6a0ce100203931ed6c66a4396153d92c7b7918c925472fac33cdf4aba0abfc9a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/Chrome/ChromeSetupOriginal.exe
Size 11.2MB
Sample260811-ppln7aed23
SHA256 6a0ce100203931ed6c66a4396153d92c7b7918c925472fac33cdf4aba0abfc9a
MD5 54cbba1e57e30bcee2b8367ab30ad0ed
SHA1 14ad6b2ae6e03f6fb1142138f82741470d0cf284
SHA512 2b51d06acfea71c423bdad822d8f2bf771c052b8fe7d92643e62576d76955fcdf51578a4a1fbea28bc78fe4fca585f362593bcb93d69e3d860bafee599ac271d
SSDEEP 196608:xSqgt68erJCyatyYHYJYy6wNA5eh+qUOq3JnARmMW1UTvTShR9W6gLzFlpaeYe+J:xSqgtDhyatyYHYJYy6wNAAIqUPARzW1p
TLSH
T1AFC69D03BAA09074F4A73271B83D673D9D217E629B3585CB86906CC45FB46D2783A36F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\151.0.7922.109\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{49210152-871f-4ffa-961d-a172abcbc09d}	platform_experience_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{49210152-871f-4ffa-961d-a172abcbc09d}\Version = "152,0,7929,0"	platform_experience_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{49210152-871f-4ffa-961d-a172abcbc09d}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\PlatformExperienceHelper\\platform_experience_helper.exe\" --first-run"	platform_experience_helper.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{49210152-871f-4ffa-961d-a172abcbc09d}\ = "Google Platform Experience Helper"	platform_experience_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{49210152-871f-4ffa-961d-a172abcbc09d}\Localized Name = "Google Platform Experience Helper"	platform_experience_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{49210152-871f-4ffa-961d-a172abcbc09d}\IsInstalled = "1"	platform_experience_helper.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	chrome.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\71454218-6b01-4cac-9629-9378f00aea20.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\da_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\hi_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\id_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\lv_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\nl.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\sw_MASCULINE.pak	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\6b17c5e8-3b21-4fd1-8327-ef3a9597a18a.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files\chromecrx_chrome_Unpacker_BeginUnzipping4116_1367850637\_locales\az\messages.json	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\hr_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\mr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\te_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Application\151.0.7922.109\Installer\chrmstp.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\th_MASCULINE.pak	setup.exe
File created	C:\Program Files\chromecrx_chrome_Unpacker_BeginUnzipping4116_1367850637\_locales\cs\messages.json	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\id_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\kn_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\ms_FEMININE.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\he_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\hi_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\VisualElements\SmallLogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\en-US_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\el_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\ar.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\chromecrx_chrome_Unpacker_BeginUnzipping4116_1367850637\_locales\mk\messages.json	chrome.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\8d29e5cf-ac06-4a2b-becd-5c075d4421b0.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\da.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\th_FEMININE.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl	updater.exe
File created	C:\Program Files\chromecrx_chrome_Unpacker_BeginUnzipping4116_1367850637\_locales\ms\messages.json	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\ml_NEUTER.pak	setup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\PlatformExperienceHelper\platform_experience_helper.exe	platform_experience_helper.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\et_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\id_FEMININE.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\0f904fd7-e904-4cfc-9014-178c09ffd862.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\cs_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\fi_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\he_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\ko_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\VisualElements\SmallLogoCanary.png	setup.exe
File created	C:\Program Files\chromecrx_chrome_Unpacker_BeginUnzipping4116_1367850637\_locales\zh_CN\messages.json	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\WidevineCdm\LICENSE	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\1f4aa13f-fbdb-4617-b3bc-44608c1be432.tmp	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\8e44f039-4647-4350-ad7c-8929fd95233a.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\de.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\fr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\kn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\ta_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\elevated_tracing_service.exe	setup.exe
File created	C:\Program Files\chromecrx_chrome_Unpacker_BeginUnzipping4116_1367850637\_locales\tr\messages.json	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\el_FEMININE.pak	setup.exe
File created	C:\Program Files\chromecrx_chrome_Unpacker_BeginUnzipping4116_1367850637\_locales\lt\messages.json	chrome.exe
File created	C:\Program Files\chromecrx_chrome_Unpacker_BeginUnzipping4116_1367850637\_locales\zh_TW\messages.json	chrome.exe
File created	C:\Program Files\chromecrx_chrome_Unpacker_BeginUnzipping4116_1367850637\128.png	chrome.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\eae7865e-4567-437f-805a-5ac3da90f340.tmp	updater.exe

Executes dropped EXE 38 IoCs

pid	Process
5636	updater.exe
5072	updater.exe
1712	updater.exe
5744	updater.exe
5400	updater.exe
5140	updater.exe
2520	updater.exe
3892	updater.exe
3024	151.0.7922.109_chrome_installer_uncompressed.exe
5836	setup.exe
6004	setup.exe
2412	setup.exe
1880	setup.exe
4116	chrome.exe
4080	chrome.exe
4532	chrome.exe
4536	chrome.exe
4540	elevation_service.exe
5004	chrome.exe
5360	chrome.exe
4324	chrome.exe
3444	chrome.exe
5548	chrome.exe
2648	chrome.exe
4544	chrome.exe
2708	chrome.exe
4580	chrome.exe
3920	updater.exe
2624	chrome.exe
3216	updater.exe
2316	os_update_handler.exe
1688	chrome.exe
4024	chrome.exe
3232	chrome.exe
6060	updater.exe
2432	updater.exe
5296	platform_experience_helper.exe
4236	chrome.exe

