e93b38da59580cc4ac3179d53944781ab02c987353ef935cd92d891e02856f5e

Analysis

user interaction
yes
max time kernel
1802s
max time network
1788s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ungoogled-chromium_153.0.8010.47-1.1_installer_x64.exe
Size 121.6MB
Sample260922-jf6ecaba86
SHA256 e93b38da59580cc4ac3179d53944781ab02c987353ef935cd92d891e02856f5e
MD5 1fade570ba3ae5ed11b005d7706719ea
SHA1 3282117ddcb8daae29752e6c45080d1d4658822d
SHA512 5b60d6f824ca7ce590469a6f2bc6e87e62c7124716da80e4fefa9f8b11d1e0552fd28c8e6cfcd3d03137f6c5ab5e9414e1748023cb7d8260ca46bcaca7c2de0b
SSDEEP 3145728:V6zI3w7Wo55zzk1Kvu0Q2ahnL+x6lCS2BhA:V6zAw7dNHvu00xLBlCS+
TLSH
T11758339A2912D1D0D7E80FF97264769C68620CD00EE6D35A2167CBC1FBCBE6E71AD50C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
4904	setup.exe
5396	setup.exe
2724	chrome.exe
4532	chrome.exe
4892	chrome.exe
2600	chrome.exe
4456	chrome.exe
5648	chrome.exe
1632	chrome.exe
4772	chrome.exe
976	chrome.exe

Loads dropped DLL 24 IoCs

pid	Process
2724	chrome.exe
2724	chrome.exe
4532	chrome.exe
4892	chrome.exe
4532	chrome.exe
4892	chrome.exe
2600	chrome.exe
2600	chrome.exe
4456	chrome.exe
4456	chrome.exe
4532	chrome.exe
5648	chrome.exe
5648	chrome.exe
4532	chrome.exe
1632	chrome.exe
1632	chrome.exe
4532	chrome.exe
4772	chrome.exe
4772	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
976	chrome.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\chromium_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\chromium_installer.log	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4892	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345411741928899"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU\Application	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.shtml	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.svg\OpenWithProgids\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.pdf\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU\Application\AppUserModelId = "Chromium.PNVTJWE5YYDKNNBVCQWLHI2ZXU"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.xhtml\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.xhtml\OpenWithProgids\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.webp\OpenWithProgids\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\chromium	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\chromium\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Chromium\\Application\\chrome.exe\" --single-argument %1"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU\AppUserModelId = "Chromium.PNVTJWE5YYDKNNBVCQWLHI2ZXU"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.htm\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.html\OpenWithProgids\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.mhtml\OpenWithProgids\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.shtml\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.svg\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.xht\OpenWithProgids\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU\DefaultIcon	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.webp\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.pdf\OpenWithProgids\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.htm\OpenWithProgids\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.xht	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\chromium\shell\open	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU\Application\ApplicationCompany = "The Chromium Authors"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.shtml\OpenWithProgids\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU\Application\ApplicationIcon = "C:\\Users\\Admin\\AppData\\Local\\Chromium\\Application\\chrome.exe,0"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Chromium\\Application\\chrome.exe\" --single-argument %1"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\chromium\shell	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\chromium\URL Protocol	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.xhtml	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Chromium\\Application\\chrome.exe\" --single-argument %1"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU\Application\AppUserModelId = "Chromium.PNVTJWE5YYDKNNBVCQWLHI2ZXU"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.xht\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU\AppUserModelId = "Chromium.PNVTJWE5YYDKNNBVCQWLHI2ZXU"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU\Application\ApplicationIcon = "C:\\Users\\Admin\\AppData\\Local\\Chromium\\Application\\chrome.exe,0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.mhtml\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.pdf	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\chromium\shell\open\command	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Chromium\\Application\\chrome.exe,3"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.mhtml	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\CLSID	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\CLSID\{635EFA6F-08D6-4EC9-BD14-8A0FDE975159}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Chromium\\Application\\153.0.8010.47\\notification_helper.exe\""	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU\DefaultIcon	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU\shell\open\command	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU\Application\ApplicationName = "Chromium"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.webp	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU\Application\ApplicationDescription = "Access the Internet"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU\shell\open	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU\Application\ApplicationDescription = "Access the Internet"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU\Application\ApplicationCompany = "The Chromium Authors"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.htm	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU\ = "Chromium HTML Document"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU\shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU\Application	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU\Application\ApplicationName = "Chromium"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Chromium\\Application\\chrome.exe,4"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumPDF.PNVTJWE5YYDKNNBVCQWLHI2ZXU\shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\.html\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\CLSID\{635EFA6F-08D6-4EC9-BD14-8A0FDE975159}	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\CLSID\{635EFA6F-08D6-4EC9-BD14-8A0FDE975159}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\CLSID\{635EFA6F-08D6-4EC9-BD14-8A0FDE975159}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Chromium\\Application\\153.0.8010.47\\notification_helper.exe"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\ChromiumHTM.PNVTJWE5YYDKNNBVCQWLHI2ZXU\shell\open	setup.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe
976	chrome.exe
976	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	3980	ungoogled-chromium_153.0.8010.47-1.1_installer_x64.exe
Token: SeIncBasePriorityPrivilege	3980	ungoogled-chromium_153.0.8010.47-1.1_installer_x64.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeCreatePagefilePrivilege	2724	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2724	chrome.exe
2724	chrome.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4904	3980	ungoogled-chromium_153.0.8010.47-1.1_installer_x64.exe	89
PID 4904 wrote to memory of 5396	4904	setup.exe	90
PID 4904 wrote to memory of 2724	4904	setup.exe	92
PID 2724 wrote to memory of 4532	2724	chrome.exe	98
PID 2724 wrote to memory of 4892	2724	chrome.exe	99
PID 2724 wrote to memory of 2600	2724	chrome.exe	100
PID 2724 wrote to memory of 4456	2724	chrome.exe	101
PID 2724 wrote to memory of 5648	2724	chrome.exe	103
PID 2724 wrote to memory of 1632	2724	chrome.exe	102
PID 2724 wrote to memory of 4772	2724	chrome.exe	108
PID 2724 wrote to memory of 976	2724	chrome.exe	109

