Overview

overview

10

Static

static

10

2026-04-18..._n.exe

windows10-2004-x64

10

2026-04-18..._n.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    18/04/2026, 09:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_n.exe
  • Size 3.8MB
  • Sample260418-k33gmscs7l
  • SHA256 5a9b93058484ea6e27e1ddbeca7ae31521af802a0b8f5f5674699dce6935d2c7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryshodipersistenceprivilege_escalationspywarestealertrojanworm

Malware Config

Signatures

  • Family: Shodi

    Shodi is a Windows worm written in C++.

    wormshodi
  • Detects Shodi worm 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 42 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_n.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_n.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4660
    • C:\Users\Admin\AppData\Local\Temp\2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_n.usa
      C:\Users\Admin\AppData\Local\Temp\2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_n.usa
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1032
      • C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={1E01CAED-8315-E230-DA76-A3E554F282BA}&lang=ja&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=defaultbrowser"
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2180
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2876
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:132
          • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:3540
          • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:3684
          • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:912
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0U2N0M1QTktMkZDQi00OTIwLTlFRDAtRDNGMjlCNkFGNjg5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0FDREYwOEZDLTcwMUUtNDE3RS1BNTRGLTUwNzQwNjBBRkU0NX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMTQxLjAuNzM0MC4wIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjEzMiIgbGFuZz0iamEiIGJyYW5kPSIiIGNsaWVudD0iIiBpaWQ9InsxRTAxQ0FFRC04MzE1LUUyMzAtREE3Ni1BM0U1NTRGMjgyQkF9Ij48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjExMDkiLz48L2FwcD48L3JlcXVlc3Q-
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2468
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={1E01CAED-8315-E230-DA76-A3E554F282BA}&lang=ja&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=defaultbrowser" /installsource taggedmi /sessionid "{3E67C5A9-2FCB-4920-9ED0-D3F29B6AF689}"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2996
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:540
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:4908
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:1148
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Program Files (x86)\Google\Update\Install\{BC219332-2D6B-4C58-BF39-7D1E24DC821F}\147.0.7727.102_chrome_installer_uncompressed.exe
      "C:\Program Files (x86)\Google\Update\Install\{BC219332-2D6B-4C58-BF39-7D1E24DC821F}\147.0.7727.102_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{BC219332-2D6B-4C58-BF39-7D1E24DC821F}\gui970B.tmp"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5100
      • C:\Program Files (x86)\Google\Update\Install\{BC219332-2D6B-4C58-BF39-7D1E24DC821F}\CR_6972F.tmp\setup.exe
        "C:\Program Files (x86)\Google\Update\Install\{BC219332-2D6B-4C58-BF39-7D1E24DC821F}\CR_6972F.tmp\setup.exe" --uncompressed-archive="C:\Program Files (x86)\Google\Update\Install\{BC219332-2D6B-4C58-BF39-7D1E24DC821F}\CR_6972F.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{BC219332-2D6B-4C58-BF39-7D1E24DC821F}\gui970B.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3240
        • C:\Program Files (x86)\Google\Update\Install\{BC219332-2D6B-4C58-BF39-7D1E24DC821F}\CR_6972F.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{BC219332-2D6B-4C58-BF39-7D1E24DC821F}\CR_6972F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=147.0.7727.102 --attachment=C:\Windows\SystemTemp\chrome_installer.log --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff75f02b840,0x7ff75f02b84c,0x7ff75f02b858
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:3280