Loads dropped DLL 40 IoCs

pid	Process
4116	chrome.exe
4080	chrome.exe
4116	chrome.exe
4532	chrome.exe
4532	chrome.exe
4536	chrome.exe
4532	chrome.exe
4532	chrome.exe
4536	chrome.exe
4532	chrome.exe
4532	chrome.exe
5004	chrome.exe
5004	chrome.exe
5360	chrome.exe
5360	chrome.exe
4324	chrome.exe
3444	chrome.exe
4324	chrome.exe
3444	chrome.exe
4116	chrome.exe
5548	chrome.exe
5548	chrome.exe
2648	chrome.exe
2648	chrome.exe
4544	chrome.exe
4544	chrome.exe
2708	chrome.exe
2708	chrome.exe
4580	chrome.exe
4580	chrome.exe
2624	chrome.exe
2624	chrome.exe
1688	chrome.exe
1688	chrome.exe
4024	chrome.exe
4024	chrome.exe
3232	chrome.exe
3232	chrome.exe
4236	chrome.exe
4236	chrome.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeSetupOriginal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3024	151.0.7922.109_chrome_installer_uncompressed.exe
5836	setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4536	chrome.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\InstallerPinned = "0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309251660365761"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\1.0\ = "GoogleUpdater TypeLib for ICurrentStateSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\1.0\ = "GoogleUpdater TypeLib for IAppWebSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromeHTML\Application	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromePDF\shell\open	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\ = "IProcessLauncher2System"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\TypeLib\ = "{34527502-D3DB-4205-A69B-789B27EE0414}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\ = "IUpdateStateSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\ = "ICompleteStatusSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\150.0.7863.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\TypeLib\ = "{0CD01D1E-4A1C-489D-93B9-9B6672877C57}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{1BF5208B-295F-4992-B5F4-3A9BB6494838}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine\CLSID\ = "{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromeHTML\shell	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatus2System"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.html	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\150.0.7863.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{699F07AD-304C-5F71-A2DA-ABD765965B54}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ = "IPolicyStatus2"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromePDF	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{90E1A5C4-5924-5AF0-BED1-C821F58D0D64}\TypeLib\ = "{90E1A5C4-5924-5AF0-BED1-C821F58D0D64}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\150.0.7863.0\\updater.exe\\4"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\google-chrome\shell\open	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1588C1A8-27D9-563E-9641-8D20767FB258}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\ = "ICompleteStatusSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\TypeLib\ = "{ACAB122B-29C0-56A9-8145-AFA2F82A547C}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{90E1A5C4-5924-5AF0-BED1-C821F58D0D64}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\TypeLib\ = "{6430040A-5EBD-4E63-A56F-C71D5990F827}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\TypeLib\ = "{B685B009-DBC4-4F24-9542-A162C3793E77}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\ = "IProcessLauncherSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\1.0\0\win64\ = "C:\\Program Files\\Google\\Chrome\\Application\\151.0.7922.109\\elevation_service.exe"	setup.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5636	updater.exe
5636	updater.exe
5636	updater.exe
5636	updater.exe
5636	updater.exe
5636	updater.exe
1712	updater.exe
1712	updater.exe
1712	updater.exe
1712	updater.exe
1712	updater.exe
1712	updater.exe
5400	updater.exe
5400	updater.exe
5400	updater.exe
5400	updater.exe
5400	updater.exe
5400	updater.exe
2520	updater.exe
2520	updater.exe
2520	updater.exe
2520	updater.exe
5636	updater.exe
5636	updater.exe
4116	chrome.exe
4116	chrome.exe
3920	updater.exe
3920	updater.exe
3920	updater.exe
3920	updater.exe
3920	updater.exe
3920	updater.exe
6060	updater.exe
6060	updater.exe
6060	updater.exe
6060	updater.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1980	ChromeSetupOriginal.exe
Token: SeIncBasePriorityPrivilege	1980	ChromeSetupOriginal.exe
Token: 33	3024	151.0.7922.109_chrome_installer_uncompressed.exe
Token: SeIncBasePriorityPrivilege	3024	151.0.7922.109_chrome_installer_uncompressed.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 5636	1980	ChromeSetupOriginal.exe	86
PID 5636 wrote to memory of 5072	5636	updater.exe	87
PID 1712 wrote to memory of 5744	1712	updater.exe	89
PID 5400 wrote to memory of 5140	5400	updater.exe	92
PID 5400 wrote to memory of 2520	5400	updater.exe	103
PID 2520 wrote to memory of 3892	2520	updater.exe	104
PID 5400 wrote to memory of 3024	5400	updater.exe	106
PID 3024 wrote to memory of 5836	3024	151.0.7922.109_chrome_installer_uncompressed.exe	107
PID 5836 wrote to memory of 6004	5836	setup.exe	108
PID 5836 wrote to memory of 2412	5836	setup.exe	109
PID 2412 wrote to memory of 1880	2412	setup.exe	110
PID 5636 wrote to memory of 4116	5636	updater.exe	112
PID 4116 wrote to memory of 4080	4116	chrome.exe	113
PID 4116 wrote to memory of 4532	4116	chrome.exe	114
PID 4116 wrote to memory of 4536	4116	chrome.exe	115
PID 4116 wrote to memory of 5004	4116	chrome.exe	117
PID 4116 wrote to memory of 5360	4116	chrome.exe	119
PID 4116 wrote to memory of 4324	4116	chrome.exe	120
PID 4116 wrote to memory of 3444	4116	chrome.exe	121
PID 4116 wrote to memory of 5548	4116	chrome.exe	122
PID 4116 wrote to memory of 2708	4116	chrome.exe	123
PID 4116 wrote to memory of 2648	4116	chrome.exe	124
PID 4116 wrote to memory of 4544	4116	chrome.exe	125
PID 4116 wrote to memory of 4580	4116	chrome.exe	127
PID 4116 wrote to memory of 2624	4116	chrome.exe	131
PID 3920 wrote to memory of 3216	3920	updater.exe	130
PID 3920 wrote to memory of 2316	3920	updater.exe	132
PID 4116 wrote to memory of 1688	4116	chrome.exe	133
PID 4116 wrote to memory of 4024	4116	chrome.exe	134
PID 4116 wrote to memory of 3232	4116	chrome.exe	136
PID 3920 wrote to memory of 6060	3920	updater.exe	137
PID 6060 wrote to memory of 2432	6060	updater.exe	138
PID 3920 wrote to memory of 5296	3920	updater.exe	139
PID 4116 wrote to memory of 4236	4116	chrome.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Chrome\ChromeSetupOriginal.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Chrome\ChromeSetupOriginal.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Google1980_626087808\bin\updater.exe
  "C:\Program Files (x86)\Google1980_626087808\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={F4FF1498-0CEA-108B-2BE5-117F9D551288}&lang=ru&browser=4&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=-arch_x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5636
- - C:\Program Files (x86)\Google1980_626087808\bin\updater.exe
    "C:\Program Files (x86)\Google1980_626087808\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=150.0.7863.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x27c,0x280,0x284,0x278,0x288,0x12002b8,0x12002c4,0x12002d0
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.109 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffeb4f4d9c0,0x7ffeb4f4d9d0,0x7ffeb4f4d9e0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1496,i,13665233138361770815,10667718296903978129,262144 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1828 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,2905623915966229443,7437399468980927633,524288 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2212 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Time Discovery
      PID:4536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2460,i,9709700964282185357,1984295259792363196,524288 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2472 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5004
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --top-chrome-webui --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3308,i,10587935429088876274,16538080102916611068,2097152 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3124 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5360
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3304,i,10767625282487955191,1030584683894708460,2097152 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3740,i,8360455595495548387,2501515163144002523,2097152 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3748 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:3444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3912,i,11748426653764774450,4284800115631927890,2097152 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3924 /prefetch:2
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4172,i,10349217280253579228,13447848325422633505,2097152 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4236 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:2708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4188,i,4559378335948078260,14206700500811237809,2097152 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4292 /prefetch:2
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:2648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4732,i,2761300247960198801,18438458446594146336,2097152 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4924 /prefetch:2
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3716,i,12860867126835058786,4165585907609214800,2097152 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5172 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,17685101922611984904,3088623541147079731,524288 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5736 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2624
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5976,i,18007655799289233539,7014731205243251343,2097152 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5980 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:1688
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6012,i,9969235869268278441,17409878552423172491,2097152 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6020 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,12867089259306403031,14443291401670331040,524288 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6248 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,467857221040164105,18395181158350959719,524288 --field-trial-handle=1804,i,13222890456568885388,12340278717110369319,262144 --variations-seed-version --pseudonymization-salt-handle=1852,i,2103981027723802372,9806699884925053126,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6264 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4236

C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=150.0.7863.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x27c,0x280,0x284,0x278,0x288,0xc702b8,0xc702c4,0xc702d0
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5744