C:\Users\Admin\AppData\Local\Temp\ungoogled-chromium_153.0.8010.47-1.1_installer_x64.exe
"C:\Users\Admin\AppData\Local\Temp\ungoogled-chromium_153.0.8010.47-1.1_installer_x64.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Users\Admin\AppData\Local\Temp\CR_26B2D.tmp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\CR_26B2D.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\CR_26B2D.tmp\CHROME.PACKED.7Z"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Users\Admin\AppData\Local\Temp\CR_26B2D.tmp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\CR_26B2D.tmp\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:5396
- - C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --from-installer
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe
      "C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1588,i,542530544766004549,4504350445107155122,262144 --field-trial-handle=1952,i,6417917972047239553,16321929425899790014,262144 --variations-seed-version --pseudonymization-salt-handle=1956,i,12464068459732069723,12697031544280976431,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1948 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4532
  - - C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe
      "C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2068,i,8888155294607378792,13025259330163636976,524288 --field-trial-handle=1952,i,6417917972047239553,16321929425899790014,262144 --variations-seed-version --pseudonymization-salt-handle=1956,i,12464068459732069723,12697031544280976431,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2072 /prefetch:11
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Time Discovery
      PID:4892
  - - C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe
      "C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2540,i,14375955168832458895,7552982582396518986,524288 --field-trial-handle=1952,i,6417917972047239553,16321929425899790014,262144 --variations-seed-version --pseudonymization-salt-handle=1956,i,12464068459732069723,12697031544280976431,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2652 /prefetch:13
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2600
  - - C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe
      "C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=renderer --top-chrome-webui --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,18169266358251109439,17829990713798561046,1572864 --field-trial-handle=1952,i,6417917972047239553,16321929425899790014,262144 --variations-seed-version --pseudonymization-salt-handle=1956,i,12464068459732069723,12697031544280976431,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4456
  - - C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe
      "C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3632,i,672315860602734657,2814188492986618134,1572864 --field-trial-handle=1952,i,6417917972047239553,16321929425899790014,262144 --variations-seed-version --pseudonymization-salt-handle=1956,i,12464068459732069723,12697031544280976431,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1632
  - - C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe
      "C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3640,i,9480145297375788435,6677957934913020964,1572864 --field-trial-handle=1952,i,6417917972047239553,16321929425899790014,262144 --variations-seed-version --pseudonymization-salt-handle=1956,i,12464068459732069723,12697031544280976431,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5648
  - - C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe
      "C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,16910203984162681264,3210602107515117464,524288 --field-trial-handle=1952,i,6417917972047239553,16321929425899790014,262144 --variations-seed-version --pseudonymization-salt-handle=1956,i,12464068459732069723,12697031544280976431,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4772
  - - C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe
      "C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=1436,i,18378826630680284659,2045285074980914295,262144 --field-trial-handle=1952,i,6417917972047239553,16321929425899790014,262144 --variations-seed-version --pseudonymization-salt-handle=1956,i,12464068459732069723,12697031544280976431,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5276 /prefetch:10
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Network Service Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3984

