85533c970219e8087a4ea666fcbb5ceac05136dc35c49bf1a9992c4e055f8f56

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2025, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-07-02_fa909875c91d95637259ae6558665559_amadey_black-basta_darkgate_elex_hijackloader_luca-stealer.exe
Size 8.5MB
Sample250702-e5211aspt5
SHA256 85533c970219e8087a4ea666fcbb5ceac05136dc35c49bf1a9992c4e055f8f56
MD5 fa909875c91d95637259ae6558665559
SHA1 aa2fa10f638afd795a693f014ea0198aae858211
SHA512 cc1856a05487f209a2ec441621128408de91c1365360ff3b0b4ee23de1d07e4a91c2f2918dad5e61ae55d2b53086a550dd9a6d50ad5c5143c228fb4bdf58fe7d
SSDEEP 196608:ILX8vpjby5OkoeYX706eGQ7WWbf6otLwGwP55ar9kCmlwe1Xf/Ohz2+K:IIvxy58eYX37Q7WWbf5L+5Mr9k3d1XfJ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\138.0.7204.51\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	chrome.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\5763b061-6264-4b95-95d0-b9717828a8f0.tmp	updater.exe
File created	C:\Program Files (x86)\chrome_url_fetcher_4056_1564384021\-44fc7fe2-65ce-487c-93f4-edee46eeaaab-_138.0.7194.0_all_eppcciev6nezaewaj5bmdlbbia.crx3	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\CR_945C4.tmp\setup.exe	138.0.7204.51_chrome_installer_uncompressed.exe
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\kn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\chrome.exe.sig	setup.exe
File created	C:\Program Files\Google\Chrome\Application\138.0.7204.51\Installer\setup.exe	setup.exe
File opened for modification	C:\Program Files\chrome_installer.log	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\bn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\de.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\VisualElements\Logo.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\elevated_tracing_service.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\th.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\tr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\d3dcompiler_47.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\cs.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\te.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\WidevineCdm\LICENSE	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\el.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\chrome.exe	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\uninstall.cmd	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\default_apps\external_extensions.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\es-419.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\fi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\_metadata\verified_contents.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\nb.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\WidevineCdm\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\vk_swiftshader.dll	setup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File opened for modification	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4056_1996980423\debug.log	UpdaterSetup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\e15c647d-685c-4544-ad6d-b69b62b3f1a0.tmp	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe57c38e.TMP	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	UpdaterSetup.exe
File created	C:\Program Files\Google5840_2070101464\bin\uninstall.cmd	UpdaterSetup.exe
File created	C:\Program Files (x86)\Google4128_1458938920\updater.7z	2025-07-02_fa909875c91d95637259ae6558665559_amadey_black-basta_darkgate_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\af.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\sk.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\VisualElements\SmallLogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\chrome_proxy.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\MEIPreload\preloaded_data.pb	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\chrome_wer.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\dxcompiler.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\en-US.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\ko.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\mr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\VisualElements\LogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\138.0.7204.51\Locales\id.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5268_1020486190\Chrome-bin\chrome.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe

Executes dropped EXE 36 IoCs

pid	Process
740	updater.exe
1832	updater.exe
6020	updater.exe
3944	updater.exe
1940	updater.exe
872	updater.exe
5236	138.0.7204.51_chrome_installer_uncompressed.exe
5268	setup.exe
1680	setup.exe
4344	setup.exe
2196	setup.exe
4164	chrome.exe
5868	chrome.exe
4640	chrome.exe
2728	chrome.exe
4548	elevation_service.exe
4696	chrome.exe
1224	chrome.exe
5776	chrome.exe
5144	chrome.exe
5928	chrome.exe
5396	chrome.exe
2308	chrome.exe
2956	chrome.exe
5640	chrome.exe
2940	chrome.exe
2056	chrome.exe
1028	chrome.exe
2496	chrome.exe
4248	chrome.exe
3188	chrome.exe
4056	updater.exe
2488	updater.exe
5840	UpdaterSetup.exe
3308	updater.exe
1756	updater.exe

