Overview

overview

10

Static

static

10

2026-08-19...at.exe

windows10-2004-x64

9

2026-08-19...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 14:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_0471505b59501d0a27dc7dd844f6e0d4_amadey_darkgate_glassworm_luca-stealer_magniber_njrat_quasar-rat.exe
  • Size 39.2MB
  • Sample260819-rd7hmaxzcx
  • SHA256 50c85c0287669ef976a1783f4bdda0c833123908b91818675cfe18a34c8943a5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 7 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 7 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 63 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 11 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 25 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_0471505b59501d0a27dc7dd844f6e0d4_amadey_darkgate_glassworm_luca-stealer_magniber_njrat_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_0471505b59501d0a27dc7dd844f6e0d4_amadey_darkgate_glassworm_luca-stealer_magniber_njrat_quasar-rat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Users\Admin\AppData\Local\Temp\WinNetHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\WinNetHelper.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5620
      • C:\Windows\SystemTemp\Google5620_2022781074\bin\updater.exe
        "C:\Windows\SystemTemp\Google5620_2022781074\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={47C7A4B2-42CA-31F0-149C-38AA96E15B77}&lang=zh-CN&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=-arch_x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
        3⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5376
        • C:\Windows\SystemTemp\Google5620_2022781074\bin\updater.exe
          C:\Windows\SystemTemp\Google5620_2022781074\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x8b1e40,0x8b1e4c,0x8b1e58
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2728
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2000
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.170 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff90215d9c0,0x7ff90215d9d0,0x7ff90215d9e0
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2080
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1592,i,7273808024583481994,2922642845782067030,262144 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1852 /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1892
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,413279329974385312,9470976453108081244,524288 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2088 /prefetch:11
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:1228
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,3416437476427020783,11329615171164939076,524288 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2572 /prefetch:13
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1984
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --top-chrome-webui --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,293503648407225333,9322454404460091826,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3232 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1564
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3556,i,15787698684217970384,3316107340497377149,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3568 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5144
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3524,i,8709969133864172451,14485010300369385102,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3616 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1048
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4088,i,9436142647696379141,9800946283152120867,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4140 /prefetch:9
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:932
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4072,i,9889563930577462042,9425471994075773102,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4568 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2812
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4872,i,4956246056559975828,413501248982514791,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4904 /prefetch:9
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2688
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4200,i,8065251272081526261,10279556354525804195,524288 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5276 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:780
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5452,i,7334000487570993969,8347053074614701100,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5432 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4920
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,6123786399955654118,15937883731188147296,524288 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5604 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4400
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6068,i,15696349683152650039,7397351881675781947,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6112 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3276
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6084,i,6901964743110412549,6000820651801086602,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6132 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5588
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6064,i,14481664029913810832,9131459971098104364,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6068 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1636
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4180,i,14966091388871552092,11688595278584978282,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6076 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6048
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6072,i,11171986199034433818,14070446890105980872,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6064 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5008
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6748,i,5587495255269400363,17859560395483417872,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6884 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2132
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6764,i,16640177995166533408,5014143905512826558,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6088 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4156
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7096,i,3886880062973943782,4747495699431275551,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6748 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4056
          • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
            "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --wake-all --system
            5⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5584
            • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
              "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x5e1e40,0x5e1e4c,0x5e1e58
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3500
            • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
              "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --wake --system
              6⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2304
              • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
                "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x5e1e40,0x5e1e4c,0x5e1e58
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                PID:780
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,1780296858590865810,4361550688908706231,524288 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6912 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5040
