Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 10:46

General

  • Target
    2026-11-11_67ffbff1b2c8109b167fa276c62bc39e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
  • Size 2.3MB
  • Sample261113-mt33xsav2x
  • SHA256 0c0a8eb4673d6bcbf76c47324e85849a335d8d6762f7f7f83af86a96e3a9e679
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-11_67ffbff1b2c8109b167fa276c62bc39e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-11_67ffbff1b2c8109b167fa276c62bc39e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4752
    • C:\Users\Admin\AppData\Local\Temp\2026-11-11_67ffbff1b2c8109b167fa276c62bc39e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-11-11_67ffbff1b2c8109b167fa276c62bc39e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe" --runasinst
      2⤵
      • Modifies trusted root certificate store through registry
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1224
      • C:\Users\Admin\AppData\Local\Temp\WH9\ChromeSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\WH9\ChromeSetup.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3780
        • C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={740233DD-F66A-303F-EFFE-912FD3654BF7}&lang=zh-CN&browser=5&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
          4⤵
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2396
          • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
            "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:5096
          • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
            "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1920
            • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:1416
            • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:3316
            • C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:2916
          • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
            "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDQwMUZGMkYtMjlENy00N0E4LTgwMzgtNzVBNzU1OTVCNTc0fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezY5NkFBNUQwLUU3MUUtNEVFRi1CMkM0LUJEOUU4MTdCNEZCN30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjE0MS4wLjczNDAuMCIgbmV4dHZlcnNpb249IjEuMy4zNi4xNTIiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7NzQwMjMzREQtRjY2QS0zMDNGLUVGRkUtOTEyRkQzNjU0QkY3fSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxNDQ5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:1300
          • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
            "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={740233DD-F66A-303F-EFFE-912FD3654BF7}&lang=zh-CN&browser=5&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{D401FF2F-29D7-47A8-8038-75A75595B574}"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            PID:5304
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:616
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:788
      • C:\Program Files (x86)\Google\Update\Install\{0B51FE1F-5DAB-42C9-A636-BF1043A41B4A}\157.0.8103.79_chrome_installer_uncompressed.exe
        "C:\Program Files (x86)\Google\Update\Install\{0B51FE1F-5DAB-42C9-A636-BF1043A41B4A}\157.0.8103.79_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{0B51FE1F-5DAB-42C9-A636-BF1043A41B4A}\gui7D79.tmp"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1816
        • C:\Program Files (x86)\Google\Update\Install\{0B51FE1F-5DAB-42C9-A636-BF1043A41B4A}\CR_51850.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{0B51FE1F-5DAB-42C9-A636-BF1043A41B4A}\CR_51850.tmp\setup.exe" --mini-installer-path="C:\Program Files (x86)\Google\Update\Install\{0B51FE1F-5DAB-42C9-A636-BF1043A41B4A}\157.0.8103.79_chrome_installer_uncompressed.exe" --archive-resource-name="CHROME.7Z" --archive-resource-type="BN" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{0B51FE1F-5DAB-42C9-A636-BF1043A41B4A}\gui7D79.tmp"
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2952
          • C:\Program Files (x86)\Google\Update\Install\{0B51FE1F-5DAB-42C9-A636-BF1043A41B4A}\CR_51850.tmp\setup.exe
            "C:\Program Files (x86)\Google\Update\Install\{0B51FE1F-5DAB-42C9-A636-BF1043A41B4A}\CR_51850.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=157.0.8103.79 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff73d1ee768,0x7ff73d1ee778,0x7ff73d1ee788
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:3140
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:804
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:3464

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          GoogleCrashHandler.exe

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\GoogleCrashHandler.exe
          • Size 302KB
          • SHA256 c94dcb40543cb405474597c7e7c9d8ef558b1422797752625db9ca4faf53689c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          GoogleCrashHandler64.exe

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\GoogleCrashHandler64.exe
          • Size 398KB
          • SHA256 5df635fd14558c0a25ceecd2ad51fbc0d129a8fe681d36ecc9e7254ae0e0a40e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          GoogleUpdate.exe

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\GoogleUpdate.exe
          • Size 167KB
          • SHA256 9a4b728a0b652056cbd312dd917adc08c72c89b6f666472f4e3d59a1b8039d89
          • MD5 SHA1 SHA512 SSDEEP TLSH

          GoogleUpdateComRegisterShell64.exe

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\GoogleUpdateComRegisterShell64.exe
          • Size 190KB
          • SHA256 55f4339688f1e72f5da0819abaa1d1f0630f39c496ec1ea0ad8e3458c8df6b02
          • MD5 SHA1 SHA512 SSDEEP TLSH

