Overview

overview

6

Static

static

1

ChromeSetup.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    180s
  • max time network
    179s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/08/2026, 17:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ChromeSetup.exe
  • Size 11.8MB
  • Sample260814-v5cdcafj7x
  • SHA256 f3afb6621a3ec2c73a71e44b3a12a88b6fb2b9edea53732a25710b69653f9e03
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in System32 directory 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 25 IoCs
  • Executes dropped EXE 59 IoCs
  • Loads dropped DLL 58 IoCs
  • Checks whether UAC is enabled 1 TTPs 12 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Windows\SystemTemp\Google2100_1665512426\bin\updater.exe
      "C:\Windows\SystemTemp\Google2100_1665512426\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={E5570C36-7443-1626-10E8-46C8C53DCBCC}&lang=en&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=-arch_x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5324
      • C:\Windows\SystemTemp\Google2100_1665512426\bin\updater.exe
        C:\Windows\SystemTemp\Google2100_1665512426\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2bc,0x2c0,0x2c4,0x2b8,0x2c8,0xbc1e40,0xbc1e4c,0xbc1e58
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4484
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2060
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.138 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff963d6d9c0,0x7ff963d6d9d0,0x7ff963d6d9e0
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4960
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1576,i,6915115813315236293,17141471342458371234,262144 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1904 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1068
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,13058588524519433085,16488936150600187503,524288 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1988 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Time Discovery
          PID:4756
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,13839883123772559567,16092194899425338570,524288 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2568 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2580
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --top-chrome-webui --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2844,i,6598280922825612284,2004254145022161427,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3044 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4624
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3616,i,8726564336308907717,16345736822371730709,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3652 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5560
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3596,i,9639137045166838015,8485487158821030026,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3620 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4236
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3912,i,16910045692692774860,5821783340077285449,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3936 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4304
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3968,i,2474710407850710352,14469948762904944939,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3980 /prefetch:9
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5464
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4296,i,12220023880891233309,2127729512239466612,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3984 /prefetch:9
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6032
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3848,i,15114423559208330432,12652184076635359291,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3840 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4752
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4972,i,6434534004931121404,4759621460472451998,524288 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5020 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5716
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,16191196733274800450,9809754832863009395,524288 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5840 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5516
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5888,i,4071777065011888844,12975230248976183162,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5904 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5144
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5932,i,3012269128998307710,5714229430934672371,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5940 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1496
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6292,i,4815073518295841121,10680081285396996768,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5888 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3928
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6332,i,9937037151737990747,6707288300350976740,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6160 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2012
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6344,i,4730303795329913506,3908145843657919989,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6512 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4332
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6504,i,7256407078822443947,2792972309870624645,524288 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6628 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6100
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6648,i,8036095011164967737,7012503206474572657,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6376 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5220
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5232,i,5158279466080879558,5335812490834802528,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6344 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5608
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6164,i,4280889199945740810,9597710911842757462,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6648 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2452
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7400,i,4050963391286952012,16867786368203701711,524288 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7428 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6044
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7456,i,5320475986912666108,2766138468351920146,524288 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=5956 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2464
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6608,i,3632690919210908139,17804132881937214239,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7004 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2800
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6964,i,14283437333896853542,8969814204708947822,2097152 --field-trial-handle=1908,i,798793363048252235,14813842048207696317,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,5437618690651095633,11273182562516386725,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6936 /prefetch:9
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3880
        • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
          "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --wake-all --system
          4⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2304
          • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
            "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xde1e40,0xde1e4c,0xde1e58
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2504
          • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
            "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --wake --system
            5⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5696
            • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
              "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a4,0x2b8,0xde1e40,0xde1e4c,0xde1e58
              6⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3808
  • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
    "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update-internal
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4936
    • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xde1e40,0xde1e4c,0xde1e58
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3724
  • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
    "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update
    1⤵
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:264
    • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xde1e40,0xde1e4c,0xde1e58
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5952
  • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
    "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5216
    • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xde1e40,0xde1e4c,0xde1e58
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1808
    • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=1904
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1488
      • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0xde1e40,0xde1e4c,0xde1e58
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4436
    • C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\151.0.7922.138_chrome_installer_uncompressed.exe
      "C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\151.0.7922.138_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\a2e9fdd5-45ae-4fe4-935e-afaa6d5c3894.tmp"
      2⤵
      • Drops file in Windows directory
      • Executes dropped EXE
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:720
      • C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\CR_38E1D.tmp\setup.exe
        "C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\CR_38E1D.tmp\setup.exe" --uncompressed-archive="C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\CR_38E1D.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\a2e9fdd5-45ae-4fe4-935e-afaa6d5c3894.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • System Network Configuration Discovery: Internet Connection Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\CR_38E1D.tmp\setup.exe
          C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\CR_38E1D.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.138 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff6e36a6708,0x7ff6e36a6718,0x7ff6e36a6728
          4⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          PID:3380
        • C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\CR_38E1D.tmp\setup.exe
          "C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\CR_38E1D.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:2792
          • C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\CR_38E1D.tmp\setup.exe
            C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\CR_38E1D.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.138 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff6e36a6708,0x7ff6e36a6718,0x7ff6e36a6728
            5⤵
            • Drops file in Windows directory
            • Executes dropped EXE
            PID:3312
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4280
    • C:\Program Files\Google\Chrome\Application\151.0.7922.138\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\151.0.7922.138\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2104
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
      1⤵
        PID:1868
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:2280
      • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update
        1⤵
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2924
        • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
          "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x26c,0x2b8,0xde1e40,0xde1e4c,0xde1e58
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2716
        • C:\Program Files\Google\Chrome\Application\151.0.7922.138\os_update_handler.exe
          "C:\Program Files\Google\Chrome\Application\151.0.7922.138\os_update_handler.exe" --channel=stable --force-install --system-level
          2⤵
          • Executes dropped EXE
          PID:4628
        • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
          "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=1964
          2⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5264
          • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
            "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2bc,0x2c0,0x2c4,0x2b8,0x2c8,0xde1e40,0xde1e4c,0xde1e58
            3⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3952
        • C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2924_1912182690\platform_experience_helper.exe
          "C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2924_1912182690\platform_experience_helper.exe" --install
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Drops file in Windows directory
          • Executes dropped EXE
          PID:2424
      • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update
        1⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2684
        • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
          "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xde1e40,0xde1e4c,0xde1e58
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3184
      • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update-internal
        1⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2012
        • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
          "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0xde1e40,0xde1e4c,0xde1e58
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1216
      • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update
        1⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4308
        • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
          "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xde1e40,0xde1e4c,0xde1e58
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5520