C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=150.0.7863.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x27c,0x280,0x284,0x278,0x288,0xc702b8,0xc702c4,0xc702d0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5140
- C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=1100
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe
    "C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=150.0.7863.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x280,0x284,0x288,0x27c,0x28c,0xc702b8,0xc702c4,0xc702d0
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3892
- C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\151.0.7922.109_chrome_installer_uncompressed.exe
  "C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\151.0.7922.109_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\60ff74cf-91ec-44e8-9251-4c3fc2acefa5.tmp"
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\CR_806A3.tmp\setup.exe
    "C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\CR_806A3.tmp\setup.exe" --uncompressed-archive="C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\CR_806A3.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\60ff74cf-91ec-44e8-9251-4c3fc2acefa5.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5836
  - - C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\CR_806A3.tmp\setup.exe
      "C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\CR_806A3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.109 "--attachment=C:\Program Files\chrome_installer.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7555a4708,0x7ff7555a4718,0x7ff7555a4728
      4⤵
      Executes dropped EXE
      PID:6004
  - - C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\CR_806A3.tmp\setup.exe
      "C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\CR_806A3.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\CR_806A3.tmp\setup.exe
        
        "C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\CR_806A3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.109 "--attachment=C:\Program Files\chrome_installer.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7555a4708,0x7ff7555a4718,0x7ff7555a4728
        5⤵
        Executes dropped EXE
        
        PID:1880

C:\Program Files\Google\Chrome\Application\151.0.7922.109\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\151.0.7922.109\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:864

C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=150.0.7863.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x27c,0x280,0x284,0x278,0x288,0xc702b8,0xc702c4,0xc702d0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3216
- C:\Program Files\Google\Chrome\Application\151.0.7922.109\os_update_handler.exe
  "C:\Program Files\Google\Chrome\Application\151.0.7922.109\os_update_handler.exe" --channel=stable --force-install --system-level
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=1864
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe
    "C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=150.0.7863.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x280,0x284,0x288,0x27c,0x28c,0xc702b8,0xc702c4,0xc702d0
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2432
- C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping3920_808709696\platform_experience_helper.exe
  "C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping3920_808709696\platform_experience_helper.exe" --install
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:5296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uninstall.cmd

Path C:\Program Files (x86)\Google1980_626087808\bin\uninstall.cmd
Size 653B
SHA256 a38e49c0e87a9dd81682346392d45c965783c25d5ec6aaa373cb9799c2a602e2
MD5 96d8312a0955f7169ec966eb46d93423
SHA1 e5e13e00fe3d0009fbf814885c4e2a64693a1486
SHA512 e07e1d4248557cdf6f5fe0684297489d7989e6ef7f84cc8b15cf409761f6f0dfa36fa6299285bd5c1e5723b5e04ec3d3cba95613ae0b6403acf594df0b4592d0
TLSH
T1A1F0D32E76C7A23146F313A16B0EC2465641C1FF172C7111325743992E7E8D30AE779E
MD5 SHA1 SHA512 TLSH

Submit Download

updater.exe

Path C:\Program Files (x86)\Google1980_626087808\bin\updater.exe
Size 6.4MB
SHA256 bc8bb3c31073ec8e5af0e90cd5d36c8fc815f9ac841f7bac48e3076acd0b06ad
MD5 c18ceeb2f10928c4c894f3d16732e2e9
SHA1 3a23f1d37640aa15f9ce961718d94bf9206d2c29
SHA512 d84f3026a173120e6f2e43087b6df060f6f0abb9b4636efb4304c02aeb1b1d83ce601a21f26d07aab9bdacbe59fd7274a00e40c24f2bcad0c1b25fba042a8620
SSDEEP 196608:SqUOq3JnARmMW1UTvTShR9W6gLzFlpaeYe+CDFrhJBZ7gsk:SqUPARzW1UTvTi9W6gLzFlpaeYe+CD9a
TLSH
T11C669E13B9508075F4AB3271B83D67395D323A639B3185CB86906C845FB4BD2A93A37F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60ff74cf-91ec-44e8-9251-4c3fc2acefa5.tmp

Path C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\60ff74cf-91ec-44e8-9251-4c3fc2acefa5.tmp
Size 394KB
SHA256 983af8c0341142512999c257064c5f457e4b79cbe007fd429e7933aa2153b1ff
MD5 307555946ead9b15402030b7469f5c01
SHA1 0a1a7e6168e4817512878dd5b98ceb89e7c4beae
SHA512 3289f6184a0ef8a6c2c6713749042e3d431cc113f6b8b20a50477a9bdc28bf86dff4e77121cad53e152cd3e96c56a23b9f9b55299662fc8601d7b65b5386a3e8
SSDEEP 12288:mV7pI0RzD59+Fx7oFICDg/vjIbMPtVbBF0H:Q7pI0RzDD5vU3kak
TLSH
T1808423BD2778CF8C00294AE5B4391E7C4D288EEF0425D5AA9EFDB29354AF1758737860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping5400_1407685978\CR_806A3.tmp\setup.exe
Size 7.2MB
SHA256 8c4865c2d7fbada052793ec312d43e704bd26ccfcd47a40688cb9aca4c839f7e
MD5 26430479ff217aadc1bc275aa478a9eb
SHA1 f5af21b23c49cd0a0da0ecf6132714b515bca293
SHA512 fe22baa9c05123290e85248fa83f88af92c5a6c3a059981fa4615c4815f8fb94e5f3ee695cd11432992dee87b2e69855db1ea5e3f629160120f1cf850f3e57f6
SSDEEP 49152:6S5hTqk4i0LVXaj7DW0RbRtVbj4AOh9j+8lJSBaz4Pdc8cXucIlNHLIlCTg0QKBS:h4XUjwAY68lcY49NrpJ8q4PA5qPQqt
TLSH
T123766C53F2B501E8D05ED974CF3A52329A357C4A4BB0A2EF269436E11A75ED47B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\Google\GoogleUpdater\150.0.7863.0\Crashpad\settings.dat
Size 40B
SHA256 760ab939c2be17217370dd6beb1f15ff21792baba123f41e10ba1334fe65e3cc
MD5 8e84b11048d33245d886edd8d025a0b3
SHA1 97be5aa085221da88012f921b5e8a0ba453690d8
SHA512 4110287fd3bd068e9dd0da0aeb9cd98ebc1c8fe1e0593cdab2d44da5670bd730a9558db14705a53373731a229ac324f95becce953534a083daa1c8c5702c5fe7
MD5 SHA1 SHA512

