Overview

overview

10

Static

static

3

2026-08-19...yn.exe

windows10-2004-x64

10

2026-08-19...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 10:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_fd1e6b2c21c5a7b7ea022c5e735da21e_amadey_elex_hellokitty_luca-stealer_njrat_remcos_swisyn.exe
  • Size 1.4MB
  • Sample260819-mm7grssblc
  • SHA256 c579f3c59e78fc3ea8ec729576aeeb3abc4460d864250067b50b9731c5aed4ea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 62 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_fd1e6b2c21c5a7b7ea022c5e735da21e_amadey_elex_hellokitty_luca-stealer_njrat_remcos_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_fd1e6b2c21c5a7b7ea022c5e735da21e_amadey_elex_hellokitty_luca-stealer_njrat_remcos_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3472
    • \??\c:\users\admin\appdata\local\temp\2026-08-19_fd1e6b2c21c5a7b7ea022c5e735da21e_amadey_elex_hellokitty_luca-stealer_njrat_remcos_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-08-19_fd1e6b2c21c5a7b7ea022c5e735da21e_amadey_elex_hellokitty_luca-stealer_njrat_remcos_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4612
      • C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={E5096338-A719-4587-9334-7209456E694C}&lang=en&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2780
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:5808
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4196
          • C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:1392
          • C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:1416
          • C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:2668
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NEU2QjM1QkYtQzAxNy00QkE5LUExQkItNENBMENBOEVFNDRBfSIgdXNlcmlkPSJ7Q0UyOEM0Q0ItOTFGMC00NzdFLUI4MzItNkNEMURFMkVDMUZEfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezE1RkRGM0QyLTk0MUUtNEI3MC04Q0VELUE1MUVCMEM1QTQ5NH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjE0MS4wLjczNDAuMCIgbmV4dHZlcnNpb249IjEuMy4zNi4xMTIiIGxhbmc9ImVuIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7RTUwOTYzMzgtQTcxOS00NTg3LTkzMzQtNzIwOTQ1NkU2OTRDfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMjM2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:5640
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={E5096338-A719-4587-9334-7209456E694C}&lang=en&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{4E6B35BF-C017-4BA9-A1BB-4CA0CA8EE44A}"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2136
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4424
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visibility of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3312
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4540
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visibility of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4632
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2836
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Program Files (x86)\Google\Update\Install\{3125307F-5233-4EA5-A729-CAE6F740CD46}\151.0.7922.170_chrome_installer_uncompressed.exe
      "C:\Program Files (x86)\Google\Update\Install\{3125307F-5233-4EA5-A729-CAE6F740CD46}\151.0.7922.170_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\gui3AA9.tmp"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Program Files (x86)\Google\Update\Install\{3125307F-5233-4EA5-A729-CAE6F740CD46}\CR_8FEC1.tmp\setup.exe
        "C:\Program Files (x86)\Google\Update\Install\{3125307F-5233-4EA5-A729-CAE6F740CD46}\CR_8FEC1.tmp\setup.exe" --uncompressed-archive="C:\Program Files (x86)\Google\Update\Install\{3125307F-5233-4EA5-A729-CAE6F740CD46}\CR_8FEC1.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\gui3AA9.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Program Files (x86)\Google\Update\Install\{3125307F-5233-4EA5-A729-CAE6F740CD46}\CR_8FEC1.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{3125307F-5233-4EA5-A729-CAE6F740CD46}\CR_8FEC1.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.170 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x298,0x29c,0x2a0,0x270,0x2a4,0x7ff7c3f61708,0x7ff7c3f61718,0x7ff7c3f61728
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1472
        • C:\Program Files (x86)\Google\Update\Install\{3125307F-5233-4EA5-A729-CAE6F740CD46}\CR_8FEC1.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{3125307F-5233-4EA5-A729-CAE6F740CD46}\CR_8FEC1.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:5092
          • C:\Program Files (x86)\Google\Update\Install\{3125307F-5233-4EA5-A729-CAE6F740CD46}\CR_8FEC1.tmp\setup.exe
            "C:\Program Files (x86)\Google\Update\Install\{3125307F-5233-4EA5-A729-CAE6F740CD46}\CR_8FEC1.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.170 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff7c3f61708,0x7ff7c3f61718,0x7ff7c3f61728
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:1988
    • C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4088
    • C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler64.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3120
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NEU2QjM1QkYtQzAxNy00QkE5LUExQkItNENBMENBOEVFNDRBfSIgdXNlcmlkPSJ7Q0UyOEM0Q0ItOTFGMC00NzdFLUI4MzItNkNEMURFMkVDMUZEfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezBGQzYxNkEzLTJBN0UtNEQ2NC05RUM5LUQzOUJDN0I3RDdBOH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzQy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjE1MS4wLjc5MjIuMTcwIiBhcD0ieDY0LXN0YWJsZS1zdGF0c2RlZl8xIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiIGlpZD0ie0U1MDk2MzM4LUE3MTktNDU4Ny05MzM0LTcyMDk0NTZFNjk0Q30iIGNvaG9ydD0iMTpndS9pMTk6IiBjb2hvcnRuYW1lPSJTdGFibGUgSW5zdGFsbHMgJmFtcDsgVmVyc2lvbiBQaW5zIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2FkMnljcHBueTNhanRkYWh6ZnVxN3o3dDV3c2FfMTUxLjAuNzkyMi4xNzAvMTUxLjAuNzkyMi4xNzBfY2hyb21lX2luc3RhbGxlcl91bmNvbXByZXNzZWQuZXhlIiBkb3dubG9hZGVkPSI1MTI2ODU0ODAiIHRvdGFsPSI1MTI2ODU0ODAiIGRvd25sb2FkX3RpbWVfbXM9IjU3MjczIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3MDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI0ODQiIGRvd25sb2FkX3RpbWVfbXM9IjYzMjQxIiBkb3dubG9hZGVkPSI1MTI2ODU0ODAiIHRvdGFsPSI1MTI2ODU0ODAiIGluc3RhbGxfdGltZV9tcz0iMzY2MDAiLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:6012
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:3328
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:4856
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2800
    • C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateOnDemand.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateOnDemand.exe" -Embedding
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4492
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.170 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff804d2d9c0,0x7ff804d2d9d0,0x7ff804d2d9e0
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5188
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1844,i,2976472623464433757,8900187785423047631,524288 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1828 /prefetch:11
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:4788
