Overview

overview

8

Static

static

3

SecuriteIn...81.exe

windows10-2004-x64

8

SecuriteIn...81.exe

windows11-ltsc_2024-x64

8

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDIR/INetC.dll

windows11-ltsc_2024-x64

3

$TEMP/ChromeSetup.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/07/2026, 08:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Trojan.Gozi.2177.22380.17981.exe
  • Size 2.8MB
  • Sample260722-j38szsysbx
  • SHA256 32b222165a61978b9d981cbd77eee2c24d7d366021ad3abfcfcd052d7a6e8d4e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 59 IoCs
  • Loads dropped DLL 40 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 14 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Gozi.2177.22380.17981.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Gozi.2177.22380.17981.exe"
    1⤵
    • Downloads MZ/PE file
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3276
    • C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
      C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1568
      • C:\Program Files (x86)\Google1568_603872924\bin\updater.exe
        "C:\Program Files (x86)\Google1568_603872924\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={7CE1A3BF-8CB5-0868-5AE3-3E79944A9662}&lang=ru&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=-arch_x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
        3⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5056
        • C:\Program Files (x86)\Google1568_603872924\bin\updater.exe
          "C:\Program Files (x86)\Google1568_603872924\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x54e5fc,0x54e608,0x54e614
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3984
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:3996
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.182 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9bc5fba50,0x7ff9bc5fba5c,0x7ff9bc5fba68
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1868
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1832,i,5844464602363127772,12518493806313416174,262144 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1864 /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3596
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,5142454215784724925,12990003781291286160,524288 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2204 /prefetch:3
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:1648
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2476,i,680908935770946400,4085891103997193178,524288 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2496 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2520
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,16625374902848708548,18335759958585510665,2097152 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3300 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4836
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3328,i,15738807297767000681,7854936177333511434,2097152 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3360 /prefetch:1
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3824
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3792,i,13271294183673080688,6996600554796975239,2097152 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3848 /prefetch:2
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1720
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4052,i,9900495419869351220,9253291460460909917,2097152 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3876 /prefetch:1
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1400
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4072,i,2706423060014203509,7477899651759780195,2097152 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4212 /prefetch:2
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1404
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3504,i,13974507268570430490,7911692731216633468,2097152 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4788 /prefetch:1
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2588
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,1789984062677951946,11091433194527953580,524288 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5612 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1684
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5776,i,13871389619904097172,497814715071602825,2097152 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5784 /prefetch:1
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:816
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5816,i,15462864220856178940,17236687450027810916,2097152 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5832 /prefetch:1
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4324
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4188,i,15772560680235491688,16450444030896344891,524288 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=3448 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2168
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,3212772848493346946,3337429433412921389,524288 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5708 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4736
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3480,i,1064327818729600598,10263528415282318336,524288 --field-trial-handle=1868,i,2207024024969853289,12005768349082060112,262144 --variations-seed-version --pseudonymization-salt-handle=1872,i,8674790153710901202,11201341533080375447,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5772 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3892
    • C:\Users\Admin\Downloads\YandexFull.exe
      "C:\Users\Admin\Downloads\YandexFull.exe" -silent
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Users\Admin\AppData\Local\Temp\yb976F.tmp
        "C:\Users\Admin\AppData\Local\Temp\yb976F.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\3822ce85-decd-4e37-95d0-be1e4818d7c9.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --install-start-time-no-uac=672908059 --installer-brand-id=yandex --installer-partner-id=723633 --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=full --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\a7006975-2c11-4493-91fb-f100129ec54a.tmp" --verbose-logging --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2472
        • C:\Users\Admin\AppData\Local\Temp\YB_5E785.tmp\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\YB_5E785.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_5E785.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\3822ce85-decd-4e37-95d0-be1e4818d7c9.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --install-start-time-no-uac=672908059 --installer-brand-id=yandex --installer-partner-id=723633 --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=full --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\a7006975-2c11-4493-91fb-f100129ec54a.tmp" --verbose-logging --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:2080
          • C:\Users\Admin\AppData\Local\Temp\YB_5E785.tmp\setup.exe