Submit Download

c836c5c2-6ff7-448d-b4d7-a413050bde92.tmp

Path C:\Program Files (x86)\Google\GoogleUpdater\c836c5c2-6ff7-448d-b4d7-a413050bde92.tmp
Size 827B
SHA256 7790df720a9ba929dd59baef69b363d3b5f78c374f133c9c2e9de9543393f892
MD5 10cb3702bde709b65a7dd7051846b0a5
SHA1 c0978f6b61436a2e75aa154ae61b67277054f761
SHA512 bb49d0cddfa97a9233ed085fe9a93c36f981cbe48f3ecbb90f9bb89bf7519e706cf606ea3669c11433231fd38a7403c2c0a08a560bbbc659604c6cf94ecc5edb
TLSH
T13F01CE2DCDA2E6B7FC854D9D029676B4D6D45205128461D988C80C5C14DB98EA12AA5A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
Size 130B
SHA256 26065da71517b115298b8840915e7528534d61d01654e3a770340491aad476a1
MD5 9ad98f7700f2de58016e9eb61f409e54
SHA1 dab8498c59d6c258091d712a57db8ad47f039380
SHA512 7769752820a4b26edb6868a8fe825f34a97f1645dc27d59cf281319cfa96ae58ab8c2705d7d58b79208cf4edd0b4c1326dc931c43d22b6564808707113ed0cd6
TLSH
T13BC02B1722CBE1C00F88051F23111CDCC3399900DD6511F430A4C12D04306DD91C2617
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
Size 248B
SHA256 635650236f11cf079ff5f99456807411cde2463115206166220c3ee508267e9f
MD5 84a678e44ed190f1dd343f841fe360ae
SHA1 1d430752507c7e0996cdfff71dd0f74f34f2df0e
SHA512 96697b503d7c30559e998a63351ba39fe4859bc62e022fed7ceeecf814d69f4d60323b1cc5e360b9e8a1b55530ae8d84bfd364b3079391e3447f2c62a2dd4b19
TLSH
T174D095017489E5E54F84056FB35214A4D33D5F0FF85331F41474909D543DD9DA585195
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 421B
SHA256 c544cd3ee283becc97d0dae4092aded572b5b287fe767fd10328cc7d2413c4f1
MD5 84dd33c0757715b66d46a52658d42c17
SHA1 c78fc8548455abce6f7ec398264afcdfd2bccbe8
SHA512 0a067b44f1a6e2b5135a4dbe558ef67ceeac228286105770df8b0d50289b220dd75bcf293eb0d1c38e3ca2e6d46e791d9d13328f5f128e8d9fd89cfc8949d677
TLSH
T143E0AB0AD923A5F3FC484E1F82690BFC83D52C594138019928CD585E00DAD9EF40F81A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 420B
SHA256 4f733f8229a8755d3ca77a8e5ab11d21300244eecc85aa23792f9e765fb4a857
MD5 514130488e98975e7638b6f948c9018e
SHA1 cd2a963af7e9404df39be6d295dae02be7192bde
SHA512 5f3a09c47b50589dc5a6973fddc365c217ddbf6d5680084ae15fe23f084a509088dd49ddaa68d5a440d443886b436da2bc0dcce4aba764418b5b6d5e63385db0
TLSH
T1E4E02B1AD927A5F3FC494E5F42691BFC87E52D594138019928CD585D00AAD9FF40F81B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 607B
SHA256 73e90c8c3fa24a65eb89eeb4ccd185a824e17c688c93b5f188e1ff3723ee6cc0
MD5 57f4fcf7f59fc763e9187e9a1bacc5f9
SHA1 7e7f1571299656f84cc60eb2ef291da62c9e11fc
SHA512 03b07c9d36920dd4c64302be67985eb87890deace873f243708570228fc3ec3554988850a52e223fd07b6c8525e7de4e00ee03a6b354806211c42370c67f26a5
TLSH
T157F0AC2DCAA3F5BAFC454D9A41A67BB8C7E44109128465D994CC0C2C14DB94EA22BE9A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 559B
SHA256 74df8586c66a57f89108ab898a69ad39f166c8969734033c5defbfec1304fb92
MD5 a54111578b47ca5d99a115fb427b3766
SHA1 82c1a2867fab0616011bca7a8f32796720e51d59
SHA512 1bbd53084c1d06af6db07144071e69c4ec282aef296af16ce68d9bd52346ee4e3d1b0508dd4a26d289587b977918725a3afa9485ae8c1eab3240ed53e27a509f
TLSH
T1A5F0202DCAA3F2BBFC014ED901B637BC87E44109128461C948CC0C1C04EB54EA22AD5B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 455B
SHA256 e59eb57a0fdf904edbd8aaaac1875b02d6d4caed9af3738d1ec227cbafb9507b
MD5 f692acbf7accbd25b80efb2195ac5da5
SHA1 1e91a127602d84183ba0745774eda062701d8bcb
SHA512 81297af30eecdc2297b4a47a1035d6c56e3ffbe4f839ac50252a11db54c4521ede5be04ff0ed412a28047f76dc43a5e4f55e14aeac6c54649d06159f7775c683
TLSH
T1FCF05C2DCD67A6BBBC004D9B427627B883D4581A1164119558C8485D04EA95EE91F85A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 525B
SHA256 b0608f732543c4d87fb3eff463edc17fa9e697da3855db86014d816d497f4788
MD5 4957255a65b25faf6a862335b3cdf1f0
SHA1 f954d64b4fcb21f5a6e8193556cee9808afce0bb
SHA512 7c5846e2bfcc24fbe76de98814d9291d39992bdb5ff0cc7a3b47435e0e904093303ac37ceb411d72a22a60e454f8aa6146211fcf93f84a89e189f47d8024667a
TLSH
T1F3F0C92ECA63E2BBFC014EC942B677B887E0450A128061C958C80C2D14EA58EA22AD5A
MD5 SHA1 SHA512 TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 28KB
SHA256 74d7af7e1d5d2e614d644d6331e80316e260bea217cfa6d4bd89918168da80ac
MD5 374b1a2ffe58f1476e38b97f52e632ca
SHA1 d82b9db19de749ad2c3a842eaf50b34a165ff6c3
SHA512 37a8d15c4722763361737ee681fc52beb84ee5373278449fba4e9b066df2e7dc5a7118ecf659f9cf01852a46280fb52598fc338599cf31ccc28b6bffec24ed74
SSDEEP 384:AcquqZkiryJTtCzWDVFhAwouEAu01u36HSBl+6y1lUz:hlDVFh8dA31RYyEz
TLSH
T1E0D2403D5D17D4B7B328DE6F3670266B25891091D39A602237DEC20CB4C79AB68DC2CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 31KB
SHA256 8b4f22c18de8946d07b39abb7710cb211b9ade28b18bd5e96ead747b4db85755
MD5 983696037a91d21082874264f881924f
SHA1 e18867822cc833c0d53f20a5df7cc736e4a6dbff
SHA512 6190c63596e0891ef2090eb3a6a11717f5b89695b5a77710b27a7340158c01a0165f2b4447129220eac2773f00a8b9fcbaa480cd42c54aa2654dce48ad603afa
SSDEEP 384:AcquqZkiryJTtCzWDVFhAwouEAu01u36HSBl+6y1lUrV+t:hlDVFh8dA31RYyEhC
TLSH
T1CFE23F3D5D1BD4B77328DEAF3670256B25891091D39A602637DEC208B4C7DA768EC2CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 37KB
SHA256 30ce299a84f64a01a672429d8004de5bbca02408a4b445cd7d001684be5b331e
