Edit tour

Windows Analysis Report
oBX1n79NgQ.exe

Overview

General Information

Sample name:	oBX1n79NgQ.exe renamed because original name is a hash value
Original sample name:	771a3a3272e20ce119b5090ca974095c0b831f52.exe
Analysis ID:	1447827
MD5:	de2e32e7e89454a112c83f0c5a86cc45
SHA1:	771a3a3272e20ce119b5090ca974095c0b831f52
SHA256:	8c3b98d51b59adb5b3d55a704304345930da7ed2d7fd78652bb700b0fc7fd556
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Compliance

Score:	47
Range:	0 - 100

Signatures

Changes security center settings (notifications, updates, antivirus, firewall)

Drops executables to the windows directory (C:\Windows) and starts them

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64_ra

oBX1n79NgQ.exe (PID: 7068 cmdline: "C:\Users\user\Desktop\oBX1n79NgQ.exe" MD5: DE2E32E7E89454A112C83F0C5A86CC45)

updater.exe (PID: 7128 cmdline: "C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={8D0CD419-2DAC-C85B-BCFF-DB2D99044B99}&lang=en&browser=5&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2 MD5: 95222FAEEAB2CEBE9502F2E123D5DD2A)

updater.exe (PID: 7148 cmdline: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x8d965c,0x8d9668,0x8d9674 MD5: 95222FAEEAB2CEBE9502F2E123D5DD2A)

updater.exe (PID: 6236 cmdline: "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --system --windows-service --service=update-internal MD5: 95222FAEEAB2CEBE9502F2E123D5DD2A)

updater.exe (PID: 6360 cmdline: "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x114965c,0x1149668,0x1149674 MD5: 95222FAEEAB2CEBE9502F2E123D5DD2A)

updater.exe (PID: 4180 cmdline: "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --system --windows-service --service=update MD5: 95222FAEEAB2CEBE9502F2E123D5DD2A)

updater.exe (PID: 1792 cmdline: "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x114965c,0x1149668,0x1149674 MD5: 95222FAEEAB2CEBE9502F2E123D5DD2A)

125.0.6422.113_chrome_installer.exe (PID: 6336 cmdline: "C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\125.0.6422.113_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\bdefe0a9-9fa1-476d-abba-f730b9c95120.tmp" MD5: 081A95E1BC6A90E22F4ABA75947B111A)

svchost.exe (PID: 2084 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6612 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 6712 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 6828 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6900 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7124 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 2756 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 1220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7088 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2084, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

Uses 32bit PE files

Source: oBX1n79NgQ.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: oBX1n79NgQ.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: oBX1n79NgQ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\updater.exe.pdb source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\UpdaterSetup.exe.pdb source: oBX1n79NgQ.exe
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\updater.exe.pdb0 source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\mini_installer.exe.pdb source: 125.0.6422.113_chrome_installer.exe, 00000013.00000000.2299389431.00007FF64A175000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\mini_installer.exe.pdbp source: 125.0.6422.113_chrome_installer.exe, 00000013.00000000.2299389431.00007FF64A175000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\UpdaterSetup.exe.pdb0 source: oBX1n79NgQ.exe

Spreading

Creates COM task schedule object (often to register a task for autostart)

Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Networking

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 2.19.244.127 2.19.244.127

Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://.css
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://.jpg
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: svchost.exe, 00000008.00000002.2595675854.0000023A1C471000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: updater.7z.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: updater.exe, 00000006.00000002.2586506734.00000000057DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/
Source: updater.exe, 00000006.00000003.1182984504.000000005F2A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/
Source: updater.exe, 00000006.00000002.2602007070.000000000666D000.00000004.00000010.00020000.00000000.sdmp, updater.exe, 00000006.00000002.2605201170.000000005ECB0000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000006.00000002.2586506734.00000000057D1000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000006.00000002.2586506734.00000000057DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564-463c
Source: updater.exe, 00000006.00000002.2586506734.0000000005758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com:80
Source: updater.exe, 00000006.00000002.2586506734.00000000057DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com:80/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564-4
Source: updater.exe, 00000006.00000002.2586506734.00000000057DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: updater.exe, 00000006.00000003.1182984504.000000005F2A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/
Source: updater.exe, 00000006.00000002.2586506734.00000000057D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d3
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: updater.exe, 00000006.00000002.2586506734.0000000005758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80etJoinInfo:
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://html4/loose.dtd
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://support.google.com/installer/
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://support.google.com/installer/%s?product=%s&error=%d
Source: svchost.exe, 0000000A.00000002.1367591897.000001DD04A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: updater.exe, 00000006.00000003.1182984504.000000005F2A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/
Source: updater.exe, 00000006.00000002.2605201170.000000005ECB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564-
Source: svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: updater.exe, 00000007.00000002.2586643156.000000005DE88000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000007.00000003.1161275621.000000005DEF4000.00000004.00001000.00020000.00000000.sdmp, oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: updater.exe, 00000003.00000002.2590487374.0000000057804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000005.00000002.1264591006.0000000048004000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000007.00000002.2585441245.000000005DE04000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report--annotation=prod=Update4--annotation=ver=126.0.6462.0--attachm
Source: updater.exe, 00000007.00000002.2586643156.000000005DE88000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report--initial-client-data=0x288
Source: updater.exe, 00000005.00000002.1264819126.0000000048088000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/reportH
Source: updater.exe, 00000003.00000002.2592490051.0000000057888000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/reportP
Source: updater.exe, 00000003.00000002.2591774630.0000000057850000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/reportcc(LOCALAPPDATA=C:
Source: updater.exe, 00000007.00000002.2586177812.000000005DE50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/reportcc(ProgramFiles(x86)=C:
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: https://crashpad.chromium.org/
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: updater.exe, 00000006.00000002.2586506734.00000000057DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1
Source: updater.exe, 00000006.00000002.2586506734.00000000057DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1Persistent-AuthWWW-AuthenticateVarySet-CookieGSESer
Source: svchost.exe, 0000000A.00000002.1367885661.000001DD04A59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 0000000A.00000003.1366840878.000001DD04A62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1367903297.000001DD04A65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366726106.000001DD04A6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366910911.000001DD04A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000002.1367929818.000001DD04A74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366726106.000001DD04A6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000A.00000003.1366819398.000001DD04A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000003.1366597748.000001DD04A75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000003.1367006248.000001DD04A5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366840878.000001DD04A62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000A.00000002.1367708275.000001DD04A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366819398.000001DD04A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000A.00000003.1366840878.000001DD04A62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1367903297.000001DD04A65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000A.00000002.1367824106.000001DD04A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1367060353.000001DD04A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000003.1366840878.000001DD04A62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: updater.exe, 00000002.00000002.2589112589.00000000052DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/
Source: updater.exe, 00000006.00000003.1182984504.000000005F2A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/
Source: updater.exe, 00000006.00000002.2605201170.000000005ECB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564-463
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: https://dl.google.com/update2/installers/icons/
Source: updater.exe, 00000002.00000002.2589112589.000000000527D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/update2/installers/icons/%7B8a69d345-d564-463c-aff1-a69d9e530f96%7D.bmp?lang=e
Source: svchost.exe, 0000000A.00000003.1367103659.000001DD04A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000003.1367060353.000001DD04A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000003.1366840878.000001DD04A62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000A.00000003.1367060353.000001DD04A41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366910911.000001DD04A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000A.00000002.1367929818.000001DD04A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000A.00000002.1367708275.000001DD04A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366819398.000001DD04A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: updater.exe, 00000006.00000002.2586506734.00000000057DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/0:0
Source: updater.exe, 00000006.00000003.1182984504.000000005F2A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/
Source: updater.exe, 00000006.00000002.2605201170.000000005ECB0000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000006.00000002.2586506734.00000000057D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000008.00000003.1202963770.0000023A1C332000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: updater.exe, 00000002.00000002.2589112589.00000000052DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: svchost.exe, 0000000A.00000003.1367060353.000001DD04A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000A.00000003.1367047073.000001DD04A3D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1367060353.000001DD04A41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1367033099.000001DD04A4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000002.1367708275.000001DD04A2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000A.00000002.1367885661.000001DD04A59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: updater.exe, 00000006.00000002.2586506734.00000000057B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update.googleapis.com/
Source: updater.exe, 00000006.00000002.2604609507.000000005EC74000.00000004.00001000.00020000.00000000.sdmp, oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: https://update.googleapis.com/service/update2/json
Source: updater.exe, 00000006.00000002.2605201170.000000005ECB0000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000006.00000002.2586506734.00000000057D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update.googleapis.com/service/update2/json?cup2key=14:ytON3GIV-mrFgzOBE-t567j1nDscA90wGC-BsN
Source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	String found in binary or memory: https://update.googleapis.com/service/update2/jsonhttps://clients2.google.com/cr/reporthttps://m.goo
Source: updater.exe, 00000006.00000002.2586506734.00000000057D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update.googleapis.com:443/service/update2/json?cup2key=14:ytON3GIV-mrFgzOBE-t567j1nDscA90wGC
Source: updater.exe, 00000006.00000002.2586506734.0000000005758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update.googleapis.com:4430
Source: updater.exe, 00000006.00000003.1182984504.000000005F2A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/
Source: updater.exe, 00000006.00000002.2605201170.000000005ECB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564

