Overview

overview

8

Static

static

3

2026-08-16...er.exe

windows10-2004-x64

8

2026-08-16...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 04:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_528448b6823e991a0e2598eb09334bdb_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
  • Size 2.5MB
  • Sample260816-e8jc3azdlb
  • SHA256 3df52350ba69533a855a91b24bf7c9f80b25a8f2a41a51a9914b2bc7da363547
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 57 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_528448b6823e991a0e2598eb09334bdb_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_528448b6823e991a0e2598eb09334bdb_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Users\Admin\AppData\Local\Temp\original_temp.exe
      "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5964
      • C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={A23B17A4-B924-BF30-9E36-92AE83D2253D}&lang=de&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=ONGR&installdataindex=empty"
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3004
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3756
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:5752
          • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:4480
          • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:3028
          • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:1808
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Q0FDRkM2RTYtNjI0NS00MkJCLTk3NjAtODFGMjdGQjYyOTc5fSIgdXNlcmlkPSJ7MEI4Qjc3NzItRkU4NS00QzFDLUJBMjUtQzE0NkVDQUI5MUJGfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezQzNjE3QzUzLTg5NTItNEI3Qi04MzlGLTAxODhCQjczNTQ4Rn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjE0MS4wLjczNDAuMCIgbmV4dHZlcnNpb249IjEuMy4zNi4xNTIiIGxhbmc9ImRlIiBicmFuZD0iT05HUiIgY2xpZW50PSIiIGlpZD0ie0EyM0IxN0E0LUI5MjQtQkYzMC05RTM2LTkyQUU4M0QyMjUzRH0iPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTI1MSIvPjwvYXBwPjwvcmVxdWVzdD4
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:5156
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={A23B17A4-B924-BF30-9E36-92AE83D2253D}&lang=de&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=ONGR&installdataindex=empty" /installsource taggedmi /sessionid "{CACFC6E6-6245-42BB-9760-81F27FB62979}"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:240
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\Program Files (x86)\Google\Update\Install\{72560B5B-34EB-4D80-90B6-C8A3D95970D4}\151.0.7922.138_chrome_installer_uncompressed.exe
      "C:\Program Files (x86)\Google\Update\Install\{72560B5B-34EB-4D80-90B6-C8A3D95970D4}\151.0.7922.138_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{72560B5B-34EB-4D80-90B6-C8A3D95970D4}\guiCD73.tmp"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4064
      • C:\Program Files (x86)\Google\Update\Install\{72560B5B-34EB-4D80-90B6-C8A3D95970D4}\CR_AA79E.tmp\setup.exe
        "C:\Program Files (x86)\Google\Update\Install\{72560B5B-34EB-4D80-90B6-C8A3D95970D4}\CR_AA79E.tmp\setup.exe" --uncompressed-archive="C:\Program Files (x86)\Google\Update\Install\{72560B5B-34EB-4D80-90B6-C8A3D95970D4}\CR_AA79E.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{72560B5B-34EB-4D80-90B6-C8A3D95970D4}\guiCD73.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3068
        • C:\Program Files (x86)\Google\Update\Install\{72560B5B-34EB-4D80-90B6-C8A3D95970D4}\CR_AA79E.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{72560B5B-34EB-4D80-90B6-C8A3D95970D4}\CR_AA79E.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.138 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff65f786708,0x7ff65f786718,0x7ff65f786728
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:4680
        • C:\Program Files (x86)\Google\Update\Install\{72560B5B-34EB-4D80-90B6-C8A3D95970D4}\CR_AA79E.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{72560B5B-34EB-4D80-90B6-C8A3D95970D4}\CR_AA79E.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4952
          • C:\Program Files (x86)\Google\Update\Install\{72560B5B-34EB-4D80-90B6-C8A3D95970D4}\CR_AA79E.tmp\setup.exe
            "C:\Program Files (x86)\Google\Update\Install\{72560B5B-34EB-4D80-90B6-C8A3D95970D4}\CR_AA79E.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.138 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff65f786708,0x7ff65f786718,0x7ff65f786728
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:3308
    • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleCrashHandler.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleCrashHandler.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4456
    • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleCrashHandler64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleCrashHandler64.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4480
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Q0FDRkM2RTYtNjI0NS00MkJCLTk3NjAtODFGMjdGQjYyOTc5fSIgdXNlcmlkPSJ7MEI4Qjc3NzItRkU4NS00QzFDLUJBMjUtQzE0NkVDQUI5MUJGfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezZGQUE1NzMyLUNEOTktNDY0Ny1BNDVELTI0OTlGOUExQTk1RX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzQy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjE1MS4wLjc5MjIuMTM4IiBhcD0ieDY0LXN0YWJsZS1zdGF0c2RlZl8xIiBsYW5nPSJkZSIgYnJhbmQ9Ik9OR1IiIGNsaWVudD0iIiBpaWQ9IntBMjNCMTdBNC1COTI0LUJGMzAtOUUzNi05MkFFODNEMjI1M0R9IiBjb2hvcnQ9IjE6Z3UvaTE5OiIgY29ob3J0bmFtZT0iU3RhYmxlIEluc3RhbGxzICZhbXA7IFZlcnNpb24gUGlucyI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9lZGdlZGwubWUuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL2Nocm9tZS9hY3Niam5sb2tjMnl0NTM3d3Jna21haXRiNTVhXzE1MS4wLjc5MjIuMTM4LzE1MS4wLjc5MjIuMTM4X2Nocm9tZV9pbnN0YWxsZXJfdW5jb21wcmVzc2VkLmV4ZSIgZG93bmxvYWRlZD0iNTEyOTY3NTkyIiB0b3RhbD0iNTEyOTY3NTkyIiBkb3dubG9hZF90aW1lX21zPSI0Mjk1NCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzk5IiBkb3dubG9hZF90aW1lX21zPSI0ODA5NCIgZG93bmxvYWRlZD0iNTEyOTY3NTkyIiB0b3RhbD0iNTEyOTY3NTkyIiBpbnN0YWxsX3RpbWVfbXM9IjM1MjQ2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4388
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2700
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:3520
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5896
    • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateOnDemand.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateOnDemand.exe" -Embedding
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4184
      • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:5684
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.138 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc1388d9c0,0x7ffc1388d9d0,0x7ffc1388d9e0
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4404
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1620,i,14668892239178648602,17030400804367055281,262144 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1964 /prefetch:2
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3600
