Overview

overview

10

Static

static

10

2026-04-18..._n.exe

windows10-2004-x64

10

2026-04-18..._n.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/04/2026, 09:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_n.exe
  • Size 3.8MB
  • Sample260418-k33gmscs7l
  • SHA256 5a9b93058484ea6e27e1ddbeca7ae31521af802a0b8f5f5674699dce6935d2c7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryshodipersistenceprivilege_escalationspywarestealertrojanworm

Malware Config

Signatures

  • Family: Shodi

    Shodi is a Windows worm written in C++.

    wormshodi
  • Detects Shodi worm 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 43 IoCs
  • Loads dropped DLL 62 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_n.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_n.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Users\Admin\AppData\Local\Temp\2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_n.usa
      C:\Users\Admin\AppData\Local\Temp\2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_n.usa
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4884
      • C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={1E01CAED-8315-E230-DA76-A3E554F282BA}&lang=ja&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=defaultbrowser"
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5012
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:5628
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2280
          • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:5228
          • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:5516
          • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:3260
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDgxMUUzMTItOTlFMy00N0Y4LTlDRTQtODlCOTEzODU1N0YxfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0U1NUQ4NzY1LTk1ODMtNEEzNS04NTU3LTg2ODY4RjIzMzlCMn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjE0MS4wLjczNDAuMCIgbmV4dHZlcnNpb249IjEuMy4zNi4xMzIiIGxhbmc9ImphIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7MUUwMUNBRUQtODMxNS1FMjMwLURBNzYtQTNFNTU0RjI4MkJBfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMjY2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:3868
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={1E01CAED-8315-E230-DA76-A3E554F282BA}&lang=ja&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=defaultbrowser" /installsource taggedmi /sessionid "{4811E312-99E3-47F8-9CE4-89B9138557F1}"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4280
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Program Files (x86)\Google\Update\Install\{A446E772-6CD1-4BFF-87ED-C0F4CB32F506}\147.0.7727.102_chrome_installer_uncompressed.exe
      "C:\Program Files (x86)\Google\Update\Install\{A446E772-6CD1-4BFF-87ED-C0F4CB32F506}\147.0.7727.102_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{A446E772-6CD1-4BFF-87ED-C0F4CB32F506}\guiC9D3.tmp"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5340
      • C:\Program Files (x86)\Google\Update\Install\{A446E772-6CD1-4BFF-87ED-C0F4CB32F506}\CR_4F404.tmp\setup.exe
        "C:\Program Files (x86)\Google\Update\Install\{A446E772-6CD1-4BFF-87ED-C0F4CB32F506}\CR_4F404.tmp\setup.exe" --uncompressed-archive="C:\Program Files (x86)\Google\Update\Install\{A446E772-6CD1-4BFF-87ED-C0F4CB32F506}\CR_4F404.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{A446E772-6CD1-4BFF-87ED-C0F4CB32F506}\guiC9D3.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5644
        • C:\Program Files (x86)\Google\Update\Install\{A446E772-6CD1-4BFF-87ED-C0F4CB32F506}\CR_4F404.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{A446E772-6CD1-4BFF-87ED-C0F4CB32F506}\CR_4F404.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=147.0.7727.102 "--attachment=C:\Program Files\chrome_installer.log" --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff635c9b840,0x7ff635c9b84c,0x7ff635c9b858
          4⤵
          • Executes dropped EXE
          PID:824
        • C:\Program Files (x86)\Google\Update\Install\{A446E772-6CD1-4BFF-87ED-C0F4CB32F506}\CR_4F404.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{A446E772-6CD1-4BFF-87ED-C0F4CB32F506}\CR_4F404.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3728
          • C:\Program Files (x86)\Google\Update\Install\{A446E772-6CD1-4BFF-87ED-C0F4CB32F506}\CR_4F404.tmp\setup.exe
            "C:\Program Files (x86)\Google\Update\Install\{A446E772-6CD1-4BFF-87ED-C0F4CB32F506}\CR_4F404.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=147.0.7727.102 "--attachment=C:\Program Files\chrome_installer.log" --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff635c9b840,0x7ff635c9b84c,0x7ff635c9b858
            5⤵
            • Executes dropped EXE
            PID:3660
        • C:\Program Files\Google\Chrome\Application\147.0.7727.102\Installer\setup.exe
          "C:\Program Files\Google\Chrome\Application\147.0.7727.102\Installer\setup.exe" --channel=stable --delete-old-versions --system-level --verbose-logging
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4492
          • C:\Program Files\Google\Chrome\Application\147.0.7727.102\Installer\setup.exe
            "C:\Program Files\Google\Chrome\Application\147.0.7727.102\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=147.0.7727.102 "--attachment=C:\Program Files\chrome_installer.log" --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff6f06eb840,0x7ff6f06eb84c,0x7ff6f06eb858
            5⤵
            • Executes dropped EXE
            PID:5720
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDgxMUUzMTItOTlFMy00N0Y4LTlDRTQtODlCOTEzODU1N0YxfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezZGMEJDNTBELTYzMEQtNEQyQy1CMTlBLUFGNTk5NjI3Q0IwN30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzQy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjE0Ny4wLjc3MjcuMTAyIiBhcD0ieDY0LXN0YWJsZS1zdGF0c2RlZl8xIiBsYW5nPSJqYSIgYnJhbmQ9IiIgY2xpZW50PSIiIGlpZD0iezFFMDFDQUVELTgzMTUtRTIzMC1EQTc2LUEzRTU1NEYyODJCQX0iIGNvaG9ydD0iMTpndS9pMTk6IiBjb2hvcnRuYW1lPSJTdGFibGUgSW5zdGFsbHMgJmFtcDsgVmVyc2lvbiBQaW5zIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2Fjdmdyc3JlaTdqdnp4ZDd6YXQ2NWV0ZmpkeGFfMTQ3LjAuNzcyNy4xMDIvMTQ3LjAuNzcyNy4xMDJfY2hyb21lX2luc3RhbGxlcl91bmNvbXByZXNzZWQuZXhlIiBkb3dubG9hZGVkPSI0Njk0OTYyMzIiIHRvdGFsPSI0Njk0OTYyMzIiIGRvd25sb2FkX3RpbWVfbXM9IjI4MDE1Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3MDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzNDMiIGRvd25sb2FkX3RpbWVfbXM9IjMyNzgxIiBkb3dubG9hZGVkPSI0Njk0OTYyMzIiIHRvdGFsPSI0Njk0OTYyMzIiIGluc3RhbGxfdGltZV9tcz0iMjkwNzgiLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4708
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:5220