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Chromium\Application\153.0.8010.47\D3DCompiler_47.dll
Size 4.5MB
SHA256 3e56c1a0867aa04cbca948b3664fcac5d51275865cd044a45a3fd6ce636ee914
MD5 ad18e66c9ba813d388576400880b0924
SHA1 6aea7765a7e115f179c805654b70333ff01a275f
SHA512 418f4aad1ba288a39bf74c79159a7be7a40bdfc3b35492beb6428a3c10d6124b36ed41cfca2200680176113eae5f6c6d3c0a7a95f60830732fa38fc0cb0a6c2f
SSDEEP 49152:3qaa1HYZcP0ot/OZLjJMLANavfP5q6SpaIx546LUbOWHHQdsCIdkTYoHjnlP0mzQ:pcP0U2xqAMXLgLDoWhfnankG
TLSH
T1BF269E56B7E850E9C1BBD138C687961BE7B1B80503305BDF02908769AF73BD16A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Chromium\Application\153.0.8010.47\chrome_100_percent.pak
Size 717KB
SHA256 b37411162032ad18062a59738ed2680f966b35a3c4c8cbdaca09e581f4fed8d2
MD5 1e8093fa2e06f4121b27303bdc433578
SHA1 8a0ad2e957cc466f37a3d923ca4ee1e2c8b2a5b4
SHA512 b534cb841ade9a3291c7648be3bd3ba553d570d68510d6c786b8779ad19a204c2a60e79482b3901254ff1970b00dd8e0c7cd72421d4d0834c142333711973be1
SSDEEP 12288:qI3HWfJwNjzgsz5B0GDJQrnKs8SNP+QSsEHeilSTe+gnzzmgpbYJblItgwZjUCrC:N32Bw7zEEmPLVbTe+gnzzmgpsbcVQt
TLSH
T1F1F412D77374AC7DFEAB1677926604B0FC735A280A42060E179BF8796913B4898D93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Chromium\Application\153.0.8010.47\chrome_200_percent.pak
Size 1.2MB
SHA256 876af4b757c780f33201f1a88b1229711db1764ebd96f6455f848b483773c4c1
MD5 056a66ce3d651e39a5799a48c92d58c1
SHA1 c96c5de0f31d91748547f7cf8a319b33b0f56e4e
SHA512 7c75d8304e2d1c092bdbd18f33c8ffa4b6eb30cc82f52f4d6b6786fd112f0713960ee8db1c10b05c9c365cf0601a4a110de6b673980e332489ab1eb463671804
SSDEEP 24576:s3WBS9n2zLmmibkFR8+mZiqr8BWhQumesXRvQt5wbJIQwuSXAk/MQ74:s3P23mNbkFRJmQ+8khQRn1Q/m8uSXAkw
TLSH
T17F5523D7D3B0DC7EDD520B77939B20E0FD7510271A62190F0B26AD7A2D13688DA96B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Local\Chromium\Application\153.0.8010.47\chrome_elf.dll
Size 2.6MB
SHA256 09aa3ec259b2b46ad9cec6d1d76e63f1130645328dcfca89eb7985ecb86ed7fc
MD5 d3002f94bcff0097ef765c7b846570f3
SHA1 6ddc549e33e7e97241feb0eebdcf5928bbe0effa
SHA512 e119f0a4a785afba3773e79d55637a7d9c8f94240f8abb958491aaeed162ab6189cae31906969ee14165cf8654eb410497f72974163c8990502d857f452a7403
SSDEEP 49152:Y8spyIh6Ob7NDE7tiGIksRhQazPa9isjzyGwSpf:Hm6Ob7FE7uY99x0
TLSH
T1BAC57B13F2D901E8D06ED1788B5B9232EA61BC454B35B6DF0A9076521F7AFE4673E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Chromium\Application\153.0.8010.47\dxcompiler.dll
Size 24.6MB
SHA256 ca63caf1f16351b90e90e4b026dc2545a27589f67e9b6d39223d6e464be4167b
MD5 b9a8d311df7f60c4137f389298eacfea
SHA1 1f371f8304d02d6cac017110370b8a8036d9d5dd
SHA512 2a7467bb3ef8152916b3cfb5bb38ef7efcd08c2d1310dfb31cfbca47892f91931e07df2054b31c7cf23075c9f1b0b457c0aac5e554a96f3a9128af820e44d5ea
SSDEEP 393216:QVoVK1fxuK9QDY72M0yinNWA0l7fqOcf6UwS3:QNJuVM0j0lGO1Z
TLSH
T1234729122686D49CC099C879C3678B268A6C30E73FA7B9DFC0F451252B79DBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Chromium\Application\153.0.8010.47\dxil.dll
