424c621eeef161501644d137068895391505d7110f1f8ee9dc76944946e3960f84e462c66fd82ee61b619ca91a07166aed5d3434f618b

memory/3396-64-0x0000000000400000-0x0000000000510000-memory.dmp

C:\ProgramData\Packas\scrok.exe

MD5 a03b2eaa4d517fd935bb0032d444f22d
SHA1 014864aac638b7c04b4d50e6c39d7266eafda773
SHA256 6fd145b1de7d0a143fd25274544d5e3c4ecee06cf3e31631d51cae8ca3e25f01
SHA512 68a253fcdb3cd1a086fe93fa7c8a7500d6b5414bdfc0dad555973697d4fb552e09088b849573f705ca91b1652ddd4572842b82d40f5821761b3ac299e465be51

memory/2748-68-0x00007FFF34550000-0x00007FFF34552000-memory.dmp

memory/2748-69-0x00007FF6D5140000-0x00007FF6D56F9000-memory.dmp

C:\ProgramData\Smart\TjNkNpAilaYvt.exe

MD5 d305d506c0095df8af223ac7d91ca327
SHA1 679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a
SHA256 923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66
SHA512 94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

memory/4024-75-0x0000000000A90000-0x0000000000B66000-memory.dmp

C:\ProgramData\Smart\TjNkNpAilaYvt.xml

MD5 2c706293a3cfff8cc184a8e9a3b3da08
SHA1 873d7c9f51aa6cebd4ad3ae5930d1de84bb4437d
SHA256 ed28baf8be3a588d50ed246c2cd741bbd498aee74ea0675d57e0b33236e22067
SHA512 4aba3e25507ba5c29219ff51553f3616d07aeeb30f7465f9e921eea94cdcb411d1f48d1eefed647c22405df275e7f9d7506aac52202aae137391c6831463b043

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TjNkNpAilaYvt.exe.log

MD5 122cf3c4f3452a55a92edee78316e071
SHA1 f2caa36d483076c92d17224cf92e260516b3cbbf
SHA256 42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0
SHA512 c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

MD5 7e6568cc889287fcbfc5db663c304c27
SHA1 bf9a37ce3c55b0aca022ae1982ac8428e23749f6
SHA256 f720bcbb4f214796518dbb0e5184b108a8788288fbfe83ee65f7ff0c512c88b9
SHA512 3cb42eae1bbd19c064e0767b20eb39032ac52e6320da3570de22d6dbeae41cadbc83c388f891d1c8a1b7fd8fb77963d64797f87ad002ea468dd28577fcfd74e1

\??\Volume{22274b92-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{052e279b-481a-4bce-bdd1-edf860f04a80}_OnDiskSnapshotProp

MD5 cc10d49307a86df631b9a0fba6017095
SHA1 c56ed20f01809ec05470bbc4b6e662eaabeb290a
SHA256 432ee96c9a37e3f0e492a361e70ed6450d1ebca06b5d2ef5b6b7555c649c8a89
SHA512 905abe0b02cbdfc184ca4e5c1288187b76eb93b5db0578c2d4ece3b40d9b9a6737b5d6b87d00a8334c8b2148f2e126b74ce2a9e5cec6e96e1bb126dea6d507aa

\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

MD5 5139fbacba6a003598e68d6237a890ff
SHA1 a45e5b1e9ffcb977310cedce5ca05d2fc3b4b417
SHA256 ae7516bdbb3a39d33d76a2b743f03766423462e4d1b67ae6fb37f38da6a5cabd
SHA512 31c67eee0a6dec9e004cda3374d676dd2963337cd579bc9a8f2ebc9a5cf036515afd237bb3fc259c09e221b969ac7ca9f26ead1f470856a3676ae3c605a3e09c

C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

MD5 722512e290ef31ab363d6ca2210c49d8
SHA1 34468206a2df1c83fbd65975132392bcc536ca65
SHA256 17e2a77b3f01b1ca8c47fe207d2104ce9154be465c9770c452bdd2ae2941e707
SHA512 b636f6c8747885f8661444d147825987f1fbb825f0dd561351ac893a47ad13515c1903bc4d186062517e72ce0c0c85a1652897bb189b766d412b58a0a71e316e