System Summary

Creates files inside the system directory

Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	File created: C:\Windows\SystemTemp\Google7068_17454511	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	File created: C:\Windows\SystemTemp\Google7068_17454511\UPDATER.PACKED.7Z	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	File created: C:\Windows\SystemTemp\Google7068_1700592644	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	File created: C:\Windows\SystemTemp\Google7068_1700592644\updater.7z	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	File created: C:\Windows\SystemTemp\Google7068_1700592644\bin	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	File created: C:\Windows\SystemTemp\Google7068_1700592644\bin\uninstall.cmd	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	File created: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Windows\SystemTemp\Google6236_1569822741	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Windows\SystemTemp\chrome_url_fetcher_4180_326256764	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Windows\SystemTemp\chrome_url_fetcher_4180_782093461	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Windows\SystemTemp\chrome_url_fetcher_4180_2047592324	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Windows\SystemTemp\chrome_url_fetcher_4180_2047592324\-8a69d345-d564-463c-aff1-a69d9e530f96-_125.0.6422.113_all_aogspox4cotu6xggqyym7s5hye.crx3	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\125.0.6422.113_chrome_installer.exe	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\manifest.json	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\_metadata\	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\manifest.fingerprint	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\bdefe0a9-9fa1-476d-abba-f730b9c95120.tmp	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior

Deletes files inside the Windows folder

Source: C:\Users\user\Desktop\oBX1n79NgQ.exe

File deleted: C:\Windows\SystemTemp\Google7068_1700592644\updater.7z

Jump to behavior

PE file contains executable resources (Code or Archives)

Source: oBX1n79NgQ.exe	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.4
Source: 125.0.6422.113_chrome_installer.exe.6.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.4
Source: 125.0.6422.113_chrome_installer.exe.6.dr	Static PE information: Resource name: BL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 1480068 bytes, 1 file, at 0x2c +A "setup.exe", number 1, 130 datablocks, 0x1203 compression

Sample file is different than original file name gathered from version info

Source: oBX1n79NgQ.exe, 00000000.00000000.1132671230.0000000000B90000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameupdater.exeH vs oBX1n79NgQ.exe
Source: oBX1n79NgQ.exe	Binary or memory string: OriginalFilenameupdater.exeH vs oBX1n79NgQ.exe

Uses 32bit PE files

Source: oBX1n79NgQ.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: sus24.evad.winEXE@22/32@0/4

Source: C:\Users\user\Desktop\oBX1n79NgQ.exe

File created: C:\Program Files (x86)\Google\GoogleUpdater

Jump to behavior

Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\{8a69d345-d564-463c-aff1-a69d9e530f96}[1].bmp

Jump to behavior

Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\G{D8E4A6FE-EA7A-4D20-A8C8-B4628776A101}
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Mutant created: \BaseNamedObjects\Global\G{D8E4A6FE-EA7A-4D20-A8C8-B4628776A101}
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1220:120:WilError_03
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\G{A5732CF5-E5AD-47A5-8131-DC4CCA530B02}.126.0.6462.0

Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe

File created: C:\Users\user\AppData\Local\Temp\updater-backup

Jump to behavior

Source: oBX1n79NgQ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\oBX1n79NgQ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: oBX1n79NgQ.exe	String found in binary or memory: https://dl.google.com/update2/installers/icons/
Source: oBX1n79NgQ.exe	String found in binary or memory: byteshttps://update.googleapis.com/service/update2/jsonhttps://clients2.google.com/cr/reporthttps://m.google.com/devicemanagement/data/apihttps://dl.google.com/update2/installers/icons/1:356l7w0
Source: oBX1n79NgQ.exe	String found in binary or memory: overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script>
Source: oBX1n79NgQ.exe	String found in binary or memory: http://support.google.com/installer/
Source: oBX1n79NgQ.exe	String found in binary or memory: ..\..\chrome\updater\app\app_install_win.ccUpdate success.No updates.Updater error: http://support.google.com/installer/%s?product=%s&error=%d installation completed: error category[], error_code[], extra_code1[], completion_message[], post_install_launch_command_line[]SetOemInstallState failedStoreRunTimeEnrollmentToken failed
Source: oBX1n79NgQ.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: oBX1n79NgQ.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: oBX1n79NgQ.exe	String found in binary or memory: --help display this help and exit
Source: oBX1n79NgQ.exe	String found in binary or memory: --help display this help and exit
Source: oBX1n79NgQ.exe	String found in binary or memory: asennuksen: $1oError sa pag-install: Nag-apply ang administrator ng network mo ng Group Policy na pumipigil sa pag-install: $1
Source: oBX1n79NgQ.exe	String found in binary or memory: Tapos na ang pag-install.
Source: oBX1n79NgQ.exe	String found in binary or memory: Kanselahin ang Pag-install
Source: oBX1n79NgQ.exe	String found in binary or memory: Error sa pag-install: $1
Source: oBX1n79NgQ.exe	String found in binary or memory: isvaatimuksia.fHindi na-install dahil hindi natutugunan ng iyong computer ang mga minimum na requirement sa hardware.mL'installation a
Source: oBX1n79NgQ.exe	String found in binary or memory: Inihinto ang Pag-install.
Source: oBX1n79NgQ.exe	String found in binary or memory: $1-installeerder
Source: oBX1n79NgQ.exe	String found in binary or memory: $1-Installationsprogramm
Source: oBX1n79NgQ.exe	String found in binary or memory: $1-installatieprogramma
Source: oBX1n79NgQ.exe	String found in binary or memory: $1-installasjonsprogram
Source: oBX1n79NgQ.exe	String found in binary or memory: .:Asennusvirhe: Asennusprosessin aloittaminen ei onnistunut.?Error sa pag-install: Hindi nagsimula ang proseso ng installer.GErreur d'installation
Source: oBX1n79NgQ.exe	String found in binary or memory: .LAsennusvirhe: Asennusohjelmaa ei suoritettu loppuun. Asennus on keskeytetty.LError sa pag-install: Hindi natapos ang installer. Na-abort ang pag-install.tErreur d'installation
Source: oBX1n79NgQ.exe	String found in binary or memory: Ini-install...
Source: oBX1n79NgQ.exe	String found in binary or memory: 3Asennus ei ole valmis. Haluatko varmasti perua sen?IHindi nakumpleto ang pag-install. Sigurado ka bang gusto mong kanselahin?9Installation non termin
Source: oBX1n79NgQ.exe	String found in binary or memory: uudelleen.#Hindi na-install. Pakisubukan ulit.,
Source: oBX1n79NgQ.exe	String found in binary or memory: isen virheen takia.FHindi na-install dahil sa isang internal na error sa server ng update.Q
Source: oBX1n79NgQ.exe	String found in binary or memory: ei tueta.OError sa pag-install: Invalid o hindi sinusuportahan ang filename ng installer.fErreur d'installation
Source: oBX1n79NgQ.exe	String found in binary or memory: ivityspalvelimella ei ole tiivistedataa sovelluksesta.\Hindi na-install dahil walang anumang data ng hash para sa application ang server ng update.p
Source: oBX1n79NgQ.exe	String found in binary or memory: n versiota ei tueta.QHindi na-install dahil hindi sinusuportahan ang bersyong ito ng operating system.ZL'installation a
Source: oBX1n79NgQ.exe	String found in binary or memory: maassa.AHindi na-install dahil pinaghihigpitan ang access sa bansang ito.=L'installation a
Source: oBX1n79NgQ.exe	String found in binary or memory: Ituloy ang Pag-install
Source: oBX1n79NgQ.exe	String found in binary or memory: n.\Salamat sa pag-install. Dapat mong i-restart ang lahat ng iyong browser bago gamitin ang $1.eMerci d'avoir install
Source: oBX1n79NgQ.exe	String found in binary or memory: n.SSalamat sa pag-install. Dapat mong i-restart ang iyong browser bago gamitin ang $1.aMerci d'avoir install
Source: oBX1n79NgQ.exe	String found in binary or memory: n.TSalamat sa pag-install. Dapat mong i-restart ang iyong computer bago gamitin ang $1.aMerci d'avoir install
Source: oBX1n79NgQ.exe	String found in binary or memory: .4Asennus ei onnistu, palvelin ei tunnista sovellusta.9Hindi na-install, hindi kilala ng server ang application.=Installation impossible. Le serveur ne reconna
Source: oBX1n79NgQ.exe	String found in binary or memory: onnistui, koska protokollaa ei tueta.BHindi na-install dahil sa error na hindi sinusuportahang protocol.K
Source: oBX1n79NgQ.exe	String found in binary or memory: Naghihintay sa pag-install...
Source: oBX1n79NgQ.exe	String found in binary or memory: $1-InstallationsprogrammPA
Source: oBX1n79NgQ.exe	String found in binary or memory: Ini-install...PA
Source: oBX1n79NgQ.exe	String found in binary or memory: ivityspalvelimella ei ole tiivistedataa sovelluksesta.\Hindi na-install dahil walang anumang data ng hash para sa application ang server ng update.PAp

Source: unknown	Process created: C:\Users\user\Desktop\oBX1n79NgQ.exe "C:\Users\user\Desktop\oBX1n79NgQ.exe"
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	Process created: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe "C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={8D0CD419-2DAC-C85B-BCFF-DB2D99044B99}&lang=en&browser=5&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=/components/winhttp/=1,/components/update_client/=2,/chrome/updater/=2
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Process created: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x8d965c,0x8d9668,0x8d9674
Source: unknown	Process created: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --system --windows-service --service=update-internal
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process created: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x114965c,0x1149668,0x1149674
Source: unknown	Process created: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --system --windows-service --service=update
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process created: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x114965c,0x1149668,0x1149674
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\125.0.6422.113_chrome_installer.exe "C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\125.0.6422.113_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\bdefe0a9-9fa1-476d-abba-f730b9c95120.tmp"
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	Process created: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe "C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={8D0CD419-2DAC-C85B-BCFF-DB2D99044B99}&lang=en&browser=5&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=/components/winhttp/=1,/components/update_client/=2,/chrome/updater/=2	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Process created: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x8d965c,0x8d9668,0x8d9674	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process created: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x114965c,0x1149668,0x1149674	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process created: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x114965c,0x1149668,0x1149674	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior

Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: asycfilt.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: mdmregistration.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: mdmregistration.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: omadmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: iri.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usosvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: updatepolicy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usocoreps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usoapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll	Jump to behavior

Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

PE / OLE file has a valid certificate

Source: oBX1n79NgQ.exe

Static PE information: certificate valid

PE file has a big code size

Source: oBX1n79NgQ.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Submission file is bigger than most known malware samples

Source: oBX1n79NgQ.exe

Static file information: File size 8730176 > 1048576

PE file has a big raw section

Source: oBX1n79NgQ.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2a9800
Source: oBX1n79NgQ.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x4f7a00

PE file contains a mix of data directories often seen in goodware

Source: oBX1n79NgQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: oBX1n79NgQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: oBX1n79NgQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: oBX1n79NgQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: oBX1n79NgQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: oBX1n79NgQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: oBX1n79NgQ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: oBX1n79NgQ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\updater.exe.pdb source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\UpdaterSetup.exe.pdb source: oBX1n79NgQ.exe
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\updater.exe.pdb0 source: oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\mini_installer.exe.pdb source: 125.0.6422.113_chrome_installer.exe, 00000013.00000000.2299389431.00007FF64A175000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\mini_installer.exe.pdbp source: 125.0.6422.113_chrome_installer.exe, 00000013.00000000.2299389431.00007FF64A175000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\UpdaterSetup.exe.pdb0 source: oBX1n79NgQ.exe

PE file contains a valid data directory to section mapping

Source: oBX1n79NgQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: oBX1n79NgQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: oBX1n79NgQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: oBX1n79NgQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: oBX1n79NgQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

PE file contains an invalid checksum

Source: oBX1n79NgQ.exe

Static PE information: real checksum: 0x851d88 should be: 0x858a7c

PE file contains sections with non-standard names

Source: updater.exe.0.dr	Static PE information: section name: CPADinfo
Source: updater.exe.2.dr	Static PE information: section name: CPADinfo
Source: GoogleUpdate.exe.4.dr	Static PE information: section name: CPADinfo
Source: 125.0.6422.113_chrome_installer.exe.6.dr	Static PE information: section name: .retplne

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Code function: 2_2_09ABCAEC pushfd ; iretd	2_2_09ABCAED
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Code function: 2_2_09ABCA88 push eax; iretd	2_2_09ABCA89
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Code function: 2_2_09ABEBC8 pushad ; ret	2_2_09ABEBC9

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Executable created and started: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\125.0.6422.113_chrome_installer.exe
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Executable created and started: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe			Jump to behavior

Drops PE files

Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	File created: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\125.0.6422.113_chrome_installer.exe	Jump to dropped file
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	File created: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Jump to dropped file
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	File created: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe			Jump to dropped file
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\125.0.6422.113_chrome_installer.exe			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains capabilities to detect virtual machines

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe TID: 6304	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6460	Thread sleep time: -30000s >= -30000s			Jump to behavior

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_Bios

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: svchost.exe, 0000000C.00000002.2575559149.00000227C6A4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}'
Source: svchost.exe, 0000000C.00000002.2577691516.00000227C6A64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000es
Source: updater.exe, 00000002.00000002.2589112589.000000000527D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: svchost.exe, 0000000C.00000002.2574358563.00000227C6A24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: updater.exe, 00000002.00000002.2589112589.0000000005305000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000002.00000002.2589112589.000000000527D000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000006.00000002.2586506734.0000000005790000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000006.00000002.2586506734.00000000057DF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2594577057.0000023A1C45E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2579626532.0000023A16E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000C.00000002.2572426051.00000227C6A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 0000000C.00000002.2574358563.00000227C6A24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\'
Source: updater.exe, 00000006.00000002.2586506734.00000000057B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: svchost.exe, 0000000C.00000002.2580409594.00000227C6A8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000C.00000002.2575559149.00000227C6A4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Process created: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x8d965c,0x8d9668,0x8d9674	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process created: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x114965c,0x1149668,0x1149674	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process created: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x114965c,0x1149668,0x1149674	Jump to behavior

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	Process created: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe "c:\windows\systemtemp\google7068_1700592644\bin\updater.exe" --install=appguid={8a69d345-d564-463c-aff1-a69d9e530f96}&iid={8d0cd419-2dac-c85b-bcff-db2d99044b99}&lang=en&browser=5&usagestats=0&appname=google%20chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=/components/winhttp/=1,/components/update_client/=2,/chrome/updater/=2
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Process created: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe c:\windows\systemtemp\google7068_1700592644\bin\updater.exe --crash-handler --system "--database=c:\program files (x86)\google\googleupdater\126.0.6462.0\crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=update4 --annotation=ver=126.0.6462.0 "--attachment=c:\program files (x86)\google\googleupdater\updater.log" --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x8d965c,0x8d9668,0x8d9674
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process created: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe "c:\program files (x86)\google\googleupdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=c:\program files (x86)\google\googleupdater\126.0.6462.0\crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=update4 --annotation=ver=126.0.6462.0 "--attachment=c:\program files (x86)\google\googleupdater\updater.log" --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x114965c,0x1149668,0x1149674
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process created: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe "c:\program files (x86)\google\googleupdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=c:\program files (x86)\google\googleupdater\126.0.6462.0\crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=update4 --annotation=ver=126.0.6462.0 "--attachment=c:\program files (x86)\google\googleupdater\updater.log" --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x114965c,0x1149668,0x1149674
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\125.0.6422.113_chrome_installer.exe "c:\windows\systemtemp\chrome_unpacker_beginunzipping4180_536941199\125.0.6422.113_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="c:\windows\systemtemp\chrome_unpacker_beginunzipping4180_536941199\bdefe0a9-9fa1-476d-abba-f730b9c95120.tmp"
Source: C:\Users\user\Desktop\oBX1n79NgQ.exe	Process created: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe "c:\windows\systemtemp\google7068_1700592644\bin\updater.exe" --install=appguid={8a69d345-d564-463c-aff1-a69d9e530f96}&iid={8d0cd419-2dac-c85b-bcff-db2d99044b99}&lang=en&browser=5&usagestats=0&appname=google%20chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=/components/winhttp/=1,/components/update_client/=2,/chrome/updater/=2	Jump to behavior
Source: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	Process created: C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe c:\windows\systemtemp\google7068_1700592644\bin\updater.exe --crash-handler --system "--database=c:\program files (x86)\google\googleupdater\126.0.6462.0\crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=update4 --annotation=ver=126.0.6462.0 "--attachment=c:\program files (x86)\google\googleupdater\updater.log" --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x8d965c,0x8d9668,0x8d9674	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process created: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe "c:\program files (x86)\google\googleupdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=c:\program files (x86)\google\googleupdater\126.0.6462.0\crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=update4 --annotation=ver=126.0.6462.0 "--attachment=c:\program files (x86)\google\googleupdater\updater.log" --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x114965c,0x1149668,0x1149674	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Process created: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe "c:\program files (x86)\google\googleupdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=c:\program files (x86)\google\googleupdater\126.0.6462.0\crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=update4 --annotation=ver=126.0.6462.0 "--attachment=c:\program files (x86)\google\googleupdater\updater.log" --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x114965c,0x1149668,0x1149674	Jump to behavior

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Queries volume information: C:\Program Files (x86)\Google\GoogleUpdater\prefs.json VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Queries volume information: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\prefs.json VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	Queries volume information: C:\Program Files (x86)\Google\GoogleUpdater\prefs.json VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior

Source: C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: svchost.exe, 0000000F.00000002.2581923377.0000029F2E502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000F.00000002.2581923377.0000029F2E502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	122 Masquerading	OS Credential Dumping	41 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	3 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 DLL Side-Loading	3 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	33 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	0%	ReversingLabs
C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	0%	ReversingLabs
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	0%	Virustotal	Browse
C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	0%	ReversingLabs
C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe	0%	Virustotal	Browse
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\125.0.6422.113_chrome_installer.exe	0%	ReversingLabs
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\125.0.6422.113_chrome_installer.exe	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://csp.withgoogle.com/csp/clientupdate-aus/1	0%	URL Reputation	safe
https://dev.ditu.live.com/REST/v1/Routes/	0%	URL Reputation	safe
https://dev.ditu.live.com/REST/v1/Routes/	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/v1/Routes/Driving	0%	URL Reputation	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	0%	URL Reputation	safe
https://crashpad.chromium.org/bug/new	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/v1/Routes/Walking	0%	URL Reputation	safe
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	0%	URL Reputation	safe
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	0%	URL Reputation	safe
https://dev.ditu.live.com/mapcontrol/logging.ashx	0%	URL Reputation	safe
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	0%	URL Reputation	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	0%	URL Reputation	safe
http://www.bingmapsportal.com	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	0%	URL Reputation	safe
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	0%	URL Reputation	safe
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	0%	URL Reputation	safe
https://crashpad.chromium.org/	0%	URL Reputation	safe
https://dev.ditu.live.com/REST/v1/Transit/Stops/	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/v1/Routes/	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	0%	URL Reputation	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	0%	URL Reputation	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	0%	URL Reputation	safe
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	0%	URL Reputation	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/v1/Locations	0%	URL Reputation	safe
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	0%	URL Reputation	safe
https://dev.virtualearth.net/mapcontrol/logging.ashx	0%	URL Reputation	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	0%	URL Reputation	safe
http://dl.google.com:80	0%	Avira URL Cloud	safe
https://dynamic.t	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod-C:	0%	URL Reputation	safe
https://m.google.com/devicemanagement/data/api	0%	URL Reputation	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Routes/Transit	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2-C:	0%	URL Reputation	safe
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	0%	URL Reputation	safe
http://.css	0%	Avira URL Cloud	safe
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	0%	URL Reputation	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	0%	URL Reputation	safe
https://dev.ditu.live.com/REST/v1/Locations	0%	URL Reputation	safe
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	0%	URL Reputation	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	0%	URL Reputation	safe
http://support.google.com/installer/%s?product=%s&error=%d	0%	Avira URL Cloud	safe
https://www.google.com/dl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/	0%	Avira URL Cloud	safe
https://dl.google.com/	0%	Avira URL Cloud	safe
https://dl.google.com/	0%	Virustotal		Browse
http://dl.google.com:80	0%	Virustotal		Browse
http://.jpg	0%	Avira URL Cloud	safe
http://dl.google.com/	0%	Avira URL Cloud	safe
http://dl.google.com:80/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564-4	0%	Avira URL Cloud	safe
https://www.google.com/dl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564	0%	Avira URL Cloud	safe
https://dl.google.com/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/	0%	Avira URL Cloud	safe
http://dl.google.com/	0%	Virustotal		Browse
http://www.google.com/dl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564-	0%	Avira URL Cloud	safe
http://dl.google.com/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564-463c	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://dl.google.com/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564-463	0%	Avira URL Cloud	safe
https://dl.google.com/update2/installers/icons/%7B8a69d345-d564-463c-aff1-a69d9e530f96%7D.bmp?lang=e	0%	Avira URL Cloud	safe
https://dl.google.com/update2/installers/icons/	0%	Avira URL Cloud	safe
http://support.google.com/installer/	0%	Avira URL Cloud	safe
http://dl.google.com:80/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564-4	0%	Virustotal		Browse
http://www.google.com/dl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/	0%	Avira URL Cloud	safe
http://dl.google.com/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/clientupdate-aus/1Persistent-AuthWWW-AuthenticateVarySet-CookieGSESer	0%	Avira URL Cloud	safe
https://dl.google.com/update2/installers/icons/	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	false	Avira URL Cloud: safe	unknown
https://csp.withgoogle.com/csp/clientupdate-aus/1	updater.exe, 00000006.00000002.2586506734.00000000057DF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000A.00000003.1366819398.000001DD04A67000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://dl.google.com:80	updater.exe, 00000006.00000002.2586506734.0000000005758000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000A.00000003.1367060353.000001DD04A41000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crashpad.chromium.org/bug/new	oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://.css	oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	false	Avira URL Cloud: safe	unknown
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000A.00000003.1366840878.000001DD04A62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1367903297.000001DD04A65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366726106.000001DD04A6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366910911.000001DD04A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000A.00000002.1367708275.000001DD04A2B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000A.00000002.1367824106.000001DD04A44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1367060353.000001DD04A41000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.google.com/dl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/	updater.exe, 00000006.00000003.1182984504.000000005F2A4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://support.google.com/installer/%s?product=%s&error=%d	oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	false	Avira URL Cloud: safe	unknown
https://dl.google.com/	updater.exe, 00000002.00000002.2589112589.00000000052DF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://.jpg	oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	false	Avira URL Cloud: safe	unknown
http://www.bingmapsportal.com	svchost.exe, 0000000A.00000002.1367591897.000001DD04A13000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000A.00000003.1367006248.000001DD04A5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366840878.000001DD04A62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://dl.google.com/	updater.exe, 00000006.00000002.2586506734.00000000057DF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000A.00000002.1367708275.000001DD04A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366819398.000001DD04A67000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crashpad.chromium.org/	oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/dl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564	updater.exe, 00000006.00000002.2605201170.000000005ECB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dl.google.com/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/	updater.exe, 00000006.00000003.1182984504.000000005F2A4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dl.google.com:80/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564-4	updater.exe, 00000006.00000002.2586506734.00000000057DF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.google.com/dl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564-	updater.exe, 00000006.00000002.2605201170.000000005ECB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 0000000A.00000003.1366597748.000001DD04A75000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000A.00000002.1367708275.000001DD04A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366819398.000001DD04A67000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 0000000A.00000003.1366840878.000001DD04A62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1367903297.000001DD04A65000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://dl.google.com/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564-463c	updater.exe, 00000006.00000002.2602007070.000000000666D000.00000004.00000010.00020000.00000000.sdmp, updater.exe, 00000006.00000002.2605201170.000000005ECB0000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000006.00000002.2586506734.00000000057D1000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000006.00000002.2586506734.00000000057DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 0000000A.00000003.1367060353.000001DD04A41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366910911.000001DD04A5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.2595675854.0000023A1C471000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000A.00000003.1366840878.000001DD04A62000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000A.00000003.1367047073.000001DD04A3D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1367060353.000001DD04A41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1367033099.000001DD04A4A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 0000000A.00000002.1367885661.000001DD04A59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000A.00000003.1367060353.000001DD04A41000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dl.google.com/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/-8a69d345-d564-463	updater.exe, 00000006.00000002.2605201170.000000005ECB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dl.google.com/update2/installers/icons/%7B8a69d345-d564-463c-aff1-a69d9e530f96%7D.bmp?lang=e	updater.exe, 00000002.00000002.2589112589.000000000527D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.t	svchost.exe, 0000000A.00000002.1367929818.000001DD04A70000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.8.dr	false	URL Reputation: safe	unknown
https://m.google.com/devicemanagement/data/api	oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dl.google.com/update2/installers/icons/	oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://support.google.com/installer/	oBX1n79NgQ.exe, updater.exe.2.dr, GoogleUpdate.exe.4.dr, updater.7z.0.dr	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000008.00000003.1202963770.0000023A1C332000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false	URL Reputation: safe	unknown
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.google.com/dl/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/	updater.exe, 00000006.00000003.1182984504.000000005F2A4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	svchost.exe, 0000000A.00000002.1367885661.000001DD04A59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000A.00000003.1366840878.000001DD04A62000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://dl.google.com/release2/chrome/acjptviylg6r2k4fyfeeegku2wya_125.0.6422.113/	updater.exe, 00000006.00000003.1182984504.000000005F2A4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://csp.withgoogle.com/csp/clientupdate-aus/1Persistent-AuthWWW-AuthenticateVarySet-CookieGSESer	updater.exe, 00000006.00000002.2586506734.00000000057DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 0000000A.00000003.1366939390.000001DD04A58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000A.00000002.1367929818.000001DD04A74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1366726106.000001DD04A6E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000A.00000003.1367103659.000001DD04A30000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.227	unknown	United States	15169	GOOGLEUS	false
2.19.244.127	unknown	European Union	16625	AKAMAI-ASUS	false
172.217.16.206	unknown	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447827
Start date and time:	2024-05-27 08:30:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	oBX1n79NgQ.exe renamed because original name is a hash value
Original Sample Name:	771a3a3272e20ce119b5090ca974095c0b831f52.exe
Detection:	SUS
Classification:	sus24.evad.winEXE@22/32@0/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, MoUsoCoreWorker.exe
Execution Graph export aborted for target updater.exe, PID 7128 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
02:31:18	API Interceptor	1x Sleep call for process: updater.exe modified
02:31:22	API Interceptor	2x Sleep call for process: svchost.exe modified
02:32:29	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
2.19.244.127	https://laurabingham.org/wp-content/plugins/wp-recipe-maker/downexcel.php	Get hash	malicious	Unknown	Browse
	n6N8r2Rjfa	Get hash	malicious	Unknown	Browse
	FakeWinlogon.7z	Get hash	malicious	Unknown	Browse
	https://www.google.com/search?sca_esv=559122478&rlz=1C1GCEU_enUS895US895&q=TPS7A94+%22krad%22&sa=X&ved=2ahUKEwiw4veU7_CAAxXqPEQIHZOoCygQ5t4CegQIKBAB&biw=2560&bih=1323&dpr=1	Get hash	malicious	GRQ Scam	Browse
	email (2).eml	Get hash	malicious	HTMLPhisher	Browse
	JUNE INVOICE345467564465456.xlsx	Get hash	malicious	HTMLPhisher	Browse
	EXTERNAL New InvoiceStatementFrom Exxir Capital.msg	Get hash	malicious	HTMLPhisher	Browse
	2023-03-08_1220.zip	Get hash	malicious	Emotet	Browse
	Fattura 783529.zip	Get hash	malicious	Emotet	Browse
	https://netorg4256154-my.sharepoint.com/:w:/g/personal/crpatton_workplace_org/EcSkHD8WppBIk8cqOjYd96wB--ZspsHY5nBgG84KpSd9DA?e=4%3aqFLxfz&at=9	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	TEILll7BsZ.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	92.122.104.90
	Pd3mM82Bs6.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	104.102.42.29
	c3f3d7cea638c32610d85c9c1dfdcfe3cba3dad9e932257113f07ffcac34b280_dump.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	104.102.42.29
	https://uncovered-fragrant-climb.glitch.me/public/eleventy.js.html	Get hash	malicious	HTMLPhisher	Browse	23.50.131.157
	T57QiayIem.elf	Get hash	malicious	Unknown	Browse	23.48.239.165
	M4huqujaBY.elf	Get hash	malicious	Unknown	Browse	104.78.21.180
	cVxP229sNF.elf	Get hash	malicious	Unknown	Browse	96.16.0.180
	uBgwoHPWaf.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	23.192.247.89
	QJqJic3hex.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	104.102.42.29
	HeYgs7bTvy.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	104.102.42.29