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:3896
  • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe
    "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe" -Embedding
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4112
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:6076
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=147.0.7727.102 --initial-client-data=0xd8,0xfc,0x100,0x40,0x104,0x7ffd251767e8,0x7ffd251767f4,0x7ffd25176800
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4720
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1824,i,2595732639991191267,9051815287741223988,262144 --field-trial-handle=1852,i,1206706897918135078,6220976399203064728,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,7021866052645136463,12700989518405538205,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1840 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1428
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,7569672307579019781,14736110276956818829,524288 --field-trial-handle=1852,i,1206706897918135078,6220976399203064728,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,7021866052645136463,12700989518405538205,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2204 /prefetch:3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Time Discovery
          PID:6136
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,16125755452675156204,10578519563822953400,524288 --field-trial-handle=1852,i,1206706897918135078,6220976399203064728,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,7021866052645136463,12700989518405538205,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2432 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5688
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,5098525530227588082,10204571040137007264,2097152 --field-trial-handle=1852,i,1206706897918135078,6220976399203064728,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,7021866052645136463,12700989518405538205,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3256 /prefetch:1
          4⤵
          • Executes dropped EXE
          PID:5972
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,12893804679409447364,970705948416588506,2097152 --field-trial-handle=1852,i,1206706897918135078,6220976399203064728,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,7021866052645136463,12700989518405538205,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3328 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3164
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3920,i,103086355594875424,8757196097251771121,2097152 --field-trial-handle=1852,i,1206706897918135078,6220976399203064728,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,7021866052645136463,12700989518405538205,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3940 /prefetch:2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4664
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4052,i,629332889624074419,13164156735420920261,2097152 --field-trial-handle=1852,i,1206706897918135078,6220976399203064728,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,7021866052645136463,12700989518405538205,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4072 /prefetch:2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3884
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4300,i,8835374159979797600,13944204546836755007,2097152 --field-trial-handle=1852,i,1206706897918135078,6220976399203064728,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,7021866052645136463,12700989518405538205,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4340 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5592
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4292,i,12594253753756264511,13638166350137519623,2097152 --field-trial-handle=1852,i,1206706897918135078,6220976399203064728,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,7021866052645136463,12700989518405538205,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4380 /prefetch:2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1252
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3640,i,5947379186615799953,16044750421268829955,2097152 --field-trial-handle=1852,i,1206706897918135078,6220976399203064728,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,7021866052645136463,12700989518405538205,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3224 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5336
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,9426807770818911173,6233821715624414839,524288 --field-trial-handle=1852,i,1206706897918135078,6220976399203064728,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,7021866052645136463,12700989518405538205,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5880 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2352
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,7302129427173597570,11115113686692355148,524288 --field-trial-handle=1852,i,1206706897918135078,6220976399203064728,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,7021866052645136463,12700989518405538205,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5944 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2436
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,12940520385932988933,7013344679384819947,524288 --field-trial-handle=1852,i,1206706897918135078,6220976399203064728,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,7021866052645136463,12700989518405538205,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5940 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3212
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4152,i,16881473071087574660,12560835779831295920,2097152 --field-trial-handle=1852,i,1206706897918135078,6220976399203064728,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,7021866052645136463,12700989518405538205,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=3956 /prefetch:2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5800
  • C:\Program Files\Google\Chrome\Application\147.0.7727.102\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\147.0.7727.102\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:5640
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
    1⤵
      PID:5540
    • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe" -Embedding
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5504
      • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /broker
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5924
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4660
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5232