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1612,i,5822939194451765243,8936466723843653563,262144 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2040 /prefetch:2
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4752
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2484,i,10424951250060685339,16050068083882622812,524288 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2600 /prefetch:13
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5152
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --top-chrome-webui --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,18439031806219036985,7321393411083212997,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3280 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6000
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3664,i,12117319519220804034,15888460378536348969,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3676 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:4104
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3860,i,14984295019859155831,4125637215626209521,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3992 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1848
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3696,i,4451721882984949946,3251464727433577392,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3712 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1064
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3876,i,11053293424171996288,5689001240123129346,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4012 /prefetch:9
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4904
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4836,i,1782721093698049544,9810717796030430939,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4844 /prefetch:9
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4108
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3872,i,16618935913502501348,4086947245038862784,524288 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4024 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4312
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5348,i,4553747974777205889,11359289454655012141,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5328 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3292
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,6702572112673866146,10023704552064320542,524288 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5976 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3212
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6016,i,17546040608879986120,15016259868549060554,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6032 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5824
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6060,i,11359645779301068768,5819489194721819485,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6076 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:124
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6400,i,18008343514304167646,9363886916915187212,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6380 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2912
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6052,i,983022755527169279,21153608805604847,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6512 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5676
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6064,i,10916157696827649648,10910798117615211087,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6400 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:5864
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6780,i,4607893319073826724,2941255787555614493,524288 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6796 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:892
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6656,i,14584467943272720558,5684611388204016875,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6052 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:5036
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6612,i,140613200327422896,1020146684101793472,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6064 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:5392
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7212,i,16089550017434564454,14789858231222168361,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6904 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:6228
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7068,i,813798038211098373,6990185709243113141,524288 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7152 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:6480
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6368,i,4357875987265286209,7813200339084951030,524288 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6028 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:6776
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6928,i,7988481734721911885,3930352304394960485,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6964 /prefetch:1
            4⤵
            • Executes dropped EXE
            PID:5808
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5308,i,11166853817883615241,11737748665783068900,2097152 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=5404 /prefetch:9
            4⤵
            • Executes dropped EXE
            PID:6160
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,4866862547341023523,7851451038249373980,524288 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=6600 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:6724
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6824,i,14665841236101659713,16947664903527864966,524288 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7032 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:6500
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6524,i,340558419835186458,16834622489552522981,524288 --field-trial-handle=2044,i,15926475446105243594,13026959667494955072,262144 --variations-seed-version --pseudonymization-salt-handle=1808,i,5497111627517787942,5894732412938765273,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=6488 /prefetch:14
            4⤵
            • Executes dropped EXE
            PID:6484
    • C:\Program Files\Google\Chrome\Application\151.0.7922.170\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\151.0.7922.170\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3680
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
      1⤵
        PID:3200
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:3756
      • C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateBroker.exe
        "C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateBroker.exe" -Embedding
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4324
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /broker
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3148
      • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5228
      • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1144