Loads dropped DLL 44 IoCs

pid	Process
4164	chrome.exe
5868	chrome.exe
4164	chrome.exe
4640	chrome.exe
4640	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
4696	chrome.exe
4696	chrome.exe
1224	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
5776	chrome.exe
5776	chrome.exe
1224	chrome.exe
5144	chrome.exe
5144	chrome.exe
5928	chrome.exe
5928	chrome.exe
5396	chrome.exe
5396	chrome.exe
2308	chrome.exe
2308	chrome.exe
2956	chrome.exe
2956	chrome.exe
5640	chrome.exe
5640	chrome.exe
4164	chrome.exe
2940	chrome.exe
2940	chrome.exe
2056	chrome.exe
2056	chrome.exe
1028	chrome.exe
1028	chrome.exe
2496	chrome.exe
2496	chrome.exe
4248	chrome.exe
4248	chrome.exe
3188	chrome.exe
3188	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 5 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-07-02_fa909875c91d95637259ae6558665559_amadey_black-basta_darkgate_elex_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5236	138.0.7204.51_chrome_installer_uncompressed.exe
5268	setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4640	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\InstallerPinned = "0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133959044373394914"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{34527502-D3DB-4205-A69B-789B27EE0414}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{119413E1-D553-5881-9669-43EB131F5143}\1.0\ = "GoogleUpdater TypeLib for IUpdaterInternalCallbackSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib\ = "{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A8EC270-ECA5-51BC-A8AB-551ED6D0CA26}\AppID = "{4A8EC270-ECA5-51BC-A8AB-551ED6D0CA26}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib\ = "{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ = "IGoogleUpdate3Web"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D40B89-9B8C-53BE-9B9E-BEB2AD53DE28}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48D40B89-9B8C-53BE-9B9E-BEB2AD53DE28}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\138.0.7194.0\\updater.exe\\5"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4}\AppID = "{8018F647-BF07-55BB-82BE-A2D7049F7CE4}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1588C1A8-27D9-563E-9641-8D20767FB258}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\129.0.6651.0\\updater.exe\\4"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\129.0.6651.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\129.0.6651.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib\ = "{F4334319-8210-469B-8262-DD03623FEB5B}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4334319-8210-469B-8262-DD03623FEB5B}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\129.0.6651.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{119413E1-D553-5881-9669-43EB131F5143}\1.0	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\129.0.6651.0\\updater.exe\\4"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\129.0.6651.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\ = "IPolicyStatus4System"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ = "ICurrentState"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\TypeLib\ = "{05A30352-EB25-45B6-8449-BCA7B0542CE5}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4A8EC270-ECA5-51BC-A8AB-551ED6D0CA26}\LocalService = "GoogleUpdaterInternalService138.0.7194.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4757239-55B2-5C3D-8B06-DDE147267C2D}\TypeLib\ = "{D4757239-55B2-5C3D-8B06-DDE147267C2D}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0\ = "GoogleUpdater TypeLib for IUpdaterCallbackSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D12C0CB6-7717-5083-8874-A3C30BB3C374}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\ = "IPolicyStatusSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatus"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{48D40B89-9B8C-53BE-9B9E-BEB2AD53DE28}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{119413E1-D553-5881-9669-43EB131F5143}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1588C1A8-27D9-563E-9641-8D20767FB258}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\ = "ICompleteStatusSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\TypeLib	updater.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
740	updater.exe
740	updater.exe
740	updater.exe
740	updater.exe
740	updater.exe
740	updater.exe
6020	updater.exe
6020	updater.exe
6020	updater.exe
6020	updater.exe
6020	updater.exe
6020	updater.exe
1940	updater.exe
1940	updater.exe
1940	updater.exe
1940	updater.exe
1940	updater.exe
1940	updater.exe
1940	updater.exe
1940	updater.exe
740	updater.exe
740	updater.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4056	updater.exe
4056	updater.exe
4056	updater.exe
4056	updater.exe
4056	updater.exe
4056	updater.exe
4056	updater.exe
4056	updater.exe
3308	updater.exe
3308	updater.exe
3308	updater.exe
3308	updater.exe
3308	updater.exe
3308	updater.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	4128	2025-07-02_fa909875c91d95637259ae6558665559_amadey_black-basta_darkgate_elex_hijackloader_luca-stealer.exe
Token: SeIncBasePriorityPrivilege	4128	2025-07-02_fa909875c91d95637259ae6558665559_amadey_black-basta_darkgate_elex_hijackloader_luca-stealer.exe
Token: 33	5236	138.0.7204.51_chrome_installer_uncompressed.exe
Token: SeIncBasePriorityPrivilege	5236	138.0.7204.51_chrome_installer_uncompressed.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 740	4128	2025-07-02_fa909875c91d95637259ae6558665559_amadey_black-basta_darkgate_elex_hijackloader_luca-stealer.exe	86
PID 4128 wrote to memory of 740	4128	2025-07-02_fa909875c91d95637259ae6558665559_amadey_black-basta_darkgate_elex_hijackloader_luca-stealer.exe	86
PID 4128 wrote to memory of 740	4128	2025-07-02_fa909875c91d95637259ae6558665559_amadey_black-basta_darkgate_elex_hijackloader_luca-stealer.exe	86
PID 740 wrote to memory of 1832	740	updater.exe	87
PID 740 wrote to memory of 1832	740	updater.exe	87
PID 740 wrote to memory of 1832	740	updater.exe	87
PID 6020 wrote to memory of 3944	6020	updater.exe	93
PID 6020 wrote to memory of 3944	6020	updater.exe	93
PID 6020 wrote to memory of 3944	6020	updater.exe	93
PID 1940 wrote to memory of 872	1940	updater.exe	97
PID 1940 wrote to memory of 872	1940	updater.exe	97
PID 1940 wrote to memory of 872	1940	updater.exe	97
PID 1940 wrote to memory of 5236	1940	updater.exe	110
PID 1940 wrote to memory of 5236	1940	updater.exe	110
PID 5236 wrote to memory of 5268	5236	138.0.7204.51_chrome_installer_uncompressed.exe	111
PID 5236 wrote to memory of 5268	5236	138.0.7204.51_chrome_installer_uncompressed.exe	111
PID 5268 wrote to memory of 1680	5268	setup.exe	112
PID 5268 wrote to memory of 1680	5268	setup.exe	112
PID 5268 wrote to memory of 4344	5268	setup.exe	113
PID 5268 wrote to memory of 4344	5268	setup.exe	113
PID 4344 wrote to memory of 2196	4344	setup.exe	114
PID 4344 wrote to memory of 2196	4344	setup.exe	114
PID 740 wrote to memory of 4164	740	updater.exe	117
PID 740 wrote to memory of 4164	740	updater.exe	117
PID 4164 wrote to memory of 5868	4164	chrome.exe	118
PID 4164 wrote to memory of 5868	4164	chrome.exe	118
PID 4164 wrote to memory of 4640	4164	chrome.exe	120
PID 4164 wrote to memory of 4640	4164	chrome.exe	120
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 2728	4164	chrome.exe	119
PID 4164 wrote to memory of 4696	4164	chrome.exe	122
PID 4164 wrote to memory of 4696	4164	chrome.exe	122
PID 4164 wrote to memory of 4696	4164	chrome.exe	122
PID 4164 wrote to memory of 4696	4164	chrome.exe	122
PID 4164 wrote to memory of 4696	4164	chrome.exe	122
PID 4164 wrote to memory of 4696	4164	chrome.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2025-07-02_fa909875c91d95637259ae6558665559_amadey_black-basta_darkgate_elex_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-07-02_fa909875c91d95637259ae6558665559_amadey_black-basta_darkgate_elex_hijackloader_luca-stealer.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Program Files (x86)\Google4128_1458938920\bin\updater.exe
  "C:\Program Files (x86)\Google4128_1458938920\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={43680E0A-2F23-160C-745E-ECCA7E38D3C0}&lang=en&browser=5&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Program Files (x86)\Google4128_1458938920\bin\updater.exe
    "C:\Program Files (x86)\Google4128_1458938920\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=129.0.6651.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xe806cc,0xe806d8,0xe806e4
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=138.0.7204.51 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff3e9e66e8,0x7fff3e9e66f4,0x7fff3e9e6700
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1988 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2152 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Time Discovery
      PID:4640
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2544 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5776
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4296 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4344 /prefetch:2
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4436 /prefetch:2
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4456 /prefetch:2
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:2308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3304 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5072 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5640
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5780 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5832 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5824 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6156 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5788 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:3188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1992,i,13814874382929980769,6030234255727530917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6212 /prefetch:2
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4248