MD5 c82e4fd6b83c9f74b2dcc731dfab5e5d
SHA1 a8e9be5d3591597d4cc9d95e399f98ebf12aec1a
SHA512 015051f9394f777b2630390efa5deb15805c74ba304a54256b1609b7519cd99964685b10f948555b205a8ee7efb125fc7d1c3dd6e34c172c16b93eea586ab654
SSDEEP 384:AcquqZkiryJTtCzWDVFhAwouEAu01u36HSBl+6y1lUrV+iQZ+H:hlDVFh8dA31RYyEhUW
TLSH
T199034F395E07D4B77324DEAF3630256B25891091A3DA602637DE820CB4C3DB768EC6DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 41KB
SHA256 57a633178577e062af3a84d8082fdf73f767431be53e1514772e01c5007af8cc
MD5 2fde4b3d5b3fac2b6df7926a7fb4d64c
SHA1 9807b2679235d083ee8671a5d80c964b72c65e48
SHA512 a813916968c5adbe3586954c897b8209fa9b6785a2542ca33ae77ad081692a12761072ba1a0dde773e4784ff53924c2c12bd0fa5bc7ef338e6b843db47423587
SSDEEP 384:AcquqZkiryJTtCzWDVFhAwouEAu01u36HSBl+6y1lUrV+iQZ+7r3L9H:hlDVFh8dA31RYyEhUYr39
TLSH
T14B135F395E07C4B773249EAF3A31255B25C80081A3DA602633DE920CB4C7DB669EC6DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 45KB
SHA256 ce86422ac4ea62dd57c5b3160c66e6bfbb3cf455106ed5f5ac8f55a3527f3a38
MD5 8c07117b612f198cf9be73f863b280ec
SHA1 64fcd13018b1431deac25f10f17616a29e85a38b
SHA512 978d3ed190a60550244b15f6a2bacc190bebda5e2d5bdb7815b058b0a514b02c05f74d09332a935e17e0508b60cf33ee6c750d9f7b3920fcf35c2f12cfc31297
SSDEEP 384:AcquqZkiryJTtCzWDVFhAwouEAu01u36HSBl+6y1lUrV+iQZ+7r3L9/Nm+p:hlDVFh8dA31RYyEhUYr3Wi
TLSH
T1582340295E07D4B773249EAF3B31255B25C90081A3DA602633DE830DB4C7DB669EC6DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 464KB
SHA256 ba40cb2aa4ec651ec81272446c8bbb35939f676be44e1d43d49be420c51a425c
MD5 39fc1af8e5f7527e83d6689f806471a4
SHA1 eb57f4405fcf05a2660922bd204f78fa920cf48b
SHA512 2de7c49c35e4d971f6cde61f37183fcafe5e7305d873c6e3c89c56ef6bd8d77b4120e74bed6a8df6db7d9b2654e48732973777fc0d54390b57d49effed3744ad
SSDEEP 12288:hZz2LHbVTmIhkflR6Vatp7qfEH1/IGtO4:hcjbVTvdOOW
TLSH
T1CDA4F168EE27C8B732244EBE3A30355E199D00D4D6DA103573DD9389B0CB9B619EC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Size 465KB
SHA256 bdd2402f9a0bae159c60aaab58f159a4b284ce36450056307f7aa91c2d6f1774
MD5 ddd6b69c438f5a6cd32d307d27791b28
SHA1 552e2e8620e2892aefa2bbd17ed486b3ea87a494
SHA512 93ea8f30d995608e17c5ba1e51ff16770e8c778e5f31b1f54b901e401ea302299de59525a2024574a38d36ea7d72beab9f50aad3001998a2a49eb373803be411
SSDEEP 12288:hZz2LHbVTmIhkflR6Vatp7qfEH1/IGtOj:hcjbVTvdOO1
TLSH
T146A4F168EE27C8B732244EBE3A30255E199C00D4D6DA503573DD938DB0CB9B619EC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
Size 1KB
SHA256 467b7109b9beaed58169dcbc01a908b2b7b6afaa98159f2a45952cb8632ad562
MD5 a78a01a9aebf4193f3d3686c9af1a5b1
SHA1 89b21fd1f6606deef1bd88ad72fcea7fb7fb2112
SHA512 7c2825b41e3d7138e30ca5daac01b1c91eb98769fcb4d032a5e2985480c156f5f337f237471a0a1401cf342f905bc455576a07de55a9598e6bfdcda9441700de
TLSH
T156314F82746EC8A1BD23CDC032E919ABC191A94CC4A1C09A2BC96F0C95C7E592DEE225
MD5 SHA1 SHA512 TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
Size 3KB
SHA256 62cd026351c9c2c6c40bba808e565399e7b1f467f3a1d1abae584fd71813557b
MD5 8356e8073805f47041323cb84630b2ce
SHA1 42a35ef91ba29fd8cc765abfddb9713c5251d717
SHA512 fae0d93b2556a8f0d7eb3a9af8ae2a10fc7a43212ad5d27215529c1e2ef921acfbd477c96c5407c80afe936895edb36c027cc72465305c89614e8830facea143
TLSH
T101615583705EC871AD23C9C032F518ABD2A1794DC4E1819A2BC97F1C64CAE993DED129
MD5 SHA1 SHA512 TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
Size 3KB
SHA256 09ddd19b83454e1979481221c293eb161adce8295cb32077da4087ccb5014581
MD5 a6927afd1a5ae162293e9dc7b18305e0
SHA1 b4d2c64f614db455536006ed267a7f36ab29fe36
SHA512 8faa3649f20047e79f89309031a935f49a48ec975029fe8ffbcc231061a0c419187b7e46679ace3611d21a734e3af939ca3ff87c2e2ef86c9863533f8824db91
TLSH
T136814343706EC875AD33C9C032F619BBC2A1794DC4E1819A2BC87F1C95CA99A3CED128
MD5 SHA1 SHA512 TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
Size 5KB
SHA256 0bb5711c79022412f3b07a627b502e64256d296d74ce428491dccad9ab4d0027
MD5 2aed202232f72d1f44c803eabc61e38c
SHA1 a3ddfa451624b29cd8723f24704541048ca0734c
SHA512 1106de110b16d74f56c425ae5bade941003b07c7819be8769580e90ca8819b3bdc062a97a9b82c9509cfbd2edcb20bf7a7f527c078ede95a600a5b16d0423dc8
SSDEEP 48:Y3jyUF0IhaFJt5mAKKkSbvIdYi5vyFAK5H19ZH1Av2RYEX5TiKkv1bvIdYTTR54Z:OFBR8V9ZVpRYffeH
TLSH
T133B15383705EC875AD37C9C032F6187BD2A17949C5E4819A2BC87F1C64CAD9A28ED128
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
Size 547KB
SHA256 3d86e885e2bac95a09fd4272db3f75c6d8842376a144a3b630b201c271262c81
MD5 6303a460dd68d985edc05a273e2039d8
SHA1 2df493f88c80d2db58351852d47e908d736bfc84
SHA512 d9de20ca2d5ef4712310a7218cf9a2a29375413b375269734d9584fb049d24a21454eb45dd7f6d1f465af396b635711fd083080f18d46ca6adbeee8941b9ce3f
SSDEEP 12288:o2IXOIoL96HKcj9C8aTZppPNSTsbYK25/iE9zE4fzV4sU7p:BzLgd9C8+nTSwsVD9IGFy
TLSH
T1E1C4F1C540445FE89F9CD61D40F93D0E83E046AD0D59290EEF523D6ADFCF9086EAA29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 e2296af5b14bb4068234c579833cd9016326de8aecbda32e526bb7ded842f319
MD5 1a5ec4f60f4a512bed16cfb673f7650f
SHA1 16020af54768434458824082075d13c8a288329d
SHA512 774636cd03ec03d8b3be27d5eb51c5e4fc5cb9e905d84408c86576cf55277fc5c6985471adb6f875c161ccfd1d4e74fc31722183319113397ff2837cf13dcf85
MD5 SHA1 SHA512