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6964,i,14862337963527325616,4960087785672310219,524288 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=4712 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4968
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6916,i,215597449197155550,6939831540679439436,524288 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6952 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4672
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6444,i,15335768606683242080,328013110295224012,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6840 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3692
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4712,i,7433248650499114524,10740972500426674945,2097152 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6876 /prefetch:9
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2308
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6820,i,11870019448638739086,7486482692146661338,524288 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=6052 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2516
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,17807878981954435785,5752891700996649349,524288 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7136 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4240
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6992,i,6573405043199986658,12208852668232855678,524288 --field-trial-handle=1856,i,7165125817958756067,15060738245891917213,262144 --variations-seed-version --pseudonymization-salt-handle=1860,i,17942884431687869456,1602838196668771211,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7192 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:996
    • C:\ProgramData\Caphyon\transport.exe
      "C:\ProgramData\Caphyon\transport.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3840
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c powershell -Command "Get-Process Weixin -ErrorAction SilentlyContinue | ForEach-Object {(Get-Item $_.Path).VersionInfo.FileVersion}"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Get-Process Weixin -ErrorAction SilentlyContinue | ForEach-Object {(Get-Item $_.Path).VersionInfo.FileVersion}"
          4⤵
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1496
  • C:\ProgramData\Caphyon\transport.exe
    C:\ProgramData\Caphyon\transport.exe
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3860
  • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
    "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update-internal
    1⤵
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3512
    • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x5e1e40,0x5e1e4c,0x5e1e58
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5356
  • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
    "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update
    1⤵
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x5e1e40,0x5e1e4c,0x5e1e58
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3016
    • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=1832
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0xf4,0xe8,0xec,0xf0,0xf8,0x5e1e40,0x5e1e4c,0x5e1e58
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2888
    • C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\151.0.7922.170_chrome_installer_uncompressed.exe
      "C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\151.0.7922.170_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\ef3d5708-81dd-4aba-9011-87cca6bce1c0.tmp"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3740
      • C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\CR_9E0E1.tmp\setup.exe
        "C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\CR_9E0E1.tmp\setup.exe" --uncompressed-archive="C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\CR_9E0E1.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\ef3d5708-81dd-4aba-9011-87cca6bce1c0.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Network Configuration Discovery: Internet Connection Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:6032
        • C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\CR_9E0E1.tmp\setup.exe
          C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\CR_9E0E1.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.170 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x29c,0x2a0,0x2a4,0x250,0x2a8,0x7ff6a5371708,0x7ff6a5371718,0x7ff6a5371728
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1836
        • C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\CR_9E0E1.tmp\setup.exe
          "C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\CR_9E0E1.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:4364
          • C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\CR_9E0E1.tmp\setup.exe
            C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\CR_9E0E1.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.170 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff6a5371708,0x7ff6a5371718,0x7ff6a5371728
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:4896
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5504
    • C:\Program Files\Google\Chrome\Application\151.0.7922.170\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\151.0.7922.170\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4828
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
      1⤵
        PID:5304
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:5004
      • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update
        1⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
          "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x5e1e40,0x5e1e4c,0x5e1e58
          2⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          PID:4688
        • C:\Program Files\Google\Chrome\Application\151.0.7922.170\os_update_handler.exe
          "C:\Program Files\Google\Chrome\Application\151.0.7922.170\os_update_handler.exe" --channel=stable --force-install --system-level
          2⤵
          • Executes dropped EXE
          PID:2684
        • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
          "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=2020
          2⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4472
          • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
            "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2b4,0x2b8,0x2bc,0x2b0,0x2c0,0x5e1e40,0x5e1e4c,0x5e1e58
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2316
        • C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2244_1235134642\platform_experience_helper.exe
          "C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2244_1235134642\platform_experience_helper.exe" --install
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:5060
      • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update
        1⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3720
        • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
          "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0x5e1e40,0x5e1e4c,0x5e1e58
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3076
      • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update-internal
        1⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5324
        • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
          "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x5e1e40,0x5e1e4c,0x5e1e58
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4468
      • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update
        1⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5328
        • C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe
          "C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x5e1e40,0x5e1e4c,0x5e1e58
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4580