C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=129.0.6651.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xe606cc,0xe606d8,0xe606e4
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3944

C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=129.0.6651.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xe606cc,0xe606d8,0xe606e4
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:872
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\138.0.7204.51_chrome_installer_uncompressed.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\138.0.7204.51_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\43ac5149-e40f-4d08-89cd-36397dde0246.tmp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5236
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\CR_945C4.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\CR_945C4.tmp\setup.exe" --uncompressed-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\CR_945C4.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\43ac5149-e40f-4d08-89cd-36397dde0246.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5268
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\CR_945C4.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\CR_945C4.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=138.0.7204.51 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff74e0f45a0,0x7ff74e0f45ac,0x7ff74e0f45b8
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:1680
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\CR_945C4.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\CR_945C4.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:4344
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\CR_945C4.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\CR_945C4.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=138.0.7204.51 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff74e0f45a0,0x7ff74e0f45ac,0x7ff74e0f45b8
        5⤵
        Executes dropped EXE
        
        PID:2196

C:\Program Files\Google\Chrome\Application\138.0.7204.51\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\138.0.7204.51\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3148

C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4056
- C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=129.0.6651.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xe606cc,0xe606d8,0xe606e4
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2488
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4056_1996980423\UpdaterSetup.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4056_1996980423\UpdaterSetup.exe" --enable-ceca-experiment --update --system --enable-logging --vmodule=*/chrome/updater/*=2
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:5840
- - C:\Program Files\Google5840_2070101464\bin\updater.exe
    "C:\Program Files\Google5840_2070101464\bin\updater.exe" --enable-ceca-experiment --update --system --enable-logging --vmodule=*/chrome/updater/*=2
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:3308
  - - C:\Program Files\Google5840_2070101464\bin\updater.exe
      "C:\Program Files\Google5840_2070101464\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=138.0.7194.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6e5f29ff8,0x7ff6e5f2a004,0x7ff6e5f2a010
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:1756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

updater.exe

Path C:\Program Files (x86)\Google4128_1458938920\bin\updater.exe
Size 4.7MB
SHA256 c06bf6776aa78e9aa48f7b1f19ae9b77b7e3277066003c653ab501304d8c2f10
MD5 a1361c84ae51ae71617978842d129712
SHA1 b4aa7a27da802454cc1a06d49020ef5f85096dad
SHA512 eb4bd87f78a16ea215c067781d664837bb8e1dd50c59a66dd4f7ed1fda13cd16741c3f351b319ecb9d63c2b9d99695fc0e0f15a3f22ece8bb02bfef5c8a2f99d
SSDEEP 98304:w6ot44wGJGswP5FDB81lr9kY/mnlsdor1XwU/Ohz2WvJ:w6otLwGwP55ar9kCmlwe1Xf/Ohz2+
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad\settings.dat
Size 40B
SHA256 c39baab537de5f31e6079b2362a879ed8819c8bf9b34a2df39e500edd3f9ad16
MD5 fd7e171a308103ab48d6c1328b39b3b7
SHA1 88c7c39ae811501773e47afa9f9e8f72f2c735e3
SHA512 59823f61bf550542deb96762e58dc61e2e0eeaf2def48d188f8cbf6a10f242c995ce09708976f77051cad436bc30eb3d5e1ee2ef01f78c75fd122b92ba887d29
MD5 SHA1 SHA512