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Image File Execution Options Injection

            1
            T1546.012

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Image File Execution Options Injection

            1
            T1546.012

            Defense Evasion

            Hide Artifacts

            1
            T1564

            Hidden Files and Directories

            1
            T1564.001

            Modify Registry

            3
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            3
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            System Time Discovery

            1
            T1124

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            GoogleCrashHandler.exe
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\GoogleCrashHandler.exe
            • Size 292KB
            • SHA256 413771b6008a8586383a918019345e431e576cc0f3638dff2fa7af73311de507
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GoogleCrashHandler64.exe
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\GoogleCrashHandler64.exe
            • Size 372KB
            • SHA256 070875d941aaf2a4a01cd61dfbd1f7122b9bc4b6030341999e4c1aadcf93f271
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GoogleUpdate.exe
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\GoogleUpdate.exe
            • Size 152KB
            • SHA256 61a92167587e540275b374890be8fd0319fe03c4f19cc79a8c2fb6871cf21e73
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GoogleUpdateComRegisterShell64.exe
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\GoogleUpdateComRegisterShell64.exe
            • Size 178KB
            • SHA256 c49b42e079880fc4d12a9c1c8a9e66b12e0d6675a8777c1d83a9fd6e958ba0aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GoogleUpdateCore.exe
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\GoogleUpdateCore.exe
            • Size 218KB
            • SHA256 7c5a8417300793b5aeddbf9f3f45ed81f2bff8b435866ef73092759e0da85239
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdate.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdate.dll
            • Size 1.9MB
            • SHA256 2062edbe465d1ff760c5416607b348087df3ba71524c785fc836bde0e58b61b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_am.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_am.dll
            • Size 46KB
            • SHA256 1cb3e2fef314d9105015f097c6a54880964e3018eb71331ee9e2e63338f2bcbb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ar.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_ar.dll
            • Size 45KB
            • SHA256 5b57dfc764757957b81f1f3a0f8d511779f581198a02a07213c38f544bb1b61a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_bg.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_bg.dll
            • Size 48KB
            • SHA256 b3965068b784f36e057c7379c9bd832e1262b522b5fde681a52a8f62e4ef6321
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_bn.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_bn.dll
            • Size 48KB
            • SHA256 e4701bac269ca63f2f8d59fa34552a20bbc2cbb8ef3cf2bf68d5f1f6440fa5da
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ca.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_ca.dll
            • Size 48KB
            • SHA256 8fc469a995e0fd426a5b8dbb0c8f9e556ab4367cb0ac33d857eda9a9c0ffae29
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_cs.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_cs.dll
            • Size 47KB
            • SHA256 709c8fdd26f85e34697d4c0974d98815cc829f5eca396bf3b7f1d1c89de3e9cb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_da.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_da.dll
            • Size 47KB
            • SHA256 528610c959f9bc94d0f64f2b3120a728aff3f4944e2b4af9e1d43ce7f8d16900
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_de.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_de.dll
            • Size 49KB
            • SHA256 0399032b5b163b243db98f938c94bfeb404235d5aa1858a3df6abc2e39958254
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_el.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_el.dll
            • Size 49KB
            • SHA256 0901a2370c683f787d43bb5c10027f7611fa4d91d7681550e57679ee4681baea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_en-GB.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_en-GB.dll
            • Size 46KB
            • SHA256 811d6e42b98c93d50c80ad1a6736826f9f388029b6a58866f3f1e0b8101f44e8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_en.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_en.dll
            • Size 47KB
            • SHA256 6a423b39ff8884fff61fd276636dd7ce884706649b5a99a8ba272a05822439c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_es-419.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_es-419.dll
            • Size 48KB