Size 1.4MB
SHA256 ffd62c20d0bd7fb1d6c81d5bf4e95d712d439fb6085eaf30bc8470e8f3a5b2ad
MD5 2047ff942deb916af3aa21d5362e58ef
SHA1 568674ca02bc5d075e5211317bd4b73a9cc7763a
SHA512 132063248d3cbdaf64340d4269453147f0a57d0d8a762449f64ea779f4b18ec01d34f7f4957ae8c453af8c2ab96877c83f4e9935dbfa1f397e5141ba6b19fd74
SSDEEP 24576:1LYVCBQEc1+2sb+0hz3CGFfq2HgSScx3PGMHxvXqNzmJkutfNUAeVnptDRHradkP:1LYVzs/z3CGFf/gSVXCmeQNUAeVnBZ5
TLSH
T114657C6B62A800B9D0FFD174CA478E1BE7B2B45503B0AB9F16F446A65F277B0563E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Chromium\Application\153.0.8010.47\icudtl.dat
Size 10.3MB
SHA256 a3c6d7824935e87fed17e94c2d84b7683ef360ebc5c4ea92e2ca70f361bc9314
MD5 caf370547187dd09e3ba999c72071940
SHA1 8743e8c82e5864bea060bc0884cce68a5aba3d62
SHA512 e9b7f28af1b594a26a48a71f04dbf78969af1d722a8ee9852a6b62b1fa374eb2722745d43b54d2d301b901b3ab41e1a6a4b6a71afe60348baca6026205174cec
SSDEEP 98304:PAcBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndUj89j:PAcBhORok2HiXUxO/RJk3IWhlYntjdZj
TLSH
T1A3B62903A2EB4EC2F9FB9FB098F552779567BD49AE32805951043F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Chromium\Application\153.0.8010.47\locales\en-US.pak
Size 486KB
SHA256 c029882e9fed762e01921252e7de061a3f7305aab21c170b60176ae849f18b33
MD5 bbdf62cf97b1221363cc05feb3ca41a9
SHA1 ff76e85d5337e0fc379e0da91dda84214af5b744
SHA512 7cbeeb2e8d62c2486e5dfff3123696da41c9fdf44ba1ccf3d67b1d86decb4e1e9ebf9be00c437fe8f495f9ff810cebb6f8e717eae5cbce24743e92ebecb5628a
SSDEEP 6144:1B880n3fXsEHfCxODeWyHTPeMf9UW6qOfaYB38b8zwX:w93rHfCsMWW6q4wX
TLSH
T153B43C1FF744122A05A352A27F09A5A2FF32D06DB39112563CBD812C3377766827B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Chromium\Application\153.0.8010.47\resources.pak
Size 21.7MB
SHA256 1607e36951796a72aa02ee9876059219e791ac236349a763b18609d1b41e5c2d
MD5 6eb51a9afb3b15aa3cacc2d1295e5fb4
SHA1 de9382a4ea6b7cb49d038a1665b77bfdcb6da75f
SHA512 cc58e3bf7491727da7066f5155baa8c0bddece900bfcbe55a4157162015b234c6bdec3d19e6731b265df4ab539756f4289b2ef54e152812ea85abf65b8a3b9c4
SSDEEP 393216:DFZLZelLgg9mno8sbcOHMTwKcnyclAdl0OMh+H71kBNEDA1Dz4Z5MCPkiivBsv4:JIggXGwJNlALfMMRkBqDA1Dz4jMCPosw
TLSH
T1FD37126AB30C523BCEA343766056B2377736848A3F8762671066937C0C1FBE5BF99458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Chromium\Application\153.0.8010.47\v8_context_snapshot.bin
Size 730KB
SHA256 fcfe8defc4593e4542c5017c0247af2c49d2881fc2304cd902bdd8893c56c5f5
MD5 b8ed05ec93bf82d3b515586137460e72
SHA1 d790b42762b7399ca05e563aa9392381c3a27ce8
SHA512 a186d788190bfd052806e461b8deaa82b83ac35c2c5df8f869c05fbb9053377e635fd77e98675092f463f7d12e6ecd3d6d30e5e2670d6c89ffe0233d8b56ac27
SSDEEP 6144:At+HUxQl34OiVy2W6tMCQ7pCQ75vb1rN5ngYZAXtmsg9VOsP6wGv14IBNrveSA:/yOky2W6OCQFCQz7KdxKVRP6TTTA
TLSH
T10DF4B3BAF50B8B21CDD9173D8EAA8E4A3674F19DEE47C01B3141977CA4BD6A09F5201C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4904_13434541162433005.pma