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 654B
SHA256 0ae6bc9af6ba7254d248ed2ae9af66e170d0b21db282d549a425171affdd1c67
MD5 3bbb7994eb33e1078d49adcdf7e3acce
SHA1 5e68c3a2a86d2cc34be9cae861447e9c237e306e
SHA512 5ef24634eb685e75d2250856d479fae3c2c2bf51877b1f2206e2798b19c4c07f0abcaaecd2c350042cce7d16a46c310655d64e80106daeca9f867a220ecfd6b9
MD5 SHA1 SHA512

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 717B
SHA256 f95bce36dabfa00bc5f793a5979574e0c21b903d2e03e74b80a5384e2536191d
MD5 e2e7cbbfae48832e92a0a1324cee607b
SHA1 ecbb09d51340df3375edf3a3fda1551e7a90dda8
SHA512 6d44fedd1136bea381b91138675153268b640478b398088b5a806968d096d71d05f555cba548dd5c5976d0eb76cededd9e8a1caf86e940aaa463fc16d59e15d1
MD5 SHA1 SHA512

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 907B
SHA256 7c75b02883340b10b795f7335328044614f99ee014edb4389faa63bd9408e6a8
MD5 879b86cf85648fe784a4e77abc8dbcc6
SHA1 969ff434722c6ce3922bec55b064db59d4bbee84
SHA512 effeeea501a3265a4e3a93c752c12e18b157e804fbbe70a7ea25afda3dcfcb751e4868bb51c0a3afced7ad09a265dfca79a8e24c9cb26dee4c3efeb4491c2453
MD5 SHA1 SHA512

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 414B
SHA256 78cebbe00bc0c64b8e75e6ca29c170768e36ec94e116bc8ecb417819498dca4d
MD5 c187d6ad6dd081345f343a06401c2f16
SHA1 0d77221b1befa992f2136634ef80729d7d52dbf8
SHA512 3bc3a424dded568b2f602c0a990a7733bf73cdd9a0c25bce0275d21d8b512bf23d6b54e4cf72e06061a7071ecd12cd5bd88ef7729169afb7ab738c195ea67aaa
MD5 SHA1 SHA512

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 555B
SHA256 5b6ccba0af254444a1c4c20c3126487a7885a669534fbfc25104c30141f1847a
MD5 a2399ceb5bd1773df82823fe995bf84e
SHA1 7e1ac5b1c4f3e0d3ec5525f526f21cd23f5a97cf
SHA512 d59fdc82f1b5ba1ff39f26fa75b609e6bc21d1297a4b6f4d3a4a7acfd0fc8d573c045b4259dc8f0b53c64a5763a98168eb61e5de46ccf40cd0d53c46c2afe88a
MD5 SHA1 SHA512

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 415B
SHA256 df768365fde0c43a5f0753576bec972b09703bf9f705a9a87a6698d4dccf9354
MD5 7114fb04be043cfed81bbba1e8cfaed0
SHA1 3f733b32a5b6dc3ed3f4feb11f21623b63323dab
SHA512 7eb5c59ee8ced30d47b7f55f220a671f49bc9fd0275d440f33283ac58117375ae4582310b7d2b18c684acdd8f18c6349159b267e02ab4f1f60addcd39dbd0337
MD5 SHA1 SHA512

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 25KB
SHA256 e3b7b3287edbf8032d5ff306e1ad3f22317fb24c7086eaa0aa1d5569867479a7
MD5 ae8ac81f9497a33194891bc53cfe1496
SHA1 f21088fbfa758d7a77da380a1d9369d81413fa66
SHA512 a31b8a4ee9ee820368974dc00d92aebd1511113063dd3c99f52d205096fca053591667f6763f1da774d74c96b24978dabc1d39c587f7dc9da2cb4578ef768cbe
SSDEEP 384:tTZxpZFxP+P0Uic6bwlaTHe6B9u9ItNtuApqQehZHqyGjdpbuA8u/+pV3kfu42zr:VwlaT3Xbd8S80PS5x
MD5 SHA1 SHA512 SSDEEP