          GoogleUpdateCore.exe

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\GoogleUpdateCore.exe
          • Size 224KB
          • SHA256 dd6dd981c7f1a6673dc8cc3a0fe1fc8a54e059a9fdb0545b0dc9258299c0c546
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdate.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdate.dll
          • Size 1.9MB
          • SHA256 a249cfdb846f0dd407c14486c173163c4339eed5be208a2a7be12a0ef0e21a3d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_am.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_am.dll
          • Size 51KB
          • SHA256 2bb6e6d59d58479602f19dbf2636acac40a27cef0ed61959a9c61e561363377e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_ar.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_ar.dll
          • Size 50KB
          • SHA256 bad8390f56f21536287008f28fbc855781250a1c30dce64345a8f974117f08fb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_bg.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_bg.dll
          • Size 53KB
          • SHA256 f1aa2f7f925f43b6fd5d8fd434d245bdaf4782ba0250f5b4a3b5fef6151ffc4f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_bn.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_bn.dll
          • Size 53KB
          • SHA256 f80738a1b58eb05d5fde4d45aa1dacabf85f6ce3e1baa278cea33821992a0595
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_ca.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_ca.dll
          • Size 53KB
          • SHA256 6605e6a2ef6962229aff407f089189709217a3148cbe627d65ab8a460a3edea2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_cs.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_cs.dll
          • Size 52KB
          • SHA256 ba0c71cb9828e6e164878f584aeb028ffc4841ca9243f033793048e42ab42e24
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_da.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_da.dll
          • Size 52KB
          • SHA256 1622fe231d4ab333ba7f5a6615e4865ca2f402efb78d95e2ea45da1e0f547e73
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_de.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_de.dll
          • Size 54KB
          • SHA256 191fc4d9f7465999854f9cc1c63e41b56e4f9e6a25211daf480931eee50348eb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_el.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_el.dll
          • Size 53KB
          • SHA256 832bcff51f75fd1543ceefcb9c0dbc68ed1d81fcce202ef0cae549cc77bba8c9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_en-GB.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_en-GB.dll
          • Size 51KB
          • SHA256 4ffe246c7639860ae1436a9284b9e7d3ffd8751d520c21db34deeba5403eee9b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_en.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_en.dll
          • Size 51KB
          • SHA256 d3ea5ca450da274adad5aee038ae3e188b25fc8c4caf8112a611ca5d37de6ddf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_es-419.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_es-419.dll
          • Size 52KB
          • SHA256 85f7c532ba90dbfb188237840f6ca632b233448d9320b33acc489bb2f0c75968
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_es.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_es.dll
          • Size 54KB
          • SHA256 76134f9ee93ac9e70339c095cba2b3332242f7c1e99554866e9f1577e35fa358
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_et.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_et.dll
          • Size 51KB
          • SHA256 b81be3ea820eff9357c1e665ed6c38ebd4e69502d8eaf4caa847f2e9e77dd434
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_fa.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_fa.dll
          • Size 51KB
          • SHA256 821962d51195daf4964b4560ac5aa8195a381ad9f25084da9cec941bc7e6e650
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_fi.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_fi.dll
          • Size 52KB
          • SHA256 390a470788899787d02b5aa2798023735f20030359ea50ea1985cd1aa4a32844
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_fil.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_fil.dll
          • Size 53KB
          • SHA256 bdd2f83f6b2a0472d8d6423cd2629fc62d79552bfdbbeeca6986f42587e2858a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_fr.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_fr.dll
          • Size 53KB
          • SHA256 4f346b98a599b067642c78909eac3321b7d029e1b236f1207a5284f23e57e9e0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_gu.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_gu.dll
          • Size 53KB
          • SHA256 7a07d7519d48d046bb8c91459c693a581a2422f6917e88de306066891947bd1d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_hi.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_hi.dll
          • Size 52KB
          • SHA256 fb98c81dd564b7b31b92ae063f0748b0980594131708deb7cab1367e4bb91038
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_hr.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_hr.dll
          • Size 52KB
          • SHA256 96d1615f5b137a96c267fd24315fbd5e1e17825070d43400538b93d4302e9bf0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_hu.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_hu.dll
          • Size 52KB
          • SHA256 0d414f01587a0fa4f025aa9a5e22f18ca3936d62f5d853f1a762730a1c82de77
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_id.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_id.dll
          • Size 51KB
          • SHA256 b023a1d72ff2bb44d57d9691e7a9c2955e137cfdd4c179f3c60f6e0a30292134
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_is.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_is.dll
          • Size 51KB
          • SHA256 26c1ee86a675556167454e955ec734adb813c010bfc5bc9f230d4b9f37c2933b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_it.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_it.dll
          • Size 53KB
          • SHA256 492a8a977c052d65e7037df696fc2c3fa8c5fd66c43de508a5210e19f6127d6f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_iw.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_iw.dll
