Malware Analysis Report

2025-03-15 03:48

Sample ID 250228-kzamfswydt
Target 2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk
SHA256 d1d042fd8cce93a4f58024622f9584ff87e7042efe36ff8b628b4ab361bf718b
Tags
fatalrat gh0strat defense_evasion discovery infostealer persistence privilege_escalation rat spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d1d042fd8cce93a4f58024622f9584ff87e7042efe36ff8b628b4ab361bf718b

Threat Level: Known bad

The file 2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk was found to be: Known bad.

Malicious Activity Summary

fatalrat gh0strat defense_evasion discovery infostealer persistence privilege_escalation rat spyware stealer trojan upx

FatalRat

Fatalrat family

Gh0st RAT payload

Gh0strat

Gh0strat family

UAC bypass

Fatal Rat payload

Boot or Logon Autostart Execution: Active Setup

Event Triggered Execution: Image File Execution Options Injection

Reads user/profile data of web browsers

Loads dropped DLL

Event Triggered Execution: Component Object Model Hijacking

Checks computer location settings

Executes dropped EXE

Checks installed software on the system

Adds Run key to start application

UPX packed file

Checks system information in the registry

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

System Network Configuration Discovery: Internet Connection Discovery

Browser Information Discovery

Checks processor information in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-28 09:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-28 09:01

Reported

2025-02-28 09:04

Platform

win7-20241023-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe"

Signatures

FatalRat

stealer trojan fatalrat

Fatalrat family

fatalrat

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

UAC bypass

defense_evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\system32\reg.exe N/A

Fatal Rat payload

rat infostealer
Description Indicator Process Target
N/A N/A N/A N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96} C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome" C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome" C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1" C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0" C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A

Event Triggered Execution: Image File Execution Options Injection

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0" C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\Users\Public\Downloads\20250228020157\bin.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\109.0.5414.120_chrome_installer.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\Users\Public\Downloads\20250228020157\bin.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\109.0.5414.120_chrome_installer.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdata_Service = "C:\\programdata\\lnk\\dick.lnk" C:\Windows\System32\reg.exe N/A

Checks installed software on the system

discovery

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\psmachine.dll C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_es-419.dll C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\SETUP.EX_ C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\109.0.5414.120_chrome_installer.exe N/A
File created C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\109.0.5414.120_chrome_installer.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\nacl_irt_x86_64.nexe C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\eventlog_provider.dll C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\libEGL.dll C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleCrashHandler.exe C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdateComRegisterShell64.exe C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_fr.dll C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_bn.dll C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\setup.exe C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping1652_531674877\manifest.fingerprint C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\VisualElements\SmallLogo.png C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_el.dll C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_sr.dll C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\Locales\id.pak C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\Locales\ur.pak C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\Locales\sr.pak C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_ar.dll C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\psmachine_64.dll C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\109.0.5414.119.manifest C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\Locales\uk.pak C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\psmachine.dll C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\Locales\th.pak C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\VisualElements\SmallLogoCanary.png C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping1652_1384411052\manifest.json C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\Locales\am.pak C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\chrome.exe C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping1652_531674877\LICENSE.txt C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_bg.dll C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\CHROME.PACKED.7Z C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\109.0.5414.120_chrome_installer.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\Locales\es-419.pak C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\Locales\ko.pak C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_ca.dll C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_ja.dll C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_zh-TW.dll C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\Locales\zh-TW.pak C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_cs.dll C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_id.dll C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdateSetup.exe C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdate.dll C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_cs.dll C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_de.dll C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_iw.dll C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\109.0.5414.120_chrome_installer.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdateBroker.exe C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleCrashHandler64.exe C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_en-GB.dll C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_hr.dll C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\VisualElements\SmallLogoDev.png C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\vk_swiftshader.dll C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\MEIPreload\manifest.json C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_lv.dll C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_fil.dll C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ml.dll C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\Locales\es.pak C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source2124_1589546375\Chrome-bin\109.0.5414.120\chrome.dll.sig C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_ml.dll C:\Users\Public\Downloads\20250228020157\bin.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ja.dll C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\Downloads\20250228020157\bin.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\programdata\20250228020157\Agghosts.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\programdata\20250228020157\Agghosts.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\programdata\20250228020157\Agghosts.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}\ = "Google Update Policy Status Class" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLSID C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8} C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ = "IAppCommandWeb" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods\ = "4" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc.1.0\CLSID\ = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E}\InprocHandler32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ = "IAppBundleWeb" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\NumMethods\ = "12" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\ProgID\ = "GoogleUpdate.CoCreateAsync.1.0" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods\ = "12" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods\ = "7" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\LocalServer32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods\ = "41" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods\ = "6" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods\ = "4" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods\ = "4" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachineFallback.1.0\CLSID\ = "{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ = "ICredentialDialog" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\PROGID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\GoogleUpdateOnDemand.exe\"" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ = "IPolicyStatus3" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods\ = "8" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods\ = "41" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.ProcessLauncher\ = "Google Update Process Launcher Class" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\.xhtml C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\PROGID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ = "IPolicyStatus2" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\Elevation\IconReference = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\goopdate.dll,-1004" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\VersionIndependentProgID\ = "GoogleUpdate.PolicyStatusMachine" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ = "IJobObserver2" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ = "IAppWeb" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020157\Agghosts.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\programdata\20250228020157\Agghosts.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
Token: 33 N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\109.0.5414.120_chrome_installer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\109.0.5414.120_chrome_installer.exe N/A
Token: 33 N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe N/A
Token: 33 N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2556 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Windows\system32\cmd.exe
PID 2556 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Windows\system32\cmd.exe
PID 2556 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Windows\system32\cmd.exe
PID 2556 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\programdata\20250228020157\Agghosts.exe
PID 2556 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\programdata\20250228020157\Agghosts.exe
PID 2556 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\programdata\20250228020157\Agghosts.exe
PID 2556 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\programdata\20250228020157\Agghosts.exe
PID 2768 wrote to memory of 2356 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2768 wrote to memory of 2356 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2768 wrote to memory of 2356 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2556 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Windows\System32\reg.exe
PID 2556 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Windows\System32\reg.exe
PID 2556 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Windows\System32\reg.exe
PID 2556 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Users\Public\Downloads\20250228020157\bin.exe
PID 2556 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Users\Public\Downloads\20250228020157\bin.exe
PID 2556 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Users\Public\Downloads\20250228020157\bin.exe
PID 2556 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Users\Public\Downloads\20250228020157\bin.exe
PID 2556 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Users\Public\Downloads\20250228020157\bin.exe
PID 2556 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Users\Public\Downloads\20250228020157\bin.exe
PID 2556 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Users\Public\Downloads\20250228020157\bin.exe
PID 2680 wrote to memory of 2924 N/A C:\Users\Public\Downloads\20250228020157\bin.exe C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe
PID 2680 wrote to memory of 2924 N/A C:\Users\Public\Downloads\20250228020157\bin.exe C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe
PID 2680 wrote to memory of 2924 N/A C:\Users\Public\Downloads\20250228020157\bin.exe C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe
PID 2680 wrote to memory of 2924 N/A C:\Users\Public\Downloads\20250228020157\bin.exe C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe
PID 2680 wrote to memory of 2924 N/A C:\Users\Public\Downloads\20250228020157\bin.exe C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe
PID 2680 wrote to memory of 2924 N/A C:\Users\Public\Downloads\20250228020157\bin.exe C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe
PID 2680 wrote to memory of 2924 N/A C:\Users\Public\Downloads\20250228020157\bin.exe C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe
PID 2924 wrote to memory of 3008 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 3008 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 3008 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 3008 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 3008 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 3008 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 3008 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2916 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2916 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2916 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2916 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2916 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2916 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2916 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2916 wrote to memory of 2828 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 2916 wrote to memory of 2828 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 2916 wrote to memory of 2828 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 2916 wrote to memory of 2828 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 2916 wrote to memory of 2736 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 2916 wrote to memory of 2736 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 2916 wrote to memory of 2736 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 2916 wrote to memory of 2736 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 2916 wrote to memory of 2696 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 2916 wrote to memory of 2696 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 2916 wrote to memory of 2696 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 2916 wrote to memory of 2696 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 2924 wrote to memory of 2820 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2820 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2820 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2820 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2820 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2820 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2820 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2328 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2328 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2328 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 2924 wrote to memory of 2328 N/A C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Public\Downloads\20250228020157\1.bat" "

C:\programdata\20250228020157\Agghosts.exe

"C:\programdata\20250228020157\Agghosts.exe"

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\System32\reg.exe

"C:\Windows\System32\reg.exe" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v GoogleUpdata_Service /d "C:\programdata\lnk\dick.lnk" /f

C:\Users\Public\Downloads\20250228020157\bin.exe

"C:\Users\Public\Downloads\20250228020157\bin.exe"

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={798BD0C5-13EB-DE8C-E07C-A7A64270D046}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEZDMzExMDItNjE0QS00ODg1LUI4NEQtMUU4NjkxRTFFRjUxfSIgdXNlcmlkPSJ7OUU4QjM1NzktMkVDOS00MEUwLTgyMkItNDYxQjM3RjdBQTgzfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezAyQjNFQTFELTUyNkYtNERENy1BQTA2LTU5OTI3QTg3MENGMH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjE1MSIgbmV4dHZlcnNpb249IjEuMy4zNi4zMTIiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7Nzk4QkQwQzUtMTNFQi1ERThDLUUwN0MtQTdBNjQyNzBEMDQ2fSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMTg2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={798BD0C5-13EB-DE8C-E07C-A7A64270D046}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{0FC31102-614A-4885-B84D-1E8691E1EF51}"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc

C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\109.0.5414.120_chrome_installer.exe

"C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\109.0.5414.120_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\gui39C8.tmp"

C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\gui39C8.tmp"

C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x140281148,0x140281158,0x140281168

C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=2 --install-level=1

C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{E319AC4E-D9BA-40E5-9750-11875443AB39}\CR_F5C9B.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x140281148,0x140281158,0x140281168

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe"

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEZDMzExMDItNjE0QS00ODg1LUI4NEQtMUU4NjkxRTFFRjUxfSIgdXNlcmlkPSJ7OUU4QjM1NzktMkVDOS00MEUwLTgyMkItNDYxQjM3RjdBQTgzfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezI2RUI1N0FGLUFDOEYtNDZDNy05NjgzLTkyOUI4QjgwMjQwQn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTA5LjAuNTQxNC4xMjAiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTI3IiBpaWQ9Ins3OThCRDBDNS0xM0VCLURFOEMtRTA3Qy1BN0E2NDI3MEQwNDZ9IiBjb2hvcnQ9IjE6MWc4eDoiIGNvaG9ydG5hbWU9IldpbmRvd3MgNyI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9lZGdlZGwubWUuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL2Nocm9tZS9jemFvMmhydnBrNXdncXJrejRra3M1cjczNF8xMDkuMC41NDE0LjEyMC8xMDkuMC41NDE0LjEyMF9jaHJvbWVfaW5zdGFsbGVyLmV4ZSIgZG93bmxvYWRlZD0iOTMxMjI2MDAiIHRvdGFsPSI5MzEyMjYwMCIgZG93bmxvYWRfdGltZV9tcz0iMTUwMDciLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM3OTEiIGRvd25sb2FkX3RpbWVfbXM9IjE1NzU2IiBkb3dubG9hZGVkPSI5MzEyMjYwMCIgdG90YWw9IjkzMTIyNjAwIiBpbnN0YWxsX3RpbWVfbXM9IjI3ODMxIi8-PC9hcHA-PC9yZXF1ZXN0Pg

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe" -Embedding

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6236b58,0x7fef6236b68,0x7fef6236b78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1064 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1036 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2124 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2268 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3092 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2276 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1556 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1368 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3800 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3960 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4100 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4164 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4204 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4188 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4200 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3916 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3252 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3336 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3252 --field-trial-handle=1260,i,11086768315006927629,12361442297959515211,131072 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 kuilngrl-1336113850.cos.ap-hongkong.myqcloud.com udp
HK 43.132.105.214:443 kuilngrl-1336113850.cos.ap-hongkong.myqcloud.com tcp
N/A 127.0.0.1:49204 tcp
US 8.8.8.8:53 www.baidu.com udp
HK 103.235.46.102:80 www.baidu.com tcp
HK 192.252.182.21:8081 tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.212.195:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.212.195:80 o.pki.goog tcp
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.213.3:443 update.googleapis.com tcp
GB 216.58.213.3:443 update.googleapis.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 184.25.193.234:80 www.microsoft.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.252.132:80 crl.microsoft.com tcp
HK 192.252.182.21:8081 tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 172.217.169.78:80 redirector.gvt1.com tcp
US 8.8.8.8:53 r2---sn-aigzrn7z.gvt1.com udp
GB 173.194.135.103:80 r2---sn-aigzrn7z.gvt1.com tcp
US 8.8.8.8:53 www.google.com udp
GB 216.58.213.3:443 update.googleapis.com tcp
N/A 224.0.0.251:5353 udp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 216.58.201.106:443 ogads-pa.googleapis.com tcp
GB 216.58.204.78:443 apis.google.com tcp
GB 216.58.201.106:443 ogads-pa.googleapis.com udp
US 8.8.8.8:53 play.google.com udp
GB 216.58.201.110:443 play.google.com tcp
GB 216.58.201.110:443 play.google.com udp
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.213.3:443 update.googleapis.com tcp
GB 216.58.213.3:443 update.googleapis.com udp