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Defense Evasion

            Modify Registry

            1
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            4
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            System Time Discovery

            1
            T1124

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            settings.dat
            • Path C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad\settings.dat
            • Size 40B
            • SHA256 81233f28828178f52c202861b3bc67f91d75762a6c85b832b3bdc8a4b5245a9b
            • MD5 SHA1 SHA512
            Submit Download

            4dcb99d7-ea9a-4eb3-82c4-b96cc96095da.tmp
            • Path C:\Program Files (x86)\Google\GoogleUpdater\4dcb99d7-ea9a-4eb3-82c4-b96cc96095da.tmp
            • Size 827B
            • SHA256 bfe4a6e6d56fe7edf563469fa0615bf8936b12d9dd592943fdb307dd0a3e51f1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
            • Size 248B
            • SHA256 96ddf370cd80bf7457939db110abcb8b087c56272b4a3c4d3f119196b23c4035
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
            • Size 130B
            • SHA256 e63e4a7d887f616480b92f06d689193a77bb19c5e47fad71a0a7f3cb0eee4c4a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 421B
            • SHA256 a9426d171ea9eb62484fb4a975973919281c1863a8047021d425fa826a8f1227
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 607B
            • SHA256 556f9dd4d5fde90589038e25c16724336bbd158209e5cc42015d971fd1865623
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 827B
            • SHA256 0172b3ff524299f8a9d1acde3d6a9842dbc02b201252c49696d40aad3f132dc6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 559B
            • SHA256 99254f19ef1a4e02133a270d741c5080dcf31c9a03e87456b9f34cc0f6be3ac2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 1KB
            • SHA256 05676fae0aa28ab878168926efb8cd4ab31851537249641e64a0a7c2ca0aba97
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 420B
            • SHA256 cf17dd390d5514c8476813f2c5afa436cf1fcc141df2b45c9717b55d5228acc8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 525B
            • SHA256 4b6addd89c84b1f745e185d224859b2526e0b0ec7eec70b87ee46b2a16278846
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 933B
            • SHA256 fc7b86ed5695ba1f136f9a9dae59e53e8c14c1a0af9df73a43daa1bc6ce69c17
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 28KB
            • SHA256 c97116c9a0d0e44888a540992d951d0e8395079b717433f9ff514e3353a3291d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 34KB
            • SHA256 82b2a45e11bd55d9741f0d61a8b6c163dfdb522b84cd9f3dfa9967a54ebbec7c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 37KB
            • SHA256 4a44c6680019bc1813eb8e7df2e4ebd6da512b1e2b1aa774057dc3615fd0f241
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 38KB
            • SHA256 b5b51ff17aeceda50931ebe3802b054e8bcaf1b01b5ed77fdb5a8a5f74dc37fb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 40KB
            • SHA256 6c79d3723b9886b84f700f7cee510331ebd46850ef2b843fdf3cb4f9f23932ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 47KB
            • SHA256 243dcc148d06e8aebd706bf4b8c513df8626fe88753a71e456e210254a0b065c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 47KB
            • SHA256 66b7f15327c0c96db234041dda37302c0be3fc06773ded4dc31290cefd881680
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 474KB
            • SHA256 0fa062d2576442829dba1523d31e27ef24f4fb8829f09511a996ad5e46a9ee75
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 764B