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            Windows Command Shell

            1
            T1059.003

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Defense Evasion

            Hide Artifacts

            1
            T1564

            Ignore Process Interrupts

            1
            T1564.011

            Modify Registry

            1
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            4
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            System Time Discovery

            1
            T1124

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            settings.dat
            • Path C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad\settings.dat
            • Size 40B
            • SHA256 9aa3f56215dfad14420f5194d7a1004ef56f37b6fa5b013e89cd366aab3b022f
            • MD5 SHA1 SHA512
            Submit Download

            metadata.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
            • Size 248B
            • SHA256 e987e119efb00420d78175fb44d4774f6f648a223560619c7bdfe4ceccfbe4f8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
            • Size 130B
            • SHA256 12648ba6e6cee8e5d20c93c31285c1e5b869e83446a3330ddeb52f73fbb94cef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            db3c892d-6db4-441a-a3cf-d88b2f8f5412.tmp
            • Path C:\Program Files (x86)\Google\GoogleUpdater\db3c892d-6db4-441a-a3cf-d88b2f8f5412.tmp
            • Size 954B
            • SHA256 e1bbae245557b9e46f828295644115c52e02fb96a745f018d291f323164ec972
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 1KB
            • SHA256 7e754992b95a2609c696d26d03bf23bf376f35b79f4383c57fb10180f57b739b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 421B
            • SHA256 a9426d171ea9eb62484fb4a975973919281c1863a8047021d425fa826a8f1227
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 610B
            • SHA256 4961b64b97c9c68fda577973c753ef2afd92e33baf0ff0f47e5c59c689f30d3b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 562B
            • SHA256 160b7697e4966cb0364324f268a67722e188e361c5ff7eb59c5814e9bfb80da8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 830B
            • SHA256 bdafeefd2232da137742c3a6e047ffa93df40bd922f75539ac1311d7a8437d54
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 830B
            • SHA256 de92ea43310c9cd2151ea1c1c3ce7f4ff787b2a5bec1526fcc03a8c623832c6c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 420B
            • SHA256 cf17dd390d5514c8476813f2c5afa436cf1fcc141df2b45c9717b55d5228acc8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 528B
            • SHA256 e6da0d62ce0b047902a2438755dcddea32316847f42f4a265cb30206940b772c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 31KB
            • SHA256 9923862e1308654cd59db181466c2ebef35020819df3b6979e49cc674455f80b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 34KB
            • SHA256 46b0c0c9b1eaff8d431c6ada234c5ca69d1779bbd1354b70ed3520df72f8ec21
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 37KB
            • SHA256 83bc39760a8a36c43e0d43d575b039000fd86038fa30148383fd623c418991db
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 45KB
            • SHA256 c628156e69f855baf323efdaaa52ebce2a96989264225c421e5654d85a56083b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 468KB
            • SHA256 28bbea401cf59184d736d87495427be7db5932ef9164d96de6e9cf9113ba357d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 470KB
            • SHA256 a03d5aca0ed913b1409acdbd96c0e5497610e5d6e3eaa05ec63736ef5fede49e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 1KB
            • SHA256 80ed6e3ae205ecdd443383ddd6df1439c75ee18a9bb596d73f6d22c92c1f0a5f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 2KB
            • SHA256 76e8f3f7a9c9eab07d442809df6cc2afb1d328b41635771037de60a06cf09b99
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 3KB
            • SHA256 1182770efeb923d87c0310934dda7a083f59c867db924273427c8e95ba53d674
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 3KB
            • SHA256 ac088dde5a9b35670e09f62b2bbcda2fc5e11c73b460d4bdc4f8b9c0640451ee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 5KB
            • SHA256 0333c5cac8c6d73303c049448596adf1cd2aab4bc232ec5cd6e267942c9fd3a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 553KB
            • SHA256 215a781e0b5557ec78f806101c253abc1e02389b8ac26b92ccc41d746005fd5c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 554KB
            • SHA256 231522fccd3a3ac6658e0d99083265df7fd19e21218b1bc912cbb436e03f4951
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_100_percent.pak
            • Path C:\Program Files\Google\Chrome\Application\151.0.7922.170\chrome_100_percent.pak
            • Size 1.1MB
            • SHA256 eee83518fc1e995af4a5b5f716d99feef9a13eec505db38c72a0d7c22c0798e8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_200_percent.pak
            • Path C:\Program Files\Google\Chrome\Application\151.0.7922.170\chrome_200_percent.pak
            • Size 2.0MB
            • SHA256 f315972add26195955f7fe6fadba6fcac392f3beee73676ea167c84ad5426d7f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_elf.dll
            • Path C:\Program Files\Google\Chrome\Application\151.0.7922.170\chrome_elf.dll
            • Size 2.6MB
            • SHA256 79cf825261001c060fd945f116b7b0481c5d48fe5887d928f1cc34af94dafad4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icudtl.dat
            • Path C:\Program Files\Google\Chrome\Application\151.0.7922.170\icudtl.dat
            • Size 10.4MB
            • SHA256 9f48c7f9c7c94d516a14870707e910ab94d75ae640ff6842c4af53276cd26ebe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-US.pak
            • Path C:\Program Files\Google\Chrome\Application\151.0.7922.170\locales\en-US.pak
            • Size 512KB
            • SHA256 cf65f3bb35f9fe2f37288a041fe1d6b4312d707c2cd7a2460334205e831be1df
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            resources.pak
            • Path C:\Program Files\Google\Chrome\Application\151.0.7922.170\resources.pak
            • Size 21.7MB
            • SHA256 b04f0af6f0bfe5308894ba2a30a38c9b474bf75371e329d22dacd44b7a210033
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome.exe
            • Size 3.8MB
            • SHA256 4fded80ee837952ebb94f1117e15528f4e6448c868825022f3982712a7819cda
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            am_MASCULINE.pak
            • Path C:\Program Files\Google\Chrome\Temp\source6032_965076369\Chrome-bin\151.0.7922.170\Locales\am_MASCULINE.pak
            • Size 18B
            • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
            • MD5 SHA1 SHA512
            Submit Download