Files

memory/2556-13-0x0000000004430000-0x000000000497D000-memory.dmp

memory/2556-14-0x0000000003EE0000-0x0000000004429000-memory.dmp

memory/2556-15-0x0000000004430000-0x000000000497D000-memory.dmp

memory/2556-16-0x00000000002C0000-0x00000000002C1000-memory.dmp

memory/2556-17-0x0000000004430000-0x000000000497D000-memory.dmp

C:\Users\Public\Downloads\20250228020157\1.bat

MD5 fa42ebb1071abc0e618c296ea2cf71a6
SHA1 9e0c0737b0e37b3e821d011eecd9b0c7c9f2a15a
SHA256 395f835731d25803a791db984062dd5cfdcade6f95cc5d0f68d359af32f6258d
SHA512 0ed9919675c224201996caeeecf625a1db00a70af5d3ba135dc3d6fa16bfcc562426c813e21b4e861f04d312635be3528d79b5c49b23e78161f2b051fa9aaf05

C:\ProgramData\20250228020157\Agghosts.exe

MD5 2a24dcd41bc3c5b5f7eceda525786578
SHA1 7e898f9ee5a97a1a261326f0168e8de44dcf8af4
SHA256 169e9e4b23878035551455f4e5dbd01ece204e59fe75361680e8786998059ca7
SHA512 aaded4c72d3fa77eefd9d4b098288dd6923bd79813466d93313d6acb00fea9bb90248fff92cc89a625c60ae3b7cc1c27e8bb178fdac624ec896267da57b9fd6a

C:\ProgramData\lnk\2.lnk

MD5 e79b7c7d0629097398788f83872e5ee2
SHA1 bedbd09576b6d6bbbbd282c7bd27b41cb87b297d
SHA256 ad8db7a28ee7f9e29bd3937c19db9f5d0faa58a4a162c3850b83f96a0fc6cc0f
SHA512 09fddf66cae84df72cd51081b3291f2a5eaeda7f0cec6fe6902d7a9377057ed9eec837a792a14930d5d77c0ec5a49f0db2d23272e2c4f24c26aeb93d5279be50

C:\programdata\20250228020157\libcef.dll

MD5 b7f8c3416cdfd6f46c790da064f66099
SHA1 d7ae9a3d49bbf1981e7d6604128e18b6cd160bd6
SHA256 b9edf03447cf402e24da384c146c9d1536871a47518c795c4aea6550e3abd94d
SHA512 24272954e57f4f4f81dad90469e84946549e3441ba599f8b819d069b803687b3da35f449c0f18755352dba208d6d63af1d6b53c0a56adbd36540b1537bb99dc7

C:\Users\Public\Downloads\20250228020157\bin.exe

MD5 7411af49c639e972108b78c2b8bc0348
SHA1 51d794a98a32340992a542088a45d0bc0e5566b7
SHA256 71ffaf0d2cc9c28ce0234e5e72bbb3bea387df8587e528c8e514616e602405ff
SHA512 b84cd4063c4adef3c211570bef0f758b455bf998e7b90c265cf7459f5d0c319ab43a4a244935847c7fc9023edda9faa1f40ac107739c2f9a7b5c035ed575c073

memory/2556-61-0x0000000003EE0000-0x0000000004429000-memory.dmp

memory/2556-60-0x0000000004430000-0x000000000497D000-memory.dmp

C:\programdata\20250228020157\Ensup.log

MD5 cdfd3b01da1fb5250177afb3b5039671
SHA1 1c076c1ceca5552324096c23190a01b3d5e4076a
SHA256 e2dee1e9c36da11b0a8da8f758e5047ac4bef9375f8fd2a0a35c452033354681
SHA512 5f827f875a1c12dc21f106815a343989f011f8e4b0be1830b0b745396970e1679c1dfce6da783b7b7afe8ddd7e45c0aede5f830d4302065f3333cbe5ccec9f28

memory/2920-64-0x00000000001D0000-0x00000000001F9000-memory.dmp

\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdate.exe

MD5 cdf152e23a8cbf68dbe3f419701244fc
SHA1 cb850d3675da418131d90ab01320e4e8842228d7
SHA256 84eaf43f33d95da9ab310fc36dc3cfe53823d2220946f021f18cf3f729b8d64e
SHA512 863e1da5bc779fa02cf08587c4de5f04c56e02902c5c4f92a06f2e631380ecabcc98e35d52609f764727e41b965c0786d24ea23fc4b9776d24d9f13e0d8ae0c2

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdate.dll

MD5 dae72b4b8bcf62780d63b9cbb5b36b35
SHA1 1d9b764661cfe4ee0f0388ff75fd0f6866a9cd89
SHA256 b0ca6700e7a4ea667d91bcf3338699f28649c2e0a3c0d8b4f2d146ab7c843ab6
SHA512 402c00cab6dac8981e200b6b8b4263038d76afe47c473d5f2abf0406222b32fff727b495c6b754d207af2778288203ce0774a6200b3e580e90299d08ce0c098f

\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_zh-CN.dll

MD5 ca52cc49599bb6bda28c38aea1f9ec4e
SHA1 494f166b530444f39bca27e2b9e10f27e34fc98a
SHA256 f9f144aa2dc0de21b24c93f498a9b4a946b7da42819a776b3283a0bcae18544b
SHA512 05e2d5711eef8f57737b2512de2e73744f17e0a34de0bfd2a06c9cc60a08ebadbafe38e30b66a2ede7fa61d5b9571adddcfbd7e1cafcee1ab2168a563d2d3f0d

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdateCore.exe

MD5 af51ea4d9828e21f72e935b0deae50f2
SHA1 c7fe57c2a16c9f5a5ebdd3cc0910427cba5308bd
SHA256 3575011873d0f6d49c783095dae06e6619f8f5463da578fbe284ca5d1d449619
SHA512 ec9828d0bade39754748fb53cfc7efdc5e57955198bac3c248ea9b5a9a607182bb1477819f220549a8e9eadbe6bf69a12da6c8af3761980d2dd9078eaeaa932f

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleCrashHandler64.exe

MD5 b659663611a4c2216dff5ab1b60dd089
SHA1 9a14392a5bdb9ea6b8c3e60224b7ff37091d48b5
SHA256 cad4aa1cf58f6b2e2aceb789d53b18418e67066ec406b2fac786cb845ef89d2b
SHA512 1065f9072cd6f1f4364f1354108f2647ee1d89f87e908a22fcd63bd3149c864c457e62268067a439d0486d8d4aa150aa984ad8ac8b51cae49014b67b80496040

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_am.dll

MD5 849bc7e364e30f8ee4c157f50d5b695e
SHA1 b52b8efa1f3a2c84f436f328decd2912efeb1b18
SHA256 f1384a25a6f40e861455c62190d794415f3e9bfca6317c214847e9535dfc3fb9
SHA512 6fd7f542a7073b3bbf1b0c200bb306b30f1b35a64a1fb013f25c7df76f63ef377d9bd736e8da2e9372f1c994785eaeedb6b60e3a0d4a4e8734c266ad61782d3b

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleUpdateComRegisterShell64.exe

MD5 be535d8b68dd064442f73211466e5987
SHA1 aa49313d9513fd9c2d2b25da09ea24d09cc03435
SHA256 c109bcb63391ac3ea93fb97fbdf3f6ed71316cacb592ef46efaea0024bc9ed59
SHA512 eb50eebeaf83be10aea8088e35a807f9001d07d17d2bc1655c3bc0cb254d0f54303348988514ba5590ebd9d3bde3f1149c3f700f62fbce63c0199ea3cfb1f638

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\GoogleCrashHandler.exe

MD5 a11ce10ac47f5f83b9bc980567331a1b
SHA1 63ee42e347b0328f8d71a3aa4dde4c6dc46da726
SHA256 101dbf984c4b3876defe2699d6160acbf1bb3f213e02a32f08fdcdc06821c542
SHA512 ff2f86c4061188ead1bfeebd36de7dbc312adcc95267537697f2bfcbb0c53e7c4ab0cd268cef22f0182391796c4612c97cbdc1266d9ee1960cdd2610d8c2bcb3

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_bg.dll

MD5 c523ec13643d74b187b26b410d39569b
SHA1 46aff0297036c60f22ad30d4e58f429890d9e09d
SHA256 80505863866bcd93a7e617dd8160531401d6d05f48d595348cd321cf7d97aeac
SHA512 ecf98e29a3481b05ab23c3ff89fa3caf054b874ed15462a5e33022aacf561d8fea4a0de35cc5f7450f62110ca4ace613e0c67f543ad22eb417e79eb3ebf24ed7

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_ar.dll

MD5 163695df53cea0728f9f58a46a08e102
SHA1 71b39eec83260e2ccc299fac165414acb46958bd
SHA256 f89dddda3e887385b42ea88118ba8fb1cc68fde0c07d44b851164564eb7c1ec8
SHA512 6dfb70a175097f3c96ae815a563c185136cb5a35f361288cc81570facfa1f1d28f49eaa61172d1da4982ebb76bd3e32c4de77cf97dedfb79f18113d7594d0989

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_da.dll

MD5 9f2e018a4f9a1d278983d0b677b91218
SHA1 c58ee1fc0d8ef9d99f85426b48c7f28f381a2c17
SHA256 d0dcdc68236eecd6b5f0b437eb92b8935741dabf1fa276a552399815af22edec
SHA512 20b74b6a9f81527d4a5fe30671d2559261fb682576f4ab04da7856280fbbaeb6af83894009c9d7cb83deeae988d0ac5ec7ec32b277b7eb45829faec2857d7014

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_el.dll

MD5 ecdd26049573614b6f41d8a102ffcf21
SHA1 5140c6cff5d596267a64df1559ac36c4e8f49e42
SHA256 a3377520f2a95b8cc06bd30e493962c07f97eebf4661a69d03efb36b2ca515c5
SHA512 933c181d7575f20480c8deadac3f3e9190081456169122216c72e7b9a04aa75612140fc37697098c7c20b77001a67966fa1661cdc9110c40634c944f833a65b1

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_es-419.dll

MD5 1c0b1c3625c9ccace1b23e0c64095ee9
SHA1 3904a80d016e0a9a267c0b5feb8e6747b44b5fa1
SHA256 f030757e1911e9efde0d74a02c22694fa5ef139f73897a7f97acab9da05f7c8b
SHA512 0a988edef8d67cd83c2be65cbfa07059df311732ee92ad73fb9411d7cf7d853a2b8d2ab801733d05ab6afaccab33a2684117bbc1d80b362b677cc53ae9de42f0

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_fil.dll

MD5 7be40d81658abf5ad064b1d2b47bab85
SHA1 6275af886533320522a8aa5d56c1ce96bd951e50
SHA256 a063ef2570a5ae5f43284ca29cf5b9723cdc5a013b7ee7743c1f35b21b4d6de3
SHA512 fb9ebefdc2bd895c06971abef0ab1d3e7483c2e38b564881a723c38e39be1dc4e7ab6996e1d6fbe2ca5864909002342afc0a478eaa660ef18c891dc164e56153

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_hu.dll

MD5 643d812265c32ef08d24ad85a4e96865
SHA1 3c576de29d0aff8b727856e16b0aefca81f9fd83
SHA256 8a9fb1677b9ff34a15dae299bdffdb1a2eb2d31d18c8f424b00a8779d2c2a7ce
SHA512 57c9acf0710f10f5d1478603ce47506a2147722c639366ef0b0330be7d278fc0fd2089a7d49e5a514d524c37bb282e8c9c8cd2290da6df7d741228e32645de32

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_kn.dll

MD5 3dc995da466a474a48eafa898fb82358
SHA1 b77da19778316cc5a08271d34843454010d9f00a
SHA256 f90ed49e60496ae9c2a14916730571266429879a2fe1e573ce124b23a431cc24
SHA512 b818f076ba0711bd84a584b360eba7134393d056403a0b001e594937b613e9b0bc6f68eb592f0206f461c95f0c50db0f182d7e6d1dba0fc0653326410ef579d4