          • Size 49KB
          • SHA256 b1386f53ac8e40f01b060719e524be485b128977b8d0bb7612d1ecc988aadba6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_ja.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_ja.dll
          • Size 48KB
          • SHA256 a03e462b097377861ea1fada213d81c4da5d9f9aabf92c69d9ac8cb9fb9a0767
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_kn.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_kn.dll
          • Size 53KB
          • SHA256 9d0c70749eb3f731581c51898e6a668144be1e0ebbdb13a3f0f0a345ae8fe801
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_ko.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_ko.dll
          • Size 47KB
          • SHA256 5c37be343c04b64088343400883f67e3aeba4a382ad05144cd6dbf48f3313e1b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_lt.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_lt.dll
          • Size 51KB
          • SHA256 2616d38efc9ecd43c6fa3619f63f41601a466f476ba8fecada7773254030bec1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_lv.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_lv.dll
          • Size 52KB
          • SHA256 39b769cab5af89e6755d775ad2de6315a4f11233cf40fa4d0073f6f01c94b5b4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_ml.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_ml.dll
          • Size 55KB
          • SHA256 ca2c8816d4dd4f881fc7e4458631be959c19a034d91d5eeb3d8886c3a09e4a1f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_mr.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_mr.dll
          • Size 53KB
          • SHA256 9af66abbb49e9b77d07443d111ce5f42ba82203a89409a098d4f6b675afe8874
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_ms.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_ms.dll
          • Size 51KB
          • SHA256 1427ffbb59acba53241a01562d13a925ea3ca137494c261eeea904bb2891c384
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_nl.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_nl.dll
          • Size 53KB
          • SHA256 a02cf3939e2bbe87fdf7d34af3cd22f214153b936750bf428b41b2be05a40f58
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_no.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_no.dll
          • Size 52KB
          • SHA256 17d6de02277a807ead2f3c66d5e864cef0283b4bd982d80997eb85c394c02896
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_pl.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_pl.dll
          • Size 52KB
          • SHA256 ab6789a0d758840dd4ffa686c62962ab825ae88b176cdb8e34397e427a3d1169
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_pt-BR.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_pt-BR.dll
          • Size 52KB
          • SHA256 23175210127308d99396ddd5543c87986233febef9273b99efc7909de889eff8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_pt-PT.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_pt-PT.dll
          • Size 52KB
          • SHA256 5d5ef69118036b457edcc23f1fe0945a37237197beda0fa11e3ee44833dbdeb6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_ro.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_ro.dll
          • Size 52KB
          • SHA256 d48d79e8a4afd04f6f1294b6b7805d24c3bfffdfa2cf5bf2228b4f5631f0acbd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_ru.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_ru.dll
          • Size 51KB
          • SHA256 7b3c3ce14924ec22e814ca0b90de0b6ba1060bc2ba9f358c9cde3768e2568c09
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_sk.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_sk.dll
          • Size 52KB
          • SHA256 6bc2b9daae56c1a7c5353193536f3b43df23d2ee45fe16d645ae9c238be0b90c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_sl.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_sl.dll
          • Size 52KB
          • SHA256 68e2504fe3ad15c634fcdeae5ef03f71c4ce8e15e640c176f29d800da00d2999
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_sr.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_sr.dll
          • Size 52KB
          • SHA256 b40d1412b3aa29d9498c531c71848d28584563be8c4e99f3a70f1787f4eb7b4f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_sv.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_sv.dll
          • Size 52KB
          • SHA256 aca8748dba8b33b44e379760693656e65bca3d1e5c598e89fa7e66a2b66bfe3d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_sw.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_sw.dll
          • Size 53KB
          • SHA256 11f21da878121c472dd6516e4983998766df0957c7e223ccaf5a6076edbdb4d1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_ta.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_ta.dll
          • Size 54KB
          • SHA256 c9e5b6b07413710487a9bc36b3f429e71a18dbc720e12a5928e0e375f33c21e7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_te.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_te.dll
          • Size 53KB
          • SHA256 aac152bc0f1f8e40d000864e2f619c6e5080ed17620b38fca7770d2d6967e73b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_th.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_th.dll
          • Size 51KB
          • SHA256 db2f60e88177a18f0e27df988dde13a14ab1d1ee9360aadb44c898aab534dbc0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_tr.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_tr.dll
          • Size 52KB
          • SHA256 ca51a7a19863cea54e524f558d3fffbaf7d5c204a474ad4a15d07390a1acf8ef
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_uk.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_uk.dll
          • Size 52KB
          • SHA256 aaa8885430de708124ffcbf4f248b55c393e94078544a1a9324ed39b37b5f399
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_ur.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_ur.dll
          • Size 52KB
          • SHA256 5e1506012b963f4dbee2b75ce78e235cc4a25ee95d9047aebba2ddf173c6535d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          goopdateres_zh-CN.dll