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,4564731014872961864,7057899431314251397,524288 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2152 /prefetch:11
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:3784
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2456,i,10645382097158695358,7304279368734445212,524288 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2540 /prefetch:13
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2876
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --top-chrome-webui --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,1423877373243680626,12095681342863440351,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3224 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2812
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3544,i,2137096989360095707,18360594536231474760,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3584 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3216
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3528,i,5881481708220798962,3297080139857969717,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3536 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5020
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4044,i,7524984190540120824,2356697423048778375,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4208 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:860
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4064,i,5256498648449687656,12873995374798102126,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4164 /prefetch:9
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5324
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4860,i,6280595119432710708,9033669831660258810,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4848 /prefetch:9
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5744
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5172,i,12045188326445664621,2853196061176429094,524288 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5160 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4512
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=1912,i,8593569646835527502,17582343744955896928,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5336 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2768
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,5173592297845372317,11682176995981299717,524288 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5696 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4844
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6016,i,6843367234393568986,6515096265761126362,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6060 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1060
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6032,i,6173907242638468998,1817381426036568849,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6080 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2156
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6308,i,10453209296363219936,2786590472786167064,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6016 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4912
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6444,i,8531897438815848081,12766780072434423559,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6472 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:3192
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6416,i,6526156188026900738,828577539564620725,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6580 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:4948
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5964,i,1870234332799782522,6325029906809043727,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6744 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:4124
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6776,i,16151054236673695547,12998210610649479576,524288 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6696 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:2660
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6004,i,8181405520094893142,6265280514348875716,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6416 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:240
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7012,i,14629251715044423345,6900839281391121549,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6008 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:2624
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6584,i,11532869925699291076,11989981930007616952,524288 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6472 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:3140
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7120,i,17333539979206028622,18282037059861407521,524288 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6184 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:4284
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6568,i,5636298360127984420,11703731099761163213,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6148 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:3268
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6192,i,11419364510506591611,18390700590600045135,2097152 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7264 /prefetch:9
            4⤵
            • Executes dropped EXE
            PID:5916
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7328,i,16448718057496279105,4103406317824706180,524288 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=5644 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:5844
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,14258264522095934696,8429140764854881804,524288 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=6020 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:5532
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6700,i,4394548279940730018,10969503948619044299,524288 --field-trial-handle=1968,i,11798693990136204584,10708271396376504917,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,13145012268231925533,11562551931119345803,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=6436 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:5544
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
      1⤵
        PID:4360
      • C:\Program Files\Google\Chrome\Application\151.0.7922.138\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\151.0.7922.138\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:1840
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:2652
      • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateBroker.exe
        "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateBroker.exe" -Embedding
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /broker
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3512
      • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1052
      • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2044