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_lt.dll

MD5 3222350eb4fd2be3cf6988e9a9434615
SHA1 da9bbbfecd332737632ab0242cdcf1b21b45e325
SHA256 ac7c39bc73487216415ccc6ba924a501d343d3639ba714e19d00b2d7d01c96bb
SHA512 c2f00d8a442f39c2a2040c256718f912c08228060ba9ddc3d341f3dcd9fb1d79e88f030944afc0583b7f0feaa85782c7497badbf96075ef0ded4dfeecd70add2

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_ml.dll

MD5 dda9ba57c266f598079ba349c4e8a7bb
SHA1 47848f7ea60abd1d1a1a74d1609e3dd449721677
SHA256 6e203d9389f8bd36ecf4ae75d4794b92310e44dd73f62d6c69f5459a5889ba49
SHA512 4599dbee5f26600430fe419306cb1a5a64f11ececd86e50325badf30ede3b33c8dbc5167051476f0809568d8af0bab3dd8ef6216d992d2fc4d2418b6210d3e3c

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_ms.dll

MD5 f9961d3ab327f13e598e1965d60f612d
SHA1 3c3713686ac14d6342606e22a615eb7e84b7adc6
SHA256 77f13c53a6d925f4ad231f92eef8493d176dfba976af04b0287cc4f3ed170385
SHA512 2c3021094afdd34f5d8cd2ce20874504e4711cd90c93e7bb8058d857d872c72f70c7c5fce659c0067b02c372b4e74894a2b1592a66a24bdc2edf5d566633c5a9

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_pl.dll

MD5 e37a2150aaa9d0d14204234b50c47b0a
SHA1 67058159a5e230fc218276352de6fb4a7d790b1e
SHA256 9ac281de97335aaf9b133e6cb70bdf4005616cda03154b42f4dfa9ff2a7bd712
SHA512 ef46d8f33dee845d67205fbd29c6a0419d8b1e08ed742686ba9269738e8be35feedaeb36150323e27acad882c6dce41a344d7724da16e3a7d74d815271d67195

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_pt-PT.dll

MD5 afc3237d8dc20022e34c2459dfddefa1
SHA1 96417a42e253189102ea2f31ce8e672199fa0407
SHA256 ebc6fb7e04cfdc606b9c7466e888aa203ea41875aa758fb841ddc2aeb806117f
SHA512 8e559b8ca0c21565c02be5cb70d5081ffcd9098bcaa5d5af4d9a0c56b749c91a3fb7bce047fa22cade8dd3fadbb25df208bc97229d462a7db57097dea45b276d

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_sk.dll

MD5 94d069339a3d35c7077930f8f9fdccdb
SHA1 a16131345015fd11ddbd9378cf1894c6539da423
SHA256 754a2ed686c822463c05000c8ff0a68dfd090683f8fca2bef2acd8fa66e0fd29
SHA512 616969d70d31ef794aba4df8a56d8ad9cc3e78eea59bede1f8ceffbc003110b9417c741d8a16113a1e1de288a2fa41db7a40b76458e2f67ffb6a4e25ef394d3d

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_sl.dll

MD5 0ab3cf59a5061717cbbfc49c1b0aa118
SHA1 60e5498d51e7803f58fa302140345e66c832c3a4
SHA256 fc9e0113b2fce88b219736bf3735594b31e5479cf87610345c583aa0fc469701
SHA512 cb31c47c411aea76fa5da8053ed6f1691e1fa30d6042377ad74d1f1c2a8e148ee900451def7c09e6c9a61f637574f9dcd80b352dd8f14f0362d3bb1603657493

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_sr.dll

MD5 e75a33ec8facb41048c4acdbfabf3504
SHA1 0583adbaa291e84259fb502576e2714445d8971e
SHA256 af5d6a5cc79889f7c6fb275aad584ab9d217c56eca1057ca946a38925c73b9af
SHA512 f0740bedf2cb8371032426c2acc08276f8dfa6743e9cc036ce5eec65d23dc284ce5aadcb3b37d6bf2e93e2fd51845b59fe793a71287dcee2edda6a40adde5e2e

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_ru.dll

MD5 3ea9e4e19291000e1e2896a6d9b01278
SHA1 a6dbecf7f5dd101411ad7a89745d32bde02ed3c7
SHA256 b3ed49efd7c34b36fdf158ebdcafe902c0829cdc8001de85c8bcec518caa6ddc
SHA512 e162b14a812200a3154c75aa2f28e19f02a5855b184c19ab48d8016c1bdc95dd134034e443cd9589c8382b57a9783bd12bdf4e3291fcd52de517034ab74ee2ca

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_ro.dll

MD5 402ddb558441f58d9b3b43f805fd5437
SHA1 72f72646a34e3115a174f566cebac31987cbf801
SHA256 58d3b773227358cbc3f6dc76481e92a4efb76c2a615bd687ef1306a384a445f7
SHA512 f014fb76b5f8f48646149fed636a6c32a9745c0e91bb36f30070314766b5fd33f46fdb5b0b74c4a326f51e681abe5b35d17164bcf617705405e8c7d873dd6520

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_pt-BR.dll

MD5 bf16776c7971b2d4d9c9b9ddf9223a13
SHA1 6b7a3bb185cf048050b433efec8a3143903734d9
SHA256 68f6802a8901d925c63d8ac926c316977342c0912e86bb88a22b7aecf77150cc
SHA512 3c7334caf7174c57802503ea0e671637bdbc008459db04ea4bd1bda9ca1c908e077d19de15a7625edbd33edc0263fc5a230396c6349280da6233d35f8c5dafa0

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_no.dll

MD5 b078d410f71bdf2b8648bf6e11375dc9
SHA1 1d0319b8a788249d3eec8ddf0b380538aeda4566
SHA256 9a1c2daaba121ac5fab1a1aee31eae36a3fbad6b99b63b38b646b82881ae9b19
SHA512 b3a3f2b1c1d57677d8f6dee703b70b78eb80cf3094ccff0f301fc77e5f7098417af843b259a7259aeef199e22a22f5a43ad9ebdadf4ad6cf299c3a77af7edcda

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_nl.dll

MD5 57b0bac4eda0c827da924232d42f76f3
SHA1 35275113ae62ae2c3d42407e218c8b7f5de85584
SHA256 429ab34307720cc976b765a6c54be85e5186ee0658c306d00125c6b1bd921bc6
SHA512 b14c3ffd77c4098cc7bebd74275028038c2753283fc2e23e8f837749ce93e1b916a0ccaf1ee1c1bab8ad1a23e8138955d894bce0ba6867e6b98d8100726dabc9

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_mr.dll

MD5 58c2651976ceae81141f379b61bc29fa
SHA1 d1ef381ac11522f819dba9a9cb0278d3bc94022f
SHA256 645dacff8bfbebad949e0f3156cda5d6a3f32b6feb3670224abeefb9e003a17b
SHA512 d02c1d2e0bc99dcb7afe627f0667dabc500e1921f68f06e767e18176c3b6d567c42258a04003ecd8717fc8d4aa7ed964d676da5029a7d81125dae186b9c43f94

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_lv.dll

MD5 d33d83efebabef0a02fc4b60bffe8d05
SHA1 33cc8a8a435e7f14182c1448fc33ede33ab1591f
SHA256 5823437043ed0c6ed61f5946ea82b4a96ba2e8110a8a1f1b7e2e2d1a17e77ba8
SHA512 19135a4b05006f6119b723c53bf99e616408bb2d84d08d0aa8fb37ef89e728b7fda82d970281a1d278caa0e6bec762468f358ac7203a31b1d37108465425f415

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_ko.dll

MD5 817334b58dbb927ce4c48c3a3020951c
SHA1 3a6cf01fec1df2539c6120d22c09ed60d7e2cbff
SHA256 d3cef44dccba742ca5436958c084fc493cd466f025d6d16bdb672fcf2caca1a4
SHA512 f966388939746ebbe4c9cf39c20a8afd629197e8bb1c7901cc1566de2eb9cfafa600eb4c3a383bfdaba17bd231137a440c1ed15dc3dcd6fca31318547d3ef3d5

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_ja.dll

MD5 9da8d2e3d88263cd7f812d11ab9bc2c9
SHA1 dbcdc83da62cc4e017887b7bf922a0bbc84c2725
SHA256 bb48d17f2ba1a12cf8fc36261e0127331c0335576989135e6a26f39b06370a72
SHA512 1f9890057feee22dddfdfda15d70b28021091648b5709641cf24219b8fba47327ac73c47ebdf5dd3d7d78e4d0191174c5eebc6374c9ba97fddc2d0655d195561

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_iw.dll

MD5 7ffd5276481f3f5fef9f1d9dac8497e1
SHA1 70a395091cd2bd4daa577d5d9d3f0adfef913d5c
SHA256 fd0d2ce2649f568572136d2fb05166d2ea359f09a144d74d18d7af300747ff74
SHA512 da5849817f2d36aff69508fcb8cc2876e2e3f4488b78ba31a88220ccd4f733cd3a9f7ebdeda3a0bc71b59e2046cce468e6feaf804f14df228bc72ab0ead7d9cd

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_it.dll

MD5 09a9fc2170493a2a41d170a50ba8bca1
SHA1 d16655f4ed41dd6c237c7a656fac5a1d701d3fb9
SHA256 ac69dc0d86be68b99092e88cdaa9790a7a8696508826ee203d5cb3b4a5d70127
SHA512 296e5a7789efb04197235c32c50c082069dd0c73e7a006a7564a8e5dfeac752e0be0061638755f878a533c567654506391f788ebfbe35b2abd5af7301503718c

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_is.dll

MD5 60356f1cf81af2df4f1249e44746e6c7
SHA1 2ef6d5a8fc130f2f64b462f3570ba7ca2251bb22
SHA256 e1370b54a0d8c228d7a0db25126c73a0952ef627c156eb6c694528f661bd80ae
SHA512 8ca6febf031afa634e1f67ed23fafc7140705a919193fb7179fd915a0d5a9ae8cff507c737831cface640ba228180f37a360080952a1a7874995103cd2c90f40

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_id.dll

MD5 ee84269990052544e742980dbaf0d83f
SHA1 52aa93d2a7143429e8af23aa82d02d08f82c53a4
SHA256 9f6e7f7eb54e9016536f99c0b4be8860957d89083a40f571e28fade5dd7b74fd
SHA512 4d2e5cc0d395d645b8134a71b10cab84c74a8058c0d45db4d45ce6e72153fedfb752ef0c0262eb28966d1dd2065cc59bc5aa86643736216eedb4a1bff60e710f

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_hr.dll

MD5 2716da909b0391389cbe63c4ac400a57
SHA1 bd393b5d1628dc5f3c4a5f97442841dfffe82201
SHA256 e211322d446dbe1c37696583be70a6b4b60536b60e7a188d7f3e186b72e5c438
SHA512 84d495de33a70bce97a1ceaab229656089d8b615e649b39ce43a400fc91d0d62637987a0425b6fa573870c3e6ae3bbc9b1f7e7777bb20479d54f514f9a5763ed

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_hi.dll

MD5 c49920211ea0dbcf0e345fca094d861a
SHA1 07280830e9dbe42cb92987432ec16b5811710582
SHA256 20c2df074927fd7e2fc62f346e0b4fb55823a3d4d531f861bf50de96ac64d092
SHA512 ae6a6b0df91d95cf7a510aa1195ce1da89f06245cae427ca7b5a72874bffd81d03c2fdd01c9ef478e303a9741ea5aa38c8b6f2f136652798aa531569916d3bf2

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_gu.dll

MD5 bab8d0e0de3cce8c6bb37f0ad0c32998
SHA1 8e874d3fa8964445af18edd2261c29d32fce949a
SHA256 68f33b5cc51cc5acacfb4b8e2501f2f15f586ba8d355773f941bf3818f4d0456
SHA512 f71f2d5c657cd934521a14c9b0a4807a3b8635d4bef0ced77f095a3a71eb1963cbbe7cbba5acf34b8fecba0413f608b30fe250df893d2c42a07214d7308f1897

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_fr.dll

MD5 463f8ddab25348ea0897ead89146402f
SHA1 a0f160a05139ad95c066ebdac738789a796229c5
SHA256 737210fd8e9a4c601693d0e9c95a323881d125b02f9f82b0a3820ca223b29af6
SHA512 e40e59d8dca80b9860359feb464933e1c9644f8d57ff5a9fdff6e598b1805ee6b0c1757cef68f9c9bb330dc3cce0fd285f22764cd2f6007d0ea42c792e61d262

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_fi.dll

MD5 5c530468d61708123c8919a8480e5967
SHA1 2d85a2335bc688d2c2045299c1e36b39b179603e
SHA256 21aa3b8d540c7b2ea33c4a11fb35fdd721b69f04a660edb2ac2031d98f38e239
SHA512 bfe4ce4762ef5de853635a2341249012da27b7a02e3f4722841792345527d7951fb20661d1b7c8a58293c4ac5ee0b34cea0e190fa5f74efd12aeacba3c74a2aa

