Overview

overview

6

Static

static

1

ChromeSetup.exe

windows10-2004-x64

Resubmissions

04/10/2026, 16:09

261004-tlwr7ssamd6

28/09/2026, 13:50

260928-q5ca5aws7m6

Analysis

  • user interaction
    yes
  • max time kernel
    96s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/09/2026, 13:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    ChromeSetup.exe
  • Size 10.3MB
  • Sample260928-q5ca5aws7m
  • SHA256 d0c41c72e135597876875e96195280da9a09eff3c6247d66ed797e31850d2e42
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in System32 directory 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 13 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 17 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Program Files (x86)\Google4388_323303159\bin\updater.exe
      "C:\Program Files (x86)\Google4388_323303159\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={F35FAE3E-40F4-BA25-D911-AC5E5672FD8C}&lang=sk&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1232
      • C:\Program Files (x86)\Google4388_323303159\bin\updater.exe
        "C:\Program Files (x86)\Google4388_323303159\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0xd7e5fc,0xd7e608,0xd7e614
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4140
  • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
    "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update-internal
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x12de5fc,0x12de608,0x12de614
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1244
  • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
    "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x27c,0x280,0x284,0x278,0x288,0x12de5fc,0x12de608,0x12de614
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4496
    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=1760
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5132
      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x27c,0x280,0x284,0x278,0x288,0x12de5fc,0x12de608,0x12de614
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5160
    • C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\154.0.8037.58_chrome_installer_uncompressed.exe
      "C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\154.0.8037.58_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\9d45ba61-7872-49f5-b67b-8e29e813d3e0.tmp"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5948
      • C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\CR_95392.tmp\setup.exe
        "C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\CR_95392.tmp\setup.exe" --uncompressed-archive="C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\CR_95392.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\9d45ba61-7872-49f5-b67b-8e29e813d3e0.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Network Configuration Discovery: Internet Connection Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:6020
        • C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\CR_95392.tmp\setup.exe
          "C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\CR_95392.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=154.0.8037.58 "--attachment=C:\Program Files\chrome_installer.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6d57f8568,0x7ff6d57f8578,0x7ff6d57f8588
          4⤵
          • Executes dropped EXE
          PID:6056
        • C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\CR_95392.tmp\setup.exe
          "C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\CR_95392.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:1848
          • C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\CR_95392.tmp\setup.exe
            "C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\CR_95392.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=154.0.8037.58 "--attachment=C:\Program Files\chrome_installer.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6d57f8568,0x7ff6d57f8578,0x7ff6d57f8588
            5⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            PID:5988
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff9f15c728,0x7fff9f15c734,0x7fff9f15c740
      2⤵
        PID:5084
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,2459105394391362367,11380373704340743874,262144 --field-trial-handle=2028,i,15428187873814037739,1989064439172586156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2024 /prefetch:2
        2⤵
          PID:1672
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1592,i,15133819379844005561,7671029059343689688,524288 --field-trial-handle=2028,i,15428187873814037739,1989064439172586156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2288 /prefetch:3
          2⤵
          • System Time Discovery
          PID:1716
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,1043335668916872378,4259143832086863994,524288 --field-trial-handle=2028,i,15428187873814037739,1989064439172586156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2520 /prefetch:8
          2⤵
            PID:2248
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,8183737259549524537,5311408342226239662,2097152 --field-trial-handle=2028,i,15428187873814037739,1989064439172586156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
            2⤵
              PID:4872
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,7842169090789023895,7723016776049448795,2097152 --field-trial-handle=2028,i,15428187873814037739,1989064439172586156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3320 /prefetch:1
              2⤵
                PID:3916
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,3339534882909133395,12981263962571424178,2097152 --field-trial-handle=2028,i,15428187873814037739,1989064439172586156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1688 /prefetch:2
                2⤵
                  PID:1804
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5104,i,16388408757357633729,9221549408096660195,2097152 --field-trial-handle=2028,i,15428187873814037739,1989064439172586156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5128 /prefetch:1
                  2⤵
                    PID:4860
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,3923058631540311378,17427721489475301666,524288 --field-trial-handle=2028,i,15428187873814037739,1989064439172586156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5564 /prefetch:8
                    2⤵
                      PID:5292
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5572,i,2043151850283939457,4973569715265759917,2097152 --field-trial-handle=2028,i,15428187873814037739,1989064439172586156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5564 /prefetch:1
                      2⤵
                        PID:5548
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5076,i,2131381037220435313,11185591506295503829,2097152 --field-trial-handle=2028,i,15428187873814037739,1989064439172586156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5576 /prefetch:1
                        2⤵
                          PID:5596
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3428,i,2311962111518986967,1639483909478640121,524288 --field-trial-handle=2028,i,15428187873814037739,1989064439172586156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3416 /prefetch:8
                          2⤵
                            PID:5484
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,7111220025712337006,7467402988053699137,524288 --field-trial-handle=2028,i,15428187873814037739,1989064439172586156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:8
                            2⤵
                              PID:5320
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3440,i,8415026760315735851,717144089918297106,524288 --field-trial-handle=2028,i,15428187873814037739,1989064439172586156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3408 /prefetch:8
                              2⤵
                                PID:5336
                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                              1⤵
                                PID:3992
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                1⤵
                                  PID:5468
                                • C:\Windows\system32\LogonUI.exe
                                  "LogonUI.exe" /flags:0x4 /state0:0xa3929855 /state1:0x41c64e6d
                                  1⤵
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of SetWindowsHookEx
                                  PID:652