Process:	C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.501866476503355
Encrypted:	false
SSDEEP:	3:YEGSAsPMF1xf8ty:YEGMS
MD5:	2738E30424BB4F0DDDB94575F10D5F86
SHA1:	21573096ECA9B8B7B3D9D68AD6A996807631B5E1
SHA-256:	5E58028EDD1D27FB853A4B05E62BF20CFC4D042123DB9AE2E7DE01870CB18819
SHA-512:	0DCCB0267E80A74402D01B0447D9C63178473830A146B5B9C530132AC52E7C73AE940F65D2879BFA5A39F811B61B70EBCA03F85931B15CF63E69FA4F4C12E9F5
Malicious:	false
Preview:	{"active_version":"126.0.6462.0","swapping":true}

C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\20d7be24-7f19-48ac-bb8d-ec2ede596347.tmp

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.6163485660751657
Encrypted:	false
SSDEEP:	3:YURAT9:YUWT9
MD5:	AA2D0C0C72BB528CF4168EA91C1C9A56
SHA1:	67BE5A0C29B13B92DD86BA935F605C4BA7EEA2CC
SHA-256:	E03E9D262CA3B7D19E37C3A69C7D8B46BD3F5542AA555A17D864071C28257B2C
SHA-512:	6BDB9A72B73F11F7627E6FCA0EE1D417201B038CB255D445DD29E5F27DE08E99A6C4729C4C893FFE97E4BC1835532879C47CCEAA051F07B3CDAD06AD17B2D5E7
Malicious:	false
Preview:	{"qualified":false}

C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\prefs.json (copy)

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.6163485660751657
Encrypted:	false
SSDEEP:	3:YURAT9:YUWT9
MD5:	AA2D0C0C72BB528CF4168EA91C1C9A56
SHA1:	67BE5A0C29B13B92DD86BA935F605C4BA7EEA2CC
SHA-256:	E03E9D262CA3B7D19E37C3A69C7D8B46BD3F5542AA555A17D864071C28257B2C
SHA-512:	6BDB9A72B73F11F7627E6FCA0EE1D417201B038CB255D445DD29E5F27DE08E99A6C4729C4C893FFE97E4BC1835532879C47CCEAA051F07B3CDAD06AD17B2D5E7
Malicious:	false
Preview:	{"qualified":false}

C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\uninstall.cmd

Download File

Process:	C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	4.923215133873056
Encrypted:	false
SSDEEP:	12:2snTJp6rOanOFkgU4hEu8NRaPJRRmvxOgtc/aH+ndUE:7T+rjO+Z4hTb6dIa8P
MD5:	FBC297EE9060D4256192E4EDB98CAD1B
SHA1:	F305C065378AEC46EB4DACAAEEE3F866B1527105
SHA-256:	099592FFA867124D16C0C6D868AF1214FD2B7180FA76E4EEE01ABF2A5CF8F044
SHA-512:	C867D366252E5124C6560FBB42ED4473DC7546360BC1221E9FCBC192E9216D6265E41AD26A733F7566C064B136AE02E21EF5F7095FCB6AE6F65B6FBEB3401FFE
Malicious:	false
Preview:	@echo off....rem Deletes recursively the directory specified by the `--dir` command line..rem argument of the script. The directory must be an updater install path.....echo %1 %2..if not "%1"=="--dir" (.. echo "Invalid switch.".. exit 1..)....set Directory=%2....rem Validate the path is an updater path...@echo %Directory% \| FindStr /L \Google\GoogleUpdater > nul..if %ERRORLEVEL% NEQ 0 (.. echo "Invalid argument.".. exit 2..)....rem Try deleting the directory 15 times and wait one second between tries...for /L %%G IN (1,1,15) do (.. ping -n 2 127.0.0.1 > nul.. rmdir %Directory% /s /q > nul.. if not exist %Directory% exit 0..)....exit 3....

C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe

Download File

Process:	C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4794656
Entropy (8bit):	6.797091169119905
Encrypted:	false
SSDEEP:	98304:IyENIIut+hl5pU9HLOaFAIH3TcLWGO7d09GZkrCRfR:bEN2tm5pOuU3TcLWGO7djZkrC5R
MD5:	95222FAEEAB2CEBE9502F2E123D5DD2A
SHA1:	DAC0E46C7B0BC998BEE826538A3128FBE396E638
SHA-256:	B8AF4588875E697E49DB4E1FF5833EF8F89FFDE327AB9DC9FAD101551D6AEC28
SHA-512:	AAEC6212BB69D7DBF4B7D09DFA6CCFCA803835C19A5974F534F7DB2D6235E741BB404969B2695FF9487EE2C7AC2AB1F740A436332B740B45FBAF579C6E13BF4F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....H8f.........."......F5..........q............@...........................J.....A.I...@...........................>.P...p.>.......A.H.............I. )....H......>.......................>......b5...............?.......>.@....................text...'E5......F5................. ..`.rdata.. ....`5......J5.............@..@.data....t...p?..V...L?.............@....tls....q.....@.......?.............@...CPADinfo(.....A.......?.............@....rsrc...H.....A.......?.............@..@.reloc........H......8G.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\GoogleUpdater\a551b306-09a1-4111-8ae6-4879d84e3582.tmp

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	407
Entropy (8bit):	4.946335397493816
Encrypted:	false
SSDEEP:	12:YewPFPuTEf4WcLfyAGVWTUQBaHSw5iuCY:YewNPWj9yAGVWTUQBayWiub
MD5:	0C7BB1BCF5B8EE88537FEFDBFC59F8C2
SHA1:	26059A80CEA72A037DB3489D83D6A9F954814F7B
SHA-256:	03A0781EE86237A4FD90548DC218D743FA62C8B6B7F3B4E450AC1631C33AFAEC
SHA-512:	90F93BBE85AFB68E9352AB5E39C77B9FAC7FF3948DC8CB8591677258CFCE840B8519F57692BA1E0DCD4B8C525CB772E783E0F6DF5CA575BCD516ECF6658EB42F
Malicious:	false
Preview:	{"active_version":"126.0.6462.0","converted_legacy_updaters":true,"swapping":false,"updateclientdata":{"apps":{"{44fc7fe2-65ce-487c-93f4-edee46eeaaab}":{"dla":-1,"dlrc":-1,"installdate":-1,"pv":"126.0.6462.0"},"{8a69d345-d564-463c-aff1-a69d9e530f96}":{"ap":"x64-stable-statsdef_1","bc":"ONGR","cohort":"1:gu:1zzl@0.5","cohortname":"Stable","dla":6246,"dlrc":6246,"installdate":6119,"pv":"117.0.5938.132"}}}}

C:\Program Files (x86)\Google\GoogleUpdater\e7a85879-b109-406f-9f99-949ca8274942.tmp

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.937096547320463
Encrypted:	false
SSDEEP:	12:Yewj9FPuTEf4WcLfyACWTUQBaHSw5iuCY:YewjTPWj9yACWTUQBayWiub
MD5:	A2C40B49F1838639E55BC42D22FE0A12
SHA1:	79585A77CC2A43473BD5C2B421B1AF61CCBA0CED
SHA-256:	1F5D8A514DCD1C5448B3347A5C23F062ECD9181A72C9DF696202BDF1C7026B0A
SHA-512:	757398DCC0693AE03F754427FB04C202DA0162ACDC3A48DDEA0B1B49558AACF96F0951B7521D16A85BB824DDB86A0385410CFB6F5049580E1F029EBB33890074
Malicious:	false
Preview:	{"active_version":"126.0.6462.0","converted_legacy_updaters":true,"eula_required":false,"had_apps":true,"server_starts":1,"swapping":false,"updateclientdata":{"apps":{"{44fc7fe2-65ce-487c-93f4-edee46eeaaab}":{"dla":-1,"dlrc":-1,"installdate":-1,"pv":"126.0.6462.0"},"{8a69d345-d564-463c-aff1-a69d9e530f96}":{"ap":"x64-statsdef_1","bc":"ONGR","cohort":"1:gu:1zzl@0.5","cohortname":"Stable","dla":6246,"dlrc":6246,"installdate":6119,"pv":"117.0.5938.132"}}}}

C:\Program Files (x86)\Google\GoogleUpdater\f786af1e-3b2e-487d-a4b6-bf2235b87f24.tmp