        • C:\Program Files (x86)\Google\Update\Install\{BC219332-2D6B-4C58-BF39-7D1E24DC821F}\CR_6972F.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{BC219332-2D6B-4C58-BF39-7D1E24DC821F}\CR_6972F.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2344
          • C:\Program Files (x86)\Google\Update\Install\{BC219332-2D6B-4C58-BF39-7D1E24DC821F}\CR_6972F.tmp\setup.exe
            "C:\Program Files (x86)\Google\Update\Install\{BC219332-2D6B-4C58-BF39-7D1E24DC821F}\CR_6972F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=147.0.7727.102 --attachment=C:\Windows\SystemTemp\chrome_installer.log --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff75f02b840,0x7ff75f02b84c,0x7ff75f02b858
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:1152
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0U2N0M1QTktMkZDQi00OTIwLTlFRDAtRDNGMjlCNkFGNjg5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0JBQjVFMjY0LTVGRjAtNDI2NC1CNEFCLTFCOUNEMDM2NUMyQn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTQ3LjAuNzcyNy4xMDIiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9ImphIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7MUUwMUNBRUQtODMxNS1FMjMwLURBNzYtQTNFNTU0RjI4MkJBfSIgY29ob3J0PSIxOmd1L2kxOToiIGNvaG9ydG5hbWU9IlN0YWJsZSBJbnN0YWxscyAmYW1wOyBWZXJzaW9uIFBpbnMiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi9jaHJvbWUvYWN2Z3JzcmVpN2p2enhkN3phdDY1ZXRmamR4YV8xNDcuMC43NzI3LjEwMi8xNDcuMC43NzI3LjEwMl9jaHJvbWVfaW5zdGFsbGVyX3VuY29tcHJlc3NlZC5leGUiIGRvd25sb2FkZWQ9IjQ2OTQ5NjIzMiIgdG90YWw9IjQ2OTQ5NjIzMiIgZG93bmxvYWRfdGltZV9tcz0iMzI4MTMiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjQyMiIgZG93bmxvYWRfdGltZV9tcz0iMzcyOTciIGRvd25sb2FkZWQ9IjQ2OTQ5NjIzMiIgdG90YWw9IjQ2OTQ5NjIzMiIgaW5zdGFsbF90aW1lX21zPSIyNzk1MyIvPjwvYXBwPjwvcmVxdWVzdD4
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2008
  • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe
    "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe" -Embedding
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3764
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=147.0.7727.102 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffef14267e8,0x7ffef14267f4,0x7ffef1426800
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3792
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,8179646159882934894,13991760141342682577,262144 --field-trial-handle=1828,i,16498623745953089846,18287452825171815914,262144 --variations-seed-version --pseudonymization-salt-handle=1864,i,15714579265737606672,2113174280112508251,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1820 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3992
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,11098585171235931897,14673560118600189188,524288 --field-trial-handle=1828,i,16498623745953089846,18287452825171815914,262144 --variations-seed-version --pseudonymization-salt-handle=1864,i,15714579265737606672,2113174280112508251,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2184 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Time Discovery
          PID:800
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,6164951754252694992,15200751108601899936,524288 --field-trial-handle=1828,i,16498623745953089846,18287452825171815914,262144 --variations-seed-version --pseudonymization-salt-handle=1864,i,15714579265737606672,2113174280112508251,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2360 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:920
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,12561301945883786526,11579758008633499594,2097152 --field-trial-handle=1828,i,16498623745953089846,18287452825171815914,262144 --variations-seed-version --pseudonymization-salt-handle=1864,i,15714579265737606672,2113174280112508251,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3216 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1644
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3364,i,15629842139663655569,5944364820030759060,2097152 --field-trial-handle=1828,i,16498623745953089846,18287452825171815914,262144 --variations-seed-version --pseudonymization-salt-handle=1864,i,15714579265737606672,2113174280112508251,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3376 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3024