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 27KB
SHA256 e91a46ac27a5f45e66c69171eabd98cfbbbbb0a673fa35ae1fdb05e54ea2c4d0
MD5 7977f4b7a0e8c53aa866294173d0ce67
SHA1 62c55e5ee5efdbc92e89c242789b09daa50afb69
SHA512 9f8c328d3f806227390ba4efa87da09a0f4e7b34911942f608b75b35eb12ca1894eb5ecf24eec3f2fc515b29f23bc486b2f8eef6938124911a7752b8fff35358
SSDEEP 384:tTZxpZFxP+P0Uic6bwlaTHe6B9u9ItNtuApqQehZHqyGjdpbuA8u/+pV3kfu42zg:VwlaT3Xbd8S80PS5JQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 29KB
SHA256 22551aaffa1339bdc61e7d963f9bad17e004aa1d42484ca47e45d712298f2b6c
MD5 be4fb29e38b70e34683aae089dbc846c
SHA1 cbb944b4bc173428d139004ff3c071bbc6d1b407
SHA512 07537f7386bbca5b3f9bd293a57789e19f99e916efb02c6ecafedaf6cec49a6d00a7d3117a3984b4eefe76fe46781c7f0515f224a1598f7901b9fed289b9b238
SSDEEP 384:tTZxpZFxP+P0Uic6bwlaTHe6B9u9ItNtuApqQehZHqyGjdpbuA8u/+pV3kfu42ze:VwlaT3Xbd8S80PS5JSvp
MD5 SHA1 SHA512 SSDEEP

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 31KB
SHA256 f644b2a2c22f543fda774c72b396773e539017396e1b5702667c5065a8871520
MD5 c2924ce02eb36a96d83d7cb6ce5308c0
SHA1 0fceae60d11748bcf182f312f982d82bb4a90592
SHA512 69124b28fa97b2e60875029da7cd3e854a0f2b0ee3242dc64d3cb830a597d7de0f003179b392ada1f16f2663cdb456cf0cf9f2f74b6e0d2cc75d65213b51d68b
SSDEEP 384:tTZxpZFxP+P0Uic6bwlaTHe6B9u9ItNtuApqQehZHqyGjdpbuA8u/+pV3kfu42za:VwlaT3Xbd8S80PS5JSvn9onmAaIc
MD5 SHA1 SHA512 SSDEEP

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 22KB
SHA256 e6dd0f6a7ba8864ac5a10335391d89223c2d2c9d443936df1360c8c050b809a2
MD5 ce749948e55f7922f99822b1ee7f72dd
SHA1 06cddc12bb3c8c6a1f3c15a3d7bb9f8a2cc847cd
SHA512 3d2fb64ea8e85b29e34b0beca6d3e318ecd03b321c65c7cb25b26bc5cac69043c4f9a961c808d9269d837bbe2c4f772d9b359be5bf073828c76ef158a82128d8
SSDEEP 384:tTZxpZFxP+P0Uic6bwlaTHe6B9u9ItNtuApqQehZHqyGjdpbuA8u/+pV3kfu42z4:VwlaT3Xbd8S80PS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 23KB
SHA256 8142f47444cdbb17b67bd9c38d25c1c9c5c69c32d2a0bbfd06732ccc443c40fa
MD5 b0ff68c970d929ebf1718e4b184010f9
SHA1 5d3aa77541364e5e23e0138701b73678f7c31dfa
SHA512 4fea1888cee6f5b05bb08a0e624c369c9870a57523bcc5a1591e37360e392d5f4486d9c8367c302ccafb7fc9d62c754b48985dab49295d6c07dfeb06ee0cfded
SSDEEP 384:tTZxpZFxP+P0Uic6bwlaTHe6B9u9ItNtuApqQehZHqyGjdpbuA8u/+pV3kfu42z1:VwlaT3Xbd8S80PS57
MD5 SHA1 SHA512 SSDEEP

Submit Download

43ac5149-e40f-4d08-89cd-36397dde0246.tmp

Path C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\43ac5149-e40f-4d08-89cd-36397dde0246.tmp
Size 725KB
SHA256 5fb6f8fafea3691ddd5d4b4c04ee6d116aa670a7fe23f6f6d4ee2735dd7d06e1
MD5 3af28063b3dd19755dbfe549c6902fdb
SHA1 429cc1f8832c216d68531ded2828ee4671c27869
SHA512 44b238a0e0963d72211b2964b471f4c495c82d8bd16b2b28ffe4d9e7a2174ef149135f14a50eab17d786137c39e45ab8c4455f7e0331925ec66cfb87888c5e01
SSDEEP 12288:GyVgvDui9y6tzOgON18WNUhc9dhQnn2LBqymGndq503UlEdjbYk/4zwjbABmPWwq:GyVgvDuxGzON187htnn2BqymGn13NhbG
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1940_1252213467\CR_945C4.tmp\setup.exe
Size 6.0MB
SHA256 2078b884ff04d3df35dde5c94cfc3282d694712226e89b43aebfe21236798966
MD5 0b7d75c65380994969b0bb1bdbbac837
SHA1 0463e15cbe9326621ea4ab4c54951ad8ca6fc1eb
SHA512 2db3aa4c63f27fc669e1012ce2375574489468e3603b4fa54e782421b7ef5ce384f115fdeb40b1c56905d286d869ffc732820a1fc33f1652be6009f5d9fd008b
SSDEEP 49152:cNKTZLOHGvMzZYNJetsuc+ZMoiqT/vf335jU1SENx2CuxqEwnuG+Gf9V1BTe/uDH:j908m3/1nENxAxWfHTxrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 bc29d9e29b16897927fb769e52e771668c017afbfbf6ed8c6d04513f0bc8b9cc
MD5 df23aaa0e36c76234301b4fab7c9df12
SHA1 eb3a21d0ccdf414c5260b2b4a540156c053eae79
SHA512 9f6766916d7e39b1ee778bffddce700d82908580cebea14124de39df16cefe8d3a27a708baaa3c86540d8aa316b74b65cbe0d2a086d4534bc2be4b304697828c
MD5 SHA1 SHA512