            transport.exe
            • Path C:\ProgramData\Caphyon\transport.exe
            • Size 4.0MB
            • SHA256 df7917a1cff29a40a632b1218679daeb53103917a29769c175115d59c9c0b2e8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BookmarkMergedSurfaceOrdering
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
            • Size 6B
            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
            • Size 72B
            • SHA256 09265a42ac17e8e9d35c881a55b408bf7870fdef9c1028f0f56e8dcb1ecd588d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            messages.json
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
            • Size 593B
            • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            craw_background.js
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
            • Size 531KB
            • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
            • Size 13KB
            • SHA256 18b0805957a44cc856af01cb4e60ab8a01716f5be2342e117693d6e31ceb7515
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Secure Preferences
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
            • Size 15KB
            • SHA256 dab2985c16c892eddd39d6e6098895303e15c5ae67774bce88eee0069afef6e9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
            • Size 96B
            • SHA256 bacd1c3581065296d7f84e407a40862b81df184dda3b34619ed98eb8893ddfee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            58abeae1-fad6-4b68-868f-76752aa5797d.tmp
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\58abeae1-fad6-4b68-868f-76752aa5797d.tmp
            • Size 48B
            • SHA256 a732301ff6fdeff8837b9c99d47e5e27db7136081dd15ff5010dd5603539c6d8
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
            • Size 72B
            • SHA256 feb43bf11ccb433bebcdf9cc822aec80ab9171129120c6faa13a6c20f5a5dfac
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
            • Size 264KB
            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
            • Size 1KB
            • SHA256 61df75b6fe5027556482806e295bdb5d7720a51771bdcc1b377b70829b40f22c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
            • Size 2KB
            • SHA256 a515ad281e595a9f3e1967a07b2bdf613f651cba1b048fa55e7ba86af0394f7a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
            • Size 2KB
            • SHA256 42afb31349eebbfaa6289cf8a5c65288fb7b4cdff5cb99823e7f93a992629a3b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
            • Size 1KB
            • SHA256 0eb5b575bc5ad0f0fe9e7747e7c8844397113e460ecb454780192355773d7265
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
            • Size 2KB
            • SHA256 b44887b22da066690f192fcf504c99a16f17588777de201db29ce0708149aba0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
            • Size 2KB
            • SHA256 5bffe545e04d375416d4d974bf8fc6ec77d09963c16ce8eb4311e89f0c6b3815
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            128.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_1194402452\Trusted Icons\Icons\128.png
            • Size 9KB
            • SHA256 9ad3eeebc2ae8f90ce1d00941f4d471603af3c02e249bf756d248cbeeb37cc52
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            192.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_1194402452\Trusted Icons\Icons\192.png
            • Size 10KB
            • SHA256 f2d0468ecdf68d9b0ebf829d68ee1e2894c14358c40334342423fbb5ea8f7a57
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            256.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_1194402452\Trusted Icons\Icons\256.png
            • Size 28KB
            • SHA256 90f78b856899a392438857ef6a85c50fcd1d48dde01483a3764c06a95c3d419e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_1194402452\Trusted Icons\Icons\32.png
            • Size 1KB
            • SHA256 56578e78a0175e9b89fef5927f9f41c7fdca566174daa7f47abbf8fb6d4afbd0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_1194402452\Trusted Icons\Icons\48.png
            • Size 2KB
            • SHA256 d859584cdaacb63559fdc79dde2a585db9fe163eeafeaba3427e79755d78e079
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_1194402452\Trusted Icons\Icons\64.png
            • Size 3KB
            • SHA256 7c98c778ec28216e89c3d8bfa6cdf69580e9f9e5f4c5cdb886c865f928d4af4c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            96.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_1194402452\Trusted Icons\Icons\96.png
            • Size 6KB
            • SHA256 9554b438be1edeb0dcd3b00833997fa872f0e278b6e86c74f595c474597c16d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            128.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_1906019750\Trusted Icons\Icons\128.png
            • Size 8KB