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      uninstall.cmd
                                      • Path C:\Program Files (x86)\Google4388_323303159\bin\uninstall.cmd
                                      • Size 653B
                                      • SHA256 099592ffa867124d16c0c6d868af1214fd2b7180fa76e4eee01abf2a5cf8f044
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      updater.exe
                                      • Path C:\Program Files (x86)\Google4388_323303159\bin\updater.exe
                                      • Size 5.8MB
                                      • SHA256 810e9879fdb18d0a5d68cd455b7187c62eb44fe585346a34f17b8802ad065482
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      settings.dat
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad\settings.dat
                                      • Size 40B
                                      • SHA256 4d680965cf7d071973df82b5d89318d4940620a27190df5a31fce0d9de55328b
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      metadata.json
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
                                      • Size 130B
                                      • SHA256 223eeff7aa5f6373d9da8ee5dd9ad755e92bdfcf832bf037cf2f6bb2d26ca67f
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      prefs.json
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                      • Size 421B
                                      • SHA256 9c1ed48b68d10a8c39189d53fb9635b9660b36ef76bbd38be7b60ac752b2ecae
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      prefs.json
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                      • Size 552B
                                      • SHA256 f49f776346ef686997b0d6861364d8b5f35a23ecabbd1cfb5e973f4467eac26d
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      prefs.json
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                      • Size 420B
                                      • SHA256 41252ff467477dd298dd1b2305b5753b4a979f499f7f086156fa4787ad93e1da
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      prefs.json
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                      • Size 519B
                                      • SHA256 6d79f8080726918d2d9fa9db381b49988b8bab1db9651a409c4f5339bdc15bcd
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      updater.log
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
                                      • Size 28KB
                                      • SHA256 c1f6bfa1acb003afff4b4e6e931895d25e78a477c20ea36bd439cf3d11b4ad70
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      updater.log
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
                                      • Size 474KB
                                      • SHA256 b0e93197116d94fed676544e1115efc5aa8002073d1d5af97412ea8abf7cda21
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      updater.log
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
                                      • Size 29KB
                                      • SHA256 2956f036c4bfcdcd968f00db758b783e771dd967eeacb362c361705b226fed91
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      updater.log
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
                                      • Size 35KB
                                      • SHA256 fadc40e954f3d8772daaa8f9d564ea43363b6578ae95942f3fbeb53898cae931
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      updater.log
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
                                      • Size 38KB
                                      • SHA256 786e0d982a036f320d97f41d03dd99416216df250ca452e92194161361d8d674
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      updater_history.jsonl
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
                                      • Size 566KB
                                      • SHA256 82edddf8ad54981a7c22dcc49adc5de58218e5e6b63c9bb8b2ff5b4214ae5a88
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      updater_history.jsonl
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
                                      • Size 1KB
                                      • SHA256 2cd98449e2fe1ee87b2f0b286c36df0035c573976b8fb4cb7765df91bfef58cc
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      updater_history.jsonl
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
                                      • Size 2KB
                                      • SHA256 34fed1eb74e99b469ab2f93be099209ed4e3969541f7d4b91370721f2fc68d17
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      updater_history.jsonl
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
                                      • Size 3KB
                                      • SHA256 f1feb1d790df5451e0ca050d0d2b306aae852a9bbe22e177dd958dfc0ebca32f
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      updater_history.jsonl
                                      • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
                                      • Size 3KB
                                      • SHA256 c4714a76ff163b761e089081659207e9e938d9791d7a6ed0f5df368d590636f9
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      9d45ba61-7872-49f5-b67b-8e29e813d3e0.tmp
                                      • Path C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\9d45ba61-7872-49f5-b67b-8e29e813d3e0.tmp
                                      • Size 408KB
                                      • SHA256 03e00a031582cf69056833a2b769a671f6a6c58c7375f2f6dab9377881902fa0