Submit Download

chrome_elf.dll

Path C:\Program Files\Google\Chrome\Application\138.0.7204.51\chrome_elf.dll
Size 1.6MB
SHA256 613857f4f5b83783ceaf061f018d3d64f54b87485b80170953b404ed48488942
MD5 8b6af7173f384ad7b740674fb9e054c5
SHA1 4eaa2d35ea11f1dce6339ccfcf84bdc5ee473690
SHA512 da3991207d9fffb8314d06428202a104fc84fba5eb58bbf0c4a4ae43ead6fcdffa2744afe9160dbb93c97fcf41fafec03d0594520ea9ad016a4d003fa877eb69
SSDEEP 24576:XHsEPmWoQHRiCY9/jm9OuOlVCBdl4im6To7eWtLCNeMXZQ6308n8w:XJmQHRiCozlVCnlrmSo7N0JXZQH8n8w
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path C:\Program Files\Google\Chrome\Application\138.0.7204.51\d3dcompiler_47.dll
Size 4.7MB
SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
MD5 1a7544f942a9a9de9354e7a0f9060e3a
SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxcompiler.dll

Path C:\Program Files\Google\Chrome\Application\138.0.7204.51\dxcompiler.dll
Size 24.7MB
SHA256 ae1546f00c6cd8e25910740ea3ddfc23d02d5416170baa4af5ee892593c95834
MD5 8b106505c97ee798e18adb7821cb59b4
SHA1 bf780a5ef07bd23749d10ec46cf381977b593cdb
SHA512 73a0a406c0343e3aae1629ed2df58d0bfc5fdab8dd3d8ac3680dc6227cb5f4fd8bb77cf383542a2d90fb62deb7983ba9c413bfffc16b1c541376f83742e52ccc
SSDEEP 196608:xoiDwAJm6jOLKlG40d56faCvPZjhXmCj9seCwlkKGp:xoikA/jQ14k5QdFXjLl9Gp
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxil.dll

Path C:\Program Files\Google\Chrome\Application\138.0.7204.51\dxil.dll
Size 1.4MB
SHA256 473f5e853120a5b6ca583ac51f453664abae15c0db1d307f29c8bf7a7b89f96c
MD5 360c2ec3a4114840498e4b0f45820395
SHA1 d5d4a71933fa25ec338cdf18d7a03281fe814d7b
SHA512 257d1443341792587b0259d658a706dd8797a83644e451f2bd6d5b292d8259ea11c5d1b176541747a5470a2562615edd44b147e6ad752b4714458db28b07f9c3
SSDEEP 24576:4Y+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kab:FiTMYxy0Sy66Zh7Sh/cyvS5Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\138.0.7204.51\elevation_service.exe
Size 2.2MB
SHA256 13643d56a3edb72ee508a7c93b515a204a2fb89da53109121ac118c285ab7d27
MD5 80116bed23f8d3a93ff79cbf1137bb4f
SHA1 6bd9c9ba9b36c416d34eaa67eb16dd141cd5c0f4
SHA512 cf8b591db1bc75fec23e00ad39c7f79209d8878c29613ea8d58758ae635ea87b51ea5fc9430940ae727c3d6ec1fc792775f4d52347aa4a34f0129d5839f55e90
SSDEEP 24576:1JtAEV2PPvgyjz9BVygmtopBRJ+IHItbpl6vbqvlEeeswDK9UMqlR599Qfrmgq6c:3KPvgyjzbV7H+Iotbple8YRMqvtqSg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Program Files\Google\Chrome\Application\138.0.7204.51\libEGL.dll
Size 500KB
SHA256 47b83279177a0cc0652ae49ea7f003c05af4d5f1879654c07648eb1a71cf79ac
MD5 05321d6a826eafd6965cdce791b08b61
SHA1 d841fcf112e633926469b4803cfb8f1b49402de4
SHA512 5187ce43ef3f7d79a20167458f607df0ae8c7f2ceba246f8011fc9806bd7657adaeacf131a11706488ecdc847cfa33aa88f5fec85522b9ad252a4d1f037ae230
SSDEEP 6144:H+mmYxsAjhuDYJhec8jBAtgVDNqtcrvQOuWm0Iec5Yog12TabGlfqrn:HOY8Yz8tVDNqtckOuW1Iec6oCGlyb
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Program Files\Google\Chrome\Application\138.0.7204.51\libGLESv2.dll
Size 7.5MB
SHA256 7d215d4924f3389f0ea95ce5abbfd9cd45542352b3fb2dd1a5be49ce72720ed0
MD5 365ce3313a442be4f28419a4ed6dafc0
SHA1 f34b3fa2502a233d8bb25b822b8186d9359a6971
SHA512 a1b8c109155a08e80c842c46987d4c8ff6a134b11dd1bc5962e12b44c3c9e830a5466f9ae5511ac31f5ac55d451716e93176647180d3b6f4518f5bf06f773fda
SSDEEP 98304:NUXzeNcJgePoYDXGjgw2HI5he7KzcCeEhXe6cW3:NcCNT2E5cC9vP
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader.dll