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3756,i,1800513524256263987,10074742188191908777,2097152 --field-trial-handle=1828,i,16498623745953089846,18287452825171815914,262144 --variations-seed-version --pseudonymization-salt-handle=1864,i,15714579265737606672,2113174280112508251,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3772 /prefetch:9
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4684
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3908,i,6585134522179459543,4011664396813918302,2097152 --field-trial-handle=1828,i,16498623745953089846,18287452825171815914,262144 --variations-seed-version --pseudonymization-salt-handle=1864,i,15714579265737606672,2113174280112508251,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3924 /prefetch:9
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3200
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4108,i,11732721294177271183,355332336627288965,2097152 --field-trial-handle=1828,i,16498623745953089846,18287452825171815914,262144 --variations-seed-version --pseudonymization-salt-handle=1864,i,15714579265737606672,2113174280112508251,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4184 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1044
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4144,i,12373361198347068847,15551942081498554687,2097152 --field-trial-handle=1828,i,16498623745953089846,18287452825171815914,262144 --variations-seed-version --pseudonymization-salt-handle=1864,i,15714579265737606672,2113174280112508251,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4204 /prefetch:9
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1072
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5036,i,18038934412023906437,1564712559319151087,2097152 --field-trial-handle=1828,i,16498623745953089846,18287452825171815914,262144 --variations-seed-version --pseudonymization-salt-handle=1864,i,15714579265737606672,2113174280112508251,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5052 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2716
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,6520190475966472063,7383240491809798097,524288 --field-trial-handle=1828,i,16498623745953089846,18287452825171815914,262144 --variations-seed-version --pseudonymization-salt-handle=1864,i,15714579265737606672,2113174280112508251,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5860 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2604
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,9784693949912054233,2088881998136779065,524288 --field-trial-handle=1828,i,16498623745953089846,18287452825171815914,262144 --variations-seed-version --pseudonymization-salt-handle=1864,i,15714579265737606672,2113174280112508251,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6076 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1644
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,16488356266393070513,7411518102445946113,524288 --field-trial-handle=1828,i,16498623745953089846,18287452825171815914,262144 --variations-seed-version --pseudonymization-salt-handle=1864,i,15714579265737606672,2113174280112508251,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6108 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3288
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3872,i,5037846518198609202,139811440039232051,2097152 --field-trial-handle=1828,i,16498623745953089846,18287452825171815914,262144 --variations-seed-version --pseudonymization-salt-handle=1864,i,15714579265737606672,2113174280112508251,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=3844 /prefetch:9
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:584
  • C:\Program Files\Google\Chrome\Application\147.0.7727.102\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\147.0.7727.102\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2908
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
    1⤵
      PID:856
    • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe" -Embedding
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3232
      • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /broker
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3372
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:440
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:792