C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

MD5 7a4eb1aec85cb4ad2bf635ab00c834fe
SHA1 89a7ce9fd4839910da4e216cb047a01daeae9347
SHA256 346a1ce864233f7eb35d1b8c21420f6aa8a92c14055104b069b80c0293528151
SHA512 c94b6e825b4b72488f6a544c97ead9a1b530361629b58409c7df8be5b0ba63c4f8722a26eb567deb210a53f7a1002968e1bab26e033dc9e90e3efcc22b75be8b

C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

MD5 40cc031c9061e9041d1843b87f302cb5
SHA1 36fdd8cbb906e59cd471d0c0ec5fbfe7b8f38055
SHA256 797a10343910757d8147c6bc0cac792cb2aaf2cecf9394f211462d29acc840f5
SHA512 d6b037d1e1eae172439cd8e9b417fdef9c2b848f2ae56d4c4aa0aa31357bc79c508fac75296bd105238f3318993b208aa95f1a7a79d66f5d3d8385df4a0b1df9

C:\ProgramData\Smart\setup.exe

MD5 118a9a9f6280e177fdac16989b8aa1a5
SHA1 fc37316439372be17a982d02cd0d294f7aaca751
SHA256 b995e6a0299f2465fd5881157aab1c6c9753c8e459efd661b9cd1e83be7e53f6
SHA512 14c731e7f7e9736f39d6c79a98bf1a3264da9dc76bab4faca82ec64f276f3d39c9bc4638991e30a06f52bf6204619f5da8c3168d11afe058e0c1d21a89d42878

memory/3464-114-0x00007FF6D5140000-0x00007FF6D56F9000-memory.dmp

memory/4508-117-0x00000000001F0000-0x00000000001F1000-memory.dmp

C:\ProgramData\setup\setup.exe

MD5 4a94844260d6a08828d781d488cef61d
SHA1 de8169fdb5ab8a120df577d92eb25a2767431738
SHA256 46d7a8abe3bb9d7302529246cd8ee6e7d0360d1045fe92662cc7580e72ef5132
SHA512 82549c1e525a90003fb0174ebba2bc3b4f58706ef9fd5e6ee07d489ab536ef286e408db6c15a52b039d3f59c09bd55e35d045def79007da5d414d5d589d34f4f

memory/4508-118-0x0000000000400000-0x0000000000BA0000-memory.dmp

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdate.dll

MD5 dae72b4b8bcf62780d63b9cbb5b36b35
SHA1 1d9b764661cfe4ee0f0388ff75fd0f6866a9cd89
SHA256 b0ca6700e7a4ea667d91bcf3338699f28649c2e0a3c0d8b4f2d146ab7c843ab6
SHA512 402c00cab6dac8981e200b6b8b4263038d76afe47c473d5f2abf0406222b32fff727b495c6b754d207af2778288203ce0774a6200b3e580e90299d08ce0c098f

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe

MD5 cdf152e23a8cbf68dbe3f419701244fc
SHA1 cb850d3675da418131d90ab01320e4e8842228d7
SHA256 84eaf43f33d95da9ab310fc36dc3cfe53823d2220946f021f18cf3f729b8d64e
SHA512 863e1da5bc779fa02cf08587c4de5f04c56e02902c5c4f92a06f2e631380ecabcc98e35d52609f764727e41b965c0786d24ea23fc4b9776d24d9f13e0d8ae0c2

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_zh-CN.dll

MD5 ca52cc49599bb6bda28c38aea1f9ec4e
SHA1 494f166b530444f39bca27e2b9e10f27e34fc98a
SHA256 f9f144aa2dc0de21b24c93f498a9b4a946b7da42819a776b3283a0bcae18544b
SHA512 05e2d5711eef8f57737b2512de2e73744f17e0a34de0bfd2a06c9cc60a08ebadbafe38e30b66a2ede7fa61d5b9571adddcfbd7e1cafcee1ab2168a563d2d3f0d

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdateCore.exe

MD5 af51ea4d9828e21f72e935b0deae50f2
SHA1 c7fe57c2a16c9f5a5ebdd3cc0910427cba5308bd
SHA256 3575011873d0f6d49c783095dae06e6619f8f5463da578fbe284ca5d1d449619
SHA512 ec9828d0bade39754748fb53cfc7efdc5e57955198bac3c248ea9b5a9a607182bb1477819f220549a8e9eadbe6bf69a12da6c8af3761980d2dd9078eaeaa932f