            • SHA256 5fde23f765f5bed5ea12f283ea6764606236cf15bbb03ce258ce1e1e4e31f69e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 2KB
            • SHA256 f4d50e10d360303e2391478c0c65bec5b685a9d9aecba6ee01712246a9098b6d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 3KB
            • SHA256 a16ec3d82e4a3dbacbf1ae4d775b4dc26d7f063bf12b119dbea734d52af8c853
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 3KB
            • SHA256 e80b5e13643db23e7296a14b18a1f61615e963e114d2e768f973dab4d40728c7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 4KB
            • SHA256 d3da2e4e3b72935c117525c8a84ee6c3cf6dbb08801cea3deabd0f9e823474af
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 5KB
            • SHA256 8e9e31b48d824242baf9229b7d959da2827bd186ccc6a653026fcb4a5553475c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 6KB
            • SHA256 3b3ef9c42cfa0c9f294b5052060139b4ec2456322df24113073fb6ca4c3fb087
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 555KB
            • SHA256 3007f356218acf88b2a1f2543c0eeccd5d81909558480b2f28a05c33a3aac6ce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_100_percent.pak
            • Path C:\Program Files\Google\Chrome\Application\151.0.7922.138\chrome_100_percent.pak
            • Size 1.1MB
            • SHA256 247f5abb7c76dfb40622b5df3e9a897b108e3074eb5d31d16ed21a5c6cfb8a9c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_200_percent.pak
            • Path C:\Program Files\Google\Chrome\Application\151.0.7922.138\chrome_200_percent.pak
            • Size 2.0MB
            • SHA256 6d9a5ffab8280570169e7e73283800317839ada6739de0f2753c408f45bee2f2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_elf.dll
            • Path C:\Program Files\Google\Chrome\Application\151.0.7922.138\chrome_elf.dll
            • Size 2.6MB
            • SHA256 b05a0e098d60c48397030569d01452c006550ac0453afd8a301692ed11380961
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icudtl.dat
            • Path C:\Program Files\Google\Chrome\Application\151.0.7922.138\icudtl.dat
            • Size 10.4MB
            • SHA256 9f48c7f9c7c94d516a14870707e910ab94d75ae640ff6842c4af53276cd26ebe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libLiteRtWebGpuAccelerator.dll
            • Path C:\Program Files\Google\Chrome\Application\151.0.7922.138\libLiteRtWebGpuAccelerator.dll
            • Size 15.7MB
            • SHA256 d80bb8cad123f4d23684155061b477dcd553b4d4a4af21c16a83c91021369c13
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-US.pak
            • Path C:\Program Files\Google\Chrome\Application\151.0.7922.138\locales\en-US.pak
            • Size 512KB
            • SHA256 cf65f3bb35f9fe2f37288a041fe1d6b4312d707c2cd7a2460334205e831be1df
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            resources.pak
            • Path C:\Program Files\Google\Chrome\Application\151.0.7922.138\resources.pak
            • Size 21.7MB
            • SHA256 f09a5c3465d0084e99f690db2c3d9b6e719e294bbea9dab7a9338f2b455069c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome.exe
            • Size 3.9MB
            • SHA256 b73b9e817990d5d6e6167e1011dadb4b53f7e37392fc658f1e809df07ea6b2b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            am_MASCULINE.pak
            • Path C:\Program Files\Google\Chrome\Temp\source2840_497379743\Chrome-bin\151.0.7922.138\Locales\am_MASCULINE.pak
            • Size 18B
            • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
            • MD5 SHA1 SHA512
            Submit Download