            "C:\Users\Admin\AppData\Local\Temp\YB_5E785.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_5E785.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\3822ce85-decd-4e37-95d0-be1e4818d7c9.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --install-start-time-no-uac=672908059 --installer-brand-id=yandex --installer-partner-id=723633 --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=full --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\a7006975-2c11-4493-91fb-f100129ec54a.tmp" --verbose-logging --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=674949883
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5132
            • C:\Users\Admin\AppData\Local\Temp\YB_5E785.tmp\setup.exe
              C:\Users\Admin\AppData\Local\Temp\YB_5E785.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=5132 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.2.960 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff68e13a218,0x7ff68e13a224,0x7ff68e13a230
              6⤵
              • Executes dropped EXE
              PID:5348
  • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
    "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update-internal
    1⤵
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4360
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0xb8e5fc,0xb8e608,0xb8e614
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:4684
  • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
    "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
    1⤵
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0xb8e5fc,0xb8e608,0xb8e614
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:644
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=1720
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2332
      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x27c,0x280,0x284,0x278,0x288,0xb8e5fc,0xb8e608,0xb8e614
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1288
    • C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\150.0.7871.182_chrome_installer_uncompressed.exe
      "C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\150.0.7871.182_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\fc46fbb9-f7af-48a8-9bc8-f32d8fc84434.tmp"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1120
      • C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\CR_AE7C6.tmp\setup.exe
        "C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\CR_AE7C6.tmp\setup.exe" --uncompressed-archive="C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\CR_AE7C6.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\fc46fbb9-f7af-48a8-9bc8-f32d8fc84434.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Network Configuration Discovery: Internet Connection Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3848
        • C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\CR_AE7C6.tmp\setup.exe
          "C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\CR_AE7C6.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.182 "--attachment=C:\Program Files\chrome_installer.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6a9ee9980,0x7ff6a9ee998c,0x7ff6a9ee9998
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:4404
        • C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\CR_AE7C6.tmp\setup.exe
          "C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\CR_AE7C6.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:988
          • C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\CR_AE7C6.tmp\setup.exe
            "C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\CR_AE7C6.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.182 "--attachment=C:\Program Files\chrome_installer.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6a9ee9980,0x7ff6a9ee998c,0x7ff6a9ee9998
            5⤵
            • Executes dropped EXE
            PID:3976
    • C:\Program Files\Google\Chrome\Application\150.0.7871.182\os_update_handler.exe
      "C:\Program Files\Google\Chrome\Application\150.0.7871.182\os_update_handler.exe" --channel=stable --force-install --system-level
      2⤵
      • Executes dropped EXE
      PID:2928
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=1880
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4788
      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x27c,0x280,0x284,0x278,0x288,0xb8e5fc,0xb8e608,0xb8e614
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3960
    • C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_483184017\platform_experience_helper.exe
      "C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_483184017\platform_experience_helper.exe" --install
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      PID:552
  • C:\Program Files\Google\Chrome\Application\150.0.7871.182\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\150.0.7871.182\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2976
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
    1⤵
      PID:240
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
      1⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4368
      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0xb8e5fc,0xb8e608,0xb8e614
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4308
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
      1⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4072
      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0xb8e5fc,0xb8e608,0xb8e614
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3656
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
      1⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0xb8e5fc,0xb8e608,0xb8e614
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4628
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
      1⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0xb8e5fc,0xb8e608,0xb8e614
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:964
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
      1⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5476
      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0xb8e5fc,0xb8e608,0xb8e614
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5492
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
      1⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5620
      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0xb8e5fc,0xb8e608,0xb8e614
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5636
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
      1⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5776
      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0xb8e5fc,0xb8e608,0xb8e614
        2⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        PID:5808
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
      1⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5964
      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0xb8e5fc,0xb8e608,0xb8e614
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5980
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
      1⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5296
      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x284,0x288,0x28c,0x280,0x290,0xb8e5fc,0xb8e608,0xb8e614
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5280