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_en-GB.dll

MD5 f82ccf890c3ae14bfd7a263d07276e60
SHA1 6a915d6eb8c99d065e36a721d721d556b74bb377
SHA256 6b07a4fd3039541e30c68a8c31c371cda2cea480787f95e0ddbca3cc2fbff0cc
SHA512 4cbf9e6728e08de8d61f34b17bb20d92b6a699969edb9afa013fe962c8fd39238288adcd826134c9bca459904d8574a804c519daac6b301e0d38f68722c0359e

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_es.dll

MD5 dae64d49ee97339b7327b52c9f720848
SHA1 15f159c4808f9e4fe6a2f1a4a19faa5d84ac630b
SHA256 e76400e62ae0ab31565e50b05d1001b775a91aa487a54dc90e53c0e103c717c2
SHA512 9ae72e5a658aa0e1fb261d62ccef474cd42d9bec2b4a50f71925d131ffea22b8f60fb961772587ce71cb30a32da3b7986e7483ecea960a509e0450d3983c84b0

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_fi.dll

MD5 5c530468d61708123c8919a8480e5967
SHA1 2d85a2335bc688d2c2045299c1e36b39b179603e
SHA256 21aa3b8d540c7b2ea33c4a11fb35fdd721b69f04a660edb2ac2031d98f38e239
SHA512 bfe4ce4762ef5de853635a2341249012da27b7a02e3f4722841792345527d7951fb20661d1b7c8a58293c4ac5ee0b34cea0e190fa5f74efd12aeacba3c74a2aa

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_fa.dll

MD5 90d38d6669931e76faa1e69aee2ab3e2
SHA1 e0de420b422c7ad4e73ace2c84db45f6db2b1d6e
SHA256 1fe4bc690efc72cb8737d4b451c2c843d2987d71bf60723471bf66cf53fcc714
SHA512 1cc66e166b4dc3b6c1f96340489652bd313d8d6de31a3165bac9da8fd42146843f840ee7a5f163512163fc8f90b865a06cc29a147c44389f40eb1edafd6d3743

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_et.dll

MD5 dfa1d51ca956e3aaa1008503aaeb3dd8
SHA1 94511faf996c1ce9b2397c7fc3f78f32fbf8f966
SHA256 3781d18bab1524cff8104167caaccb7eee6614394068dbb7b7c412c7c9b5aae9
SHA512 b25f9a14053acab26f1d353e9d908cbe769a640d0e8d66c30209c2a5d76c503b8e7fb04651f37ff482f7c4df4ffed33013d37b1f7bb6650e25447006f447b85d

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_es-419.dll

MD5 1c0b1c3625c9ccace1b23e0c64095ee9
SHA1 3904a80d016e0a9a267c0b5feb8e6747b44b5fa1
SHA256 f030757e1911e9efde0d74a02c22694fa5ef139f73897a7f97acab9da05f7c8b
SHA512 0a988edef8d67cd83c2be65cbfa07059df311732ee92ad73fb9411d7cf7d853a2b8d2ab801733d05ab6afaccab33a2684117bbc1d80b362b677cc53ae9de42f0

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_en.dll

MD5 741211652c66a8a6790396e1875eefa9
SHA1 2ccd5653b5fc78bcc19f86b493cef11844ba7a0c
SHA256 e0945deacdb6b75ff2587dea975774b9b800747e2ee3f3917e5b40ddb87eda10
SHA512 b70f847d8ca8828c89bbb67b543950fbd514c733cf62b52ad7fc0dab7b2168fe56d1f21bef3210f5c7f563f72831455d870a5f9aa6c557f1e3543ef7329c42f9

C:\ProgramData\NVIDIARV\svchost.exe

MD5 4ce1a842d3d770f6fa4b4167542408b2
SHA1 43b0c03b176318ce2551d3dfc2c18e18f53c2240
SHA256 ba51980ef9681d849c9331e891cc411c1687d3c011f0acc01da9f4ef640764b6
SHA512 a28f0659af75da93f479359212dc4ffb9440f171cf89b19de929b7a8015b5e087ea53ab979dd6815597865538c79b1e3354e987940da88da4dfcf16bdf1f4337

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_el.dll

MD5 ecdd26049573614b6f41d8a102ffcf21
SHA1 5140c6cff5d596267a64df1559ac36c4e8f49e42
SHA256 a3377520f2a95b8cc06bd30e493962c07f97eebf4661a69d03efb36b2ca515c5
SHA512 933c181d7575f20480c8deadac3f3e9190081456169122216c72e7b9a04aa75612140fc37697098c7c20b77001a67966fa1661cdc9110c40634c944f833a65b1