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Query Registry

          4
          T1012

          System Information Discovery

          5
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          System Time Discovery

          1
          T1124

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          GoogleCrashHandler.exe
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\GoogleCrashHandler.exe
          • Size 299KB
          • SHA256 03e91a5144ab49e6a39df0d920987e718fd36f8d5ca34e243506025e8da1db78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoogleCrashHandler64.exe
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\GoogleCrashHandler64.exe
          • Size 396KB
          • SHA256 2ae4d76b2037bf4ea615e92c7064272c93fc6a5cd649a95502234f6f32b9b151
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoogleUpdate.exe
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\GoogleUpdate.exe
          • Size 164KB
          • SHA256 63854e78780866d2ae56a58958a1fda017a71f54b71fe70cf5403958e961862a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoogleUpdateComRegisterShell64.exe
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\GoogleUpdateComRegisterShell64.exe
          • Size 187KB
          • SHA256 974ec719d34ac9af4d37681a8a6dfeb24f3dd136b2681be09dbc86afb6d9f616
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoogleUpdateCore.exe
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\GoogleUpdateCore.exe
          • Size 222KB
          • SHA256 eae6d2053a0f4ea3af887c9244770d31cbacab69f165d4ac5fa49b619f0d6bc3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdate.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdate.dll
          • Size 1.9MB
          • SHA256 b31ed15eeb3e535d1318a566000adc069b793fd0f19ba9ae18342f7656121596
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_am.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_am.dll
          • Size 48KB
          • SHA256 dd0e5047fe6036f3fbea9d04c7563afdb31bd88e42f19879d75299c685c08dd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ar.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_ar.dll
          • Size 47KB
          • SHA256 f4a1a5b7749bafd84927ae0a281db0eee2e2a1ce9cd77ca08165f8bc587cc3b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_bg.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_bg.dll
          • Size 50KB
          • SHA256 bb6569ad79623eed5f042982c2fe2808d8a9cd2b85b98d9bd0a0cf8999c31eba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_bn.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_bn.dll
          • Size 50KB
          • SHA256 adc617b5e3e647355e47006d5b9a130341323c1345fadd25ee880bba89eb95d3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ca.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_ca.dll
          • Size 50KB
          • SHA256 83898433d55d80a230b260af4f746621124c35d2a9814339372de47a57cf6619
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_cs.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_cs.dll
          • Size 49KB
          • SHA256 dff5216c302bd82c514e053f0a7091b315b98229c9a7c67bd37a41a9a825798e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_da.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_da.dll
          • Size 49KB
          • SHA256 c768ff1ccfece2edfd19ca3c90f67a32e061cc153987d3865cc1146587b1cb26
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_de.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_de.dll
          • Size 51KB
          • SHA256 5267fbbfb123d5603cbbb60f2d00a0d446dd5885a1e5f032887a49a8a3da08f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_el.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_el.dll
          • Size 51KB
          • SHA256 be8800221c1ffa7c0a28bbd2042bdd14bfcb8536f8ffab569b07a8c80f8252bb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_en-GB.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_en-GB.dll
          • Size 48KB
          • SHA256 8ac7bc668a8e1c317e9f84796b4df2f804d6ad47a60f8759f54990bf243e6981
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_en.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_en.dll
          • Size 49KB
          • SHA256 22b51dc5d66d1487b5371353253ec26a6cb99c5425e800d06e670b4321e52472
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_es-419.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_es-419.dll
          • Size 50KB
          • SHA256 d6ef58c4f99d160dcb0690e17fc53c4cbba9584995b5c787efd7d5a03f461856
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_es.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_es.dll
          • Size 51KB
          • SHA256 113def0d64b16936e317fe1cd64d8e76c6b0d3aa2dcf510c69205b733d6edba5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_et.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_et.dll