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_fa.dll

MD5 90d38d6669931e76faa1e69aee2ab3e2
SHA1 e0de420b422c7ad4e73ace2c84db45f6db2b1d6e
SHA256 1fe4bc690efc72cb8737d4b451c2c843d2987d71bf60723471bf66cf53fcc714
SHA512 1cc66e166b4dc3b6c1f96340489652bd313d8d6de31a3165bac9da8fd42146843f840ee7a5f163512163fc8f90b865a06cc29a147c44389f40eb1edafd6d3743

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_et.dll

MD5 dfa1d51ca956e3aaa1008503aaeb3dd8
SHA1 94511faf996c1ce9b2397c7fc3f78f32fbf8f966
SHA256 3781d18bab1524cff8104167caaccb7eee6614394068dbb7b7c412c7c9b5aae9
SHA512 b25f9a14053acab26f1d353e9d908cbe769a640d0e8d66c30209c2a5d76c503b8e7fb04651f37ff482f7c4df4ffed33013d37b1f7bb6650e25447006f447b85d

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_es.dll

MD5 dae64d49ee97339b7327b52c9f720848
SHA1 15f159c4808f9e4fe6a2f1a4a19faa5d84ac630b
SHA256 e76400e62ae0ab31565e50b05d1001b775a91aa487a54dc90e53c0e103c717c2
SHA512 9ae72e5a658aa0e1fb261d62ccef474cd42d9bec2b4a50f71925d131ffea22b8f60fb961772587ce71cb30a32da3b7986e7483ecea960a509e0450d3983c84b0

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_en-GB.dll

MD5 f82ccf890c3ae14bfd7a263d07276e60
SHA1 6a915d6eb8c99d065e36a721d721d556b74bb377
SHA256 6b07a4fd3039541e30c68a8c31c371cda2cea480787f95e0ddbca3cc2fbff0cc
SHA512 4cbf9e6728e08de8d61f34b17bb20d92b6a699969edb9afa013fe962c8fd39238288adcd826134c9bca459904d8574a804c519daac6b301e0d38f68722c0359e

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_en.dll

MD5 741211652c66a8a6790396e1875eefa9
SHA1 2ccd5653b5fc78bcc19f86b493cef11844ba7a0c
SHA256 e0945deacdb6b75ff2587dea975774b9b800747e2ee3f3917e5b40ddb87eda10
SHA512 b70f847d8ca8828c89bbb67b543950fbd514c733cf62b52ad7fc0dab7b2168fe56d1f21bef3210f5c7f563f72831455d870a5f9aa6c557f1e3543ef7329c42f9

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_de.dll

MD5 96d92500b9a763f4b862c511c17e0a47
SHA1 2fd441eb8685d15e14fa6405e82359adea3e7148
SHA256 58829d135ff41e574ed5fc5e0421e4aa204267b02ca3ffaf08d8efb0a70fdd4c
SHA512 a1014584f1f278160d579848fa188f627676aee819e9395517490b00e273db6f583d7ddd31af6e35c9d251021df7fb26c88512aaa1c865c2ee3ba60c0a2db49a

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_cs.dll

MD5 b9033db8d0e5bf254979b0f47d10e93d
SHA1 2859de0d851b5f4fd3056e8f9015cece2436c307
SHA256 12c41c2f472b6a05fd6392e9d4f8aeb9a40840c2cbefd68b39d20f9d1d4d77ed
SHA512 52075df4ae5c86ebb0bac20604ea072a163761ae058c1473211bf4bb0eeed043cfc5a92386f876b53484cdf4e3f8a7b75d8f4bf9894c24f8c22ec23a50b70b7c

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_ca.dll

MD5 39e25ba8d69f493e6f18c4ef0cf96de8
SHA1 5584a94a85d83514a46030c4165e8f7a942e63e2
SHA256 1f66ebdcaae482a201a6e0fab9c1f4501c23a0d4ad819ccd555fdca9cc7edb94
SHA512 773c995b449d64e36eb8cab174db29e29e29985bcfd714799d6b05b01bb7d4a0fc2aefaf2e27ff02b0e105fbe0d34d7efe29b193a1bc3365ec47e1f1003bed26

C:\Program Files (x86)\Google\Temp\GUMDCE8.tmp\goopdateres_bn.dll

MD5 dafa45a82ce30cf2fd621e0a0b8c031f
SHA1 e39ed5213f9bb02d9da2c889425fab8ca6978db7
SHA256 d58e5f0fa894123de1d9b687a5b84826e095eca128ee5df8870f2db74f4233a2
SHA512 2b772ebc128eb59d636eec36583329962ead8e0a399fd56394b1244486bf815f4e033ceef74a62a9930ab2bf6ec1ba5e2d3c942183f7cb2355a716a3e2c6c7a1

C:\Users\Admin\AppData\Local\Temp\CabF0F6.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\setup.exe

MD5 b42b8ac29ee0a9c3401ac4e7e186282d
SHA1 69dfb1dd33cf845a1358d862eebc4affe7b51223
SHA256 19545e8376807bce8a430c37cab9731e85052103f769dd60a5da3d93ca68c6ec
SHA512 b5269e7392e77a0fa850049ff61e271c5aab90d546945b17a65cc2ea6420432ae56321e1e39cfd97ccdb3dfc37ddbd6ff77907f5685cc2323b8635c8cdb4a84f

memory/2920-400-0x00000000005E0000-0x00000000005F2000-memory.dmp

memory/2920-403-0x00000000005E0000-0x00000000005F2000-memory.dmp

memory/2920-404-0x00000000005E0000-0x00000000005F2000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

MD5 3433ccf3e03fc35b634cd0627833b0ad
SHA1 789a43382e88905d6eb739ada3a8ba8c479ede02
SHA256 f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d
SHA512 21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Temp\scoped_dir1652_2061148080\839f3f0e-5999-460c-b444-b2801084ef43.tmp

MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

C:\Users\Admin\AppData\Local\Temp\scoped_dir1652_2061148080\CRX_INSTALL\_locales\en\messages.json

MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json

MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\CURRENT~RFf77baf6.TMP

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000002.dbtmp

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 982a5d24f205af498030484c94f10e8e
SHA1 1565e86dede86f14eccdb627640e5abf3adf2281
SHA256 85f5c9e034ceb39db68a0e41a2ab7db01efa29014c72aaa3dfbb175345a17dcf
SHA512 38af47557bc685e881b78f298a9c88ac161e8615fd4062a80fdf44ee751a9bd092150b73a59649026be673f2c4c5df71ec4a07851464d799d51bf4df0fc21e78

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\76a252e8-259e-43a5-878a-acc0081e3689.tmp

MD5 38374c90d7e1a72a4450077c687b1e5a
SHA1 c6217e88c3dd30a6db94d9b932797c95130ca5a0
SHA256 01c2e93b02a93ee360ce3f8172a37472271d2b81645d0fe73184d2b5d6feba5b
SHA512 ff1ab74e5fa73166762ea880a4c35e048314ab8857a9c122d2a6c35a7123ae9a5958399177612418e78c49ee17496ed11a31cb78c3acd670a5eec31387dd23fa

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 4ea3e236f484e548980892a5e80ba2cc
SHA1 d40e8b18646534da80c1c683eb935e373d716cde
SHA256 7b7ade3c738c6d599374afc934990e6d10869c3c687b229e88925a61e9d1e74d
SHA512 120f67aefb0701eafb9e26397c36e900a2384b4053d10e882b7a653193425866beb4e842e0d1aaa9b6e5f6a2b2653ef7dc98d2e93d19a728c10ce268a0942a92

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 327b811358c0b56be1d277a521ad3e28
SHA1 69df8a51671a6ab49a9286ff7619b9b65123efa6
SHA256 bd12c268b48839ee28127daa11834899ae6151a835c30154784c4a5ac784ae93
SHA512 4e88fa788855a34df06a1f994e142cbb11c56819f234a655887391d638c3c7c2f4b56fef0c5af69f26516d81d7cb2ebcaec122f982b5ac96a9deda97138e033b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 f3a5fec2285be3be0832795e48f79121
SHA1 72b00383a610d6000355dfb00747c5d61599ebf5
SHA256 76b1a410901b48a03eb779312a10bcf2ac4f40338177e86a7d538f2a8512334e
SHA512 0bfabcfc6a38e0e83601a2e22d61102b78aca645a4ba9c9ec5df91dc353c7e85fce604c0a0a83f7fdf646621a3a9699e59e5221e7b0465d8fa84f4080fbbe053

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-28 09:01

Reported

2025-02-28 09:04

Platform

win10v2004-20250217-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe"

Signatures

FatalRat

stealer trojan fatalrat

Fatalrat family

fatalrat

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

UAC bypass

defense_evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\system32\reg.exe N/A

Fatal Rat payload

rat infostealer
Description Indicator Process Target
N/A N/A N/A N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96} C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome" C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\133.0.6943.142\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable" C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome" C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1" C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0" C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A

Event Triggered Execution: Image File Execution Options Injection

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0" C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\Users\Public\Downloads\20250228020156\bin.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\133.0.6943.142_chrome_installer.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.142\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdata_Service = "C:\\programdata\\lnk\\dick.lnk" C:\Windows\System32\reg.exe N/A

Checks installed software on the system

discovery

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Google\Temp\GUTB74C.tmp C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_ca.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_fa.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\v8_context_snapshot.bin C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping4420_23653162\manifest.fingerprint C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_et.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_fi.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_sv.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_hu.dll C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\Locales\mr.pak C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\VisualElements\SmallLogoBeta.png C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\psuser_64.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_ar.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_fi.dll C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\133.0.6943.142_chrome_installer.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\default_apps\external_extensions.json C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping4420_1015478436\_locales\mr\messages.json C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_cs.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_lt.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ml.dll C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ta.dll C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\chrome.7z C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\chrome.dll C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_pt-PT.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\Locales\cs.pak C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\Locales\ro.pak C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\optimization_guide_internal.dll C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping4420_1015478436\_locales\si\messages.json C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping4420_1015478436\_locales\ca\messages.json C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_da.dll C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_en-GB.dll C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_fil.dll C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\Locales\ko.pak C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\Locales\ru.pak C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\Locales\sr.pak C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\Locales\tr.pak C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping4420_1015478436\_locales\is\messages.json C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_en.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_ko.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_fa.dll C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\Locales\pt-BR.pak C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping4420_1015478436\_locales\ar\messages.json C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\Locales\sl.pak C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\Locales\sv.pak C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\Locales\ta.pak C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping4420_1015478436\_locales\en_GB\messages.json C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_et.dll C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ko.dll C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_lt.dll C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\Locales\et.pak C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\VisualElements\Logo.png C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\os_update_handler.exe C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_es.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_ta.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\133.0.6943.142\Locales\fa.pak C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\Google\Chrome\Temp\source1900_1094635787\Chrome-bin\chrome_proxy.exe C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping4420_1015478436\_locales\ne\messages.json C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping4420_1015478436\_locales\pt_PT\messages.json C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdateBroker.exe C:\Users\Public\Downloads\20250228020156\bin.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\psmachine.dll C:\Users\Public\Downloads\20250228020156\bin.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\programdata\20250228020156\Agghosts.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\Downloads\20250228020156\bin.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\programdata\20250228020156\Agghosts.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\programdata\20250228020156\Agghosts.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133852069755686796" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine\CurVer\ = "GoogleUpdate.Update3WebMachine.1.0" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E}\InprocHandler32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ = "ICredentialDialog" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods\ = "4" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods\ = "11" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\Elevation\Enabled = "1" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\PROGID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ = "IJobObserver" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc\ = "Google Update Legacy On Demand" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ = "IBrowserHttpRequest2" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\Elevation\IconReference = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\goopdate.dll,-1004" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods\ = "4" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ = "IProcessLauncher2" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ = "IProcessLauncher" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\Elevation\IconReference = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\goopdate.dll,-1004" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\goopdate.dll,-3000" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\ChromeHTML C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ = "IAppCommandWeb" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ = "IGoogleUpdate3WebSecurity" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E}\InprocHandler32 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\Elevation\IconReference = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\goopdate.dll,-1004" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\133.0.6943.142\\notification_helper.exe" C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc.1.0\CLSID\ = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\Elevation C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods\ = "11" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ = "GoogleUpdate Update3Web" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D} C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69} C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\VersionIndependentProgID\ = "GoogleUpdate.CoCreateAsync" C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods\ = "24" C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\VersionIndependentProgID C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A
N/A N/A C:\programdata\20250228020156\Agghosts.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\programdata\20250228020156\Agghosts.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
Token: 33 N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\133.0.6943.142_chrome_installer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\133.0.6943.142_chrome_installer.exe N/A
Token: 33 N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Token: 33 N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1340 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Windows\system32\cmd.exe
PID 1340 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Windows\system32\cmd.exe
PID 380 wrote to memory of 4720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 380 wrote to memory of 4720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1340 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\programdata\20250228020156\Agghosts.exe
PID 1340 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\programdata\20250228020156\Agghosts.exe
PID 1340 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\programdata\20250228020156\Agghosts.exe
PID 1340 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Windows\System32\reg.exe
PID 1340 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Windows\System32\reg.exe
PID 1340 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Users\Public\Downloads\20250228020156\bin.exe
PID 1340 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Users\Public\Downloads\20250228020156\bin.exe
PID 1340 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe C:\Users\Public\Downloads\20250228020156\bin.exe
PID 4920 wrote to memory of 3184 N/A C:\Users\Public\Downloads\20250228020156\bin.exe C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe
PID 4920 wrote to memory of 3184 N/A C:\Users\Public\Downloads\20250228020156\bin.exe C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe
PID 4920 wrote to memory of 3184 N/A C:\Users\Public\Downloads\20250228020156\bin.exe C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe
PID 3184 wrote to memory of 2412 N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3184 wrote to memory of 2412 N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3184 wrote to memory of 2412 N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3184 wrote to memory of 4704 N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3184 wrote to memory of 4704 N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3184 wrote to memory of 4704 N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 4704 wrote to memory of 3668 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 4704 wrote to memory of 3668 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 4704 wrote to memory of 2080 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 4704 wrote to memory of 2080 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 4704 wrote to memory of 4808 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 4704 wrote to memory of 4808 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
PID 3184 wrote to memory of 2036 N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3184 wrote to memory of 2036 N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3184 wrote to memory of 2036 N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3184 wrote to memory of 4248 N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3184 wrote to memory of 4248 N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3184 wrote to memory of 4248 N/A C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3572 wrote to memory of 2016 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\133.0.6943.142_chrome_installer.exe
PID 3572 wrote to memory of 2016 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\133.0.6943.142_chrome_installer.exe
PID 2016 wrote to memory of 1900 N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\133.0.6943.142_chrome_installer.exe C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe
PID 2016 wrote to memory of 1900 N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\133.0.6943.142_chrome_installer.exe C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe
PID 1900 wrote to memory of 448 N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe
PID 1900 wrote to memory of 448 N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe
PID 1900 wrote to memory of 4792 N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe
PID 1900 wrote to memory of 4792 N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe
PID 4792 wrote to memory of 852 N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe
PID 4792 wrote to memory of 852 N/A C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe
PID 3572 wrote to memory of 4536 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe
PID 3572 wrote to memory of 4536 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe
PID 3572 wrote to memory of 4536 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe
PID 3572 wrote to memory of 1060 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe
PID 3572 wrote to memory of 1060 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe
PID 3572 wrote to memory of 3268 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3572 wrote to memory of 3268 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3572 wrote to memory of 3268 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1340 wrote to memory of 3220 N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1340 wrote to memory of 3220 N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 1340 wrote to memory of 3220 N/A C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
PID 3220 wrote to memory of 4420 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3220 wrote to memory of 4420 N/A C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4420 wrote to memory of 2404 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4420 wrote to memory of 2404 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4420 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4420 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4420 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4420 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4420 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4420 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2025-02-28_f3e4feed797b47a2d54a863284411a40_ryuk.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Downloads\20250228020156\1.bat" "