Submit Download

chrome_100_percent.pak

Path C:\Program Files\Google\Chrome\Application\151.0.7922.109\chrome_100_percent.pak
Size 1.1MB
SHA256 70917c2a75a009589e4f7158eb84497a8ce47c9d7c596dc73a9ef28fdb4bd279
MD5 3185050b3052abd096a4d567a210c8f6
SHA1 3eb1d80327ecc1c36cd02b1727f50f7b1f3b7363
SHA512 c6430d57d5ecb37d836b024373a20236605511e52c9c887e9dcc922e73adce6488d461ac52e2a47249ee3806b15ce81db0524cdb9787513926f9c51849976916
SSDEEP 24576:03VBXMgU696am0VK7vjzEEmPLM9bTe+gnofxIbBopeVGQ/:03VdM4YasLjuPQ9uwpItoEVGQ/
TLSH
T18E4523D773749C3DEE5A06B7825605B0FCBB197D0B52010E5B9AF8766817B8898CA3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Program Files\Google\Chrome\Application\151.0.7922.109\chrome_200_percent.pak
Size 2.0MB
SHA256 bbccb945524ab8e760f9799ce245cd3dc1b2d5149ac90005082a44e27cfa38e1
MD5 df7f615845a83293d3f3072d8b405b99
SHA1 9b750a4a2f081a492929fe12b666af2078141dc7
SHA512 dd95d80e8bcae2b3b92ab9b5f9b85b3a9bc16eb37c59ab72b36a0915d6b59179d1d6f7c12831fe978a614e8f24bf70e1d052e80ccdad45de0712fa08fb0a34b7
SSDEEP 49152:63VsJ7H8a5LqsZmNbkFRJmQj8khQRnoce8uSXAfD+hIGQi:n2qLqikTcJhQq7SXA6Ifi
TLSH
T14DA523C7E3709C7EDD170A77868701F1FD7A006B1662111F4E61BA3A2925EC8D9CAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Program Files\Google\Chrome\Application\151.0.7922.109\chrome_elf.dll
Size 2.6MB
SHA256 8806d65591ea167238abeec95836fcd7684bca17b01b084ee34ec51249831085
MD5 b8cf37b8e432bc54970efaf7b04b1239
SHA1 b1f6c4dcc954e33e6f7e3ebace89a33b293ee023
SHA512 ba61470b1fad439049f26d767bcbc85fb3ce2eb11573ab09df897a93ea97844b0fc0cf89a7341ecda9643936a403a820fde77d314b54430cd72ecaf558a3c67d
SSDEEP 49152:ng3RLj/UXAtPB2+P0oTqglZCO51qgdRtkngZ4n0h5jM:Chdtp2+PF0Ovtf4iW
TLSH
T196C57B13F2DA01E8C05DD1788B5B9232EA61BC454B35B6DF0A90B6562F7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\151.0.7922.109\elevation_service.exe
Size 3.7MB
SHA256 f52c89a0c947f9cbeaedb791465b9aece866f882ff473f1f42bcc6b232e3e011
MD5 8fdd256a0f49dd35685ab1c8f5ff617d
SHA1 5f5dcd844b5d141eb5c5f58471033f8d2ee9831d
SHA512 a24d62561f54fb8b579a1ade06521216a354784e4d0ded6ed981f9836dab317f8df8ab6ca329e8197422300efcb963286d136c69df89c9a898f109996123f53d
SSDEEP 49152:Pg68nSLAVJNZTQVKSdBKcJKx0YahvYd4/uzLNdDDScyi6gVipEVaqFY/Ol1SP:D0ZTCBBK5J4iFy60aYP
TLSH
T1F0067C13F1DA01D8C05AD1B98B4A9633FA61BC494B25B6DF0B9076122B7AFE09F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files\Google\Chrome\Application\151.0.7922.109\icudtl.dat
Size 10.4MB
SHA256 9f48c7f9c7c94d516a14870707e910ab94d75ae640ff6842c4af53276cd26ebe
MD5 c9d17441b2314fe514cd8cb951577c1c
SHA1 15cae4dee805f3e04171e00781da13fe40036439
SHA512 836d4f4fa591ee059dbfb943c2f13ded58a0f5048b5505214ec7105d0963106e0078aa262090d0dac9cca80995c7961a900ffa7a2af8ff315aabad1313bd37a4
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89j:1/cBhORok2HiXUxO/RJk3IWhlYntjdOj
TLSH
T1A9B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libLiteRtWebGpuAccelerator.dll

Path C:\Program Files\Google\Chrome\Application\151.0.7922.109\libLiteRtWebGpuAccelerator.dll
Size 15.6MB
SHA256 c195d08e5c075524a086bfaaa43f03f71a188d451e9ace313c7e455dc3806509
MD5 78e4abf01f27c463d643dc2cc4c890a2
SHA1 63add408d7f066aff091b0b7b82e12c07a425671
SHA512 840f50208fc84ff18aaab93eaf98fe520ed9b29309843badaf3665fa8dad7260ab006846eae4af9aa47673b4ee9f1d17bf6d432113a9cf9a845b87ed1a9460a9
SSDEEP 196608:r9Ga03zWLdqohmByljI+8RyiMPFT2BVd3gx1PL:7qqmByljI+8RyiMPFCBVdCPL
TLSH
T138F64A13F2A641D8C05DC1B9475A9233BA61BC894734BADF0B85BB112EB5FE0AB3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Program Files\Google\Chrome\Application\151.0.7922.109\locales\en-US.pak
Size 512KB
SHA256 cf65f3bb35f9fe2f37288a041fe1d6b4312d707c2cd7a2460334205e831be1df
MD5 eb803c98be57e9361a636ab043e95371
SHA1 ff1aaedc2b30f0baed79c8cd255ec991b4dbac02
SHA512 3a7ea8c151e9c510b08da67b399ad9344d3a6c32aa09bd25d814297877c5902dc1b04226e80ff9f9605d7b18286364e5cf46bc75cc2c4ef669710fa00852cb11
SSDEEP 6144:Sh4DmiKiH3ixJqGbNn36DTp6Mf9KWFqHfaYMi1gqN/kjwE:TKbiSxJqGMMWFqGwE
TLSH
T125B43C1FF344122A05A352A27F09A5A2FF36D06DA35112563CBD812C33B7767827B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Program Files\Google\Chrome\Application\151.0.7922.109\resources.pak
Size 21.7MB
SHA256 bb1e44fbe1081d9c571cb40d11979cd85daab48d26a112c0f5914eb53781893d
MD5 4e61ea1b2362ed04582bed31d668976b
SHA1 7a5b352ba014f6680005ff71a2536a8ca6935b0e
SHA512 c45867d68bf71d032e24197880fd87343e5eb44f83f5f47e0a4ef026212715c8c4a188a6b5ed1fc514a67c2913c25eca9aaa32fcfd88574c9fed3ac919c70a40
SSDEEP 393216:uWZaZLZelLgg9mno8sbq1oRxc8KG2T0vW/MjUCFab4HxxvkrBnlLEqdl4:uWsIgg3/KdMzjUwab4HnkBnlLEqn4
TLSH
T10737126AB300523BCFA34376545BA23B7335804E3F479367205AE36D1C5BBE89E6894D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.9MB
SHA256 b24f7c774a5485e65dae2c88eb0014c3482795bf8a8a37fc6a637b40d23cbc13
MD5 2924ff2a4c2b7f7605739766c470915c
SHA1 af0ed9c17000e30332717038c947e9033563e768
SHA512 fa76bac0538feb473b7a004ae3589a7b9b424e82eabde0aa7a2c04934d2d5b9ba083b3342aa924f2f0179d35c8ad2f619836eef1f5cac1015f34e8af0ed2b531
SSDEEP 49152:lYmsWILH+pCzPBC/ZRVXqGxG0V0wuGQ8vGaWMrx4mZXL3cj9FTvkXLcPTY6Y5A0:lYmbuHDs/JXmNCjeQZZ
TLSH
T117168D13F2D951D9C019C179875B9233EA62BC554B31B6DF0A907A122FB6FE06B3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_MASCULINE.pak