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Image File Execution Options Injection

            1
            T1546.012

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Image File Execution Options Injection

            1
            T1546.012

            Defense Evasion

            Modify Registry

            1
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            3
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            System Time Discovery

            1
            T1124

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            GoogleCrashHandler.exe
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\GoogleCrashHandler.exe
            • Size 302KB
            • SHA256 c94dcb40543cb405474597c7e7c9d8ef558b1422797752625db9ca4faf53689c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GoogleCrashHandler64.exe
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\GoogleCrashHandler64.exe
            • Size 398KB
            • SHA256 5df635fd14558c0a25ceecd2ad51fbc0d129a8fe681d36ecc9e7254ae0e0a40e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GoogleUpdate.exe
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\GoogleUpdate.exe
            • Size 167KB
            • SHA256 9a4b728a0b652056cbd312dd917adc08c72c89b6f666472f4e3d59a1b8039d89
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GoogleUpdateComRegisterShell64.exe
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\GoogleUpdateComRegisterShell64.exe
            • Size 190KB
            • SHA256 55f4339688f1e72f5da0819abaa1d1f0630f39c496ec1ea0ad8e3458c8df6b02
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GoogleUpdateCore.exe
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\GoogleUpdateCore.exe
            • Size 224KB
            • SHA256 dd6dd981c7f1a6673dc8cc3a0fe1fc8a54e059a9fdb0545b0dc9258299c0c546
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdate.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdate.dll
            • Size 1.9MB
            • SHA256 a249cfdb846f0dd407c14486c173163c4339eed5be208a2a7be12a0ef0e21a3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_am.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_am.dll
            • Size 51KB
            • SHA256 2bb6e6d59d58479602f19dbf2636acac40a27cef0ed61959a9c61e561363377e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ar.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_ar.dll
            • Size 50KB
            • SHA256 bad8390f56f21536287008f28fbc855781250a1c30dce64345a8f974117f08fb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_bg.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_bg.dll
            • Size 53KB
            • SHA256 f1aa2f7f925f43b6fd5d8fd434d245bdaf4782ba0250f5b4a3b5fef6151ffc4f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_bn.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_bn.dll
            • Size 53KB
            • SHA256 f80738a1b58eb05d5fde4d45aa1dacabf85f6ce3e1baa278cea33821992a0595
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ca.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_ca.dll
            • Size 53KB
            • SHA256 6605e6a2ef6962229aff407f089189709217a3148cbe627d65ab8a460a3edea2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_cs.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_cs.dll
            • Size 52KB
            • SHA256 ba0c71cb9828e6e164878f584aeb028ffc4841ca9243f033793048e42ab42e24
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_da.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_da.dll
            • Size 52KB
            • SHA256 1622fe231d4ab333ba7f5a6615e4865ca2f402efb78d95e2ea45da1e0f547e73
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_de.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_de.dll
            • Size 54KB
            • SHA256 191fc4d9f7465999854f9cc1c63e41b56e4f9e6a25211daf480931eee50348eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_el.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_el.dll
            • Size 53KB
            • SHA256 832bcff51f75fd1543ceefcb9c0dbc68ed1d81fcce202ef0cae549cc77bba8c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_en-GB.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_en-GB.dll
            • Size 51KB
            • SHA256 4ffe246c7639860ae1436a9284b9e7d3ffd8751d520c21db34deeba5403eee9b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_en.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_en.dll
            • Size 51KB
            • SHA256 d3ea5ca450da274adad5aee038ae3e188b25fc8c4caf8112a611ca5d37de6ddf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_es-419.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_es-419.dll
            • Size 52KB
            • SHA256 85f7c532ba90dbfb188237840f6ca632b233448d9320b33acc489bb2f0c75968
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_es.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_es.dll