Path C:\Users\Admin\AppData\Local\Chromium\Application\SetupMetrics\4904_13434541162433005.pma
Size 3KB
SHA256 ca1ab2b812d97b7b980b329539ba019ad73530928c9369ec8ce611c01fdf58bc
MD5 92ea46929a745f0de90c9495999928d4
SHA1 b84c2f1f053b6f8d80a81e34d454fa82c6924ce8
SHA512 5cd2e91ee940883ce200ac71e2d0128b8ffd62533aadcd40aadf0bef87202049c3ee44e420a637b9bcdc5dafadd18cd254da3e0faf3318858da9315d75c97f17
TLSH
T120712F05E784256BD0C74630CDBF8BC49FF4FD8D6600129776DA691D1BA71C48F8D216
MD5 SHA1 SHA512 TLSH

Submit Download

5396_13434541158234580.pma

Path C:\Users\Admin\AppData\Local\Chromium\Application\SetupMetrics\5396_13434541158234580.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe
Size 4.2MB
SHA256 1b82c6609289f4a9ff36485e69038c35e32c5895f6393e9eb1847417039a19cd
MD5 f302c96dd92d468a89f79b05f1efe8b8
SHA1 1ce9b2eaab04a12582ddb267e3c7e080fc5007a2
SHA512 6ff251ce8dc94c8454dda8bf9d53369eb058dc9b894fb1bc33bd0985e2c3e889e7bf1f8bea1002a1ad522109392b042cac5bad9d455119d1c338c4d2f2aa573a
SSDEEP 49152:vbobrXxB6IPrTb0M6sdN/12d94MNsIVB0to5m10wPHlTsW1V1bQ5bDykGSyPu5nn:vbMLbA4MNs7LpZf7pRSWEPU
TLSH
T174167D13F29951D8C01DC079876A9633EA71BC554B3176DF0A907B122FBAEE06B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_MASCULINE.pak

Path C:\Users\Admin\AppData\Local\Chromium\Temp\source4904_2055254081\Chrome-bin\153.0.8010.47\Locales\am_MASCULINE.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