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	520
Entropy (8bit):	5.011212324290353
Encrypted:	false
SSDEEP:	6:YEGMo7kXIGkiCf1FPGtTEmeHBJEHWo5DusQK4ZXQCaBTVxIUiE2FVL8pZOrRuXSY:Yewj9FPuTEf4WcLfyACW7BimpZ8RuCY
MD5:	C5690FE326AA678B9A9E8C79A815C5A2
SHA1:	ECF1E1CC436D13C4EA999B3655F21BAB3369A744
SHA-256:	3869969312BAC5417EF0BC9553F9106B9A2210304AD4BDC19F743DE846FCB5C0
SHA-512:	D6749A0454BC8AB83534ACDC34717BCA2072753114DDDE02EC9B6C2F8114F84C8421BDFF482E9065C5D717B55776A0C114802DB86CAFA98FCBCABCE11C361498
Malicious:	false
Preview:	{"active_version":"126.0.6462.0","converted_legacy_updaters":true,"eula_required":false,"had_apps":true,"server_starts":1,"swapping":false,"updateclientdata":{"apps":{"{44fc7fe2-65ce-487c-93f4-edee46eeaaab}":{"dla":-1,"dlrc":-1,"installdate":-1,"pv":"126.0.6462.0"},"{8a69d345-d564-463c-aff1-a69d9e530f96}":{"ap":"x64-statsdef_1","bc":"ONGR","cohort":"1:gu/i19:","cohortname":"Stable Installs & Version Pins","dla":6246,"dlrc":6355,"installdate":6119,"pf":"d484a09d-e1ec-442e-af08-741340bb36e5","pv":"117.0.5938.132"}}}}

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json (copy)

Download File

Process:	C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.501866476503355
Encrypted:	false
SSDEEP:	3:YEGSAsPMF1xf8ty:YEGMS
MD5:	2738E30424BB4F0DDDB94575F10D5F86
SHA1:	21573096ECA9B8B7B3D9D68AD6A996807631B5E1
SHA-256:	5E58028EDD1D27FB853A4B05E62BF20CFC4D042123DB9AE2E7DE01870CB18819
SHA-512:	0DCCB0267E80A74402D01B0447D9C63178473830A146B5B9C530132AC52E7C73AE940F65D2879BFA5A39F811B61B70EBCA03F85931B15CF63E69FA4F4C12E9F5
Malicious:	false
Preview:	{"active_version":"126.0.6462.0","swapping":true}

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RF5a14f9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.501866476503355
Encrypted:	false
SSDEEP:	3:YEGSAsPMF1xf8ty:YEGMS
MD5:	2738E30424BB4F0DDDB94575F10D5F86
SHA1:	21573096ECA9B8B7B3D9D68AD6A996807631B5E1
SHA-256:	5E58028EDD1D27FB853A4B05E62BF20CFC4D042123DB9AE2E7DE01870CB18819
SHA-512:	0DCCB0267E80A74402D01B0447D9C63178473830A146B5B9C530132AC52E7C73AE940F65D2879BFA5A39F811B61B70EBCA03F85931B15CF63E69FA4F4C12E9F5
Malicious:	false
Preview:	{"active_version":"126.0.6462.0","swapping":true}

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RF5a8c0d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.501866476503355
Encrypted:	false
SSDEEP:	3:YEGSAsPMF1xf8ty:YEGMS
MD5:	2738E30424BB4F0DDDB94575F10D5F86
SHA1:	21573096ECA9B8B7B3D9D68AD6A996807631B5E1
SHA-256:	5E58028EDD1D27FB853A4B05E62BF20CFC4D042123DB9AE2E7DE01870CB18819
SHA-512:	0DCCB0267E80A74402D01B0447D9C63178473830A146B5B9C530132AC52E7C73AE940F65D2879BFA5A39F811B61B70EBCA03F85931B15CF63E69FA4F4C12E9F5
Malicious:	false
Preview:	{"active_version":"126.0.6462.0","swapping":true}

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RF5aba32.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.501866476503355
Encrypted:	false
SSDEEP:	3:YEGSAsPMF1xf8ty:YEGMS
MD5:	2738E30424BB4F0DDDB94575F10D5F86
SHA1:	21573096ECA9B8B7B3D9D68AD6A996807631B5E1
SHA-256:	5E58028EDD1D27FB853A4B05E62BF20CFC4D042123DB9AE2E7DE01870CB18819
SHA-512:	0DCCB0267E80A74402D01B0447D9C63178473830A146B5B9C530132AC52E7C73AE940F65D2879BFA5A39F811B61B70EBCA03F85931B15CF63E69FA4F4C12E9F5
Malicious:	false
Preview:	{"active_version":"126.0.6462.0","swapping":true}

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	ASCII text, with very long lines (45447)
Category:	modified
Size (bytes):	1328893
Entropy (8bit):	6.045834959696742
Encrypted:	false
SSDEEP:	24576:/SbY9scDnPQ5+UNkM0LLwLreMwHCoCsx2YL55ZmlwHmJ6Y0QE2zRewTYtl:G70LLRHJ52ww0QErsYtl
MD5:	EE7756524B62BC1ABA4766AF93B53B1C
SHA1:	3F9CE938D15216C6ECCC7D8000688AFFD3546901
SHA-256:	6EAAFA8B224041112FE216FFFB44669C077B487C3B889E26D042E69E59A124EB
SHA-512:	135DF40C4AFD21169EB64C9A780E3AC2433135E6B55B0904306DDB9380169C62083A29CB4D074F35BDA9E631D64CF9FE44221D12C1FF6C2CC596318F4E8293D9
Malicious:	false
Preview:	[7068:7072:0527/023115.570:VERBOSE1:installer.cc(386)] "C:\Users\user\Desktop\oBX1n79NgQ.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={8D0CD419-2DAC-C85B-BCFF-DB2D99044B99}&lang=en&browser=5&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=/components/winhttp/=1,/components/update_client/=2,/chrome/updater/=2.[7128:7132:0527/023116.128:VERBOSE1:updater.cc(326)] Version: 126.0.6462.0, opt, 32 bits, command line: "C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={8D0CD419-2DAC-C85B-BCFF-DB2D99044B99}&lang=en&browser=5&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=/components/winhttp/=1,/components/update_client/=2,/chrome/updater/=2.[7128:7132:0527/023116.128:VERBOSE1:updater.cc(328)] OS version: 10.0.19045.2006, System uptime (secon

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4794656
Entropy (8bit):	6.797091169119905
Encrypted:	false
SSDEEP:	98304:IyENIIut+hl5pU9HLOaFAIH3TcLWGO7d09GZkrCRfR:bEN2tm5pOuU3TcLWGO7djZkrC5R
MD5:	95222FAEEAB2CEBE9502F2E123D5DD2A
SHA1:	DAC0E46C7B0BC998BEE826538A3128FBE396E638
SHA-256:	B8AF4588875E697E49DB4E1FF5833EF8F89FFDE327AB9DC9FAD101551D6AEC28
SHA-512:	AAEC6212BB69D7DBF4B7D09DFA6CCFCA803835C19A5974F534F7DB2D6235E741BB404969B2695FF9487EE2C7AC2AB1F740A436332B740B45FBAF579C6E13BF4F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....H8f.........."......F5..........q............@...........................J.....A.I...@...........................>.P...p.>.......A.H.............I. )....H......>.......................>......b5...............?.......>.@....................text...'E5......F5................. ..`.rdata.. ....`5......J5.............@..@.data....t...p?..V...L?.............@....tls....q.....@.......?.............@...CPADinfo(.....A.......?.............@....rsrc...H.....A.......?.............@..@.reloc........H......8G.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7946174631381349
Encrypted:	false
SSDEEP:	3072:yJjAgNE4Pj5vHcjTcyBP9UjaaQ/ka4qWn:QAgN8nj/ka4
MD5:	2E62F700DBEF6F4FD6A791B1804F4B5A
SHA1:	D87749E0A93088A08FEE21C698D668B192FAA596
SHA-256:	801EA5DD22FA71303DE1D5A23D690E5687C16A9EA817709E3883DDBBB88259FE
SHA-512:	4A664E1945E976EAC18FE6E71245295561C16398E359D8FA4D4E5DE3E3121C3A4E0579B8A5454AED1C5D7EA769D21C9C8727914893F51A64E28113835BB1B97D
Malicious:	false
Preview:	..6.........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................d6d6.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x50444f60, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7864922108122813
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/6vDfi5Wy10MctJ+t9ka4XQ0/Ykr3g16L2UPkLk+kyt4eCu3uZB:Dazaovh7uka4Es2U1RFNp3pvHzrHBHz
MD5:	F1F574BA6776F9CF62C90958FBD59CA6
SHA1:	82D6CD3059A17173504CF57C9C6E29894ABFC74E
SHA-256:	AE441D85BE6445455F44C2DB80FC86227107A1C04D0C044A1EC99EB2A8A24D4E
SHA-512:	DE6B583521752E5BC492F1CAE562F58D0CE188AFF138B30DDF9DCBD213D291F131396A414FEE71722CBA4EA33030E718C788B6F4E88BE3FD239E3798437608CC
Malicious:	false
Preview:	PDO`... ...............X\...;...{......................0.z...... ...{.......\|..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................+.....\|.7................nd.......\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08165831017916597
Encrypted:	false
SSDEEP:	3:9Pll/EYeE8ZQjoWjvegMsjv/Ss/IGYZX/tgZQjl1ollSdLvl+/rS56/:9PXEzXZQdjGxsYSQZeQN0e
MD5:	E9C25FE9F9A52D9FDEB833DD4D309CB6
SHA1:	3980A63D56271DC7B50ABF15846C95DCEFD5AB1E
SHA-256:	8CC2DA718D35E6C751EE87AA5C724095E05DABF9DB2786B325E750DD0953D498
SHA-512:	DE95E137CD971C92103762E347BDC690A46D68D872F163E5BB07079FF52E415CDCD2DE9B89CFC6949CEE9C542B866D095F491581EF6872AA37F4A73656E420BC
Malicious:	false
Preview:	.Y.!.....................................;...{.......\|... ...{........... ...{... ...{..#.#.. ...{.\|................nd.......\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.f89ee6fd-e514-48d1-a431-e731cf2d05b9.1.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	1.188324460838318
Encrypted:	false
SSDEEP:	12:o+jqPqF69Fq5jU38lQk56GWtbgjO3s7Nxk56GZkt6LBSk8pFvw+N:nc1gQGtm2jGtZtDeFHN
MD5:	7A8A613976B7B7669E886D35D8110087
SHA1:	292A74890C0E54BEE5469A5962559AA29BE1FFE4
SHA-256:	63D53541E207022EC2CA940B01A0E429F49167780DF7D6AA01A70A5143EE9F96
SHA-512:	FC0A4F8477778EC2B46DB657FFE0830D8015A13ECB5699DD450635DDBB94B58ED34A44C1D4592F60E29692E5D2CB3EA82490F62C7B468A6598ACC81863B90B61
Malicious:	false
Preview:	............................................................................D............(.....................eJ..............Zb..K....(......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................S.@.Y...........(.............U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.U.S.O.S.h.a.r.e.d.\.L.o.g.s.\.S.y.s.t.e.m.\.U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...f.8.9.e.e.6.f.d.-.e.5.1.4.-.4.8.d.1.-.a.4.3.1.-.e.7.3.1.c.f.2.d.0.5.b.9...1...e.t.l...........P.P..........(.....................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\{8a69d345-d564-463c-aff1-a69d9e530f96}[1].bmp