            • Size 54KB
            • SHA256 76134f9ee93ac9e70339c095cba2b3332242f7c1e99554866e9f1577e35fa358
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_et.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_et.dll
            • Size 51KB
            • SHA256 b81be3ea820eff9357c1e665ed6c38ebd4e69502d8eaf4caa847f2e9e77dd434
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fa.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_fa.dll
            • Size 51KB
            • SHA256 821962d51195daf4964b4560ac5aa8195a381ad9f25084da9cec941bc7e6e650
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fi.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_fi.dll
            • Size 52KB
            • SHA256 390a470788899787d02b5aa2798023735f20030359ea50ea1985cd1aa4a32844
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fil.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_fil.dll
            • Size 53KB
            • SHA256 bdd2f83f6b2a0472d8d6423cd2629fc62d79552bfdbbeeca6986f42587e2858a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fr.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_fr.dll
            • Size 53KB
            • SHA256 4f346b98a599b067642c78909eac3321b7d029e1b236f1207a5284f23e57e9e0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_gu.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_gu.dll
            • Size 53KB
            • SHA256 7a07d7519d48d046bb8c91459c693a581a2422f6917e88de306066891947bd1d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_hi.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_hi.dll
            • Size 52KB
            • SHA256 fb98c81dd564b7b31b92ae063f0748b0980594131708deb7cab1367e4bb91038
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_hr.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_hr.dll
            • Size 52KB
            • SHA256 96d1615f5b137a96c267fd24315fbd5e1e17825070d43400538b93d4302e9bf0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_hu.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_hu.dll
            • Size 52KB
            • SHA256 0d414f01587a0fa4f025aa9a5e22f18ca3936d62f5d853f1a762730a1c82de77
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_id.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_id.dll
            • Size 51KB
            • SHA256 b023a1d72ff2bb44d57d9691e7a9c2955e137cfdd4c179f3c60f6e0a30292134
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_is.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_is.dll
            • Size 51KB
            • SHA256 26c1ee86a675556167454e955ec734adb813c010bfc5bc9f230d4b9f37c2933b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_it.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_it.dll
            • Size 53KB
            • SHA256 492a8a977c052d65e7037df696fc2c3fa8c5fd66c43de508a5210e19f6127d6f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_iw.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_iw.dll
            • Size 49KB
            • SHA256 b1386f53ac8e40f01b060719e524be485b128977b8d0bb7612d1ecc988aadba6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ja.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_ja.dll
            • Size 48KB
            • SHA256 a03e462b097377861ea1fada213d81c4da5d9f9aabf92c69d9ac8cb9fb9a0767
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_kn.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_kn.dll
            • Size 53KB
            • SHA256 9d0c70749eb3f731581c51898e6a668144be1e0ebbdb13a3f0f0a345ae8fe801
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ko.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_ko.dll
            • Size 47KB
            • SHA256 5c37be343c04b64088343400883f67e3aeba4a382ad05144cd6dbf48f3313e1b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_lt.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_lt.dll
            • Size 51KB
            • SHA256 2616d38efc9ecd43c6fa3619f63f41601a466f476ba8fecada7773254030bec1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_lv.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_lv.dll
            • Size 52KB
            • SHA256 39b769cab5af89e6755d775ad2de6315a4f11233cf40fa4d0073f6f01c94b5b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ml.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_ml.dll
            • Size 55KB
            • SHA256 ca2c8816d4dd4f881fc7e4458631be959c19a034d91d5eeb3d8886c3a09e4a1f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_mr.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_mr.dll
            • Size 53KB
            • SHA256 9af66abbb49e9b77d07443d111ce5f42ba82203a89409a098d4f6b675afe8874
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ms.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_ms.dll
            • Size 51KB
            • SHA256 1427ffbb59acba53241a01562d13a925ea3ca137494c261eeea904bb2891c384