Path C:\Program Files\Google\Chrome\Temp\source5836_1251812016\Chrome-bin\151.0.7922.109\Locales\am_MASCULINE.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 33KB
SHA256 ef5975258f733f45fc4e54dd255b76bc2d083ca5be0a39947a80c4681c82b7ab
MD5 c1b819c558d542c896b299a3913976a0
SHA1 5b2df9fbfecf7b7a7624dd04b3cf0f35c7234592
SHA512 0e0b6554800783d7877892e2c4e911b664a54cb3923e5286433db94af93507035966a550a227debeb4b12b5327718d3f414532e565398c33c92a0876d96cadf4
SSDEEP 768:1DHfdxMppC6ny6voaaualcrr7rr73UQRJ9pxFK7PF:fM9pxFo
TLSH
T1F6F222656F0290AF3F40EE6A370331196EFA5281E3D546F63B9E6045F1DEC66009F1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a7ebf7ff7e0cfa793938a614c6db114a3db34760b15cd204d7fdce95adcf9fd5
MD5 484ac8595065d119fa875095a8e894dd
SHA1 2c872aa7242325ca82cadf7245d4d882451a0059
SHA512 b1d6d0bdec733e8c76897ce44cc5d3c4b91de78822479e91f578238f0550a3b00265b303e7c1617ea818340fa527a5bb46dceb0ede5284392105af486c18a4be
TLSH
T112E022AEC9A2EC3708FD171DA0500745EB5453073A8088AB3A3C89198FB523F439AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d3021731b61f27e307b2fe7ca57493add1bd0db51b1b0f50ce4d74b79487f721
MD5 cda431b430124835a0c066a94be57f8e
SHA1 ab690b878db8e7c6259890bcd7ed2c867f918957
SHA512 9d30a758f326e3a272c88f9dd1995b2596ec2d78a33cd1f3cc0a10cafcca709933d0664a5ca4fd87fc9aabae507ae8c49fa220b33798e3d79fb13b0c7af30616
TLSH
T160A00255A6C40491CF5116B418575551373C8E7C72519317D1E449948C636F14607047
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f87f7b3a71f2616b7f4e56edc5e06c868992008e0118b5c501cb4bd1ace49877
MD5 cd4fe77fe7f32fee25f04a45c4721cca
SHA1 dad926d379e0a8597248665c3e24e9f7648dfd39
SHA512 3024e0acf0d58488f0c53ab204a0069d7d0e9486925f7018c4d574d85d378a1c01c89e6dcc517601b8cb3df7b0cfda7c10dd5dd8b18ca308a2ee647501e3da69
SSDEEP 192:6RryOXchJR3mv7DhdSY692Hc36+WNOsgAPGifPO2ceUuesKqkCyIsn9agw+:6RGOYCXhd+Qk0NTfW2uuVid
TLSH
T18362E72EE920A97B6CDBD219FD653B53D7F5002121E12EC0D6FC992C16EB6CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 24KB
SHA256 90f594ad05eb84e4574b1d1dd005ae3528c015d76eafecbe9c030380c8143900
MD5 6319a9efdfe81a607943886d36726915
SHA1 eed0c38d96fb5c777e5233aac8bbd48dca97428a
SHA512 589c8772a08df5e4e9d4e61daeab96b5777683ff726afe6e588ba019467e3bf1285d13afb6a038da423d728567a1f95503f47d336ed8c1bbec76ab536bf2e873
SSDEEP 768:+0C9J7KxkXqKf/pUZNCgVLH2HfgsnK67pLuLu697pLuL/rVONi+ErUtZtGgKEPcG:+rUSEuGEDIi+NtmfE0G
TLSH
T10BB2E9B7AC4C8E770F94D5CCED2BBA0FEDB9024B55DAC8A542FA582503C1ACB11151EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