          • Size 49KB
          • SHA256 1687cc0d1b9948221fa2d005dc6aeacbc730dd5f79073118318578eeceeb0a11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fa.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_fa.dll
          • Size 48KB
          • SHA256 107940a04c9392143b9693437832b60413e496f3a4152568001e370ff5c63b6a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fi.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_fi.dll
          • Size 49KB
          • SHA256 7b398f815cbc97a0c2182356a860f58a929beae897423fb2c918f0f6f19348b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fil.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_fil.dll
          • Size 50KB
          • SHA256 48e3f78b12fd65fbfa64344c86c0aaf84b3f1bbeaea4bbe71c35fc8ebef9cff2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fr.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_fr.dll
          • Size 51KB
          • SHA256 484b8c7997926aa611bf15665f6a3482b35d5a99d91493cc822ef90d70719ba5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_gu.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_gu.dll
          • Size 51KB
          • SHA256 b3111f3e780a788bb10232408a7a13bd16304cd99d6be5b2415798827f70003a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hi.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_hi.dll
          • Size 49KB
          • SHA256 bc4d28cf08cb49c6a96f11e837b862c2570b8feae40a320979fef4689292f262
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hr.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_hr.dll
          • Size 50KB
          • SHA256 bab75e543851c62d9f7b1c71cdaecd2aadc1bb7c6769f8341db817f2616c6b68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hu.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_hu.dll
          • Size 50KB
          • SHA256 e7005ab9665440218bd456e0512c0c7f6bdee837724a6ff28848df22baa83ae7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_id.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_id.dll
          • Size 49KB
          • SHA256 3d125804addff9eb36b7fb9afeacdf7866fc2120b8e35f06aaf0bd5f98e8dfa5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_is.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_is.dll
          • Size 49KB
          • SHA256 b7ebd5f63c0268b423a37ed5606be4c5a98ac7b79c3b2c7a908e7758736ac486
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_it.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_it.dll
          • Size 51KB
          • SHA256 e7f301cb7c6deb08aaafd289d4b669cb55e5979cc7703fe28e044ca7d41c40d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_iw.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_iw.dll
          • Size 47KB
          • SHA256 cc985b473bb9984124d28b2d8f12b95b01ea82df9abcad99d45f0da8b38d7383
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ja.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_ja.dll
          • Size 46KB
          • SHA256 2c50b3a69a2aeab774a6b9f3b394d928ae2bf9b77b89912ef2a7f8c3864b5e43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_kn.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_kn.dll
          • Size 51KB
          • SHA256 f874b0a857cb1942ff026ba0ed5fac59de972febd5132cc79dc43c556351c970
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ko.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_ko.dll
          • Size 45KB
          • SHA256 2488aef59063829972e7b5bcee9ca191807e89adc594fcacd8ae6007470ffaa6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_lt.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_lt.dll
          • Size 49KB
          • SHA256 1e3567d589f9065c07f23568d72484129369b312000fcad39b3c396a16ca4a79
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_lv.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_lv.dll
          • Size 50KB
          • SHA256 4e23c5bb7ee2729b7a3900c8893c63e25b578962e481e06479d11071704c3935
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ml.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_ml.dll
          • Size 52KB
          • SHA256 4ccd80bba3e5c68ff394233d1888ae0be69bc6530c8c86a397ec88778644f678
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_mr.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_mr.dll
          • Size 50KB
          • SHA256 9b21202d5d8f5040f096b66fcb4485bc0767b75f3d62bcc8fa4a2d215a049562
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ms.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_ms.dll
          • Size 49KB
          • SHA256 cb6c561e082a14da36c4dd918b21fa8fffec89d9a9ca0f0ebf4d52ab0a6ac043
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_nl.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_nl.dll
          • Size 50KB
          • SHA256 755a1bf1e8dd39927feafaba7cb9f0986f426904e8549b24fea7c14e2aa1d744