            • SHA256 05043c90fd7c795f665f7d4374673857da8ba578ef01a9563cf81bf98410de57
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            192.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_1906019750\Trusted Icons\Icons\192.png
            • Size 7KB
            • SHA256 e77ddd838401a22545cde73bc8dadabfb059ea65ef0784836c7dc823ffbb587a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            256.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_1906019750\Trusted Icons\Icons\256.png
            • Size 21KB
            • SHA256 02d9d896281e088a9ef8562cc1dce71ffba7db465f7379a0bb69ddf3dc2de52e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_1906019750\Trusted Icons\Icons\32.png
            • Size 1KB
            • SHA256 4ef6af3958daea67637a1034e4ff3910360c34f8d5bba1bd15dcdf7078bc3c77
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_1906019750\Trusted Icons\Icons\48.png
            • Size 2KB
            • SHA256 c9a6445efb6b3ed818d1e703f82f6c0445b49efc69b1480c61cdb2944114f523
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_1906019750\Trusted Icons\Icons\64.png
            • Size 3KB
            • SHA256 e7e71e63123edd2441d670e4f27134615639e695670c3fd8e566706cc2c65654
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            96.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_1906019750\Trusted Icons\Icons\96.png
            • Size 5KB
            • SHA256 360654ce87e12eca80b384779ecfcf54f95d264c5e75d5b0a4c9f9304e7610c0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            128.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_940816733\Trusted Icons\Icons\128.png
            • Size 10KB
            • SHA256 36fa37d7b13869e4ab189350764cab7b7006f24dc85b8998dba7fe6d1a229da4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            192.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_940816733\Trusted Icons\Icons\192.png
            • Size 9KB
            • SHA256 ec1370090506692a566f9572cf962fe24819c496793229adb93b4e25524bf625
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            256.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_940816733\Trusted Icons\Icons\256.png
            • Size 29KB
            • SHA256 7ca88ce2772a18613c1c30b8715bc435942cb8e112185515a342e282b449e8d5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            32.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_940816733\Trusted Icons\Icons\32.png
            • Size 1KB
            • SHA256 efeb751507c77b56963b563705e3d20325805e332988bb3e48cd891e2dd11b3c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            48.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_940816733\Trusted Icons\Icons\48.png
            • Size 2KB
            • SHA256 82fc9e7be1c1dc78bcca8c54db0fcd89e4658d542070b418b1d3f0c82e1a7389
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            64.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_940816733\Trusted Icons\Icons\64.png
            • Size 4KB
            • SHA256 88ee95cc4940438e85c0f103638c8bfc8f326bc25c7223c5f6455657b0fcb128
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            96.png
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2000_940816733\Trusted Icons\Icons\96.png
            • Size 6KB
            • SHA256 3d5cf5e1f10b583ed4f0bb84e82e5adef1dae546ff7befc7974d459ba807b542
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            trusted_vault.pb
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
            • Size 84B
            • SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
            • Size 72KB
            • SHA256 b48cc15cb8541e7a353e06a1bd734f5a9a24fe45274fc64645fe36c95b20d471
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
            • Size 72KB
            • SHA256 17e731c9d8c3a4a27d0e05ae1a31ee681240f25f4588737640565372430d7813
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
            • Size 4KB
            • SHA256 8602a2cf1cccc4471fff9fb9db6d5c3909a95ef190ba102ab58c94327b80c2a3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WinNetHelper.exe
            • Path C:\Users\Admin\AppData\Local\Temp\WinNetHelper.exe
            • Size 11.8MB
            • SHA256 9f07f940fcf4e46f75481c1dcea43e27a5d06b6b5be91e01993abbd35bac09fb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            messages.json
            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2000_933999489\CRX_INSTALL\_locales\en\messages.json
            • Size 450B
            • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            settings.dat
            • Path C:\Windows\SystemTemp\Crashpad\settings.dat
            • Size 40B
            • SHA256 1c72fbf58586c7e8806de070b9572da3e4bebbd80db57684f150c999c3e00f06
            • MD5 SHA1 SHA512
            Submit Download