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_de.dll

MD5 96d92500b9a763f4b862c511c17e0a47
SHA1 2fd441eb8685d15e14fa6405e82359adea3e7148
SHA256 58829d135ff41e574ed5fc5e0421e4aa204267b02ca3ffaf08d8efb0a70fdd4c
SHA512 a1014584f1f278160d579848fa188f627676aee819e9395517490b00e273db6f583d7ddd31af6e35c9d251021df7fb26c88512aaa1c865c2ee3ba60c0a2db49a

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_da.dll

MD5 9f2e018a4f9a1d278983d0b677b91218
SHA1 c58ee1fc0d8ef9d99f85426b48c7f28f381a2c17
SHA256 d0dcdc68236eecd6b5f0b437eb92b8935741dabf1fa276a552399815af22edec
SHA512 20b74b6a9f81527d4a5fe30671d2559261fb682576f4ab04da7856280fbbaeb6af83894009c9d7cb83deeae988d0ac5ec7ec32b277b7eb45829faec2857d7014

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_cs.dll

MD5 b9033db8d0e5bf254979b0f47d10e93d
SHA1 2859de0d851b5f4fd3056e8f9015cece2436c307
SHA256 12c41c2f472b6a05fd6392e9d4f8aeb9a40840c2cbefd68b39d20f9d1d4d77ed
SHA512 52075df4ae5c86ebb0bac20604ea072a163761ae058c1473211bf4bb0eeed043cfc5a92386f876b53484cdf4e3f8a7b75d8f4bf9894c24f8c22ec23a50b70b7c

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_ca.dll

MD5 39e25ba8d69f493e6f18c4ef0cf96de8
SHA1 5584a94a85d83514a46030c4165e8f7a942e63e2
SHA256 1f66ebdcaae482a201a6e0fab9c1f4501c23a0d4ad819ccd555fdca9cc7edb94
SHA512 773c995b449d64e36eb8cab174db29e29e29985bcfd714799d6b05b01bb7d4a0fc2aefaf2e27ff02b0e105fbe0d34d7efe29b193a1bc3365ec47e1f1003bed26

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_bn.dll

MD5 dafa45a82ce30cf2fd621e0a0b8c031f
SHA1 e39ed5213f9bb02d9da2c889425fab8ca6978db7
SHA256 d58e5f0fa894123de1d9b687a5b84826e095eca128ee5df8870f2db74f4233a2
SHA512 2b772ebc128eb59d636eec36583329962ead8e0a399fd56394b1244486bf815f4e033ceef74a62a9930ab2bf6ec1ba5e2d3c942183f7cb2355a716a3e2c6c7a1

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_bg.dll

MD5 c523ec13643d74b187b26b410d39569b
SHA1 46aff0297036c60f22ad30d4e58f429890d9e09d
SHA256 80505863866bcd93a7e617dd8160531401d6d05f48d595348cd321cf7d97aeac
SHA512 ecf98e29a3481b05ab23c3ff89fa3caf054b874ed15462a5e33022aacf561d8fea4a0de35cc5f7450f62110ca4ace613e0c67f543ad22eb417e79eb3ebf24ed7

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_ar.dll

MD5 163695df53cea0728f9f58a46a08e102
SHA1 71b39eec83260e2ccc299fac165414acb46958bd
SHA256 f89dddda3e887385b42ea88118ba8fb1cc68fde0c07d44b851164564eb7c1ec8
SHA512 6dfb70a175097f3c96ae815a563c185136cb5a35f361288cc81570facfa1f1d28f49eaa61172d1da4982ebb76bd3e32c4de77cf97dedfb79f18113d7594d0989

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_am.dll

MD5 849bc7e364e30f8ee4c157f50d5b695e
SHA1 b52b8efa1f3a2c84f436f328decd2912efeb1b18
SHA256 f1384a25a6f40e861455c62190d794415f3e9bfca6317c214847e9535dfc3fb9
SHA512 6fd7f542a7073b3bbf1b0c200bb306b30f1b35a64a1fb013f25c7df76f63ef377d9bd736e8da2e9372f1c994785eaeedb6b60e3a0d4a4e8734c266ad61782d3b