            BookmarkMergedSurfaceOrdering
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
            • Size 6B
            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
            • MD5 SHA1 SHA512
            Submit Download

            messages.json
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
            • Size 593B
            • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            craw_background.js
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
            • Size 531KB
            • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
            • Size 2KB
            • SHA256 d79424f3f5983ab7b6795720050fead5200eaf93823fabc4b5a8ec594728f43b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
            • Size 517B
            • SHA256 05fef6a84e6b85ef4cb933f07b7f766d0f34e8d22e8bf73b4e4fbb000201593a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
            • Size 13KB
            • SHA256 08223d7c18c5e709439b0628618456ff938080e992f0a976fce11774b0127670
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Secure Preferences
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
            • Size 18KB
            • SHA256 28470e66863a53bc07ff8080f2732b0f4012bc41ee9f3c2a137b79c8cd1d3bb7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
            • Size 96B
            • SHA256 34d00463200184f4651ec397af0f186aa1c139fbe507cf7119948b76e0a02d5d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            c975ed26-4faa-4e18-a4e3-fd12ec0ff62c.tmp
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\c975ed26-4faa-4e18-a4e3-fd12ec0ff62c.tmp
            • Size 48B
            • SHA256 d2a88551ce5d94b665c574198844b33624c8662451fb68d7d888316ec127d0fc
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
            • Size 72B
            • SHA256 aa094a03d252af03f99f90c9bd3a6ab06eec3149c4e7187b6191462f83ce341d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
            • Size 264KB
            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            6a029b31-b438-48ec-b6a2-63c55bb7dfbc.tmp
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\6a029b31-b438-48ec-b6a2-63c55bb7dfbc.tmp
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
            • Size 111B
            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
            • Size 1KB
            • SHA256 efeb751507c77b56963b563705e3d20325805e332988bb3e48cd891e2dd11b3c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
            • Size 2KB
            • SHA256 82fc9e7be1c1dc78bcca8c54db0fcd89e4658d542070b418b1d3f0c82e1a7389
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
            • Size 4KB
            • SHA256 88ee95cc4940438e85c0f103638c8bfc8f326bc25c7223c5f6455657b0fcb128
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
            • Size 1KB
            • SHA256 4ef6af3958daea67637a1034e4ff3910360c34f8d5bba1bd15dcdf7078bc3c77
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
            • Size 2KB
            • SHA256 c9a6445efb6b3ed818d1e703f82f6c0445b49efc69b1480c61cdb2944114f523
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
            • Size 3KB
            • SHA256 e7e71e63123edd2441d670e4f27134615639e695670c3fd8e566706cc2c65654
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
            • Size 1KB
            • SHA256 0eb5b575bc5ad0f0fe9e7747e7c8844397113e460ecb454780192355773d7265
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
            • Size 2KB
            • SHA256 b44887b22da066690f192fcf504c99a16f17588777de201db29ce0708149aba0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
            • Size 2KB
            • SHA256 5bffe545e04d375416d4d974bf8fc6ec77d09963c16ce8eb4311e89f0c6b3815
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            128.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2060_1532976536\Trusted Icons\Icons\128.png
            • Size 7KB
            • SHA256 f347cab07bc35efee9af2cd12d1759679c95ed4301ef9b26f63a3c3ca01b81a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            192.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2060_1532976536\Trusted Icons\Icons\192.png