C:\programdata\20250228020156\Agghosts.exe

"C:\programdata\20250228020156\Agghosts.exe"

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\System32\reg.exe

"C:\Windows\System32\reg.exe" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v GoogleUpdata_Service /d "C:\programdata\lnk\dick.lnk" /f

C:\Users\Public\Downloads\20250228020156\bin.exe

"C:\Users\Public\Downloads\20250228020156\bin.exe"

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={798BD0C5-13EB-DE8C-E07C-A7A64270D046}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0RCRDc4QTktRjE3QS00QzIwLTk2MEYtRTQwN0Q0NjhCODU3fSIgdXNlcmlkPSJ7QUUyQkEwQUMtNzhGNC00OEFELThFMEUtQjM2QjdEQTRERUI0fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0QwQzM4MkQ4LUQzQTAtNEQzMS05NUM2LUEzNjIwOTNBNjZGN30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjM3MSIgbmV4dHZlcnNpb249IjEuMy4zNi4zMTIiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7Nzk4QkQwQzUtMTNFQi1ERThDLUUwN0MtQTdBNjQyNzBEMDQ2fSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI4NjAiLz48L2FwcD48L3JlcXVlc3Q-

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={798BD0C5-13EB-DE8C-E07C-A7A64270D046}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{7DBD78A9-F17A-4C20-960F-E407D468B857}"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc

C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\133.0.6943.142_chrome_installer.exe

"C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\133.0.6943.142_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\guiD8.tmp"

C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\guiD8.tmp"

C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.142 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff673f80f58,0x7ff673f80f64,0x7ff673f80f70

C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1

C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe

"C:\Program Files (x86)\Google\Update\Install\{D3310587-4B07-4D36-BC0F-0D025D704D49}\CR_F458D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.142 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff673f80f58,0x7ff673f80f64,0x7ff673f80f70

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe"

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe"

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0RCRDc4QTktRjE3QS00QzIwLTk2MEYtRTQwN0Q0NjhCODU3fSIgdXNlcmlkPSJ7QUUyQkEwQUMtNzhGNC00OEFELThFMEUtQjM2QjdEQTRERUI0fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0Y0NDExNkQ3LUZBQ0EtNDg0My1CMURBLTYzMjMxM0I4QkU1Q30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMzLjAuNjk0My4xNDIiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTAiIGlpZD0iezc5OEJEMEM1LTEzRUItREU4Qy1FMDdDLUE3QTY0MjcwRDA0Nn0iIGNvaG9ydD0iMTpndS9pMTk6IiBjb2hvcnRuYW1lPSJTdGFibGUgSW5zdGFsbHMgJmFtcDsgVmVyc2lvbiBQaW5zIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2k1bzZtdHhxbWJ1cmI2Y2Q2YXkyNGxtbGFpXzEzMy4wLjY5NDMuMTQyLzEzMy4wLjY5NDMuMTQyX2Nocm9tZV9pbnN0YWxsZXIuZXhlIiBkb3dubG9hZGVkPSIxMTg3MDYwMzIiIHRvdGFsPSIxMTg3MDYwMzIiIGRvd25sb2FkX3RpbWVfbXM9Ijk1NDciLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM1OSIgZG93bmxvYWRfdGltZV9tcz0iMTA3OTYiIGRvd25sb2FkZWQ9IjExODcwNjAzMiIgdG90YWw9IjExODcwNjAzMiIgaW5zdGFsbF90aW1lX21zPSIyOTk1MyIvPjwvYXBwPjwvcmVxdWVzdD4

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe" -Embedding

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.142 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa965adcf8,0x7ffa965add04,0x7ffa965add10

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1972,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1968 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2228,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2232 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2376,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2536 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3244 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3264 /prefetch:1

C:\Program Files\Google\Chrome\Application\133.0.6943.142\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.142\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3864,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3876 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3908,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4012 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3352,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3372 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4832,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4428 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5564,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5576 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5652,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5664 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5680,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5716 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5848,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6032 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6244,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5968 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5676,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5808 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=208,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4100 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4016,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4236 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4260,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5636 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6380,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5648 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4244,i,14203003345095204713,12353118546947214200,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4220 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 kuilngrl-1336113850.cos.ap-hongkong.myqcloud.com udp
HK 43.132.105.214:443 kuilngrl-1336113850.cos.ap-hongkong.myqcloud.com tcp
N/A 127.0.0.1:65392 tcp
US 8.8.8.8:53 www.baidu.com udp
HK 103.235.46.115:80 www.baidu.com tcp
HK 192.252.182.21:8081 tcp
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.213.3:443 update.googleapis.com tcp
GB 216.58.213.3:443 update.googleapis.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.212.195:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 216.58.212.195:80 o.pki.goog tcp
HK 192.252.182.21:8081 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
GB 216.58.213.3:443 update.googleapis.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.google.com udp
NL 142.250.27.84:443 accounts.google.com udp
GB 216.58.204.68:443 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 216.58.204.78:443 apis.google.com udp
GB 142.250.187.202:443 ogads-pa.googleapis.com udp
GB 142.250.187.202:443 ogads-pa.googleapis.com tcp
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.213.3:443 update.googleapis.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.14:443 play.google.com udp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 142.250.200.14:443 play.google.com udp
GB 142.250.179.225:443 clients2.googleusercontent.com udp
N/A 224.0.0.251:5353 udp
GB 216.58.213.3:443 update.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.180.10:443 chromewebstore.googleapis.com tcp
HK 192.252.182.21:8081 tcp
US 8.8.8.8:53 update.googleapis.com udp
GB 216.58.213.3:443 update.googleapis.com tcp
GB 216.58.213.3:443 update.googleapis.com udp

Files

memory/1340-6-0x0000000140000000-0x000000014054D000-memory.dmp

memory/1340-7-0x000001C6E27D0000-0x000001C6E2D19000-memory.dmp

memory/1340-8-0x000001C6E2210000-0x000001C6E2211000-memory.dmp

memory/1340-9-0x0000000140000000-0x000000014054D000-memory.dmp

C:\ProgramData\20250228020156\Agghosts.exe

MD5 2a24dcd41bc3c5b5f7eceda525786578
SHA1 7e898f9ee5a97a1a261326f0168e8de44dcf8af4
SHA256 169e9e4b23878035551455f4e5dbd01ece204e59fe75361680e8786998059ca7
SHA512 aaded4c72d3fa77eefd9d4b098288dd6923bd79813466d93313d6acb00fea9bb90248fff92cc89a625c60ae3b7cc1c27e8bb178fdac624ec896267da57b9fd6a

C:\Users\Public\Downloads\20250228020156\1.bat

MD5 fa42ebb1071abc0e618c296ea2cf71a6
SHA1 9e0c0737b0e37b3e821d011eecd9b0c7c9f2a15a
SHA256 395f835731d25803a791db984062dd5cfdcade6f95cc5d0f68d359af32f6258d
SHA512 0ed9919675c224201996caeeecf625a1db00a70af5d3ba135dc3d6fa16bfcc562426c813e21b4e861f04d312635be3528d79b5c49b23e78161f2b051fa9aaf05

C:\programdata\20250228020156\libcef.dll

MD5 b7f8c3416cdfd6f46c790da064f66099
SHA1 d7ae9a3d49bbf1981e7d6604128e18b6cd160bd6
SHA256 b9edf03447cf402e24da384c146c9d1536871a47518c795c4aea6550e3abd94d
SHA512 24272954e57f4f4f81dad90469e84946549e3441ba599f8b819d069b803687b3da35f449c0f18755352dba208d6d63af1d6b53c0a56adbd36540b1537bb99dc7

C:\programdata\20250228020156\Ensup.log

MD5 cdfd3b01da1fb5250177afb3b5039671
SHA1 1c076c1ceca5552324096c23190a01b3d5e4076a
SHA256 e2dee1e9c36da11b0a8da8f758e5047ac4bef9375f8fd2a0a35c452033354681
SHA512 5f827f875a1c12dc21f106815a343989f011f8e4b0be1830b0b745396970e1679c1dfce6da783b7b7afe8ddd7e45c0aede5f830d4302065f3333cbe5ccec9f28

memory/4544-41-0x0000000002C00000-0x0000000002C29000-memory.dmp

C:\ProgramData\lnk\2.lnk

MD5 238e8ea1e818f04f6a7f7a5447612de1
SHA1 c4ee022dda7a8fd26b8df9fc8f1db8420eb9c88b
SHA256 ba05ae221689bdbfe1745fad04eefeb94da9ef86c4b31daaaec7be9c0c88dbfc
SHA512 a6f3b9a94cc6ca1e20838eda2e5139954648166fb5b365994dbd01c42b1a532d3e9637b2b0c53727627aa37a08e3591bd7edcc863fb5efa2719c80d8e14dc29b

C:\Users\Public\Downloads\20250228020156\bin.exe

MD5 7411af49c639e972108b78c2b8bc0348
SHA1 51d794a98a32340992a542088a45d0bc0e5566b7
SHA256 71ffaf0d2cc9c28ce0234e5e72bbb3bea387df8587e528c8e514616e602405ff
SHA512 b84cd4063c4adef3c211570bef0f758b455bf998e7b90c265cf7459f5d0c319ab43a4a244935847c7fc9023edda9faa1f40ac107739c2f9a7b5c035ed575c073

memory/1340-68-0x0000000140000000-0x000000014054D000-memory.dmp

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdate.exe

MD5 cdf152e23a8cbf68dbe3f419701244fc
SHA1 cb850d3675da418131d90ab01320e4e8842228d7
SHA256 84eaf43f33d95da9ab310fc36dc3cfe53823d2220946f021f18cf3f729b8d64e
SHA512 863e1da5bc779fa02cf08587c4de5f04c56e02902c5c4f92a06f2e631380ecabcc98e35d52609f764727e41b965c0786d24ea23fc4b9776d24d9f13e0d8ae0c2