            • SHA256 03e20932406075782c27928a2c00e7c3c0335f038493c26fd2a807628c01a62d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_es.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_es.dll
            • Size 49KB
            • SHA256 8636548ec4e744529907195c4a5409961cf64a3dc780c575878a138691296523
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_et.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_et.dll
            • Size 47KB
            • SHA256 4787362197beae7a64a3e285f3b6a9319d7162a25544d1b1f1e7bf13c0f21a72
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fa.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_fa.dll
            • Size 46KB
            • SHA256 30a7f0627468cc6b6c3a76d9604f8ff6c4f8f3d403f3ff1da7c1e738b2af7eb4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fi.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_fi.dll
            • Size 47KB
            • SHA256 3f00fa0a84d5e9f5cfc07f3396d027d1fb9d124870ea214ec1bde5a6b03c56ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fil.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_fil.dll
            • Size 48KB
            • SHA256 1e501600dbf9369ad76bf15f042f570c2118f9f5a90bbf9afd41d7e4f97f10d5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_fr.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_fr.dll
            • Size 49KB
            • SHA256 e81dff2d456e1bf829bcf609dd7fd2ebf6f1449ac8f7ddbbe4cb8334acca1616
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_gu.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_gu.dll
            • Size 49KB
            • SHA256 478e673e747c9115365979e9ed70fec4c5037abbc1f17d4359b780c2d86a64ff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_hi.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_hi.dll
            • Size 47KB
            • SHA256 9ea6676cc9eb63656f04c4ea24ad193a57d12efa57a1910c9e23d659631d8f98
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_hr.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_hr.dll
            • Size 48KB
            • SHA256 3e8029083b72bd5d18fa8b801d0e416e183db5c8e8e83f7184772f2b9ea02c36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_hu.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_hu.dll
            • Size 48KB
            • SHA256 796cb56a40ae096ba835a57b214dd919c47638eab034d1ffb2d97a1c4b2b7576
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_id.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_id.dll
            • Size 47KB
            • SHA256 04a4ad107f2445c7c8dd144dab75c625d94f031ffe9bc038a7d9159c4c3c7abf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_is.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_is.dll
            • Size 47KB
            • SHA256 7c3eece7ebc54911930c5fe3630412e4330a4eeccafc74bd144d189f5d42ad12
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_it.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_it.dll
            • Size 49KB
            • SHA256 5b704af66abb921663581e49e1ce6897fa411e3f91c6619b8e0a79c02c5e11fb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_iw.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_iw.dll
            • Size 45KB
            • SHA256 1198a618cc0fc48fe5054d1fab3234cf97d7477750cb2c8a871c45df9862b2e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ja.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_ja.dll
            • Size 44KB
            • SHA256 30383e61689707dc0788bdee8deafdb81f3b30244e5058b9e4fb1bcd3bc94e61
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_kn.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_kn.dll
            • Size 49KB
            • SHA256 c4b71b570f8e9bb94606289c56e1a855d75b9e784d3de89d2e01505ff4bc8e57
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ko.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_ko.dll
            • Size 43KB
            • SHA256 92001595935d97c9d87ee4671afda1164684dccf84dd5d5ad9bc3478fbbb7cee
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_lt.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_lt.dll
            • Size 47KB
            • SHA256 61ad28fce0dd8d3d4732143a194ab3116d8fff08cdaf0aa6315758ef4ea9a79a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_lv.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_lv.dll
            • Size 48KB
            • SHA256 643d74e77fc2f6bab45b3a131ccd5cf7968f666ffb8edead47a04a75648a3979
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ml.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_ml.dll
            • Size 50KB
            • SHA256 68d61a09e534daea5a0e909999f2f3f1090a4d1d79f876bd83ffad4b2d9582ec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_mr.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_mr.dll
            • Size 48KB
            • SHA256 017273a9e6ba7a854c6e9863f642aad0d63deecb180866c7a73757bca2c594d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ms.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_ms.dll
            • Size 47KB
            • SHA256 dd45ace221fdd13f96801d3e1301b3facc4cc8b2a92c9a809850be0508097602