          • Path C:\Program Files (x86)\Google\Temp\GUM1FCE.tmp\goopdateres_zh-CN.dll
          • Size 46KB
          • SHA256 045921ac478365b5dd1f358307d2236c9e238745c814c8fa38e1ae49211493db
          • MD5 SHA1 SHA512 SSDEEP TLSH

          af.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\af.pak
          • Size 567KB
          • SHA256 b5bdba83e372756cb72304b794f4d7072e3d5869764909a05fdc71fb42edac7d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          am.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\am.pak
          • Size 916KB
          • SHA256 3eb2fc05731e95c26d3756bce23839764ad3c9f6a012f950651093f6bbeba1f1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\ar.pak
          • Size 1017KB
          • SHA256 9d206d7433e1da73873e193709fe2ad903829bbfbcd216df8c096f1de9127f55
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bg.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\bg.pak
          • Size 1.0MB
          • SHA256 c7db9cb55a539726556867306709f0946a3f289a32fe246a3835d0e77165a940
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\bn.pak
          • Size 1.3MB
          • SHA256 1231bf50c97e174ff68f8f0ea88c23036fe1b49e5f44333f77832d667dd7ae9b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ca.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\ca.pak
          • Size 647KB
          • SHA256 884977b52d305b8bde059f3d638a9864369e09d69b258bc3053f65f9c5ee5c32
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cs.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\cs.pak
          • Size 661KB
          • SHA256 e1d7bfad5f9e6a7db3ab140718a9d163d1e05139ae8a0e7b14bc6dc11e20e804
          • MD5 SHA1 SHA512 SSDEEP TLSH

          da.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\da.pak
          • Size 599KB
          • SHA256 a736af5978beb5d36a38659ca454c3f43010b51993617675cc41a359fd49d2c9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\de.pak
          • Size 651KB
          • SHA256 80dcf13e064920708416d5068616304b3f3bba2034d5b8081470e573f1c04b73
          • MD5 SHA1 SHA512 SSDEEP TLSH

          el.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\el.pak
          • Size 1.1MB
          • SHA256 e2cc67c37db294c85ae30a073cb8ce33bba5a48f26bb0e5ea507549a311d463a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-GB.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\en-GB.pak
          • Size 516KB
          • SHA256 c94c5fa9512f6f3528e544963565a0b96e65fe51e0afceadb9a3bbaf4671d0bc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-US.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\en-US.pak
          • Size 522KB
          • SHA256 c7edae5b44291c263cdbdf2299734b77187a57730328214d44e16c6c403ef1f7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es-419.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\es-419.pak
          • Size 632KB
          • SHA256 88715ec58dafa5cf91be2ccb5d16559e0f0b0ab8fd775c9a09f9e3079d1cf590
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\es.pak
          • Size 629KB
          • SHA256 2cb15a961d0f29dc37172a01a88a787594828e19b3537176c1d9a7702cee72c8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          et.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\et.pak
          • Size 577KB
          • SHA256 735e7f5a06cd97d5ab2fbc049231a4ef51292eddf4d3dad2f70762357f36e8f6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fa.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\fa.pak
          • Size 951KB
          • SHA256 a626095feb097df26b32f4975ff65913772d1d82c784cdc6809155704675ccfd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fi.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\fi.pak
          • Size 585KB
          • SHA256 12ee0c74e334d222220fac29f2dd6cab7fe4d593aa773e0cb834fd691a7c1f96
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fil.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\fil.pak
          • Size 661KB
          • SHA256 dab381604d695821c10910d2f81328e059054e37b1af86f9d0fac24c3ae2b3c0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\fr.pak
          • Size 688KB
          • SHA256 b564097984304ede8809da35585fa0fe1f625831d810ef5a97c3d810d525e60c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gu.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\gu.pak
          • Size 1.3MB
          • SHA256 8c66de4d669b8152e7d532a346b55fa8d60d93e7297580c4f39f7f0a4a358126
          • MD5 SHA1 SHA512 SSDEEP TLSH