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Query Registry

          3
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          System Time Discovery

          1
          T1124

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          GoogleCrashHandler.exe
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\GoogleCrashHandler.exe
          • Size 299KB
          • SHA256 03e91a5144ab49e6a39df0d920987e718fd36f8d5ca34e243506025e8da1db78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoogleCrashHandler64.exe
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\GoogleCrashHandler64.exe
          • Size 396KB
          • SHA256 2ae4d76b2037bf4ea615e92c7064272c93fc6a5cd649a95502234f6f32b9b151
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoogleUpdate.exe
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\GoogleUpdate.exe
          • Size 164KB
          • SHA256 63854e78780866d2ae56a58958a1fda017a71f54b71fe70cf5403958e961862a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoogleUpdateComRegisterShell64.exe
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\GoogleUpdateComRegisterShell64.exe
          • Size 187KB
          • SHA256 974ec719d34ac9af4d37681a8a6dfeb24f3dd136b2681be09dbc86afb6d9f616
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoogleUpdateCore.exe
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\GoogleUpdateCore.exe
          • Size 222KB
          • SHA256 eae6d2053a0f4ea3af887c9244770d31cbacab69f165d4ac5fa49b619f0d6bc3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdate.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdate.dll
          • Size 1.9MB
          • SHA256 b31ed15eeb3e535d1318a566000adc069b793fd0f19ba9ae18342f7656121596
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_am.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_am.dll
          • Size 48KB
          • SHA256 dd0e5047fe6036f3fbea9d04c7563afdb31bd88e42f19879d75299c685c08dd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ar.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_ar.dll
          • Size 47KB
          • SHA256 f4a1a5b7749bafd84927ae0a281db0eee2e2a1ce9cd77ca08165f8bc587cc3b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_bg.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_bg.dll
          • Size 50KB
          • SHA256 bb6569ad79623eed5f042982c2fe2808d8a9cd2b85b98d9bd0a0cf8999c31eba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_bn.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_bn.dll
          • Size 50KB
          • SHA256 adc617b5e3e647355e47006d5b9a130341323c1345fadd25ee880bba89eb95d3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ca.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_ca.dll
          • Size 50KB
          • SHA256 83898433d55d80a230b260af4f746621124c35d2a9814339372de47a57cf6619
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_cs.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_cs.dll
          • Size 49KB
          • SHA256 dff5216c302bd82c514e053f0a7091b315b98229c9a7c67bd37a41a9a825798e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_da.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_da.dll
          • Size 49KB
          • SHA256 c768ff1ccfece2edfd19ca3c90f67a32e061cc153987d3865cc1146587b1cb26
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_de.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_de.dll
          • Size 51KB
          • SHA256 5267fbbfb123d5603cbbb60f2d00a0d446dd5885a1e5f032887a49a8a3da08f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_el.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_el.dll
          • Size 51KB
          • SHA256 be8800221c1ffa7c0a28bbd2042bdd14bfcb8536f8ffab569b07a8c80f8252bb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_en-GB.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_en-GB.dll
          • Size 48KB
          • SHA256 8ac7bc668a8e1c317e9f84796b4df2f804d6ad47a60f8759f54990bf243e6981
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_en.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_en.dll
          • Size 49KB
          • SHA256 22b51dc5d66d1487b5371353253ec26a6cb99c5425e800d06e670b4321e52472
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_es-419.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_es-419.dll
          • Size 50KB
          • SHA256 d6ef58c4f99d160dcb0690e17fc53c4cbba9584995b5c787efd7d5a03f461856
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_es.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_es.dll
          • Size 51KB
          • SHA256 113def0d64b16936e317fe1cd64d8e76c6b0d3aa2dcf510c69205b733d6edba5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_et.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_et.dll
          • Size 49KB