Download File

Process:	C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe
File Type:	PC bitmap, Windows 3.x format, 92 x 24 x 24, resolution 2835 x 2835 px/m, cbSize 6678, bits offset 54
Category:	modified
Size (bytes):	6678
Entropy (8bit):	3.742120780049679
Encrypted:	false
SSDEEP:	96:ITfMHLJWJLJJJGKJYJh5W8JxZpkuhfnQ3t2ms3kglj:I0x51aLfsNj
MD5:	64C3009B9F0526A4FD2C8A9825B86F7D
SHA1:	F501929B39E6488F26EFE5FAB3AB71EC879DE6AD
SHA-256:	B49EDF5F970FA5B4D0608C2934053929E20D54C5E052164B4D2B375F2CB7E409
SHA-512:	DECB6594DA8F5713A5DD9F0F80266BE9A0B3DE6A09EF3C45A0C28A10AF7977CF06A817A2D867F10F5F376475DB2D11CD21BC5F1D1D969162FCFF50F2053EACE9
Malicious:	false
Preview:	BM........6...(...\................................................................................................................................................................................................................................................................................................................................................}.Fb..T..L..?..K..d..........................................................................................................................................................................................................................................................e.#\..[..Y..V..Q.#F..@..B..C..G...............................................................................................................................................................................................................................................M^..Z..Y..Y..Y..X..S..M.sA..@..@..@..C.._............................................................

C:\Users\user\AppData\Local\Temp\~DFD6B7B8DB9D6FB665.TMP

Download File

Process:	C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	3.8505081657468243
Encrypted:	false
SSDEEP:	96:vTfMHLJWJLJJJGKJYJh5W8JxZpkuhfnQ3t2ms3kgl:v0x51aLfsN
MD5:	5C2E7CBBA073E1B3A400453E928C9643
SHA1:	268CF1D9FB0DAB1F9496CE81144504B1C351CCCC
SHA-256:	0BE327163809789793EF4C602FE1A1687212E7D7A9B03D62B784CD8845AB4D38
SHA-512:	4DB4728F46F45BF1458284D8C5370906FDB34CEDF50FE0DD8DEAF797A70823087A74D076D104AB79906AB83C2E5A087290E3C7F0344D4AF4F38F61CC542561D2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.245270539372925
Encrypted:	false
SSDEEP:	48:FaqdF78F7B+AAHdKoqKFxcxkFiF7KaqdF7tZ+AAHdKoqKFxcxkF/z:cEOB+AAsoJjykePE7+AAsoJjykh
MD5:	3C58A9B46096F9BFDC7B848AAD3CB150
SHA1:	1224F55355BAB0B537D39628391B32B3B9F924B5
SHA-256:	7E9A078AFEE10775CFDF4EA8DCA1357C25CE484812C8A4A1C6FC6D2DBE34FA25
SHA-512:	74D28B3B7821E74C21ED0984F22EAAA7AF4F81D8254F4ACB2468BAFF1828DA61CDCF76DD1C40CD7ACF00C80381F2198B3FA0D4CC631017FFDB90D35230FE4459
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. O.c.t. .. 0.6. .. 2.0.2.3. .1.1.:.3.5.:.2.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\SystemTemp\Google7068_1700592644\bin\uninstall.cmd

Download File

Process:	C:\Users\user\Desktop\oBX1n79NgQ.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	4.923215133873056
Encrypted:	false
SSDEEP:	12:2snTJp6rOanOFkgU4hEu8NRaPJRRmvxOgtc/aH+ndUE:7T+rjO+Z4hTb6dIa8P
MD5:	FBC297EE9060D4256192E4EDB98CAD1B
SHA1:	F305C065378AEC46EB4DACAAEEE3F866B1527105
SHA-256:	099592FFA867124D16C0C6D868AF1214FD2B7180FA76E4EEE01ABF2A5CF8F044
SHA-512:	C867D366252E5124C6560FBB42ED4473DC7546360BC1221E9FCBC192E9216D6265E41AD26A733F7566C064B136AE02E21EF5F7095FCB6AE6F65B6FBEB3401FFE
Malicious:	false
Preview:	@echo off....rem Deletes recursively the directory specified by the `--dir` command line..rem argument of the script. The directory must be an updater install path.....echo %1 %2..if not "%1"=="--dir" (.. echo "Invalid switch.".. exit 1..)....set Directory=%2....rem Validate the path is an updater path...@echo %Directory% \| FindStr /L \Google\GoogleUpdater > nul..if %ERRORLEVEL% NEQ 0 (.. echo "Invalid argument.".. exit 2..)....rem Try deleting the directory 15 times and wait one second between tries...for /L %%G IN (1,1,15) do (.. ping -n 2 127.0.0.1 > nul.. rmdir %Directory% /s /q > nul.. if not exist %Directory% exit 0..)....exit 3....

C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe

Download File

Process:	C:\Users\user\Desktop\oBX1n79NgQ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4794656
Entropy (8bit):	6.797091169119905
Encrypted:	false
SSDEEP:	98304:IyENIIut+hl5pU9HLOaFAIH3TcLWGO7d09GZkrCRfR:bEN2tm5pOuU3TcLWGO7djZkrC5R
MD5:	95222FAEEAB2CEBE9502F2E123D5DD2A
SHA1:	DAC0E46C7B0BC998BEE826538A3128FBE396E638
SHA-256:	B8AF4588875E697E49DB4E1FF5833EF8F89FFDE327AB9DC9FAD101551D6AEC28
SHA-512:	AAEC6212BB69D7DBF4B7D09DFA6CCFCA803835C19A5974F534F7DB2D6235E741BB404969B2695FF9487EE2C7AC2AB1F740A436332B740B45FBAF579C6E13BF4F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....H8f.........."......F5..........q............@...........................J.....A.I...@...........................>.P...p.>.......A.H.............I. )....H......>.......................>......b5...............?.......>.@....................text...'E5......F5................. ..`.rdata.. ....`5......J5.............@..@.data....t...p?..V...L?.............@....tls....q.....@.......?.............@...CPADinfo(.....A.......?.............@....rsrc...H.....A.......?.............@..@.reloc........H......8G.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SystemTemp\Google7068_1700592644\updater.7z

Download File

Process:	C:\Users\user\Desktop\oBX1n79NgQ.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	4795504
Entropy (8bit):	6.797272378551999
Encrypted:	false
SSDEEP:	98304:0yENIIut+hl5pU9HLOaFAIH3TcLWGO7d09GZkrCRfRX:nEN2tm5pOuU3TcLWGO7djZkrC5RX
MD5:	6DAE9FBB56642743BE1FC8BDEDB791C2
SHA1:	0D7C375E7BB378190D142F85D5DDCBA8F0675F07
SHA-256:	04C4C27BC623E52C1A348924D3FFB4827663888141259F211890B34424AE5AE4
SHA-512:	DC609BAC461FB84973F976B860FCD858B385A55CD53E6FF6A5329471E5EB20C13042AF305F4A7D121B9E21AF1D8DF7E199F7AD207F7653E1B856229858A132CE
Malicious:	false
Preview:	7z..'.....:.,,I.....$..........@echo off....rem Deletes recursively the directory specified by the `--dir` command line..rem argument of the script. The directory must be an updater install path.....echo %1 %2..if not "%1"=="--dir" (.. echo "Invalid switch.".. exit 1..)....set Directory=%2....rem Validate the path is an updater path...@echo %Directory% \| FindStr /L \Google\GoogleUpdater > nul..if %ERRORLEVEL% NEQ 0 (.. echo "Invalid argument.".. exit 2..)....rem Try deleting the directory 15 times and wait one second between tries...for /L %%G IN (1,1,15) do (.. ping -n 2 127.0.0.1 > nul.. rmdir %Directory% /s /q > nul.. if not exist %Directory% exit 0..)....exit 3....MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....H8f.........."......F5..........q............@...........................J.....A.I...@...........................>.P...p.>.......A.H.............I. )....H......>.......................>