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_nl.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_nl.dll
            • Size 48KB
            • SHA256 ca7fd9ab1a0ff16ba45a2b9af0b4e23a0069b8b51f67202b8464f63386a14779
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_no.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_no.dll
            • Size 47KB
            • SHA256 7a2749005481b54f075b69873a5d49b5982f5b03d37ba5bc70a9f4c1f0cb61a4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_pl.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_pl.dll
            • Size 48KB
            • SHA256 e616ad11687f9b14c8e06e0b29d8b5ccd9a1cc094152787059debe53d64a7985
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_pt-BR.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_pt-BR.dll
            • Size 47KB
            • SHA256 25135ea0454ab264d4749e365dec0e48a4c1aee48e2f3b121fab35bc7c31ffd9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_pt-PT.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_pt-PT.dll
            • Size 48KB
            • SHA256 221cd55748d98ef8b175a098e3b02f80513efe34847f4d86673770d1359cb6d6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ro.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_ro.dll
            • Size 48KB
            • SHA256 05f4add4284caaf857683ff7b38cd982e9d1b567fd38593272399acb235a51f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ru.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_ru.dll
            • Size 47KB
            • SHA256 1de37dd6ade210475536abaf2645bbb82befe4f8d9b44dfed3a4fade683d8dfc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sk.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_sk.dll
            • Size 47KB
            • SHA256 035207127c46e506d2a5c373d4c4826e7b24ddfcf2326b167eba2a86b4e43934
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sl.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_sl.dll
            • Size 48KB
            • SHA256 64ac3d744f4771b5f725afd1ffdeef98e26958f6e42db2728111bf38fa605825
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sr.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_sr.dll
            • Size 47KB
            • SHA256 c0821659c3e94ecd4ab6200872edbef47aacbd12ec1a07aee7c53712eacc598b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sv.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_sv.dll
            • Size 47KB
            • SHA256 abf145f6e5f03c7912c50c7c3f3ebd4a43912d7583b9045712b95532ed5a7691
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_sw.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_sw.dll
            • Size 49KB
            • SHA256 6c0926bce25f4147fcf1bdc7bb953f0ad3ef19281aca97dcaad72654b522741d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ta.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_ta.dll
            • Size 49KB
            • SHA256 e3e957d7b9074d3c44ce35f60544a96656232eb71faaec77436e2e791f2caf4c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_te.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_te.dll
            • Size 49KB
            • SHA256 3827e057d8a0f0faf271768b34d43ae9d4201a74d8f4625a267b5e299c6560dc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_th.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_th.dll
            • Size 46KB
            • SHA256 cd94ddd570d4879e1c866c108c1bf13c2ea06f6b01a98de6522295d0b057a5ff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_tr.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_tr.dll
            • Size 47KB
            • SHA256 5f11baaf869fd0c4b8d0d433e6f54969323bde8bb80cbf1ed48a803ed0f570a0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_uk.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_uk.dll
            • Size 47KB
            • SHA256 6a4ae32245b88787ad2345ad9c241b1703f27e312a197257862cc5c2365eb4ec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_ur.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_ur.dll
            • Size 47KB
            • SHA256 e8e7e79133a652575c3a1de3b7b033141641bc06888108d8b11d96c563e89920
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_vi.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_vi.dll
            • Size 47KB
            • SHA256 254f5ac46b3b65075127ba6e9ad1feba60d735357dbfda6e7c649dbfcfc0cc6d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            goopdateres_zh-CN.dll
            • Path C:\Program Files (x86)\Google\Temp\GUM11C9.tmp\goopdateres_zh-CN.dll
            • Size 41KB
            • SHA256 7159bf516cb32940ee17a9435e83facf8fb37c53dc8bfdbdccbac07e2936f1b6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            am_MASCULINE.pak
            • Path C:\Program Files\Google\Chrome\Temp\source3188_1198587148\Chrome-bin\151.0.7922.170\Locales\am_MASCULINE.pak
            • Size 18B
            • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
            • MD5 SHA1 SHA512
            Submit Download