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdate.dll

MD5 dae72b4b8bcf62780d63b9cbb5b36b35
SHA1 1d9b764661cfe4ee0f0388ff75fd0f6866a9cd89
SHA256 b0ca6700e7a4ea667d91bcf3338699f28649c2e0a3c0d8b4f2d146ab7c843ab6
SHA512 402c00cab6dac8981e200b6b8b4263038d76afe47c473d5f2abf0406222b32fff727b495c6b754d207af2778288203ce0774a6200b3e580e90299d08ce0c098f

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_zh-CN.dll

MD5 ca52cc49599bb6bda28c38aea1f9ec4e
SHA1 494f166b530444f39bca27e2b9e10f27e34fc98a
SHA256 f9f144aa2dc0de21b24c93f498a9b4a946b7da42819a776b3283a0bcae18544b
SHA512 05e2d5711eef8f57737b2512de2e73744f17e0a34de0bfd2a06c9cc60a08ebadbafe38e30b66a2ede7fa61d5b9571adddcfbd7e1cafcee1ab2168a563d2d3f0d

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdateCore.exe

MD5 af51ea4d9828e21f72e935b0deae50f2
SHA1 c7fe57c2a16c9f5a5ebdd3cc0910427cba5308bd
SHA256 3575011873d0f6d49c783095dae06e6619f8f5463da578fbe284ca5d1d449619
SHA512 ec9828d0bade39754748fb53cfc7efdc5e57955198bac3c248ea9b5a9a607182bb1477819f220549a8e9eadbe6bf69a12da6c8af3761980d2dd9078eaeaa932f

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_el.dll

MD5 ecdd26049573614b6f41d8a102ffcf21
SHA1 5140c6cff5d596267a64df1559ac36c4e8f49e42
SHA256 a3377520f2a95b8cc06bd30e493962c07f97eebf4661a69d03efb36b2ca515c5
SHA512 933c181d7575f20480c8deadac3f3e9190081456169122216c72e7b9a04aa75612140fc37697098c7c20b77001a67966fa1661cdc9110c40634c944f833a65b1

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_es.dll

MD5 dae64d49ee97339b7327b52c9f720848
SHA1 15f159c4808f9e4fe6a2f1a4a19faa5d84ac630b
SHA256 e76400e62ae0ab31565e50b05d1001b775a91aa487a54dc90e53c0e103c717c2
SHA512 9ae72e5a658aa0e1fb261d62ccef474cd42d9bec2b4a50f71925d131ffea22b8f60fb961772587ce71cb30a32da3b7986e7483ecea960a509e0450d3983c84b0

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_sw.dll

MD5 4ee5a9caf4adc71e4befbc0379c41e94
SHA1 8ef6d22227f6622fe9b5a3179d069de910105153
SHA256 e619faa6e77470fb92dd2cb5b8d9dd4ad37ee37b23b399337074028491f1b2b9
SHA512 6393ade560ccc82b725c94e32d99f59f481396a0e446613906b0f8e0e92fc958d40174ed5de0551102c0184bd2cc69f80900c1a3503554caa1419bd83dc3e6de

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_ta.dll

MD5 8e8d6887fde2466da2be1d384c0383cf
SHA1 dbf9085b136415bbf5f014bb302a74c829b8c097
SHA256 aba95443bab217b2d7865affe9413c5c942ecc99eca9eff65a1c0530b4ea077f
SHA512 4a67122980013b8694dbf7857b038faf00981c53af8ae7431b8f0ebcbba1414259ae1ec236a02c799f2952a9bb78f9d639ef9088d6fe1d51e29c7519bc5ca6f0

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_sv.dll

MD5 d7b734454ff3da92dd1fd229c60bb6e6
SHA1 31569dafa2cd9d7cf896b9d8f30f4eeac7ae5ac5
SHA256 977180603ca761728318cea3c1905d8bac8ff3edee3a6cb6f5e15bed528e953f
SHA512 9efdb877c61276e6ca9e411a7009ab98d5844164de29a502fd5b582381fd49085c64bc5b27be782881fa5b1f62ca19259f6a4417bccd39cc4e5c9f2184c07842

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_sr.dll

MD5 e75a33ec8facb41048c4acdbfabf3504
SHA1 0583adbaa291e84259fb502576e2714445d8971e
SHA256 af5d6a5cc79889f7c6fb275aad584ab9d217c56eca1057ca946a38925c73b9af
SHA512 f0740bedf2cb8371032426c2acc08276f8dfa6743e9cc036ce5eec65d23dc284ce5aadcb3b37d6bf2e93e2fd51845b59fe793a71287dcee2edda6a40adde5e2e

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_sl.dll

MD5 0ab3cf59a5061717cbbfc49c1b0aa118
SHA1 60e5498d51e7803f58fa302140345e66c832c3a4
SHA256 fc9e0113b2fce88b219736bf3735594b31e5479cf87610345c583aa0fc469701
SHA512 cb31c47c411aea76fa5da8053ed6f1691e1fa30d6042377ad74d1f1c2a8e148ee900451def7c09e6c9a61f637574f9dcd80b352dd8f14f0362d3bb1603657493

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_sk.dll

MD5 94d069339a3d35c7077930f8f9fdccdb
SHA1 a16131345015fd11ddbd9378cf1894c6539da423
SHA256 754a2ed686c822463c05000c8ff0a68dfd090683f8fca2bef2acd8fa66e0fd29
SHA512 616969d70d31ef794aba4df8a56d8ad9cc3e78eea59bede1f8ceffbc003110b9417c741d8a16113a1e1de288a2fa41db7a40b76458e2f67ffb6a4e25ef394d3d

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_ru.dll

MD5 3ea9e4e19291000e1e2896a6d9b01278
SHA1 a6dbecf7f5dd101411ad7a89745d32bde02ed3c7
SHA256 b3ed49efd7c34b36fdf158ebdcafe902c0829cdc8001de85c8bcec518caa6ddc
SHA512 e162b14a812200a3154c75aa2f28e19f02a5855b184c19ab48d8016c1bdc95dd134034e443cd9589c8382b57a9783bd12bdf4e3291fcd52de517034ab74ee2ca

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_ro.dll

MD5 402ddb558441f58d9b3b43f805fd5437
SHA1 72f72646a34e3115a174f566cebac31987cbf801
SHA256 58d3b773227358cbc3f6dc76481e92a4efb76c2a615bd687ef1306a384a445f7
SHA512 f014fb76b5f8f48646149fed636a6c32a9745c0e91bb36f30070314766b5fd33f46fdb5b0b74c4a326f51e681abe5b35d17164bcf617705405e8c7d873dd6520

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_pt-PT.dll

MD5 afc3237d8dc20022e34c2459dfddefa1
SHA1 96417a42e253189102ea2f31ce8e672199fa0407
SHA256 ebc6fb7e04cfdc606b9c7466e888aa203ea41875aa758fb841ddc2aeb806117f
SHA512 8e559b8ca0c21565c02be5cb70d5081ffcd9098bcaa5d5af4d9a0c56b749c91a3fb7bce047fa22cade8dd3fadbb25df208bc97229d462a7db57097dea45b276d

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_pt-BR.dll

MD5 bf16776c7971b2d4d9c9b9ddf9223a13
SHA1 6b7a3bb185cf048050b433efec8a3143903734d9
SHA256 68f6802a8901d925c63d8ac926c316977342c0912e86bb88a22b7aecf77150cc
SHA512 3c7334caf7174c57802503ea0e671637bdbc008459db04ea4bd1bda9ca1c908e077d19de15a7625edbd33edc0263fc5a230396c6349280da6233d35f8c5dafa0

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_pl.dll

MD5 e37a2150aaa9d0d14204234b50c47b0a
SHA1 67058159a5e230fc218276352de6fb4a7d790b1e
SHA256 9ac281de97335aaf9b133e6cb70bdf4005616cda03154b42f4dfa9ff2a7bd712
SHA512 ef46d8f33dee845d67205fbd29c6a0419d8b1e08ed742686ba9269738e8be35feedaeb36150323e27acad882c6dce41a344d7724da16e3a7d74d815271d67195

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_no.dll

MD5 b078d410f71bdf2b8648bf6e11375dc9
SHA1 1d0319b8a788249d3eec8ddf0b380538aeda4566
SHA256 9a1c2daaba121ac5fab1a1aee31eae36a3fbad6b99b63b38b646b82881ae9b19
SHA512 b3a3f2b1c1d57677d8f6dee703b70b78eb80cf3094ccff0f301fc77e5f7098417af843b259a7259aeef199e22a22f5a43ad9ebdadf4ad6cf299c3a77af7edcda

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_nl.dll

MD5 57b0bac4eda0c827da924232d42f76f3
SHA1 35275113ae62ae2c3d42407e218c8b7f5de85584
SHA256 429ab34307720cc976b765a6c54be85e5186ee0658c306d00125c6b1bd921bc6
SHA512 b14c3ffd77c4098cc7bebd74275028038c2753283fc2e23e8f837749ce93e1b916a0ccaf1ee1c1bab8ad1a23e8138955d894bce0ba6867e6b98d8100726dabc9

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_ms.dll

MD5 f9961d3ab327f13e598e1965d60f612d
SHA1 3c3713686ac14d6342606e22a615eb7e84b7adc6
SHA256 77f13c53a6d925f4ad231f92eef8493d176dfba976af04b0287cc4f3ed170385
SHA512 2c3021094afdd34f5d8cd2ce20874504e4711cd90c93e7bb8058d857d872c72f70c7c5fce659c0067b02c372b4e74894a2b1592a66a24bdc2edf5d566633c5a9

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_mr.dll

MD5 58c2651976ceae81141f379b61bc29fa
SHA1 d1ef381ac11522f819dba9a9cb0278d3bc94022f
SHA256 645dacff8bfbebad949e0f3156cda5d6a3f32b6feb3670224abeefb9e003a17b
SHA512 d02c1d2e0bc99dcb7afe627f0667dabc500e1921f68f06e767e18176c3b6d567c42258a04003ecd8717fc8d4aa7ed964d676da5029a7d81125dae186b9c43f94

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_ml.dll

MD5 dda9ba57c266f598079ba349c4e8a7bb
SHA1 47848f7ea60abd1d1a1a74d1609e3dd449721677
SHA256 6e203d9389f8bd36ecf4ae75d4794b92310e44dd73f62d6c69f5459a5889ba49
SHA512 4599dbee5f26600430fe419306cb1a5a64f11ececd86e50325badf30ede3b33c8dbc5167051476f0809568d8af0bab3dd8ef6216d992d2fc4d2418b6210d3e3c

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_lv.dll

MD5 d33d83efebabef0a02fc4b60bffe8d05
SHA1 33cc8a8a435e7f14182c1448fc33ede33ab1591f
SHA256 5823437043ed0c6ed61f5946ea82b4a96ba2e8110a8a1f1b7e2e2d1a17e77ba8
SHA512 19135a4b05006f6119b723c53bf99e616408bb2d84d08d0aa8fb37ef89e728b7fda82d970281a1d278caa0e6bec762468f358ac7203a31b1d37108465425f415

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_lt.dll

MD5 3222350eb4fd2be3cf6988e9a9434615
SHA1 da9bbbfecd332737632ab0242cdcf1b21b45e325
SHA256 ac7c39bc73487216415ccc6ba924a501d343d3639ba714e19d00b2d7d01c96bb
SHA512 c2f00d8a442f39c2a2040c256718f912c08228060ba9ddc3d341f3dcd9fb1d79e88f030944afc0583b7f0feaa85782c7497badbf96075ef0ded4dfeecd70add2

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_ko.dll

MD5 817334b58dbb927ce4c48c3a3020951c
SHA1 3a6cf01fec1df2539c6120d22c09ed60d7e2cbff
SHA256 d3cef44dccba742ca5436958c084fc493cd466f025d6d16bdb672fcf2caca1a4
SHA512 f966388939746ebbe4c9cf39c20a8afd629197e8bb1c7901cc1566de2eb9cfafa600eb4c3a383bfdaba17bd231137a440c1ed15dc3dcd6fca31318547d3ef3d5

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_kn.dll

MD5 3dc995da466a474a48eafa898fb82358
SHA1 b77da19778316cc5a08271d34843454010d9f00a
SHA256 f90ed49e60496ae9c2a14916730571266429879a2fe1e573ce124b23a431cc24
SHA512 b818f076ba0711bd84a584b360eba7134393d056403a0b001e594937b613e9b0bc6f68eb592f0206f461c95f0c50db0f182d7e6d1dba0fc0653326410ef579d4