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_no.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_no.dll
          • Size 49KB
          • SHA256 a9b7e5d5bb1e4d9a177996f460fe2d27b0d165257d761581b803c975f5d70d88
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pl.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_pl.dll
          • Size 50KB
          • SHA256 2abefeda97eb2c572415ccba1b62a76a6526e25a2156dd7a9c20fa3c9228ed4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pt-BR.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_pt-BR.dll
          • Size 49KB
          • SHA256 62debb832e3f44455c9f99befbe9246ebe5e7d9eefab19a2192f7d2cc39198e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pt-PT.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_pt-PT.dll
          • Size 50KB
          • SHA256 4b20441e4f8b23981e98469b5c9f85d7739ad65c111e20478be10dc0670abfe1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ro.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_ro.dll
          • Size 50KB
          • SHA256 952ecac650a4a8072b481d5e7a298140058defe6fa7148e8b2a9025c624987bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ru.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_ru.dll
          • Size 49KB
          • SHA256 ead8fd54f91c7f0cfaf3ce972f2a90550320cb9e8bc380ba8e938d527cfbe169
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sk.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_sk.dll
          • Size 49KB
          • SHA256 913570f399ea5c271ab23c72cc5d2599d9e922147307ec66aa9ee52e9eefcdd8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sl.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_sl.dll
          • Size 50KB
          • SHA256 d4223c3182a8ecdb02f3ed4b6aeeaf055aed0e88dbed7aa3739aa7863a24147c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sr.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_sr.dll
          • Size 49KB
          • SHA256 2ad574c16dd25d7ba856d6174f127c29c195a831694e1b9a21a2ce11ab4a8074
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sv.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_sv.dll
          • Size 49KB
          • SHA256 4e789d125fc64baf4c91ff794a0e940c1669b2198148bca2f6e99038efda7463
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sw.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_sw.dll
          • Size 51KB
          • SHA256 a31235a4ae88911304d50eb1b1a0ad9e86509213e8725e60324a601401a91108
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ta.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_ta.dll
          • Size 51KB
          • SHA256 9989fac81fe341ca2331c43c3486f0f54629990a829c2a34d18ef6177ef1c156
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_te.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_te.dll
          • Size 51KB
          • SHA256 3f28a7afc7bae974cec6fa7711c18a5240d700a6c16549b8a0ff58380a9383f2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_th.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_th.dll
          • Size 48KB
          • SHA256 fe5a2cf08240957d1ad339bf8954ca9af8c92de008670ef453790093e4c2289e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_tr.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_tr.dll
          • Size 49KB
          • SHA256 eb61f9e6afcef3165c54f213491f6df95b76c2be201f4d7019e504d76ff47447
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_uk.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_uk.dll
          • Size 49KB
          • SHA256 a1fada665f8a72a02e1475beb53c6a6e771c75fa5f46594dd3df0fef70ebd5a1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ur.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_ur.dll
          • Size 49KB
          • SHA256 0aabe7cf5293482c749fc9ed97878d0cbdd02efe0d29ab52d0abeb92e910e5db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_vi.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_vi.dll
          • Size 49KB
          • SHA256 364ed3f184dc33b5a4c40328a668433b861ebcdd9915937032d353c9c4ba040f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_zh-CN.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM1EAE.tmp\goopdateres_zh-CN.dll
          • Size 43KB
          • SHA256 bb9ecd7eb6c1b54e9a451b8fcfb7f86b7b0c00964544ef7d520f34e31af48132
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrmstp.exe
          • Path C:\Program Files\Google\Chrome\Application\147.0.7727.102\Installer\chrmstp.exe
          • Size 7.1MB
          • SHA256 5c334ac7c7d7cd3e9c620b69bc02e6cdf3c72ff4a020a9660389fe5ee38cbf0e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          am_MASCULINE.pak
          • Path C:\Program Files\Google\Chrome\Temp\source5644_1778134641\Chrome-bin\147.0.7727.102\Locales\am_MASCULINE.pak
          • Size 18B
          • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
          • MD5 SHA1 SHA512
          Submit Download