6fdea0b8-3917-4b82-9c50-657c1d58df10.tmp

Path C:\Users\Admin\AppData\Local\Chromium\User Data\6fdea0b8-3917-4b82-9c50-657c1d58df10.tmp
Size 1KB
SHA256 6b432e3dcf4ce6de213b08bb647172a0efe470ceee99a64b15d00dbad988e063
MD5 609f367af5634f22a28b0d8f4fca8cda
SHA1 0a6ca647745208d7a61a11a6680efe645ebc8243
SHA512 9d2c28769219c1741e98f4e759fd2e2baae19026f8432c79949bb10245ad1dd1249fb87532bdb20079563b240b63a341691ba0a8c25187f92d305228cbf38c7e
TLSH
T18C1182B2A59C7A238C8466E536867A031E28B23362814E14B1DE4B6503F7EBC4D03872
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Chromium\User Data\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Google Profile.ico8ca2ed3e-95b4-4dc9-bd6d-8bd89a2554b6.tmp

Path C:\Users\Admin\AppData\Local\Chromium\User Data\Default\Google Profile.ico8ca2ed3e-95b4-4dc9-bd6d-8bd89a2554b6.tmp
Size 193KB
SHA256 efb27bb0d709e33aa2c28c9cbbf4cc334e93465a9ac246569d63fd97c02c57fd
MD5 6fcb382fc188e0e68487c5d458a654b8
SHA1 589eaa72deb716472968d575220147ef594ec145
SHA512 6d7b3bdeacee6dd76186206dfa1d6bd87fd88b21f4aa17292acbaac7b1e5c263010cdeec4c12f2ddd0ef5c6bf7c480b9f5ffe69c54c9fbd7271ba9597975ba78
SSDEEP 3072:+yvl7dpavYAmnEoMpJaPflpssPaXpLPPbg1:+elGvOEoMpcPsfg1
TLSH
T1D4145CB0BA7D2D02CF74C6309579111C6BE8BD05B891724A67CD3E13077F658DAE6B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Chromium\User Data\Default\Preferences
Size 10KB
SHA256 cef0d7b57f4a19d772057fcf74a8c7d4a1702a238bf36f0087e78a3973c31871
MD5 01f6f42253780bccc2cfb4ad880eba48
SHA1 5966ff8c96495f3e77a6c5487eec710dba3f3231
SHA512 e42327c7fb45caaa5e8fe01a49f3d8303d99ae4119cbb0d829427d999e63da8eb5344183eaa2c2fe4c1d7d04dfef7c0a3a6c4dcf4080a05c6982f6ecae239415
SSDEEP 192:zTM3BL9Gv7BgxXXc36+WNO8xu/FSowpd9yIsnZagJ2:zUhYoXk0ako5J2
TLSH
T1B422851DE924B97B5CC7D31AF969BB52D3F5102134912E44EAFC893D26EBACC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferencesefc5658f-aa9f-46ab-8af4-dfc745d4cca6.tmp