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_ja.dll

MD5 9da8d2e3d88263cd7f812d11ab9bc2c9
SHA1 dbcdc83da62cc4e017887b7bf922a0bbc84c2725
SHA256 bb48d17f2ba1a12cf8fc36261e0127331c0335576989135e6a26f39b06370a72
SHA512 1f9890057feee22dddfdfda15d70b28021091648b5709641cf24219b8fba47327ac73c47ebdf5dd3d7d78e4d0191174c5eebc6374c9ba97fddc2d0655d195561

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_iw.dll

MD5 7ffd5276481f3f5fef9f1d9dac8497e1
SHA1 70a395091cd2bd4daa577d5d9d3f0adfef913d5c
SHA256 fd0d2ce2649f568572136d2fb05166d2ea359f09a144d74d18d7af300747ff74
SHA512 da5849817f2d36aff69508fcb8cc2876e2e3f4488b78ba31a88220ccd4f733cd3a9f7ebdeda3a0bc71b59e2046cce468e6feaf804f14df228bc72ab0ead7d9cd

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_it.dll

MD5 09a9fc2170493a2a41d170a50ba8bca1
SHA1 d16655f4ed41dd6c237c7a656fac5a1d701d3fb9
SHA256 ac69dc0d86be68b99092e88cdaa9790a7a8696508826ee203d5cb3b4a5d70127
SHA512 296e5a7789efb04197235c32c50c082069dd0c73e7a006a7564a8e5dfeac752e0be0061638755f878a533c567654506391f788ebfbe35b2abd5af7301503718c

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_is.dll

MD5 60356f1cf81af2df4f1249e44746e6c7
SHA1 2ef6d5a8fc130f2f64b462f3570ba7ca2251bb22
SHA256 e1370b54a0d8c228d7a0db25126c73a0952ef627c156eb6c694528f661bd80ae
SHA512 8ca6febf031afa634e1f67ed23fafc7140705a919193fb7179fd915a0d5a9ae8cff507c737831cface640ba228180f37a360080952a1a7874995103cd2c90f40

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_id.dll

MD5 ee84269990052544e742980dbaf0d83f
SHA1 52aa93d2a7143429e8af23aa82d02d08f82c53a4
SHA256 9f6e7f7eb54e9016536f99c0b4be8860957d89083a40f571e28fade5dd7b74fd
SHA512 4d2e5cc0d395d645b8134a71b10cab84c74a8058c0d45db4d45ce6e72153fedfb752ef0c0262eb28966d1dd2065cc59bc5aa86643736216eedb4a1bff60e710f

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_hu.dll

MD5 643d812265c32ef08d24ad85a4e96865
SHA1 3c576de29d0aff8b727856e16b0aefca81f9fd83
SHA256 8a9fb1677b9ff34a15dae299bdffdb1a2eb2d31d18c8f424b00a8779d2c2a7ce
SHA512 57c9acf0710f10f5d1478603ce47506a2147722c639366ef0b0330be7d278fc0fd2089a7d49e5a514d524c37bb282e8c9c8cd2290da6df7d741228e32645de32

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_hr.dll

MD5 2716da909b0391389cbe63c4ac400a57
SHA1 bd393b5d1628dc5f3c4a5f97442841dfffe82201
SHA256 e211322d446dbe1c37696583be70a6b4b60536b60e7a188d7f3e186b72e5c438
SHA512 84d495de33a70bce97a1ceaab229656089d8b615e649b39ce43a400fc91d0d62637987a0425b6fa573870c3e6ae3bbc9b1f7e7777bb20479d54f514f9a5763ed

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_hi.dll

MD5 c49920211ea0dbcf0e345fca094d861a
SHA1 07280830e9dbe42cb92987432ec16b5811710582
SHA256 20c2df074927fd7e2fc62f346e0b4fb55823a3d4d531f861bf50de96ac64d092
SHA512 ae6a6b0df91d95cf7a510aa1195ce1da89f06245cae427ca7b5a72874bffd81d03c2fdd01c9ef478e303a9741ea5aa38c8b6f2f136652798aa531569916d3bf2

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_gu.dll

MD5 bab8d0e0de3cce8c6bb37f0ad0c32998
SHA1 8e874d3fa8964445af18edd2261c29d32fce949a
SHA256 68f33b5cc51cc5acacfb4b8e2501f2f15f586ba8d355773f941bf3818f4d0456
SHA512 f71f2d5c657cd934521a14c9b0a4807a3b8635d4bef0ced77f095a3a71eb1963cbbe7cbba5acf34b8fecba0413f608b30fe250df893d2c42a07214d7308f1897

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_fr.dll

MD5 463f8ddab25348ea0897ead89146402f
SHA1 a0f160a05139ad95c066ebdac738789a796229c5
SHA256 737210fd8e9a4c601693d0e9c95a323881d125b02f9f82b0a3820ca223b29af6
SHA512 e40e59d8dca80b9860359feb464933e1c9644f8d57ff5a9fdff6e598b1805ee6b0c1757cef68f9c9bb330dc3cce0fd285f22764cd2f6007d0ea42c792e61d262

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_fil.dll

MD5 7be40d81658abf5ad064b1d2b47bab85
SHA1 6275af886533320522a8aa5d56c1ce96bd951e50
SHA256 a063ef2570a5ae5f43284ca29cf5b9723cdc5a013b7ee7743c1f35b21b4d6de3
SHA512 fb9ebefdc2bd895c06971abef0ab1d3e7483c2e38b564881a723c38e39be1dc4e7ab6996e1d6fbe2ca5864909002342afc0a478eaa660ef18c891dc164e56153

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_fi.dll

MD5 5c530468d61708123c8919a8480e5967
SHA1 2d85a2335bc688d2c2045299c1e36b39b179603e
SHA256 21aa3b8d540c7b2ea33c4a11fb35fdd721b69f04a660edb2ac2031d98f38e239
SHA512 bfe4ce4762ef5de853635a2341249012da27b7a02e3f4722841792345527d7951fb20661d1b7c8a58293c4ac5ee0b34cea0e190fa5f74efd12aeacba3c74a2aa

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_fa.dll

MD5 90d38d6669931e76faa1e69aee2ab3e2
SHA1 e0de420b422c7ad4e73ace2c84db45f6db2b1d6e
SHA256 1fe4bc690efc72cb8737d4b451c2c843d2987d71bf60723471bf66cf53fcc714
SHA512 1cc66e166b4dc3b6c1f96340489652bd313d8d6de31a3165bac9da8fd42146843f840ee7a5f163512163fc8f90b865a06cc29a147c44389f40eb1edafd6d3743

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_et.dll

MD5 dfa1d51ca956e3aaa1008503aaeb3dd8
SHA1 94511faf996c1ce9b2397c7fc3f78f32fbf8f966
SHA256 3781d18bab1524cff8104167caaccb7eee6614394068dbb7b7c412c7c9b5aae9
SHA512 b25f9a14053acab26f1d353e9d908cbe769a640d0e8d66c30209c2a5d76c503b8e7fb04651f37ff482f7c4df4ffed33013d37b1f7bb6650e25447006f447b85d

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_es-419.dll

MD5 1c0b1c3625c9ccace1b23e0c64095ee9
SHA1 3904a80d016e0a9a267c0b5feb8e6747b44b5fa1
SHA256 f030757e1911e9efde0d74a02c22694fa5ef139f73897a7f97acab9da05f7c8b
SHA512 0a988edef8d67cd83c2be65cbfa07059df311732ee92ad73fb9411d7cf7d853a2b8d2ab801733d05ab6afaccab33a2684117bbc1d80b362b677cc53ae9de42f0

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_en-GB.dll

MD5 f82ccf890c3ae14bfd7a263d07276e60
SHA1 6a915d6eb8c99d065e36a721d721d556b74bb377
SHA256 6b07a4fd3039541e30c68a8c31c371cda2cea480787f95e0ddbca3cc2fbff0cc
SHA512 4cbf9e6728e08de8d61f34b17bb20d92b6a699969edb9afa013fe962c8fd39238288adcd826134c9bca459904d8574a804c519daac6b301e0d38f68722c0359e

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_en.dll

MD5 741211652c66a8a6790396e1875eefa9
SHA1 2ccd5653b5fc78bcc19f86b493cef11844ba7a0c
SHA256 e0945deacdb6b75ff2587dea975774b9b800747e2ee3f3917e5b40ddb87eda10
SHA512 b70f847d8ca8828c89bbb67b543950fbd514c733cf62b52ad7fc0dab7b2168fe56d1f21bef3210f5c7f563f72831455d870a5f9aa6c557f1e3543ef7329c42f9

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_da.dll

MD5 9f2e018a4f9a1d278983d0b677b91218
SHA1 c58ee1fc0d8ef9d99f85426b48c7f28f381a2c17
SHA256 d0dcdc68236eecd6b5f0b437eb92b8935741dabf1fa276a552399815af22edec
SHA512 20b74b6a9f81527d4a5fe30671d2559261fb682576f4ab04da7856280fbbaeb6af83894009c9d7cb83deeae988d0ac5ec7ec32b277b7eb45829faec2857d7014

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_ca.dll

MD5 39e25ba8d69f493e6f18c4ef0cf96de8
SHA1 5584a94a85d83514a46030c4165e8f7a942e63e2
SHA256 1f66ebdcaae482a201a6e0fab9c1f4501c23a0d4ad819ccd555fdca9cc7edb94
SHA512 773c995b449d64e36eb8cab174db29e29e29985bcfd714799d6b05b01bb7d4a0fc2aefaf2e27ff02b0e105fbe0d34d7efe29b193a1bc3365ec47e1f1003bed26

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_bn.dll

MD5 dafa45a82ce30cf2fd621e0a0b8c031f
SHA1 e39ed5213f9bb02d9da2c889425fab8ca6978db7
SHA256 d58e5f0fa894123de1d9b687a5b84826e095eca128ee5df8870f2db74f4233a2
SHA512 2b772ebc128eb59d636eec36583329962ead8e0a399fd56394b1244486bf815f4e033ceef74a62a9930ab2bf6ec1ba5e2d3c942183f7cb2355a716a3e2c6c7a1

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_bg.dll

MD5 c523ec13643d74b187b26b410d39569b
SHA1 46aff0297036c60f22ad30d4e58f429890d9e09d
SHA256 80505863866bcd93a7e617dd8160531401d6d05f48d595348cd321cf7d97aeac
SHA512 ecf98e29a3481b05ab23c3ff89fa3caf054b874ed15462a5e33022aacf561d8fea4a0de35cc5f7450f62110ca4ace613e0c67f543ad22eb417e79eb3ebf24ed7

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_ar.dll

MD5 163695df53cea0728f9f58a46a08e102
SHA1 71b39eec83260e2ccc299fac165414acb46958bd
SHA256 f89dddda3e887385b42ea88118ba8fb1cc68fde0c07d44b851164564eb7c1ec8
SHA512 6dfb70a175097f3c96ae815a563c185136cb5a35f361288cc81570facfa1f1d28f49eaa61172d1da4982ebb76bd3e32c4de77cf97dedfb79f18113d7594d0989

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_am.dll

MD5 849bc7e364e30f8ee4c157f50d5b695e
SHA1 b52b8efa1f3a2c84f436f328decd2912efeb1b18
SHA256 f1384a25a6f40e861455c62190d794415f3e9bfca6317c214847e9535dfc3fb9
SHA512 6fd7f542a7073b3bbf1b0c200bb306b30f1b35a64a1fb013f25c7df76f63ef377d9bd736e8da2e9372f1c994785eaeedb6b60e3a0d4a4e8734c266ad61782d3b

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleUpdateComRegisterShell64.exe

MD5 be535d8b68dd064442f73211466e5987
SHA1 aa49313d9513fd9c2d2b25da09ea24d09cc03435
SHA256 c109bcb63391ac3ea93fb97fbdf3f6ed71316cacb592ef46efaea0024bc9ed59
SHA512 eb50eebeaf83be10aea8088e35a807f9001d07d17d2bc1655c3bc0cb254d0f54303348988514ba5590ebd9d3bde3f1149c3f700f62fbce63c0199ea3cfb1f638

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleCrashHandler64.exe

MD5 b659663611a4c2216dff5ab1b60dd089
SHA1 9a14392a5bdb9ea6b8c3e60224b7ff37091d48b5
SHA256 cad4aa1cf58f6b2e2aceb789d53b18418e67066ec406b2fac786cb845ef89d2b
SHA512 1065f9072cd6f1f4364f1354108f2647ee1d89f87e908a22fcd63bd3149c864c457e62268067a439d0486d8d4aa150aa984ad8ac8b51cae49014b67b80496040

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_de.dll

MD5 96d92500b9a763f4b862c511c17e0a47
SHA1 2fd441eb8685d15e14fa6405e82359adea3e7148
SHA256 58829d135ff41e574ed5fc5e0421e4aa204267b02ca3ffaf08d8efb0a70fdd4c
SHA512 a1014584f1f278160d579848fa188f627676aee819e9395517490b00e273db6f583d7ddd31af6e35c9d251021df7fb26c88512aaa1c865c2ee3ba60c0a2db49a