            BookmarkMergedSurfaceOrdering
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
            • Size 6B
            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
            • Size 72B
            • SHA256 09265a42ac17e8e9d35c881a55b408bf7870fdef9c1028f0f56e8dcb1ecd588d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            messages.json
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
            • Size 593B
            • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            craw_background.js
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
            • Size 531KB
            • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            98078fab-9f95-4580-b429-72821c58eea9.tmp
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\98078fab-9f95-4580-b429-72821c58eea9.tmp
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
            • Size 13KB
            • SHA256 250ace286a19af56752f933bcf1ee870ca781036db41ff972adf082170b0597e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Secure Preferences
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
            • Size 18KB
            • SHA256 d4393ab0ddd1722507d1f125ccf418dbb8265bb88f8fc946407711bd16afadf7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
            • Size 96B
            • SHA256 b0328b8fe0a6b129c5945a0cab26c5cd067ec87e3e40bb3a7c2b66787a048eaf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            5db71fbd-c2af-416f-9018-209adb54c63a.tmp
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\5db71fbd-c2af-416f-9018-209adb54c63a.tmp
            • Size 48B
            • SHA256 68120c4b33d4b4e4a305057ac3c0da2217b1cb6718adb1838ecff35b20f231db
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
            • Size 72B
            • SHA256 85b95ba855e74841db1d8a3350f73873cf13fb3f1b66c2bd127c539918b231d0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
            • Size 264KB
            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
            • Size 1KB
            • SHA256 efeb751507c77b56963b563705e3d20325805e332988bb3e48cd891e2dd11b3c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
            • Size 2KB
            • SHA256 82fc9e7be1c1dc78bcca8c54db0fcd89e4658d542070b418b1d3f0c82e1a7389
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
            • Size 4KB
            • SHA256 88ee95cc4940438e85c0f103638c8bfc8f326bc25c7223c5f6455657b0fcb128
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
            • Size 1KB
            • SHA256 7cce326e62b1efd08d37bee0c3cd20258a2527e5b267a359c03240a76badced0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png
            • Size 2KB
            • SHA256 442bdbf96a0bbf2274f4f2a7a2a27bcf0e0851131284797df90bff59f738894d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png
            • Size 3KB
            • SHA256 6b2ff6fdec1a618e884b82acdff34292f05002959e1ccabf9c2723d383a47f98
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
            • Size 1KB
            • SHA256 61df75b6fe5027556482806e295bdb5d7720a51771bdcc1b377b70829b40f22c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
            • Size 2KB
            • SHA256 a515ad281e595a9f3e1967a07b2bdf613f651cba1b048fa55e7ba86af0394f7a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
            • Size 2KB
            • SHA256 42afb31349eebbfaa6289cf8a5c65288fb7b4cdff5cb99823e7f93a992629a3b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
            • Size 1KB
            • SHA256 0eb5b575bc5ad0f0fe9e7747e7c8844397113e460ecb454780192355773d7265
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
            • Size 2KB
            • SHA256 b44887b22da066690f192fcf504c99a16f17588777de201db29ce0708149aba0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
            • Size 2KB
            • SHA256 5bffe545e04d375416d4d974bf8fc6ec77d09963c16ce8eb4311e89f0c6b3815
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\pommaclcbfghclhalboakcipcmmndhcj\Icons\32.png
            • Size 1KB
            • SHA256 d036530ce6b5320532f359ee4b96e5b2338f78640e91bcab10e7f2e637574240
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\pommaclcbfghclhalboakcipcmmndhcj\Icons\48.png