          • SHA256 1687cc0d1b9948221fa2d005dc6aeacbc730dd5f79073118318578eeceeb0a11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fa.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_fa.dll
          • Size 48KB
          • SHA256 107940a04c9392143b9693437832b60413e496f3a4152568001e370ff5c63b6a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fi.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_fi.dll
          • Size 49KB
          • SHA256 7b398f815cbc97a0c2182356a860f58a929beae897423fb2c918f0f6f19348b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fil.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_fil.dll
          • Size 50KB
          • SHA256 48e3f78b12fd65fbfa64344c86c0aaf84b3f1bbeaea4bbe71c35fc8ebef9cff2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fr.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_fr.dll
          • Size 51KB
          • SHA256 484b8c7997926aa611bf15665f6a3482b35d5a99d91493cc822ef90d70719ba5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_gu.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_gu.dll
          • Size 51KB
          • SHA256 b3111f3e780a788bb10232408a7a13bd16304cd99d6be5b2415798827f70003a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hi.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_hi.dll
          • Size 49KB
          • SHA256 bc4d28cf08cb49c6a96f11e837b862c2570b8feae40a320979fef4689292f262
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hr.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_hr.dll
          • Size 50KB
          • SHA256 bab75e543851c62d9f7b1c71cdaecd2aadc1bb7c6769f8341db817f2616c6b68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hu.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_hu.dll
          • Size 50KB
          • SHA256 e7005ab9665440218bd456e0512c0c7f6bdee837724a6ff28848df22baa83ae7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_id.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_id.dll
          • Size 49KB
          • SHA256 3d125804addff9eb36b7fb9afeacdf7866fc2120b8e35f06aaf0bd5f98e8dfa5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_is.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_is.dll
          • Size 49KB
          • SHA256 b7ebd5f63c0268b423a37ed5606be4c5a98ac7b79c3b2c7a908e7758736ac486
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_it.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_it.dll
          • Size 51KB
          • SHA256 e7f301cb7c6deb08aaafd289d4b669cb55e5979cc7703fe28e044ca7d41c40d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_iw.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_iw.dll
          • Size 47KB
          • SHA256 cc985b473bb9984124d28b2d8f12b95b01ea82df9abcad99d45f0da8b38d7383
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ja.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_ja.dll
          • Size 46KB
          • SHA256 2c50b3a69a2aeab774a6b9f3b394d928ae2bf9b77b89912ef2a7f8c3864b5e43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_kn.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_kn.dll
          • Size 51KB
          • SHA256 f874b0a857cb1942ff026ba0ed5fac59de972febd5132cc79dc43c556351c970
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ko.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_ko.dll
          • Size 45KB
          • SHA256 2488aef59063829972e7b5bcee9ca191807e89adc594fcacd8ae6007470ffaa6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_lt.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_lt.dll
          • Size 49KB
          • SHA256 1e3567d589f9065c07f23568d72484129369b312000fcad39b3c396a16ca4a79
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_lv.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_lv.dll
          • Size 50KB
          • SHA256 4e23c5bb7ee2729b7a3900c8893c63e25b578962e481e06479d11071704c3935
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ml.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_ml.dll
          • Size 52KB
          • SHA256 4ccd80bba3e5c68ff394233d1888ae0be69bc6530c8c86a397ec88778644f678
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_mr.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_mr.dll
          • Size 50KB
          • SHA256 9b21202d5d8f5040f096b66fcb4485bc0767b75f3d62bcc8fa4a2d215a049562
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ms.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_ms.dll
          • Size 49KB
          • SHA256 cb6c561e082a14da36c4dd918b21fa8fffec89d9a9ca0f0ebf4d52ab0a6ac043
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_nl.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_nl.dll
          • Size 50KB
          • SHA256 755a1bf1e8dd39927feafaba7cb9f0986f426904e8549b24fea7c14e2aa1d744
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_no.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_no.dll