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\goopdateres_cs.dll

MD5 b9033db8d0e5bf254979b0f47d10e93d
SHA1 2859de0d851b5f4fd3056e8f9015cece2436c307
SHA256 12c41c2f472b6a05fd6392e9d4f8aeb9a40840c2cbefd68b39d20f9d1d4d77ed
SHA512 52075df4ae5c86ebb0bac20604ea072a163761ae058c1473211bf4bb0eeed043cfc5a92386f876b53484cdf4e3f8a7b75d8f4bf9894c24f8c22ec23a50b70b7c

C:\Program Files (x86)\Google\Temp\GUMB74B.tmp\GoogleCrashHandler.exe

MD5 a11ce10ac47f5f83b9bc980567331a1b
SHA1 63ee42e347b0328f8d71a3aa4dde4c6dc46da726
SHA256 101dbf984c4b3876defe2699d6160acbf1bb3f213e02a32f08fdcdc06821c542
SHA512 ff2f86c4061188ead1bfeebd36de7dbc312adcc95267537697f2bfcbb0c53e7c4ab0cd268cef22f0182391796c4612c97cbdc1266d9ee1960cdd2610d8c2bcb3

memory/4544-375-0x0000000002EB0000-0x0000000002EC2000-memory.dmp

memory/4544-374-0x0000000002EB0000-0x0000000002EC2000-memory.dmp

memory/4544-371-0x0000000002EB0000-0x0000000002EC2000-memory.dmp

C:\Program Files\Google\Chrome\Application\133.0.6943.142\Installer\setup.exe

MD5 80718da9500a4e26c9847cd987da1713
SHA1 091b6f62579da0fa240e0ec272be57a2ac4d2d12
SHA256 fca2996bd26929ecb82629e5c237c4a748d9b30243dbb5bc4af2dcd3701937fb
SHA512 3409ff509e433b65d66e29dba66a57e80675902bf84d5eccdf60181f79b4fb015ae80d9db8a3f3dac570848c6c841bdbe8c7577c31e9da0cb1ec89eed203581c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 f4f5cb4a5c76ebfbf4d2a0b440194ae1
SHA1 2cdc10c29b72958d1f62f8889d683988826d9a79
SHA256 4b79ac96ed5bffbcaa31e3ea48f87e289b76e9196d23ce317cf54cfd347e2618
SHA512 ed5f5ede665458748a4b381209651c98c4754a678521ebccdb0278504c1579e2ee9488384dab2d5a0b1ba6094ac3b308fb6978cfe206d531b9fedbf545819393

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

MD5 505a174e740b3c0e7065c45a78b5cf42
SHA1 38911944f14a8b5717245c8e6bd1d48e58c7df12
SHA256 024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d
SHA512 7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0e3caf67-ffd7-4b92-a6d4-3b8a28cdd012.tmp

MD5 b77fc97eecd8f7383464171a4edef544
SHA1 bbae26d2a7914a3c95dca35f1f6f820d851f6368
SHA256 93332c49fab1deb87dac6cb5d313900cb20e6e1ba928af128a1d549a44256f68
SHA512 68745413a681fdf4088bf8d6b20e843396ae2e92fbb97239dc6c764233a7e7b700a51548ff4d2ea86420b208b92a5e5420f08231637fbb5dbf7e12a377be3fc3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4420_2032219469\Icons\128.png

MD5 654cafa7846b64b91835e202c3efca65
SHA1 4e0fa549b16a47ca9e22e0a510229f528740d51b
SHA256 956bd19ad9a62b83792bed90a6e6457e0812abb36ef85763f62883d70f65241b
SHA512 65db6e4824ee4caa38fa4ec837c2ee4290e34c8d2c5099b33720e7b6ab83997608ae8a6d47961d8506be3d23606b179cf792cc040a7c6c3f251855c294b26223

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\64.png

MD5 0aa5ac35c79f5cb38dd5fafbabf2983c
SHA1 36658f24dbb49f5ff2a19897b22071f72e523f12
SHA256 3695587d1d40ba3171aa991cb77e6c9080b550db7c3d3b52097c1723ab060f32
SHA512 fcbc8a65c4b852c848a13fa12131fa7b17b1310ad3278e78545e8334ddf199b627110bde2fc0a5e7312fad3a5f12b0db54c665d00f1feb1cf3b7c4b18e7569e7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\48.png

MD5 5bfbb6b6a7e313f5d67a1219f7866c4a
SHA1 c49ec46ca5fb945b582c99b47a2b7c09da8f766e
SHA256 6dc4e5c4c1722173cb9d40e7edd2947c12677b12fd2fdd6e2544bda6bb456ab1
SHA512 55928faf39965083855cf6e1a8bc477560b41f3d8d8f678de7271960c6b59b7f2a256ae4e03428f86c1fc0e431370512e9c69a5631cad9e103e8978faa10ac13

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\32.png

MD5 a3a00ef924278ba60be0fffeec04995e
SHA1 69ab25402bb5ef6d99538ec8044c6edb128be0d3
SHA256 a5670fe56dbae316511d6f8c7349477c69c53dc59fe5615984eed5c8cf55a717
SHA512 fd53f2c0e8f493817f5ff5c2f9b87ffb82a11bc2b56a9798072efdf22677d2760bc489a2c8d76fdee6f65a0f4509d4bc257851811b4f720120780e796c6bc4b9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

MD5 eae462c55eba847a1a8b58e58976b253
SHA1 4d7c9d59d6ae64eb852bd60b48c161125c820673
SHA256 ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad
SHA512 494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

C:\Users\Admin\AppData\Local\Temp\scoped_dir4420_1961782262\CRX_INSTALL\_locales\en_CA\messages.json

MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 a8385133177433dd5f91e5fe286d53e9
SHA1 b726c9f63f40b2c73dd8d22919e9b1c7ffe6bdda
SHA256 39943d8a62c8473a3131c18bd6385eb832370707d00febd9cd9efefe17981b4e
SHA512 e3c11c4e2fcc8bbe685b843465ea5ecc2667c0c0d12a8cc68ce5f634d366aad16ab8d2aba1093e05ecda5c35141bbcd2c317710c283ec419f8ce279e17eb2214

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 d508889b04c8c635df8188acc4216d89
SHA1 c01b0a6fc25818ffcf383b7c4121a1b33adbce03
SHA256 21d629a03add4984120e5bf9ed82966632c8cbd47a8056fbc05514cd6a9db2b4
SHA512 6e4ab535c41a36e470e0c0c7e582c411d8e1b17b9d6402dd279da26fab6e3f13818e22912ced1e5862fcc8a7cd6f595c1199c32b5e32ab60f4cc17d094a287b0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 8affc4848f1f38f114313aa2bed4e061
SHA1 999d5fca9f0a0635945ff2aad93bb087ba4c2fb1
SHA256 fd626642aa424981a2d32d49cd144ab894ea0d227f1c1297281b3846de528957
SHA512 11e71f329501bbe6d599d1fb5a681d4d1bbd02b827dac88eeab57809dadb777d7d3ab39bdfb2763eb3f9afc3bbc531b151244fa36e9b1c36358ca789624ba8aa

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 aed7b5d2c6d372cc94b01f502a57fbd7
SHA1 73634710cfcfce5f76d7c783726e96ffaa77d084
SHA256 3d2b781c4cfd1daea093289573b0467e5005f060b932d3fda561b907cf553e5c
SHA512 4832aef0d8d95068fe3bc955b28e8d1753c50985b20546a85b983df25810bd0ecf2d23fbca03fa681f951d99014dbfb84e4dc06c535940478e0e14d9e1aff958

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 3acc425bca49c581e574c2770985aa08
SHA1 f6ab06ed80427034cd170b7064c09f50446c9b53
SHA256 d71f7c5f5ac18cf6705817364728a6dd450f77ec88f68c0a267e2fe0eb07efb3
SHA512 893de8dc872baeea778192bd1f0b1f85dac22fa591659d968fbba0a8311629e3216098d6bfc08194c62e6df8663aec49dc862ded9910d90322da551d9f68b9dd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 6aee072ff772d87e133be9751a9e67d1
SHA1 9359e29dda6b83a1aa17f537c3c363ebfac148bc
SHA256 d71f70fdce3d042152def7c3d58f29a80456c7732e440594742903fe2257c0ad
SHA512 9e06dbe507f1cc949d739d05e70c50d975047ead9236765adb8b6e1c138549040150f3a302311d78095d740b5c9205ebf8cb01ebfd7b5d97e64ab28639f6021b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d88790de9c3805928689497d92aa4fa7
SHA1 c654e55f32859d92f8c83c68b44b04e7c0f910d9
SHA256 7c3cf67d294b7b66a901061571318aaf58b3dcfdcea65daa847de9fd9a54cb97
SHA512 27f71423f8e0ac241172df02d8c5dc0911e9f601c419629f9fce81d1efc8a1e08d4c48d255fed4c619f229c7b84a88d7581a94d69612d018072a2ce5b7a1a6e3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 4e5e2ef0a68390bb80cf26bf379ead82
SHA1 68d7f4655b844db884ac23b6a7b577676ad371cc
SHA256 2641e6f9855bca18dacac43632d68b6f5632a4cc1aedc289066248c13849f74d
SHA512 0e946f8b9604440a9d3c01e23e9458a290f5a79be597f30190055084c9bd15b3b1c3d18cd2030f3113cb4cbdf2b876840afa654790768043ccfa05d74d362378

memory/4544-967-0x0000000001200000-0x000000000134D000-memory.dmp

memory/4544-964-0x0000000001200000-0x000000000134D000-memory.dmp

memory/4544-968-0x0000000001200000-0x000000000134D000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 03294085d0c300b2e60be90e5260ed6d
SHA1 f545dfa8184a3f178ec67622e16684d968b4c5d8
SHA256 8127e655ecd8c93d7b281d7daaf1f18c922a5eda040064025b0ada501f497285
SHA512 cc9903339899f2e17e66a87688f6e2c55b21894209dbffb56679eccd3f325105d1df6c68d1084420b4e91c97f4c0de2bbb7b74b8adb9d7cf41c12a11b52739cc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 5c9816b78452b5cd54ff8d529e3d3134
SHA1 5b32b1f7a5e4c8aa315fead8a82e4af13205fa6a
SHA256 374a6d85a41e487020c09ee34218c86920b20a0b778af5da1b1367e25dc1643d
SHA512 d885733462a04bf4467d0a2097c063547572f1d36bd7a6a43a6620080082c9ce6c2dac2a9f54f86863181dbcb52b40a42ed3b547ba9e13b2b41a7149adb70090

C:\Program Files\chrome_Unpacker_BeginUnzipping4420_23653162\manifest.json

MD5 9585cb6cae92df90f9fce1091c6da40a
SHA1 fca8bded549311578c4623680159ffed831fc38b
SHA256 337415af627a5c520de87843330d5b49d8041e4bcd3154b5bec1d2a1f5eb997e
SHA512 99192b2f98c559ce61cfe5796733a9da01cf9b4ca966500abdd71e35e18a3bf9b75ce5815e73f19d07f299e4be2b8fc6b9f289d6bbbbf357b9c0d24622db8207

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.55.0\Filtering Rules

MD5 5f2e8bc6fd4937fbb0939c6773064f3e
SHA1 524faece2a5491ef2739c2424f962c9adf74e891
SHA256 4723c6e42380c6a90a601c9bf6e4dd72136958516de05623dc8d342b6e05f00c
SHA512 d5b3cf6ab579b71f68bb02739b70de1d403ce59c45442015e09b502e723e9d9ffcced8429c228f467995cd01a13cae9d2172994ff0d8677dfe501898922e00b7

C:\Program Files\chrome_Unpacker_BeginUnzipping4420_1546147682\manifest.json

MD5 e4e87cd28cc2fb07859df48e8b18819e
SHA1 21ea14f31fe01060a97a7ae48df8beb8c94a9716
SHA256 070712e8973fa606e2fa0b9686dfc445d50a8b80b082eb753135f6c65ffaa458
SHA512 4a17f550714f86c94927721c8b435028f4a4baf4e61a71eb6a7fe3da7f6fd02321a8df2c9154d1112949d26f0bf318894c6a409a00519a38f34721f3158a0490

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation\9577\crl-set

MD5 caba86db6d4a247c07fef908a9aed2ea
SHA1 0a1cf009a63673ab69cb07b23d5c14ed0778f3b7
SHA256 b56f1a7d9bc3db572773f2679e39ba9443505a3a52d3135ecd1f7570f0b60e0f
SHA512 a1e4b686320bac84088a56ba39a3cc0ead8c3a3eb104664d2f3825544f972c3c8e42a3447bf22324581f23569070dab7a1a704ae1c8ad06335ad5a775038a968