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      setup.exe
                                      • Path C:\Program Files (x86)\updater_chrome_Unpacker_BeginUnzipping216_2098097636\CR_95392.tmp\setup.exe
                                      • Size 7.7MB
                                      • SHA256 c7ec6077c68525c3b595abe312e9c405e55fc28dd05002c9c460ab3e6f4e410f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      settings.dat
                                      • Path C:\Program Files\Crashpad\settings.dat
                                      • Size 40B
                                      • SHA256 aa8087381e814cbdc0ecc107d6ca4ab9bae7a682661c6b0cb63adfef07b52d19
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      1848_13435077088052023.pma
                                      • Path C:\Program Files\Google\Chrome\Application\SetupMetrics\1848_13435077088052023.pma
                                      • Size 344B
                                      • SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      6020_13435077088073683.pma
                                      • Path C:\Program Files\Google\Chrome\Application\SetupMetrics\6020_13435077088073683.pma
                                      • Size 3KB
                                      • SHA256 eb18ed65e45e01f5a16bc708d4751655c92be39f2ee908d9865ae599b9fe4e4b
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      new_chrome.exe
                                      • Path C:\Program Files\Google\Chrome\Application\new_chrome.exe
                                      • Size 4.3MB
                                      • SHA256 96512cf816b5c7d6d82b53aeb314f6c95cd971c0288202852ba56cbaec8a842a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      am_MASCULINE.pak
                                      • Path C:\Program Files\Google\Chrome\Temp\source6020_633024534\Chrome-bin\154.0.8037.58\Locales\am_MASCULINE.pak
                                      • Size 18B
                                      • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      chrome_installer.log
                                      • Path C:\Program Files\chrome_installer.log
                                      • Size 34KB
                                      • SHA256 e99c02e3dd13a242242463dcd1e349b599162b6eeb00c3e26a67bec13b037d03
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      BookmarkMergedSurfaceOrdering
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                      • Size 6B
                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      BrowsingTopicsState
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                      • Size 649B
                                      • SHA256 55252ed1f1e58d037205fd5db0cb36a3f84d85fc1fbc020c21e3ad29b27a0fbc
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      the-real-index
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                      • Size 96B
                                      • SHA256 c49e1290c85b5825016a18b62775604b327f5dffcd1d91274cf6fb8218230b53
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      SCT Auditing Pending Reports
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                      • Size 2B
                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 10KB
                                      • SHA256 d0cd7945b663a2572f0f3071fc702cac51552a00103c840be43c2b9ac845d9f3
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 12KB
                                      • SHA256 d7076b1e0748398cb91122a7517b6b1915594b289d7755e5b62b7fcb257021b6
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 13KB
                                      • SHA256 c318eb6f994c0e530a9087fb3dd31537d2ebe08c1924cbb8fbe5ffbbbc1ecea0
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Secure Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                      • Size 16KB
                                      • SHA256 33984f55ea56f159544f3428c0d50b7175e966158efbe8c0e40b6847937712db
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      the-real-index
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                      • Size 120B
                                      • SHA256 c1e8d34f160781a4fa1cf2730d1fff7a271eaf6863d9999415e528d7af42e80f
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      the-real-index~RFe5952aa.TMP
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5952aa.TMP
                                      • Size 96B
                                      • SHA256 9cbfcb013f487398d67bc7496929d898c02f528d8f3aff543555488f7a5d7fd6
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      • Size 263KB
                                      • SHA256 d70284a570d4d08245be8d3d7ec83239249b98303e9a6cb4bb1093d6ae1fcc46
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      • Size 131KB
                                      • SHA256 80aa29322a1cdffd457436e5e9f0a3ce4fae2838671a9c9fcc93af3c0d74a4f0
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      • Size 130KB
                                      • SHA256 89fbee8cf59e3c0ca36dbd0b29ba668fabe954a4561e6c4e20b3ac5921e087e3
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      • Size 263KB
                                      • SHA256 d3bca2166b2cf5664317d613686f34c955573eaf5416dca28533d311a132d415
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      • Size 264KB
                                      • SHA256 dd573ef1ec15f544844ea8d2f4354a42b231a5a216642b2a243bfd2e9ece72fb
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download