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdateComRegisterShell64.exe

MD5 be535d8b68dd064442f73211466e5987
SHA1 aa49313d9513fd9c2d2b25da09ea24d09cc03435
SHA256 c109bcb63391ac3ea93fb97fbdf3f6ed71316cacb592ef46efaea0024bc9ed59
SHA512 eb50eebeaf83be10aea8088e35a807f9001d07d17d2bc1655c3bc0cb254d0f54303348988514ba5590ebd9d3bde3f1149c3f700f62fbce63c0199ea3cfb1f638

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleCrashHandler64.exe

MD5 b659663611a4c2216dff5ab1b60dd089
SHA1 9a14392a5bdb9ea6b8c3e60224b7ff37091d48b5
SHA256 cad4aa1cf58f6b2e2aceb789d53b18418e67066ec406b2fac786cb845ef89d2b
SHA512 1065f9072cd6f1f4364f1354108f2647ee1d89f87e908a22fcd63bd3149c864c457e62268067a439d0486d8d4aa150aa984ad8ac8b51cae49014b67b80496040

C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleCrashHandler.exe

MD5 a11ce10ac47f5f83b9bc980567331a1b
SHA1 63ee42e347b0328f8d71a3aa4dde4c6dc46da726
SHA256 101dbf984c4b3876defe2699d6160acbf1bb3f213e02a32f08fdcdc06821c542
SHA512 ff2f86c4061188ead1bfeebd36de7dbc312adcc95267537697f2bfcbb0c53e7c4ab0cd268cef22f0182391796c4612c97cbdc1266d9ee1960cdd2610d8c2bcb3

memory/2416-361-0x0000000000400000-0x000000000090B000-memory.dmp

memory/2416-365-0x0000000010000000-0x000000001002D000-memory.dmp

memory/920-363-0x0000000000400000-0x000000000090B000-memory.dmp

memory/920-377-0x0000000002A00000-0x0000000002C00000-memory.dmp

memory/4608-381-0x0000000002A00000-0x0000000002C00000-memory.dmp

memory/920-376-0x0000000002A00000-0x0000000002C00000-memory.dmp

memory/920-373-0x0000000010000000-0x000000001002D000-memory.dmp

memory/4608-382-0x0000000002A00000-0x0000000002C00000-memory.dmp

C:\Program Files\Google\Chrome\Application\133.0.6943.127\Installer\setup.exe

MD5 3eda07f3f5bd229c5a02ca9487dd152d
SHA1 b6b845c42e2316b63a61a058eb1a9714211a54ec
SHA256 cba6ac1785a616fbffb09afb29cc8b5d9a82a019d9b547338aa09b6a06905e11
SHA512 e8a0d0308f955f923753380033ebf12a795d9e3dd57e155e46ff6d709c9a4a71a24227b79a129773e6209eb1039202928a9515294833b36c218f44d787349aa6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 65b44f4fbdb9acb223ba8e197d46d689
SHA1 653d555d05e2ee4e87be69a026013c3e82aca6c5
SHA256 1b70a0749dd7f2d1837982aa6bcd825a31f220027a818880bd2bef5eb7bf67ff
SHA512 29da9be389dc3751be838f47032d461a2144671c69d894bdabfbe51387e2bb00dbdb909ce9291fc9977c5228e8f0a4ffc40e89ff2a8faf18badfcdf5d79a986a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

MD5 505a174e740b3c0e7065c45a78b5cf42
SHA1 38911944f14a8b5717245c8e6bd1d48e58c7df12
SHA256 024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d
SHA512 7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

MD5 b77fc97eecd8f7383464171a4edef544
SHA1 bbae26d2a7914a3c95dca35f1f6f820d851f6368
SHA256 93332c49fab1deb87dac6cb5d313900cb20e6e1ba928af128a1d549a44256f68
SHA512 68745413a681fdf4088bf8d6b20e843396ae2e92fbb97239dc6c764233a7e7b700a51548ff4d2ea86420b208b92a5e5420f08231637fbb5dbf7e12a377be3fc3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5104_1856981287\Icons\128.png

MD5 654cafa7846b64b91835e202c3efca65
SHA1 4e0fa549b16a47ca9e22e0a510229f528740d51b
SHA256 956bd19ad9a62b83792bed90a6e6457e0812abb36ef85763f62883d70f65241b
SHA512 65db6e4824ee4caa38fa4ec837c2ee4290e34c8d2c5099b33720e7b6ab83997608ae8a6d47961d8506be3d23606b179cf792cc040a7c6c3f251855c294b26223