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_nl.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_nl.dll
            • Size 53KB
            • SHA256 a02cf3939e2bbe87fdf7d34af3cd22f214153b936750bf428b41b2be05a40f58
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_no.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_no.dll
            • Size 52KB
            • SHA256 17d6de02277a807ead2f3c66d5e864cef0283b4bd982d80997eb85c394c02896
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_pl.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_pl.dll
            • Size 52KB
            • SHA256 ab6789a0d758840dd4ffa686c62962ab825ae88b176cdb8e34397e427a3d1169
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_pt-BR.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_pt-BR.dll
            • Size 52KB
            • SHA256 23175210127308d99396ddd5543c87986233febef9273b99efc7909de889eff8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_pt-PT.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_pt-PT.dll
            • Size 52KB
            • SHA256 5d5ef69118036b457edcc23f1fe0945a37237197beda0fa11e3ee44833dbdeb6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ro.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_ro.dll
            • Size 52KB
            • SHA256 d48d79e8a4afd04f6f1294b6b7805d24c3bfffdfa2cf5bf2228b4f5631f0acbd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ru.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_ru.dll
            • Size 51KB
            • SHA256 7b3c3ce14924ec22e814ca0b90de0b6ba1060bc2ba9f358c9cde3768e2568c09
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sk.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_sk.dll
            • Size 52KB
            • SHA256 6bc2b9daae56c1a7c5353193536f3b43df23d2ee45fe16d645ae9c238be0b90c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sl.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_sl.dll
            • Size 52KB
            • SHA256 68e2504fe3ad15c634fcdeae5ef03f71c4ce8e15e640c176f29d800da00d2999
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sr.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_sr.dll
            • Size 52KB
            • SHA256 b40d1412b3aa29d9498c531c71848d28584563be8c4e99f3a70f1787f4eb7b4f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sv.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_sv.dll
            • Size 52KB
            • SHA256 aca8748dba8b33b44e379760693656e65bca3d1e5c598e89fa7e66a2b66bfe3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sw.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_sw.dll
            • Size 53KB
            • SHA256 11f21da878121c472dd6516e4983998766df0957c7e223ccaf5a6076edbdb4d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ta.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_ta.dll
            • Size 54KB
            • SHA256 c9e5b6b07413710487a9bc36b3f429e71a18dbc720e12a5928e0e375f33c21e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_te.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_te.dll
            • Size 53KB
            • SHA256 aac152bc0f1f8e40d000864e2f619c6e5080ed17620b38fca7770d2d6967e73b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_th.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_th.dll
            • Size 51KB
            • SHA256 db2f60e88177a18f0e27df988dde13a14ab1d1ee9360aadb44c898aab534dbc0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_tr.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_tr.dll
            • Size 52KB
            • SHA256 ca51a7a19863cea54e524f558d3fffbaf7d5c204a474ad4a15d07390a1acf8ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_uk.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_uk.dll
            • Size 52KB
            • SHA256 aaa8885430de708124ffcbf4f248b55c393e94078544a1a9324ed39b37b5f399
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ur.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_ur.dll
            • Size 52KB
            • SHA256 5e1506012b963f4dbee2b75ce78e235cc4a25ee95d9047aebba2ddf173c6535d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_vi.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_vi.dll
            • Size 51KB
            • SHA256 782ac9f33437d44905ad8bc867b80fc59511cff992317115b6a52839349a2c0a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_zh-CN.dll
            • Path C:\Program Files (x86)\Google\Temp\GUME2C5.tmp\goopdateres_zh-CN.dll
            • Size 46KB
            • SHA256 045921ac478365b5dd1f358307d2236c9e238745c814c8fa38e1ae49211493db
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            am_MASCULINE.pak
            • Path C:\Program Files\Google\Chrome\Temp\source3068_606237908\Chrome-bin\151.0.7922.138\Locales\am_MASCULINE.pak
            • Size 18B
            • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
            • MD5 SHA1 SHA512
            Submit Download