Path C:\Users\Admin\AppData\Local\Chromium\User Data\Default\Preferencesefc5658f-aa9f-46ab-8af4-dfc745d4cca6.tmp
Size 10KB
SHA256 8f449dca4338ea99a63626e7b2185eebfacc454c378afe13be69c1c8dcdb5318
MD5 3c4937b745e5d33901e4d36c5c61cfc1
SHA1 8039566e1c00458f2efa034502f8b5abd0ce5e1d
SHA512 18e4b2a90ab811d43fd6997c66510b79c3477b4cc5a06a47696cc7068285d669269079d6b97c26016ce349f7bcf4667bb5903302cb45e63b6dccc74cce13c2bc
SSDEEP 192:zTM3BL9Gv7BguXXc36+WNO8xu/FSoH9d9yIsnZagJ2:zUhYlXk0akosJ2
TLSH
T1C822961DE924B97B1CC7D31AF929BA53E7F5102134912E44EAFC893C26E7ACC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Chromium\User Data\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Chromium\User Data\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Chromium\User Data\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Chromium\User Data\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Chromium\User Data\Local State
Size 3KB
SHA256 c95fe6e4a7ec09120f025a196252948dba48b76dcad64545807e7a7880cf1ae8
MD5 a9c08f3882bdebc4c79bf9929df67f59
SHA1 d8b037c8c5132293144ca600adc61ddc267bbcc0
SHA512 e1558cdef1c2152d538ad49b76ad3ccc635dfae6debd74550295c00c26ba4f69db6e408015318daab4b23a1e88a48a4d3baa8fcb9c4bf370c22a96da302d21f6
TLSH
T1E651A524A098BDB708B2D292B1463E03CAB4A1B7B1516F94F9EC4F2D12F7AF81342513
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Chromium\User Data\Local State
Size 3KB
SHA256 43c8dac8be73ea4e04fcf2cf0992531e9c61e42aa0d5fbea996e80cb1d882ca2
MD5 f59f50c864c84aa4f515d20d07b2ba75
SHA1 a5f8aa5a26cd6f73271aedd0f1f96d3e2ace2e50
SHA512 03f825daee9c8bd2b887ab234e5824dd0f90821c466b8b191c2054ffe231a716caa43ed1bb4f507a5a373d08118a1fb8e60708aa754e4b980f2256d0e934d574
TLSH
T19151A624A098BDB748B2D292B5463E03DAB4A1B7B1516F94F9EC4F1D12F7AFC1342513
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\CR_26B2D.tmp\setup.exe
Size 6.0MB
SHA256 94320071162db4dc39e5f41c77d0516c6816d172b600647994a39a9eb03b3f33
MD5 a0fe7ab91c1703d7166b62e237a908a9
SHA1 941c346186f3d0f91fe34f24d75a1c23ec153043
SHA512 83c7661b9263318b67185fd56682f722209c823b9d41a0d4c86acf33de913685c717f319396909b670407bf90c0e02a48903901ddbc2817ba48c8bb479f5ac5a
SSDEEP 98304:TjKkzfdsDMDaf2LZ+M8aCh1YyBcHcGfkmcoxj:jzp++MLhuZX7co
TLSH
T109566B53F3A501E8D05EC974CF2991329A257C8A47B5A3EF2AD436E11A71ED47B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chromium.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chromium.lnk
Size 2KB
SHA256 85f011b28c7fd68d5036f60dc0f2f0d5dc00c90f9ebcd7bdb53a74e3ec52f2b5
MD5 a7c185c8f4056cde96fdc781b994eca5
SHA1 c0a51529d00e9b10979753390d244d8cc59e51ce
SHA512 ce4c24344d91bef50629311fecf8569abab26b2479cdb97f6d365fc53e4bb55c7cc9e9bbf37d31280cbf8c9953a329d1a7b76da2ee09002850c6b7fee2d9dac3
TLSH
T1EE41FF0BBAF81A14F3FF95795BFB77204D3FB872A25A4A1D214092491C61D054A48F3B
MD5 SHA1 SHA512 TLSH

Submit Download

Chromium.lnk

Path C:\Users\Admin\Desktop\Chromium.lnk
Size 2KB
SHA256 16716de44391694e466788ba3dc07267d0fdac65a85d1804ea5f3938cf4bb295
MD5 269e2f7684d39450aa651d4e0d35684d
SHA1 9565b44074771541bd4c6890dec8e5078de4d8d5
SHA512 8e9c5ee1526e2bb211420fe4356d1804271b0d712fd3fe2dd239b12d053d7e763baa6ea633bb818c7e8441142d8b2d99ba86c18930495bee727bf00301b7252d
TLSH
T1AD41CF07B6FD1614F3FB96796BFB77208D7FB872560A491D214092091CA2D055A88B3B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/976-1618-0x000001F6C37E0000-0x000001F6C37E1000-memory.dmp

Download

memory/976-1616-0x000001F6C37E0000-0x000001F6C37E1000-memory.dmp

Download

memory/976-1627-0x000001F6C37E0000-0x000001F6C37E1000-memory.dmp

Download

memory/976-1626-0x000001F6C37E0000-0x000001F6C37E1000-memory.dmp

Download

memory/976-1625-0x000001F6C37E0000-0x000001F6C37E1000-memory.dmp

Download

memory/976-1624-0x000001F6C37E0000-0x000001F6C37E1000-memory.dmp

Download

memory/976-1623-0x000001F6C37E0000-0x000001F6C37E1000-memory.dmp

Download

memory/976-1622-0x000001F6C37E0000-0x000001F6C37E1000-memory.dmp

Download