          • Size 49KB
          • SHA256 a9b7e5d5bb1e4d9a177996f460fe2d27b0d165257d761581b803c975f5d70d88
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pl.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_pl.dll
          • Size 50KB
          • SHA256 2abefeda97eb2c572415ccba1b62a76a6526e25a2156dd7a9c20fa3c9228ed4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pt-BR.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_pt-BR.dll
          • Size 49KB
          • SHA256 62debb832e3f44455c9f99befbe9246ebe5e7d9eefab19a2192f7d2cc39198e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_pt-PT.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_pt-PT.dll
          • Size 50KB
          • SHA256 4b20441e4f8b23981e98469b5c9f85d7739ad65c111e20478be10dc0670abfe1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ro.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_ro.dll
          • Size 50KB
          • SHA256 952ecac650a4a8072b481d5e7a298140058defe6fa7148e8b2a9025c624987bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ru.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_ru.dll
          • Size 49KB
          • SHA256 ead8fd54f91c7f0cfaf3ce972f2a90550320cb9e8bc380ba8e938d527cfbe169
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sk.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_sk.dll
          • Size 49KB
          • SHA256 913570f399ea5c271ab23c72cc5d2599d9e922147307ec66aa9ee52e9eefcdd8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sl.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_sl.dll
          • Size 50KB
          • SHA256 d4223c3182a8ecdb02f3ed4b6aeeaf055aed0e88dbed7aa3739aa7863a24147c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sr.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_sr.dll
          • Size 49KB
          • SHA256 2ad574c16dd25d7ba856d6174f127c29c195a831694e1b9a21a2ce11ab4a8074
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sv.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_sv.dll
          • Size 49KB
          • SHA256 4e789d125fc64baf4c91ff794a0e940c1669b2198148bca2f6e99038efda7463
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_sw.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_sw.dll
          • Size 51KB
          • SHA256 a31235a4ae88911304d50eb1b1a0ad9e86509213e8725e60324a601401a91108
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ta.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_ta.dll
          • Size 51KB
          • SHA256 9989fac81fe341ca2331c43c3486f0f54629990a829c2a34d18ef6177ef1c156
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_te.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_te.dll
          • Size 51KB
          • SHA256 3f28a7afc7bae974cec6fa7711c18a5240d700a6c16549b8a0ff58380a9383f2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_th.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_th.dll
          • Size 48KB
          • SHA256 fe5a2cf08240957d1ad339bf8954ca9af8c92de008670ef453790093e4c2289e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_tr.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_tr.dll
          • Size 49KB
          • SHA256 eb61f9e6afcef3165c54f213491f6df95b76c2be201f4d7019e504d76ff47447
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_uk.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_uk.dll
          • Size 49KB
          • SHA256 a1fada665f8a72a02e1475beb53c6a6e771c75fa5f46594dd3df0fef70ebd5a1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ur.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_ur.dll
          • Size 49KB
          • SHA256 0aabe7cf5293482c749fc9ed97878d0cbdd02efe0d29ab52d0abeb92e910e5db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_vi.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_vi.dll
          • Size 49KB
          • SHA256 364ed3f184dc33b5a4c40328a668433b861ebcdd9915937032d353c9c4ba040f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_zh-CN.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMDA91.tmp\goopdateres_zh-CN.dll
          • Size 43KB
          • SHA256 bb9ecd7eb6c1b54e9a451b8fcfb7f86b7b0c00964544ef7d520f34e31af48132
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrmstp.exe
          • Path C:\Program Files\Google\Chrome\Application\147.0.7727.102\Installer\chrmstp.exe
          • Size 7.1MB
          • SHA256 5c334ac7c7d7cd3e9c620b69bc02e6cdf3c72ff4a020a9660389fe5ee38cbf0e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          am_MASCULINE.pak
          • Path C:\Program Files\Google\Chrome\Temp\source3240_1740198353\Chrome-bin\147.0.7727.102\Locales\am_MASCULINE.pak
          • Size 18B
          • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
          • MD5 SHA1 SHA512
          Submit Download