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Modify Registry

          2
          T1112

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Query Registry

          5
          T1012

          System Information Discovery

          5
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          System Time Discovery

          1
          T1124

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          uninstall.cmd
          • Path C:\Program Files (x86)\Google1568_603872924\bin\uninstall.cmd
          • Size 653B
          • SHA256 099592ffa867124d16c0c6d868af1214fd2b7180fa76e4eee01abf2a5cf8f044
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          updater.exe
          • Path C:\Program Files (x86)\Google1568_603872924\bin\updater.exe
          • Size 5.8MB
          • SHA256 810e9879fdb18d0a5d68cd455b7187c62eb44fe585346a34f17b8802ad065482
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          settings.dat
          • Path C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad\settings.dat
          • Size 40B
          • SHA256 489ca2df772108742e1cc9b6f5cdfea6d79e103ad457c687b70c74a796f16444
          • MD5 SHA1 SHA512
          Submit Download

          metadata.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
          • Size 248B
          • SHA256 c28104156ccabe1ec4d8ed525e34a7c1a03577eb1021d3f9ac3fdcccda08fb86
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          metadata.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
          • Size 130B
          • SHA256 9b61ec0d20b5b48e941032252c14f8ca9bd7f5665bec8dd81082fe92d3dae148
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 421B
          • SHA256 9c1ed48b68d10a8c39189d53fb9635b9660b36ef76bbd38be7b60ac752b2ecae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 827B
          • SHA256 7c07b5bcd465b294db2c50f9c9db5fd62633ee2814042703fed2b1d2fc8a1da8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 828B
          • SHA256 14f229ad1c479ad62b72595495a4363e0d43b96ce36c07785e57278eafdc987b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 828B
          • SHA256 9dbdf26491c6f71a622e52cfba294e7e57e7f3ef9d2c9014be34aee4db330c24
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 559B
          • SHA256 cf62c0a48d1c0129a45174c37d66e74e199052ba20b86ce750469fd88d725a3d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 525B
          • SHA256 eee25da0c3365a491696800f228bbee3b9206e9b5e1c31510ab06ad472347aaa
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 827B
          • SHA256 b478726a629c19d37e29261c88437310a873a94ed178cde3456979b914c18d5f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 827B
          • SHA256 72b78ec71191796bc04773ae3c70408136b11b0d065407d6dcec76d738471e72
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 827B
          • SHA256 649ff7ca87012be3c210a871b40ac6b61d0c989fe800635bfb548bbc8d836c0a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 827B
          • SHA256 e8a5551245a0c86fc40fc97036b70d3f66d787bd8543dd6e89cf96a2b577cdb6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 779B
          • SHA256 8426529c34849c7977ad0a7ebbbfc04e63406515d4df17b5669cbd2464ddd7bd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 827B
          • SHA256 da40c5b8bb26cbac5c8ab9580a3a1b2ba647871ea7054b2a54b63a1fc923d266
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 827B
          • SHA256 3c40bbd499de76487673baa372f3a6dac09461fbf95fff98a7fec0951a5b416d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 827B
          • SHA256 699010a019b149e4db68878a5f6c0e941c7c3513b6009a53d926f7d77bb34697
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prefs.json
          • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
          • Size 420B
          • SHA256 41252ff467477dd298dd1b2305b5753b4a979f499f7f086156fa4787ad93e1da
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          updater.log
          • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
          • Size 29KB
          • SHA256 debc7c57890fa461b12aeea01b5058150af3a54aba94c1b59018f669d8ae46e7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          updater.log
          • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
          • Size 34KB
          • SHA256 b32ea0d90d9fea35a450099679b9f63ac0477b14870b4aa46fb091143f652278
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          updater.log
          • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
          • Size 35KB
          • SHA256 1457aced0601ace264c32d0b2702a00bcf1df8f1073fccdd3f3703479e3bf677
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          updater.log
          • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
          • Size 42KB
          • SHA256 91c5679f20e2971c2008d023b0044d57288c989f1019258910494e2e1217b19e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          updater.log
          • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
          • Size 50KB
          • SHA256 6606358c15f1eba7d40fe34827f7e79a0cdbe92a1e0e1270e8193e638ee69ea3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          updater.log
          • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
          • Size 460KB
          • SHA256 34fc29b06a9cf577bd740c6a202697c5d097dd98bd8d0bef7c96442c2649a3f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          updater_history.jsonl
          • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
          • Size 1KB
          • SHA256 6ec77c45ac32fffc917a1931b1f652f9f5f7a35d7286448437b9d80aa52e8dfc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          updater_history.jsonl
          • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
          • Size 3KB
          • SHA256 406fdf21aaecbcc7a9f890bf3e04634d696cca117ae042c908ccde3fef60c534
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          updater_history.jsonl
          • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
          • Size 3KB
          • SHA256 4fe1fb48421a18b94db2881837ece1ead0edcbf4d91fa0f3f2247d1014a109b7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          updater_history.jsonl
          • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
          • Size 5KB
          • SHA256 20e9404141c8f6bfa8689016a8073692c9e9f3d656179490aa3046260ac6d4c0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          updater_history.jsonl
          • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
          • Size 546KB
          • SHA256 3d050807270c948e0ee80c3cd3fa497d27689c9e1a2e3dfd502fb41fadc1fec9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\CR_AE7C6.tmp\setup.exe
          • Size 7.3MB
          • SHA256 864b0e1dd281e4503bf4dcdf084d7269dbd8173c3fcbc1f2b38261ab990f1698
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fc46fbb9-f7af-48a8-9bc8-f32d8fc84434.tmp
          • Path C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping1984_1697655563\fc46fbb9-f7af-48a8-9bc8-f32d8fc84434.tmp
          • Size 393KB
          • SHA256 233fdb8a65c0bcdc4015e2674d679aec5da7d059391fdaf9ffb4dc995cd9baa5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          settings.dat
          • Path C:\Program Files\Crashpad\settings.dat
          • Size 40B
          • SHA256 914c57ec0100fc795fa54afb55fe224eb414b7ee0148b47a32853a553295e07c
          • MD5 SHA1 SHA512
          Submit Download