286cdf45-902a-4897-bfee-dd349b1004d4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\286cdf45-902a-4897-bfee-dd349b1004d4.tmp
Size 96B
SHA256 40df777a6ad9472d06ff5702fb07fd10b04ed56d6f03a64e931351b58e74c0fa
MD5 547e603cbb2fc6acf12a4e32bb7ca5c2
SHA1 32f51b6870b35c367f336131d6a996c6dd8dbac4
SHA512 ec867b5db62f988d45d6b930ddc14f487d6e6307ad1674a910d3b5a57797684803824dc5e1b84bf8600f5bcd2b15fd435ce43a95926721264a22c3044d5d471a
TLSH
T1ADB022A8C3232283C00202B0B203828C3000CE008302222383F8B0FFCB320E2023B000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d3222c1c3f28442081897e3ac6b64b09d8bad80d93b2d3155f188e8a36f533c8
MD5 02f7d5e3fdfa4cc2303f0f094ea697b9
SHA1 e717c36b12c62f9953b255b996254d307001062b
SHA512 ca7ff58e1676979e3fec795a27e28f6f76d0d7c9606a92c2c7da9e2c8a056aab49e33756d810aeb6a04c7fdf899b4c12f5598c6c1fd0714b39f87180f75409cb
TLSH
T1B1B0124399C01604C83543B569D2808833185460062D23864AA594FA543B480430B253
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4116_1200102582\Icons\128.png
Size 8KB
SHA256 c4d6a0f6c263a4d611fd6ec65643b9844f6eb0c1c9c0ec64b2fa9fcaad149170
MD5 442e70a4876f0efb53ca6a8a38fdf617
SHA1 9dbf81b1c1b9c1eeaccc829cdd1b5d36eb2b4fd0
SHA512 ea5802c44aa5cf64d93c99a342859919471ec4374ff4e1c9557e3f6d1702a8c9018d868dded4c0e48a3fa03f2506866d99701359247ed854d284461a58fd6383
SSDEEP 192:92WSdyiZeVVhKoiUCE3HbYl34FRr28dQ3aPHfjTZV/an:Ived+0HiojrxaqPbTZJan
TLSH
T1B502AF6EF47720FBD0CB4BB7F4135B604B5C0F5A8A6517C190788BAD20276A7435FA98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4116_681343891\Trusted Icons\Icons\192.png
Size 6KB
SHA256 b76aa025f0516496f80008232c3f1e9584cd74090ac50c0d67c89d619595e58d
MD5 3b9fd7fa846b9d9a5cdee0a5b975ca20
SHA1 591e75e94469a79a19b997642d66b84963c9c1c1
SHA512 d3edbb2fee9ef181a119b4a3be396a00a2efa7769542326b3de10ac60ca36b9ae71e1d88e2419428f06877163629331b39330b06d074a3c9b28bf51710c333fe
SSDEEP 192:sOEKQaGefBPWkJLCVgCJ2AxJxoIM0Ue/Kbh9:RZGefBPWkJ2hJ2kCTzh9
TLSH
T108D19FD16A20D5611AD4A4D5281EACBF8A35D348DBD5C74D4EF4D23CC68EACE237DE10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4116_681343891\Trusted Icons\Icons\256.png
Size 22KB
SHA256 b989f789c07c6d8f103d42c1adbd90a2152e54ac006a4db4956be29e5b292e94
MD5 c1e5541bb448e13f31774db3cd8bace9
SHA1 4147cc5b68dc69ceef6af6525befef6bbcc12df0
SHA512 b211a2b69becebc78f3b45721a0f7c1ad9ed5b14724554d815fe78fa775d543b7993a68c6100df1ee46e9f50a8538b7c79d9b2cbc65fde2ecd69cbd6ac2191f0
SSDEEP 384:LnFIgXhQKgVNbIfLmcFbyL2zBBVFc7j140WC3KQ83ZNPc60hA2wln/9/JIr8yL:K61gjbItFmL2U7j1405m3UHW2UF8
TLSH
T163A2E1DEBB1E02F0E3E2D0661624E134BDE5436EC98617829824B3997BD16CF44F6873
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4116_681343891\Trusted Icons\Icons\32.png
Size 1KB
SHA256 d036530ce6b5320532f359ee4b96e5b2338f78640e91bcab10e7f2e637574240
MD5 1b7822ea3fade00be4ebb7fa00229685
SHA1 e1befd4a70806fb35cc15c49628fcf85959d5cbd
SHA512 cff1207942b3659e4eb844c3f00fdb2dfb0fd8044d25fe34366dce207b82e8408ba88208e9f0f7bf9b507a321b4623aec27c5d1a5bbb317f535859d49b151335
TLSH
T1CC31085BA5303BB4D8CA7AED9A3488282C90C94DCE1D14E5982964A1230EFB2445E38A
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4116_681343891\Trusted Icons\Icons\48.png
Size 2KB
SHA256 04ab9b9bb94719dffe4487c44a9b5d2386b56e5d34f4b26e0c6c9c0505d78f22
MD5 1aa8c008ec6fbf48b81eae8ac95bc127
SHA1 6e2db63fb1a95df7d28086409deaea0870e7c63a
SHA512 b74780ba21a4675afe67cd7c0d1fd6060e16eda99f943c46df1cefdad6b4414aa5caa2126c3d882fb05718bb3d6a7802c9bc7812c8c271dfddaf66bf7f7f68be
TLSH
T173514ADBB7A4147081E70A7972740F369C8484CE684C7928EA4397C2AFB354AB3C586F
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4116_681343891\Trusted Icons\Icons\64.png
Size 3KB
SHA256 09a66a69d37f7e99b104f442f878fd72e8fb3637eefba61987aaaa7a2a1cb185
MD5 77c1d493fe1e7d70cd12e5cf38c13ab6
SHA1 3c61f4b935227229f3e58b20306ca3571b927299
SHA512 5e497daf5600770e4a68883f66ac699f0a1796dcb1567d3271d3eb6364e479d2a8ff0f7df1a723b2899694faafc7bdbf578745c83cc91084bd32cdba47243af5
TLSH
T18C814DC555C58847E14715798674C5FAC758C63BB22EBBE0CCC69C7F140276AF20AB87
MD5 SHA1 SHA512 TLSH

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4116_681343891\Trusted Icons\Icons\96.png
Size 6KB
SHA256 2561ac539473f6175a4387169cdf3237a7ac46dfa7de354b60d8f2c03e081e74
MD5 75760ee744059b7640d25f2344902257
SHA1 dd87b3bdb62bf9137c64916bc2d46d7e2235f4f3
SHA512 fbb1e172270938bb2f123e918eac0176857b455bd99ad83f84388fa0069b20dfa7939a62c722f3cfc43265e90ccf661e0019dfea42746c9f0a470d4e17222416
SSDEEP 192:YQAETt5KnXxV+WDDbMh7vDlWzrdFcKKqmb6fMzOVuiBJ:Y5ETt5uxV/D8NIDcKKv6fMzOVu8
TLSH
T1D7D19F4A05083805E3ACB1A70DD9F39267245C103D2A92DB9733208BA8D155A3F7E3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trusted_vault.pb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
Size 84B
SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
MD5 85d7a7c1e12b26cd994cd41e587629d6
SHA1 bf53173aa4b19a217eb542951dbafe3ec3506810
SHA512 b3562e0466d9e218e96be44a01feac567e2843f61d1fe5201a5c7d6eef0e714cb5d7d8aa380dbe4f341aca2c46e615f3bfd29621a4898cb8e027cf1155b8df83
TLSH
T115A0128266008642461DB130C80B4C4018311C5A0B34400111F36EA362D5900C541440
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9db152dd09f21b8418f8933da8ead626c8ede55f5b9ede74d1f24888cd6982f4
MD5 329fb49948eb466757302ade297e0488
SHA1 3c47d0a7928da079b44d2fde4109611be4855a8a
SHA512 3c16d5c2efc9fcef6fc86bb89eb09d4b00c5c49083ad6f193acd9cdde498163a193b4465ca36c875044217212cada478dd3bbc75d70e652c05bae60eba0da491
SSDEEP 3072:BGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMA:Qm7Rkm1tYpBeh2BAoA
TLSH
T17CC312275E71A9365D79B74EB48E0B1F1EF24AA7C930DE92C8D86B0437E97CC0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 66KB
SHA256 2f43097a02ea710013f59ab5b18d2bad34d1335ef2339466453a3b35c0de61d0
MD5 5c623bb60609f261485aad3ee63c773a
SHA1 857a9403f08dd5dc2916e6180daad384a8abd372
SHA512 7929b3c9fbce176bba6783b4ea3ff9e0cf36e32e3a938f2a1141641711aee6082f7a53c65a6785172bc98c44e2746e2a90de6cf5d998c3959cb9e622771d55a1
SSDEEP 768:+Smz1mhwJpr/8qiDYTkW2/9GDfsYhgLiCIe15v/ayEkI7ihB51cJYTc2cBDASu8z:Xc0m8qiDJCQhjvgkIuhB51z4DWr4Jz
TLSH
T156630296FCB5AC56C3F981BABD2C527F1BD5829E440470F4AB8C134C80E95C98B67FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\metadata.json
Size 124B
SHA256 da5df9479545a675710206bcc1cbeb92c7bbf7ea418368a553061fa261c57c37
MD5 8fb8442361b98b8a4f1f6f1e57899cb6
SHA1 78380cadda8c30447986e930c9487e68b9f207fc
SHA512 937dc6419b09979eb227cd4fe9467bc8aaddadf0cba7b95595b816f958d6c74ee30035c2f8728d58893b08c9399eb10c3e3ae8651af93e784f9a01f1a1d08413
TLSH
T18BB02B85C70E0D950E35143C48520B1B27415E0030508434455A450841301CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download