          BookmarkMergedSurfaceOrdering
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
          • Size 6B
          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
          • MD5 SHA1 SHA512
          Submit Download

          BrowsingTopicsState
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
          • Size 414B
          • SHA256 308a54900e20200188d4b94298c9a9b9ab1d667964cbeef1ca4f41e16a4368e0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
          • Size 72B
          • SHA256 8c5603816828e4747cd53fa5397b6ae62c4e932c5dca8fbdca9e3e415d1902c6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dasherSettingSchema.json
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
          • Size 854B
          • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          service_worker_bin_prod.js
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\service_worker_bin_prod.js
          • Size 121KB
          • SHA256 ed3803ef5bac39e8b153d283695ee3562398e5d771a6c7fe5d1a85805672ab3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
          • Size 3KB
          • SHA256 fe3071fc66546c9412232574c93c22cb8112c00a2eb943dd43506a6d171e0b78
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
          • Size 13KB
          • SHA256 d4d533d776cc6202d370f00684612a4eeb1eb8f750e97fefe2fd3d4e52a3f975
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Secure Preferences
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
          • Size 23KB
          • SHA256 60fbec4ad4c389530cc7a3adfd1f037435d29012c2544364babe81a6e0cf3912
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
          • Size 120B
          • SHA256 813880b0086b954216df43a59f7ce40fddfa62e427c10fabebb893e29d2d84cb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
          • Size 120B
          • SHA256 5dc474f03bd46aa879974350d67ecdbadc767c04625ff610935203113e3cbf45
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index~RFe5993e9.TMP
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5993e9.TMP
          • Size 120B
          • SHA256 26c3d04afb893fd21d9c2baf5e8dd5e831689c9fd6ec712c18b8b0c709b58ec4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          trusted_vault.pb
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
          • Size 84B
          • SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 90KB
          • SHA256 b4af6a1b6b33e81dbcb56177fc58f14d6704e1330c910a9df02271dee41e2211
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 61KB
          • SHA256 1e6ce9a01be1573efc44dc9f2860040fe3bba301a8a94c7c7a467c698a9413c4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 64KB
          • SHA256 3d144681a10cd424ee955ae86430570322498b2bcdb26e4692490c61bbe404bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 61KB
          • SHA256 672b413b53a460a89d018ab71cd24c6366cb2cc855197106511c53f80232e96f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
          • Size 147KB
          • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\metadata.json
          • Size 124B
          • SHA256 3ddcb4982c9778214ebf843981c9fbfb66e1522ebb4076d6f4460b250042e17e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_n.usa
          • Path C:\Users\Admin\AppData\Local\Temp\2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_n.usa
          • Size 1.3MB
          • SHA256 b9561fd4ecfa5d1e8c3451d5c4c2be886db4ff3b6bf2fb4a5d2fdaedfc37d1cf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UsaShohdi.asu
          • Path C:\Windows\SysWOW64\UsaShohdi.asu
          • Size 3.8MB
          • SHA256 7c30ed5d158c67fffaa1e7489146829830f67bd4ceb46e9adaef60710176df30
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/824-1952-0x00007FF635610000-0x00007FF635D55000-memory.dmp
          Download

          memory/1668-295-0x0000000001890000-0x0000000001996000-memory.dmp
          Download

          memory/3660-1803-0x00007FF635610000-0x00007FF635D55000-memory.dmp
          Download

          memory/4280-294-0x0000000003120000-0x0000000003226000-memory.dmp
          Download

          memory/5012-1405-0x0000000001000000-0x0000000001029000-memory.dmp
          Download

          memory/5012-291-0x0000000001000000-0x0000000001029000-memory.dmp
          Download

          memory/5012-293-0x0000000003700000-0x000000000379F000-memory.dmp
          Download

          memory/5012-1407-0x0000000003700000-0x000000000379F000-memory.dmp
          Download

          memory/5012-292-0x0000000000FA0000-0x0000000000FAF000-memory.dmp
          Download

          memory/5924-1523-0x0000000000BE0000-0x0000000000BEE000-memory.dmp
          Download

          memory/5924-1524-0x0000000002E30000-0x0000000002E59000-memory.dmp
          Download