            uninstall.cmd
            • Path C:\Windows\SystemTemp\Google5620_2022781074\bin\uninstall.cmd
            • Size 653B
            • SHA256 a38e49c0e87a9dd81682346392d45c965783c25d5ec6aaa373cb9799c2a602e2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater.exe
            • Path C:\Windows\SystemTemp\Google5620_2022781074\bin\updater.exe
            • Size 7.1MB
            • SHA256 c74ba01a8c2884b991f072b8990dfb9dea27ac7e6af63c075e077bf0a9f1b18e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\CR_9E0E1.tmp\setup.exe
            • Size 7.2MB
            • SHA256 4f903f4923f19cab50f12038a75701d26ea2e35f9d4a79a206deb083d36bb1b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ef3d5708-81dd-4aba-9011-87cca6bce1c0.tmp
            • Path C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping2336_1896458658\ef3d5708-81dd-4aba-9011-87cca6bce1c0.tmp
            • Size 398KB
            • SHA256 5b8d0fe5c8da35a5ae2045323edfbc180fb70513415b73ebc840fcc83fb35537
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_installer.log
            • Path C:\Windows\SystemTemp\chrome_installer.log
            • Size 31KB
            • SHA256 62360a654857d5239ca1de31f8a3e354bc0d82506b7e436077d046b47e2941f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1496-1025-0x00000208DE510000-0x00000208DE532000-memory.dmp
            Download

            memory/1652-28-0x0000000000C30000-0x0000000003382000-memory.dmp
            Download

            memory/3840-75-0x00007FF724650000-0x00007FF724A59000-memory.dmp
            Download

            memory/3840-80-0x00007FF724650000-0x00007FF724A59000-memory.dmp
            Download

            memory/3840-1027-0x00007FF724650000-0x00007FF724A59000-memory.dmp
            Download

            memory/3860-76-0x00007FF724650000-0x00007FF724A59000-memory.dmp
            Download

            memory/3860-77-0x00007FF724650000-0x00007FF724A59000-memory.dmp
            Download