          chrome_100_percent.pak
          • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\chrome_100_percent.pak
          • Size 1.0MB
          • SHA256 7eb0ef02ebafb7801142b7e98d60ee30afa20cf3c1b5ef0ca005f71f2b2e94d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_200_percent.pak
          • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\chrome_200_percent.pak
          • Size 2.1MB
          • SHA256 28ae89830f39125bcc2df11f8a20e3f0d1d2e589bc30bb2cd41cd0000c1d14bf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_elf.dll
          • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\chrome_elf.dll
          • Size 2.6MB
          • SHA256 761413a9efa7aaffb6d8fdfa8c2088b111af637f292a213317c2e7dab4c34a6e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\elevation_service.exe
          • Size 3.8MB
          • SHA256 59ac77a9958136dd466caf87a293a730da2ee8df4956b30328279b9447e52139
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icudtl.dat
          • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\icudtl.dat
          • Size 10.4MB
          • SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-US.pak
          • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\locales\en-US.pak
          • Size 509KB
          • SHA256 10ddb6c3bc2c191f371120bc67a4e54e5bfe9fa62b48028306fbada83b2029d8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          resources.pak
          • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\resources.pak
          • Size 16.7MB
          • SHA256 dd13eddcbc6e5ffb51826cd588f86f395c9247d75b16bbaea575617a163f128a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome.exe
          • Path C:\Program Files\Google\Chrome\Application\chrome.exe
          • Size 3.8MB
          • SHA256 4fb07e3572e6f750c24f3ed49594ec0d6321c489500482b22666acb414b8b722
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          am_MASCULINE.pak
          • Path C:\Program Files\Google\Chrome\Temp\source3848_1081903983\Chrome-bin\150.0.7871.182\Locales\am_MASCULINE.pak
          • Size 18B
          • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
          • MD5 SHA1 SHA512
          Submit Download

          chrome_installer.log
          • Path C:\Program Files\chrome_installer.log
          • Size 33KB
          • SHA256 e0669b423e56700d32863d6ac53e5caf1c4dfce751e9c878554b27100fdeec7b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BookmarkMergedSurfaceOrdering
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
          • Size 6B
          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
          • MD5 SHA1 SHA512
          Submit Download