          BookmarkMergedSurfaceOrdering
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
          • Size 6B
          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
          • MD5 SHA1 SHA512
          Submit Download

          BrowsingTopicsState
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
          • Size 414B
          • SHA256 c4db2dcf275e245c964f4d420f3524d6ae89f93339b746fe90a2f2876ce2a5f0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
          • Size 72B
          • SHA256 4b1a53fef022083a14336cb0f134167c1adecb32d111252dda9661b9e9b2cdd6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dasherSettingSchema.json
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
          • Size 854B
          • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          service_worker_bin_prod.js
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\service_worker_bin_prod.js
          • Size 121KB
          • SHA256 ed3803ef5bac39e8b153d283695ee3562398e5d771a6c7fe5d1a85805672ab3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
          • Size 3KB
          • SHA256 1369f923d2e782260cf8402039c26513d5a1d04ba9a0f8c4a7011c4b98307410
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
          • Size 13KB
          • SHA256 d5d3ec7879ee430a75fa520dd5b0ad8cf4e99f463999dd86ecc3901d42d05498
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Secure Preferences
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
          • Size 23KB
          • SHA256 639147ee5f5f284b1ac7f3240a1f02fbb8a9a8455cc6b4dfff85207ba5457f8a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp-index
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
          • Size 120B
          • SHA256 766e063841b9816b40eed19ed0d48fabb65616750a21e3e0769c66a403488a44
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
          • Size 120B
          • SHA256 238398ac38e220658e9824c31603169333c350356a3a054436df373ae4f8b046
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index~RFe595d49.TMP
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595d49.TMP
          • Size 120B
          • SHA256 b1c449e76b92a2b379875b599683ebe7afcfb42634bd51043012e7b6a4ae8232
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          trusted_vault.pb
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
          • Size 84B
          • SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 61KB
          • SHA256 10369c3e8307ae87d61addecebd59ea06df5e02b541335946f3b320a71644897
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 61KB
          • SHA256 dc8e24d8e08724eed04c13ea2189ef66f12dbe89fd0d9062ff003b64b496c5d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 64KB
          • SHA256 40664886289057f8e8e04a0a95d184df32dfb2a2b48cb510685251d3a53b0455
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 90KB
          • SHA256 9909d4570c36da7139b82501580ac42eabca2c7e59c9c2296288088b7f1fd802
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
          • Size 147KB
          • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\metadata.json
          • Size 124B
          • SHA256 3ddcb4982c9778214ebf843981c9fbfb66e1522ebb4076d6f4460b250042e17e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_n.usa
          • Path C:\Users\Admin\AppData\Local\Temp\2026-04-18_df11cf4151756c42e7f0e8f72c7886e1_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_n.usa
          • Size 1.3MB
          • SHA256 b9561fd4ecfa5d1e8c3451d5c4c2be886db4ff3b6bf2fb4a5d2fdaedfc37d1cf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UsaShohdi.asu
          • Path C:\Windows\SysWOW64\UsaShohdi.asu
          • Size 3.8MB
          • SHA256 7c30ed5d158c67fffaa1e7489146829830f67bd4ceb46e9adaef60710176df30
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/132-279-0x0000000002450000-0x000000000259D000-memory.dmp
          Download

          memory/440-1984-0x0000000001CD0000-0x0000000001E1D000-memory.dmp
          Download

          memory/792-1983-0x0000000001440000-0x000000000158D000-memory.dmp
          Download

          memory/912-278-0x0000025F10980000-0x0000025F10CF8000-memory.dmp
          Download

          memory/1032-1791-0x0000000001400000-0x00000000015AC000-memory.dmp
          Download

          memory/1032-297-0x0000000001400000-0x00000000015AC000-memory.dmp
          Download

          memory/1152-2292-0x00007FF75E9A0000-0x00007FF75F0E5000-memory.dmp
          Download

          memory/1836-303-0x0000000000F10000-0x000000000105D000-memory.dmp
          Download

          memory/1836-1793-0x0000000000F10000-0x000000000105D000-memory.dmp
          Download

          memory/1836-302-0x00000000003E0000-0x00000000003E6000-memory.dmp
          Download

          memory/2008-1790-0x00000000013B0000-0x00000000014FD000-memory.dmp
          Download

          memory/2180-1788-0x0000000002550000-0x000000000269D000-memory.dmp
          Download

          memory/2180-299-0x0000000002550000-0x000000000269D000-memory.dmp
          Download

          memory/2180-298-0x0000000000920000-0x0000000000926000-memory.dmp
          Download

          memory/2468-292-0x0000000002D80000-0x0000000002ECD000-memory.dmp
          Download

          memory/2996-1786-0x00000000025A0000-0x00000000026ED000-memory.dmp
          Download

          memory/2996-300-0x0000000000B60000-0x0000000000B66000-memory.dmp
          Download

          memory/2996-301-0x00000000025A0000-0x00000000026ED000-memory.dmp
          Download

          memory/3280-1986-0x00007FF75E9A0000-0x00007FF75F0E5000-memory.dmp
          Download

          memory/3372-1981-0x0000000002AF0000-0x0000000002C3D000-memory.dmp
          Download

          memory/3540-276-0x000001C431610000-0x000001C431988000-memory.dmp
          Download

          memory/3684-277-0x00000208F59D0000-0x00000208F5D48000-memory.dmp
          Download

          memory/4572-1785-0x0000000002BC0000-0x0000000002D0D000-memory.dmp
          Download

          memory/4908-290-0x0000000002280000-0x00000000023CD000-memory.dmp
          Download