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\48.png

MD5 5bfbb6b6a7e313f5d67a1219f7866c4a
SHA1 c49ec46ca5fb945b582c99b47a2b7c09da8f766e
SHA256 6dc4e5c4c1722173cb9d40e7edd2947c12677b12fd2fdd6e2544bda6bb456ab1
SHA512 55928faf39965083855cf6e1a8bc477560b41f3d8d8f678de7271960c6b59b7f2a256ae4e03428f86c1fc0e431370512e9c69a5631cad9e103e8978faa10ac13

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\64.png

MD5 0aa5ac35c79f5cb38dd5fafbabf2983c
SHA1 36658f24dbb49f5ff2a19897b22071f72e523f12
SHA256 3695587d1d40ba3171aa991cb77e6c9080b550db7c3d3b52097c1723ab060f32
SHA512 fcbc8a65c4b852c848a13fa12131fa7b17b1310ad3278e78545e8334ddf199b627110bde2fc0a5e7312fad3a5f12b0db54c665d00f1feb1cf3b7c4b18e7569e7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\32.png

MD5 a3a00ef924278ba60be0fffeec04995e
SHA1 69ab25402bb5ef6d99538ec8044c6edb128be0d3
SHA256 a5670fe56dbae316511d6f8c7349477c69c53dc59fe5615984eed5c8cf55a717
SHA512 fd53f2c0e8f493817f5ff5c2f9b87ffb82a11bc2b56a9798072efdf22677d2760bc489a2c8d76fdee6f65a0f4509d4bc257851811b4f720120780e796c6bc4b9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 a7cf1376df03c07d924c4dc706c97555
SHA1 08059f43bd5f86cb7328062fedd3934c3b9c6a21
SHA256 93d942eee75391df3f3b704bcb7616fead0464c17ab589b56c42d92dea3bc97d
SHA512 504ac58f9c91e9448395e9606772540dc0a481b04c0152af7219da397c261476697dd820560c265d128b5b21d58db71b7ce34757cdc70a978f388667f49bdee1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 566c63046e3c7fda9a230f2596f37609
SHA1 3ad57ea71c827c5d7d8940cf8c79d4ec43376187
SHA256 1608982013b0dfe9c31f34a36c529bd7d75939539cab0953640822673d0ea3d4
SHA512 285dcd41d40fb1e60ada492c3e1f5cdb390e685b1f7be3e999b0ce8efb16bb689ed6d276309ed4202ce8c5458444ae5dd8d15dc67f5fdfd50c82c4690f6a9a40

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3a7702a699b3bff043b3c88dbaf5e162
SHA1 a1fc7be0bebe076b2007b7c094e2d3c0297a3152
SHA256 c65293a66b8687a8cd510a619fa72e9947bc1a513de25fbe17725da488731dbf
SHA512 340d8c44387f72dfb926b9052ef9a734289ef819cf6e72c6e949bc0ffa29d85bcba28ebe5e691f513c68089697c659c714f4427c9d9aeb79bbcf41e59dd31745

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 cc02ccd9ec41abda529c62753969a454
SHA1 7233188b3268979b9bd5a91b94ec8aae22dea1a8
SHA256 8cba8636522b2a5d91a6be26e552d57a1d76254146507b058f249615898de5e8
SHA512 717674497d570a12834aeb7bf1bad84a3c8c2341ef5e56340e4cf4752ba93a951b08ae4f5b68995427b217dabb8caf91c987e9307cc0661a86ca766997abf662

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 23d57336233e87a1e91ad506cdc3c4b2
SHA1 ad00fd760b23fd6497e5d2df527b19c7a1ba8630
SHA256 660d918e1e7052020dc17119c1a0e75a9c37cd5d85fa1501286023b509d072a3
SHA512 d67bf4ed3837d2428045280223b13ef30b3bdd552f5de8c2878e0ac6689058bd1ebbe0dcfde7a17aff5e8c341f9724469bc3e0d2ef1442e8582c306920d408d3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 a490c4553fc9a2e9b73bdbc54a13394a
SHA1 1b829756d8a402674d67659e78c1a105ce39e50a
SHA256 2f579aac89d4911a9c8c3472c39dd1e9de587d155ae20fe758f0719a1a496b6e
SHA512 82bce177c8c35871dc988e77fe65dde01de723bdeb4236165f8a36d55741e13a1cc268a9df607f8f78fe0a2e267cb3337dbce897e0b1d6948a52457a16359229