          BrowsingTopicsState
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
          • Size 414B
          • SHA256 13e3941fdd7cd3282f3685ccdc1c34cc3657812af032756e44a6448b1ffcbc66
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
          • Size 72B
          • SHA256 cb169cce50e30809fed49a29f3c040e48f795bb0273564913710e1fb444f6f8a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          data_1
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
          • Size 264KB
          • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
          • Size 13KB
          • SHA256 8f07ceb261912bc138ae5be7a7b2ed379653637c0f39ad52dca50fb8e97d6ce1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Secure Preferences
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
          • Size 17KB
          • SHA256 1249235a074ab16a32a13984e6d0e67982e650cfa15d483c805f71bc84068c64
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          32.png
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\pommaclcbfghclhalboakcipcmmndhcj\Icons\32.png
          • Size 1KB
          • SHA256 e5cfd25297afeed35f2932ede23ab2b49ef40ba498a51bc52a124b5ebe721539
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          48.png
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\pommaclcbfghclhalboakcipcmmndhcj\Icons\48.png
          • Size 1KB
          • SHA256 1f763520713953f55df389caee55e1320b3b91d16199dd476a22fb42cc14acc6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          64.png
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\pommaclcbfghclhalboakcipcmmndhcj\Icons\64.png
          • Size 2KB
          • SHA256 3227838954949b03fb522482b0bd1cba7e59fea739c5f489ea75ada4cc86f582
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          128.png
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3996_1625790034\Icons\128.png
          • Size 3KB
          • SHA256 c1d053e070a02c4a970a1e09601b847826ce158bc9cad4ebbf04706655d6a03e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          192.png
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3996_896644318\Trusted Icons\Icons\192.png
          • Size 1KB
          • SHA256 e8006048ffc9aacb8d04179877ba4d7c64e7db7ad5aa27f322f49241ec79adc1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          trusted_vault.pb
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
          • Size 84B
          • SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 115KB
          • SHA256 6ea2101f36dc66ef38fc92a2bc55bd4e323919c6533c35c21f3fd9f2f2ba7684
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 69KB
          • SHA256 80f3c2bee1158d76748209e9d0c6cd35e8100c8fd84541acd60022fe290480fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 69KB
          • SHA256 d15ba5e2f681c3cf9e32e5f5214e00d492241fa8a9d0607c09edf24ef2d88ac0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ChromeSetup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
          • Size 10.3MB
          • SHA256 9c0acb85737434d8d32093f3fe759e918ed1568170c7997e5716636f29ac0faf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          lite_installer.log
          • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
          • Size 1KB
          • SHA256 4242aa21fc7bb379139211cd3d6aa9f8c55d7007305d209624aa94be5e49fd74
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          lite_installer.log
          • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
          • Size 12KB
          • SHA256 ed3e78bd873c4bd9d6ea40eb7989323858820fe311170101aa792a55358ef997
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          master_preferences
          • Path C:\Users\Admin\AppData\Local\Temp\master_preferences
          • Size 542B
          • SHA256 0325fd8be2634b3b8fd40c2d7900b7816bc4cc456ed1b708d9b1f0ca1af4853b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          all_zip
          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.2.960\resources\configs\all_zip
          • Size 1.4MB
          • SHA256 63beea67e56d13a961cdb616ea42b3807de3f149c980ae3badb71e13318ae3d9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ui
          • Path C:\Users\Admin\AppData\Roaming\Yandex\ui
          • Size 38B
          • SHA256 019f575b92c981d71f8989f882434fe0240f2eda6cd5a074ce519166fc7dc2dc
          • MD5 SHA1 SHA512
          Submit Download