            setup.exe
            • Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
            • Size 1.6MB
            • SHA256 dff9710de3a2ac4d4bddfb5a6e57459f02a142cd21097fbdc76b735f74c72af3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BookmarkMergedSurfaceOrdering
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
            • Size 6B
            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
            • Size 72B
            • SHA256 09265a42ac17e8e9d35c881a55b408bf7870fdef9c1028f0f56e8dcb1ecd588d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            messages.json
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
            • Size 593B
            • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            craw_background.js
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
            • Size 531KB
            • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            5111291b-1034-4124-ac59-84e56be42452.tmp
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5111291b-1034-4124-ac59-84e56be42452.tmp
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
            • Size 13KB
            • SHA256 0769035550d5139e156f6974f989b1b8a916631cc34b3b5a69a08628ef8d559c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Secure Preferences
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
            • Size 18KB
            • SHA256 c43bbb936620fcf2dec313f2d7dddbf29fc5995fd18fb1ee95b368ddb0c2e58e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
            • Size 96B
            • SHA256 fbfdc03858a2b87e418a0ab0c7b1296dad2b13b80c27e18ec77f41f92841e1ed
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
            • Size 72B
            • SHA256 cffc2b605e5cde9179a0e691ee5d3be27ff2e60f9344ccc5024cbcd839d4f80d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
            • Size 48B
            • SHA256 77421a3db719db2acf35118de04427919f72c847a8a4ef44a3e75356caf4f6ae
            • MD5 SHA1 SHA512
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
            • Size 264KB
            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
            • Size 1KB
            • SHA256 61df75b6fe5027556482806e295bdb5d7720a51771bdcc1b377b70829b40f22c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
            • Size 2KB
            • SHA256 a515ad281e595a9f3e1967a07b2bdf613f651cba1b048fa55e7ba86af0394f7a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
            • Size 2KB
            • SHA256 42afb31349eebbfaa6289cf8a5c65288fb7b4cdff5cb99823e7f93a992629a3b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
            • Size 1KB
            • SHA256 4ef6af3958daea67637a1034e4ff3910360c34f8d5bba1bd15dcdf7078bc3c77
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
            • Size 2KB
            • SHA256 c9a6445efb6b3ed818d1e703f82f6c0445b49efc69b1480c61cdb2944114f523
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
            • Size 3KB
            • SHA256 e7e71e63123edd2441d670e4f27134615639e695670c3fd8e566706cc2c65654
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
            • Size 1KB
            • SHA256 56578e78a0175e9b89fef5927f9f41c7fdca566174daa7f47abbf8fb6d4afbd0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
            • Size 2KB
            • SHA256 d859584cdaacb63559fdc79dde2a585db9fe163eeafeaba3427e79755d78e079
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
            • Size 3KB
            • SHA256 7c98c778ec28216e89c3d8bfa6cdf69580e9f9e5f4c5cdb886c865f928d4af4c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\pommaclcbfghclhalboakcipcmmndhcj\Icons\32.png
            • Size 1KB
            • SHA256 d036530ce6b5320532f359ee4b96e5b2338f78640e91bcab10e7f2e637574240
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\pommaclcbfghclhalboakcipcmmndhcj\Icons\48.png
            • Size 2KB
            • SHA256 04ab9b9bb94719dffe4487c44a9b5d2386b56e5d34f4b26e0c6c9c0505d78f22
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\pommaclcbfghclhalboakcipcmmndhcj\Icons\64.png
            • Size 3KB
            • SHA256 09a66a69d37f7e99b104f442f878fd72e8fb3637eefba61987aaaa7a2a1cb185
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            trusted_vault.pb
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
            • Size 84B
            • SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
            • Size 4KB
            • SHA256 21f0a22831a1964592221c842860a88360817f6a74b02a95c03725f0032b958b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
            • Size 70KB
            • SHA256 447fa792194ec2bdb92cd2e189d2809fdbea7d8618a60dda520d9c148c2daf27
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
            • Size 70KB
            • SHA256 7c072edda292bb52c64cf6aa2a35bed3106cc0d92a88b26bbeb94f2df8c29d59
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            RCXE028.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RCXE028.tmp
            • Size 1.1MB
            • SHA256 51d2b735adc961996e2849215d3d19e1333dea11220fcb9999a34eff1ed803fe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            original_temp.exe
            • Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
            • Size 1.4MB
            • SHA256 4080063afe90f35e4c3dd71b79014431fab84c25418751bc28d6a303f58c9410
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            messages.json
            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_1075128330\CRX_INSTALL\_locales\en\messages.json
            • Size 450B
            • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            virus_temp.exe
            • Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
            • Size 1.1MB
            • SHA256 244941158a7b9a9e128a45040c27ac0cef5c416771c7dc11ecf2892456c60f92
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            virus_temp.exe
            • Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
            • Size 1.1MB
            • SHA256 fb84410a3f050fb882debc8e1080b151f768e166385c2e99852d699990af45fe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            virus_temp.exe
            • Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
            • Size 1.1MB
            • SHA256 72647da3c74def24eace55911257a94c5d8bf367f9dc00076d1483e0775583e2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3308-1381-0x00007FF65F0D0000-0x00007FF65F840000-memory.dmp
            Download

            memory/4680-1360-0x00007FF65F0D0000-0x00007FF65F840000-memory.dmp
            Download

            memory/4836-860-0x0000000000400000-0x000000000052A000-memory.dmp
            Download

            memory/4836-289-0x0000000000400000-0x000000000052A000-memory.dmp
            Download