            • Size 2KB
            • SHA256 04ab9b9bb94719dffe4487c44a9b5d2386b56e5d34f4b26e0c6c9c0505d78f22
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\pommaclcbfghclhalboakcipcmmndhcj\Icons\64.png
            • Size 3KB
            • SHA256 09a66a69d37f7e99b104f442f878fd72e8fb3637eefba61987aaaa7a2a1cb185
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            128.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4492_495503159\Trusted Icons\Icons\128.png
            • Size 8KB
            • SHA256 05043c90fd7c795f665f7d4374673857da8ba578ef01a9563cf81bf98410de57
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            192.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4492_495503159\Trusted Icons\Icons\192.png
            • Size 7KB
            • SHA256 e77ddd838401a22545cde73bc8dadabfb059ea65ef0784836c7dc823ffbb587a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            256.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4492_495503159\Trusted Icons\Icons\256.png
            • Size 21KB
            • SHA256 02d9d896281e088a9ef8562cc1dce71ffba7db465f7379a0bb69ddf3dc2de52e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4492_495503159\Trusted Icons\Icons\32.png
            • Size 1KB
            • SHA256 4ef6af3958daea67637a1034e4ff3910360c34f8d5bba1bd15dcdf7078bc3c77
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4492_495503159\Trusted Icons\Icons\48.png
            • Size 2KB
            • SHA256 c9a6445efb6b3ed818d1e703f82f6c0445b49efc69b1480c61cdb2944114f523
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4492_495503159\Trusted Icons\Icons\64.png
            • Size 3KB
            • SHA256 e7e71e63123edd2441d670e4f27134615639e695670c3fd8e566706cc2c65654
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            96.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4492_495503159\Trusted Icons\Icons\96.png
            • Size 5KB
            • SHA256 360654ce87e12eca80b384779ecfcf54f95d264c5e75d5b0a4c9f9304e7610c0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            trusted_vault.pb
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
            • Size 84B
            • SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
            • Size 72KB
            • SHA256 93c697752a9423fe3698d4d47b43b3dddf5950dcae50ba5339415ca8e2a6ef65
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
            • Size 4KB
            • SHA256 c264926691a2da8f732b4198c9195e30af8c73450f31de040cf23af3fee4a005
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2026-08-19_fd1e6b2c21c5a7b7ea022c5e735da21e_amadey_elex_hellokitty_luca-stealer_njrat_remcos_swisyn.exe 
            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-19_fd1e6b2c21c5a7b7ea022c5e735da21e_amadey_elex_hellokitty_luca-stealer_njrat_remcos_swisyn.exe 
            • Size 1.3MB
            • SHA256 d9bfa9308196d07b464288baf09f9616cb80113d1017c99413d7a61369c7c3da
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            messages.json
            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4492_903563709\CRX_INSTALL\_locales\en\messages.json
            • Size 450B
            • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            explorer.exe
            • Path C:\Windows\Resources\Themes\explorer.exe
            • Size 135KB
            • SHA256 6513348a0255a266fa951580a3245efabe50a630019d08896478a7482da9dc29
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1472-737-0x00007FF7C38B0000-0x00007FF7C401B000-memory.dmp
            Download

            memory/1988-1294-0x00007FF7C38B0000-0x00007FF7C401B000-memory.dmp
            Download

            memory/2836-175-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/3312-1299-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/3472-177-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/3472-0-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/4424-178-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/4540-176-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/4632-1347-0x0000000000400000-0x000000000041F000-memory.dmp
            Download