            • Size 8KB
            • SHA256 a40d5f045ad67b296abb8c3aedebad36d11de19c27ab991e0e27ec8cd5e09e18
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            256.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2060_1532976536\Trusted Icons\Icons\256.png
            • Size 21KB
            • SHA256 f6a845fa0308781327f9f9f3f1d657a64348b50ed7c8613e69d76d7d2f8b8adc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2060_1532976536\Trusted Icons\Icons\32.png
            • Size 1KB
            • SHA256 61df75b6fe5027556482806e295bdb5d7720a51771bdcc1b377b70829b40f22c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2060_1532976536\Trusted Icons\Icons\48.png
            • Size 2KB
            • SHA256 a515ad281e595a9f3e1967a07b2bdf613f651cba1b048fa55e7ba86af0394f7a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2060_1532976536\Trusted Icons\Icons\64.png
            • Size 2KB
            • SHA256 42afb31349eebbfaa6289cf8a5c65288fb7b4cdff5cb99823e7f93a992629a3b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            96.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2060_1532976536\Trusted Icons\Icons\96.png
            • Size 5KB
            • SHA256 e1ea1bd9d66f0f7b550a43af33073cc80a270d2ec0cad510ccecb64e50d9c0ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            trusted_vault.pb
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
            • Size 84B
            • SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
            • Size 69KB
            • SHA256 a96219520d5a8e6d3c51f1da90f9fb040517bf86fefc968ac5ecd207fb929da7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
            • Size 69KB
            • SHA256 a70e63e3c197e629d38fc67bab4971d884bd848ccb3f1a78cbb6ba5db13e242b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
            • Size 69KB
            • SHA256 61b55720088f03a10fab078380cc384c9c06fa1928e2c0888c0e4bd36d1e64d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
            • Size 4KB
            • SHA256 f06ca5c1306e9af4839131114a53ed9dee89a450ad4dc1210a31f482ba2b78d8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            messages.json
            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_1669262176\CRX_INSTALL\_locales\en\messages.json
            • Size 450B
            • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            settings.dat
            • Path C:\Windows\SystemTemp\Crashpad\settings.dat
            • Size 40B
            • SHA256 8c8f023e8571238b5da916d457275e7bb34ac064caf5cc52ddeee584144a8aa9
            • MD5 SHA1 SHA512
            Submit Download

            uninstall.cmd
            • Path C:\Windows\SystemTemp\Google2100_1665512426\bin\uninstall.cmd
            • Size 653B
            • SHA256 a38e49c0e87a9dd81682346392d45c965783c25d5ec6aaa373cb9799c2a602e2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater.exe
            • Path C:\Windows\SystemTemp\Google2100_1665512426\bin\updater.exe
            • Size 7.1MB
            • SHA256 c74ba01a8c2884b991f072b8990dfb9dea27ac7e6af63c075e077bf0a9f1b18e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\CR_38E1D.tmp\setup.exe
            • Size 7.3MB
            • SHA256 e1cd16ebde8f0a229d4f6aef3c86cc221853aa82860e0badcbb3268bacb8ff76
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            a2e9fdd5-45ae-4fe4-935e-afaa6d5c3894.tmp
            • Path C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5216_1144055889\a2e9fdd5-45ae-4fe4-935e-afaa6d5c3894.tmp
            • Size 398KB
            • SHA256 d2442276146c8c45311cd7b107de7454b92e4752a5548532d5017ca994fc66c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_installer.log
            • Path C:\Windows\SystemTemp\chrome_installer.log
            • Size 31KB
            • SHA256 21bdc74b59906dcda72549296c56ec8b875c80e849bcdc5ebcf7f40325603029
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download