Path C:\Program Files\Google\Chrome\Application\138.0.7204.51\vk_swiftshader.dll
Size 5.1MB
SHA256 6f7b30246114c57ca6175a1a877658bf3d39894dae0a7e67a4e0346dc96575f6
MD5 4a2272573912b9846baec1c46b722bb2
SHA1 f29c504f333e86d49ecd611131aa88ee996efa24
SHA512 2bf039a6d236fb8142df600f2b3b27964ac4f392cde6a6408d00a942164e34656351f7b08d9f58fef6b94a650ee877a69abfcaff6a7458c057adb5683f29dec6
SSDEEP 49152:nhR5gjs4boKMsPZ6pIHwpgS1s+YXJAkbypnNrNBYOsYX/k1CLqhWSji1LCV+MGym:nP5gsbhnLxUvbam+HfF
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.0MB
SHA256 660948ba9396395bc1dc6a236a85b7aa72a918dd6a53ef3267e2dc932580f247
MD5 a391b8fb4c8f44780d24908988682699
SHA1 c5058fa44df7ccf3436af1b452c12a0872ce56b5
SHA512 2eae37d895c1bf3b8a359e765b3a5a612bf3a61da69df8fe629e909a4defc116aae6875571c5140b934794a637d8dbb69e7db96e1c14b64209a60a9c4cd7605f
SSDEEP 49152:a/o/OC+YdBMqFaQKh5MkhOjsiI/bCtjCOEh952Enc6JCmMcPTY6Y5A3:a/6BsPtGZ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 29KB
SHA256 7bb824d060bbf10af9a3c8507dfa969abeaaac237bd573b665687d678be2da49
MD5 26868368796e1c07309ec40f233617f9
SHA1 f902f66e32d671ba2a2502ec0c1ca75a5687ae38
SHA512 049145043565c85b625eccea020ddfb413e84c90f1f0b4b6d75c5825248088e048100f3b988536b140cae173621ab1ebff0bdbd9937eaf9cc19b52ea9ab877eb
SSDEEP 384:mGapQS/GqUKhTQ7Tq7+jNPQaEkVvsDEDjLjkQga9QgahW:nNjNPQaljjkQga9Qga8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Google Chrome.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
Size 2KB
SHA256 31248621ea794e2fa1c6ed6f393ccbd42110156c1a77f41f71b915be60056eb8
MD5 e5f396a19108c6927fbec4c13698f80b
SHA1 53c756590b90a691c1b813e374f4a8dacd041cd9
SHA512 e0fe7cd5f7be366a15090c0fc650d4ee4f3f4e44b8435963be854219e94214913fe5d7785ec5125bc7639d075dec1d5afd67b0906da9c6622a1e259873684467
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 de97c0fcfb960474775ee9ab99d39b4622f40bd4d4a840521b14e39a413de9e6
MD5 e205f7872f02022adbaf6eaf88b8331c
SHA1 ad478d495516863eb8ebe176cb0608e11009827a
SHA512 883e0eb62279ec11cce91dba58dccb28f4736ba8d834f2015fe8e519c7e6bb48024e37368aeaf8a9c2e0e75698fed9056931e90ea9a2c5d6f3935a4dd0c1208d
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
MD5 SHA1 SHA512