          he.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\he.pak
          • Size 833KB
          • SHA256 c47f25662bd2ae28fc2517c71ba2836cd8f62f0e893cfee1a545ae5d212a95f4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\hi.pak
          • Size 1.4MB
          • SHA256 002d69fa011981b556472372cb49474965cb510e59387eebffc7f8179496cca0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hr.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\hr.pak
          • Size 640KB
          • SHA256 1f3a6b580bfb601cda443459f96266d42e4d53408c8cd6fd52114d29bcef1256
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\hu.pak
          • Size 686KB
          • SHA256 b014ffcb54ea6e3f6aebdcf4549c7f1b5681eecb5cf4dfd341b5794c0a787b08
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\id.pak
          • Size 567KB
          • SHA256 30a6a00372aecfd421952a271fc19b5d079f3512f50866ff6caf36add6a50cb1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\it.pak
          • Size 626KB
          • SHA256 60eb9319a479c896fcb53dd5ceed6c2f87992b2fde0b02302bf31d8438f3aa21
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\ja.pak
          • Size 759KB
          • SHA256 a1618ec2708b415b2fb3ecf0ad125df69b37c4a5eab5995db04db37ffa7938df
          • MD5 SHA1 SHA512 SSDEEP TLSH

          kn.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\kn.pak
          • Size 1.5MB
          • SHA256 0f9c0c8212b0e9fa9e7b4e496cdfc7d71c779c9791aefa49b1cc59ca7e37a519
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\ko.pak
          • Size 646KB
          • SHA256 1456932f4614e6da7146ff516e1636e930ac23fb4b0f79d60118828b3046d3dd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lt.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\lt.pak
          • Size 694KB
          • SHA256 6e6bc17a6591c09bb46218c7c50237863369d9e92ecc65df914e2f72226fa38f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lv.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\lv.pak
          • Size 691KB
          • SHA256 70d9d6f55f8d05458fe40be0a90cbb279e15ad6bcdf1c9106160ad49654e56f9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ml.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\ml.pak
          • Size 1.5MB
          • SHA256 c2adbb0bddef7bec2c58dcc3d196c14ac7964d413e9eeb6d4d772d6662e82de9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mr.pak

          • Path C:\Program Files\Google\Chrome\Application\157.0.8103.79\Locales\mr.pak
          • Size 1.0MB
          • SHA256 0d1208a868b7114df10e79fa57b057f815fcff89403a86ada059a5a990dd4e62
          • MD5 SHA1 SHA512 SSDEEP TLSH

          am_FEMININE.pak

          • Path C:\Program Files\Google\Chrome\Temp\source2952_1635335532\Chrome-bin\157.0.8103.79\Locales\am_FEMININE.pak
          • Size 18B
          • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
          • MD5 SHA1 SHA512

          Bookmarks

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Bookmarks
          • Size 1KB
          • SHA256 ed4dd0c9eadbb8c38ef68b604257355a936ba80787d5bfc2de0fc0f62a6cfbd6
          • MD5 SHA1 SHA512 TLSH

          ChromeSetup.exe

          • Path C:\Users\Admin\AppData\Local\Temp\WH9\ChromeSetup.exe
          • Size 1.4MB
          • SHA256 7764082011fce2574bc359fc9ea0d1b2f13ae976f26ba1ac653829bb253fe73e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          csg_config.ini

          • Path C:\Users\Admin\AppData\Roaming\CSGDataInfo\csg_config.ini
          • Size 496B
          • SHA256 21964dcb492cc2cd68eddd3ee2ccffd66a44c81dee7293ceaff127cba81a9c62
          • MD5 SHA1 SHA512 TLSH

          csg_config.ini

          • Path C:\Users\Admin\AppData\Roaming\CSGDataInfo\csg_config.ini
          • Size 194B
          • SHA256 41d094433c59e30f0cebc031bcb23f7abada2705e90ecf415d96b812adbc2e10
          • MD5 SHA1 SHA512 TLSH

          csg_config.ini

          • Path C:\Users\Admin\AppData\Roaming\CSGDataInfo\csg_config.ini
          • Size 1KB
          • SHA256 ff76938faf8cf687c3e77dc53947affc44a6121524d7fdff499471be760c5ebd
          • MD5 SHA1 SHA512 TLSH

          csg_config.ini

          • Path C:\Users\Admin\AppData\Roaming\CSGDataInfo\csg_config.ini
          • Size 317B
          • SHA256 370bc1883b2b6325143ded2d9a558e5ea9f38a07b2e48435aa76a38a3b571b4a
          • MD5 SHA1 SHA512 TLSH