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 512d2e91618a0dd9829b22929328fcad101f9fbf26dcf6e0767e669e8059948c
MD5 c3788926083cb11621e1add908867124
SHA1 7870fab3ea44cf59629408f34372ddd2b9a45d33
SHA512 6a6c6a79c0ff3d49fad9afef08c21184d3bde4e1754ab9c47ff8caf0fe54fe53932451a9ab477c2f2f721909006229adae247cc440fda910206ee65cfdc0d252
SSDEEP 192:hvzSNEDkoCcS8PRpwBFHg6+WNHk0Qwe12/INpeyIsnA6gtgr:hvqEoKXkF5E0S22uu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5128d504c99f19070e0abe9e38d0bb6941589579a34be1b2c4a2b8bbaacd4b2c
MD5 97eda8ee55c83a61f27eb59e653134df
SHA1 bbfb726eff9e70a0b9719a977c026f360970a072
SHA512 b34b6592f9d1afc5e0c5f357881538dbe34e41aed9ce432e76a86964d8eda119b63cfec10f2a3954f360d353705640e8ac6141d4109ee604953aa05f70155ce6
SSDEEP 192:hvCSNEDkoCcS8PRpwBFHg6+WNHk0Qwe12/INpeyIsnA6gtgr:hvxEoKXkF5E0S22uu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 20KB
SHA256 c2d3f7b5bf2fb91e36a0193c079cc51946681a93b287c56c224f4b7a2ad4df3c
MD5 b5cec3690c7b9deb948d2924286ef828
SHA1 e9eaead65ead67530ac614d76041f570693a18c9
SHA512 83cbe568253dcdebd31e937fcdd8473054e7534ec21c1342986b0b71e5682051ca94f6a8531a380812ca114f786184062ef92f945386bbc735d19f93832b9fd3
SSDEEP 384:h59B7KxkXqKf/pUZNCgVLH2HfUlv37pLuLceiDYXrEPkXqKf/pUZNCgVLH2Hf1rb:hDB7KxkXqKf/pUZNCgVLH2HfU937pLut
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8752445c7ba9591518dd3e0ddc78d3a023c036e0db9187c44e27f226781c1a74
MD5 8ed707b0025c652ee490cba2a74f759c
SHA1 5f178384cf3eeccaaf88af684031d4d2cf90f705
SHA512 8a46466ca0771fb731b042e2ae28759c07d2f7c7cabe33c835dc432f0625c966836fc450129c501adb6b9c8dcf1107e64379f53dca1ff8ddc260113e0fba91d7
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe594c61.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594c61.TMP
Size 48B
SHA256 27af268f73247656e1bac0741e17c622081479feecfad9968558dd4a7730a64e
MD5 9884ec9d105a550ff6e23106c8c0d3f9
SHA1 3a7f3b1a09c43c873808489070d35d9f1e2205d0
SHA512 5555c93df63ade78f36667c1dbf76d43896a922287491f6347d6ab75bcb42c8ecaaf26038678670b1ff7689e9ad8a3b0cae445f59e32f25c84b1cd2ceed80084
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 9a1703e6286b5fd6243a48b6e8e3b85a02d4707dbaeecf3e27e2ed298c0a9500
MD5 f159003c30342d60949dfeebc5a8e2b1
SHA1 b00b738dbf02dc2670c774d9b1ec62383e1ca336
SHA512 07d525c94eb83ac6ac644482d3d835aff26b4252e3c44dd18893731042bb31d5ca345938259f411cd35d1fbf2624121de2aa584b5f22b1ac5f42424d8f288ef2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 72531ad32e28b2b3c43d94621a5bf9fbef8e4d85b2ae2b060c38e6a02d9e9d75
MD5 ba48a55e52be660e9c03f12386c49ca7
SHA1 1c29323c6348a9f0af3d2b91122bdd83171f5751
SHA512 df323c82ba7f0e3ecfa386e1a8105b134c44861a2d7889df721099f5aea84cc2ba2121fe0d3ce7f4d810de53f3dff15365c4e1933bfd4170ee788d684b9d011c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

trusted_vault.pb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
Size 38B
SHA256 ac6ce31fc9613c21bcbbfa3e53bed3f9aaba4ea292204b5ceecb1404ac55fcf4
MD5 f834416fab7cebab7ac4952218e4d533
SHA1 037e264f893ab12270c3c91918b5971bfc5c1eea
SHA512 da01f967dfaa179c5e2d47fd579f488d2d89bea5e2a7c873785b6e98a4692d5811e637e56167ca399f46a3220d525dcacb116fd20b331c42b72a69bfe41ae9e4
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 7535243467b1ffb80adc8e06d5b9fed6d680e053b4e1d487c6a8fddadfb9b0cb
MD5 f72b8a307e0d2cc3ddcdf5adc01d455b
SHA1 c14c0fe793cf37d8d0767a0e8f2b6e392e91f66d
SHA512 225e109eb2faf664e555ff8fec38d8684d60c5268703100395556b4deaa0efe25c613d1fd16c21bc1687dad6f970dbaf5b1e9a000d815c000ad95ba3ae7527a5
SSDEEP 1536:wb3iXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMc:0SXjM4rTmN5eWvStRNoV8cWK7XF+TwMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 139KB
SHA256 2098949b7b7959472caa2a5d1ebed1eb4ddefb24e6eeffb0c12700329358b8c2
MD5 a7846c47d9bd6584513ac5d321dba042
SHA1 38a96ad8ec90150d851cbc0fd8407399d1e2b145
SHA512 7a7ea8d6cae09ee39d084bc9e1b11b9b8ba83fd981e33dd8d9c74974e8924cfbfbad8b868e2310afc6bb33c6ba7236b61eb61bc595afdda3555f11b29b227ee6
SSDEEP 3072:na8Uttj3XJGQAUYAvKB8S8XjM4rTmN5eWvStRNoV8cWK7XF+TwM+:a2BAvKB5oJrTnGfzF+TwM+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 139KB
SHA256 07bc11fc7ac7b7556f9f467450f3572cc7e8ed11be2f0454b7a829c02ad91330
MD5 5df7e222cbb3bc1c6e53f6307596af87
SHA1 7ac8804d0498791c3a28f2bbf6bdc3ec2703f017
SHA512 78ce8895c411cd172a8bacfac3e66b5dbc94c9967b88fc3b148afb057ac7cb66a63098c37c47626bcf4c3cc0cc4f0ee1886fbbef76dab6a6e22c41f40f968752
SSDEEP 3072:oa8Uttj3XJGQAUYAvKB8S8XjM4rTmN5eWvStRNoV8cWK7XF+TwM+:L2BAvKB5oJrTnGfzF+TwM+
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4164_237269084\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
MD5 SHA1 SHA512

Submit Download

fb93210a-a15f-41e7-8a49-75411b0997a7.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4164_237269084\fb93210a-a15f-41e7-8a49-75411b0997a7.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5 SHA1 SHA512 SSDEEP

Submit Download