C:\Windows\SystemTemp\Google7068_17454511\UPDATER.PACKED.7Z

Download File

Process:	C:\Users\user\Desktop\oBX1n79NgQ.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	4795634
Entropy (8bit):	6.797251972564827
Encrypted:	false
SSDEEP:	98304:0yENIIut+hl5pU9HLOaFAIH3TcLWGO7d09GZkrCRfRO:nEN2tm5pOuU3TcLWGO7djZkrC5RO
MD5:	C5A5386E06DFEAADE687B981D6845FA9
SHA1:	FDB52DBDF5832EE99003725F0FB05775FED11A0D
SHA-256:	8091E8858BAAE8D9DE5680C22322DCB4E4CE888AFC021E418DB29B7165483AFC
SHA-512:	1D03FA9ED5916DA8DF7910E47EC274DA6B9BAA6447630E591013CDD4E4833B2FF8F43060AA984DA31DF62E0EC01ABCB705AD5D4A08872C43295D904562C38B33
Malicious:	false
Preview:	7z..'......rp,I.....b.......AUv.7z..'.....:.,,I.....$..........@echo off....rem Deletes recursively the directory specified by the `--dir` command line..rem argument of the script. The directory must be an updater install path.....echo %1 %2..if not "%1"=="--dir" (.. echo "Invalid switch.".. exit 1..)....set Directory=%2....rem Validate the path is an updater path...@echo %Directory% \| FindStr /L \Google\GoogleUpdater > nul..if %ERRORLEVEL% NEQ 0 (.. echo "Invalid argument.".. exit 2..)....rem Try deleting the directory 15 times and wait one second between tries...for /L %%G IN (1,1,15) do (.. ping -n 2 127.0.0.1 > nul.. rmdir %Directory% /s /q > nul.. if not exist %Directory% exit 0..)....exit 3....MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....H8f.........."......F5..........q............@...........................J.....A.I...@...........................>.P...p.>.......A.H.............I. )....H

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\125.0.6422.113_chrome_installer.exe

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	113062448
Entropy (8bit):	7.999993331426941
Encrypted:	true
SSDEEP:	3145728:SzAO4gB/Ni7twFa5fqNKMQbYSaRDyLF03xpO+2FRla:YAHmeDnTZOm+2FRU
MD5:	081A95E1BC6A90E22F4ABA75947B111A
SHA1:	6B19BA41A0D3AB1BA59599A48046C777DD747117
SHA-256:	8869D64F87816FE5365A5E0AC5AF479EB309D62A32A9D22816755B9BCA9DB284
SHA-512:	3D9E2C04735614FF4F743886A28BD36CB2A4F4EBBF6A0E97258A70ADBF7EF590529A59B84DBF8BDDBE1D52457075FFBB77ADA53DAC189E10724D7C5C05664690
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....6Nf.........."......6..........P=.........@.............................@............`..................................................Y..P.......$.......p......0L...0..$....X..............................PP..@...........X[...............................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data........p.......P..............@....pdata..p............R..............@..@.retplne.............V...................rsrc...$............X..............@..@.reloc..$....0.....................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1459
Entropy (8bit):	5.990928431982429
Encrypted:	false
SSDEEP:	24:pZRj/flT6rH50opRstVmdYpv7aoXlwhxo4IKACjxJxqOoXp/QRouRWhv4MX0Xh:p/h6dMtAdYpv7aklwnNIK1QOkZ0RWhva
MD5:	3AA3E0093BDEE2792E941EAD76997BBE
SHA1:	FF14E5FCDEE3D8FD8A8A0AB9A826568D6EF740DC
SHA-256:	61866F067AF70A37BC324D43BE7874E58EC4BB1D54A46227960DEEEAB3D1416E
SHA-512:	572137B3484FC8F8B44234737B03D5B299C0AB1697DE0AE1CDFC63AEE7A2D0A7198D8939A66FE4012EAA211A94345E33ACF5D8B7F80CAEA78181A050E36FEFC6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjUuMC42NDIyLjExM19jaHJvbWVfaW5zdGFsbGVyLmV4ZSIsInJvb3RfaGFzaCI6IlI4Zk9QQzQwLVZ6MzBta0ZBcmMwNVNBbXhZQUlockVrSXN4WXpxOE5zQjAifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoicURqLWVtQkRxR2dFUUloQkFCb0lyMzQ2R0xwaVpBWXgyNHZvQ0hKX3lUayJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImhnYXBwamxhamVhZGRjaGJrb29ob2FjZG9laGdjbGJqIiwiaXRlbV92ZXJzaW9uIjoiMTI1LjAuNjQyMi4xMTMiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"NRF6aKQ-HBFAd1Rpquix2170Apxac43NLPnvAWYG94VPOybJ7UpQ1tMb4Ay47dqlftMpoNKIzbbv3l3uka0Gw6jUNg1sF_8xITETOXw3RI5xAs9NwcyfvdBSAWDWgS_FBXvXGbHF1ZinmgeTaI5GTyQVRl8U1QYcFTAXepqvI1lHuLAkjmD6hBDBDcM_AfzXcdoyPSu76xNgPnpU60t1_9jTMaPM7T28PW0BVY5xtjFGzkJten42b4FlMaiWSCvud9GAKSktraq1vtebmjhb7jbYt_GShwuGTabomDWyWHz0mo7bZSpwjTG

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\bdefe0a9-9fa1-476d-abba-f730b9c95120.tmp

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65533), with no line terminators
Category:	dropped
Size (bytes):	646139
Entropy (8bit):	6.022417709736822
Encrypted:	false
SSDEEP:	12288:noUVsxkhg/L55Z0SulglHmJAdY0GhE2amRhELEImtYlNDtg:noCsx2YL55ZmlwHmJ6Y0QE2zRewTYtg
MD5:	156C30C8FF6F86C572A4C1F6C56A5D18
SHA1:	D439791E116F76815C503F9526CD47C775D72CA3
SHA-256:	80643F1A399CB74ECC8E3AE38FAB16F1C01C8FBBB87744B9D42A799C55A090F9
SHA-512:	3463344E3B1C6FD3CDE8C926EB6A560A5EDAFF7BC3E84706CAF32BC74F77CA70174C2E1979913082C793EF134D6658027A6597109B3AF62DD0B9CE58A48202F5
Malicious:	false
Preview:	.{"variations_compressed_seed":"H4sIAAAAAAAA\/+z9eZwcyVknjHdWdffMhDSaUuhqla5WjqRpaUY1Vdl1zuFx9SV1jVpqV7UO25hSZmV0VU5nZRaZWd3qwbD2LLbhw+6awxjf5viw2D8wxh6z\/i2HDS+zL8Zgv8uxNrCAFy\/LrjE3u2vsl4X3kxGZWRl5VZZmPGfbf2i68nm+kfE8EZERTzwHKDVW5juv3V5ZWM6uLFzdXtnObq+sVfMrTy72V9ba2ysL1a3F9nK7Wn300XvXXsNfuiF+27UHL6mPwp9lwKHqcpdvozriRaStIFHiV2V+G2llprYIzlzVUTOEoKkbvCCjZi6bTYnC4VCgWg7AeVUxNFV2s4wJh2EYS\/0wvLtUzGQzs+VsJZPL5dLjpVLm3HRyZhx+1PPK1yQRqVf6Rq9vBL+yiyDylV10cV\/ZxVKfgrsHr1zkXG\/8VwlwrnptSe0rIm9IqjLP94y+hpZUbYvXxAbf7cloTeoi3eC7Pb3M1C6DowuSbjYrNhe7SGsjpbX9uCTLjS3JaHVSovAAHAGxhsDskqq1kHhFacZnS40JD6RHaWYd5K1m1tdHbIcdoZ36Cbg7x+Uz2UxxNp\/LZNMTOc4U9dg0M52YTs4w8M8ZcCAA7xpXZmrnwN2LChbtJb6vYGEeCqGuPQyOR8ntGpcaEw6lQ5gfAScipUG42WDu+hl4d7mcyWbys1w+k8sX07sqOfPPfD6fyQ66epOBfxzR2dPgTnsgmf2EL75+noDj5XLmXJrqbYHq4A8nwIFVvo2WlXW1Kqh9Y60j6Q3JQGWmtuTTJpcGexsddYuMGnMSI8WAE+u8rCNT04FIlAQCKYgEgpkpCYRys8Hc9RLcVSmZfS9WuEw2vTuXnc1kM4VsruhS9DiXQAo3gZTzVxv4nwtzNxn4fQmQpsCq+rbSWkJGqyMp7TJTe9A\/2I9GsdQWwb2DkRBKlhoTjqajYJbAKd

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\manifest.fingerprint

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.919078122092779
Encrypted:	false
SSDEEP:	3:SqzQHIpSCYGcBSED2S6byzzcVUwn:SfHIUGcBSq1Pz2Uwn
MD5:	4116CB9AE0F1240BC12F4D935E370418
SHA1:	AE99D9B7F18A222441B39E0AEA104A3EA2E77063
SHA-256:	AD1BD36A4C6B6D1F1D3DDE0D4BF5C8B655BB83F1848776FA54BF9855F2AC60BC
SHA-512:	AEF0654D40E2DE94B97BADE3C3F90667AFD47B5AA7AAA3D54C0470DCBB3A5D7F690064923F15BDFFF8D903049283C994A0074CA00DDCA0414872424DE2E4C2BD
Malicious:	false
Preview:	1.af4056dff86a0f736adeea2f1c9247c6fb37a611754450eb01e36582171805b6

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\manifest.json

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107
Entropy (8bit):	4.629827473688602
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFjVLTtWc6YJOXLNBFFKS1DVLTtd:F6VlM8c6kOXLLKS1h
MD5:	20606BCE9915CFAA0889001CDA020E09
SHA1:	A909DCECD8495EE497272ED1A83FA902722BE668
SHA-256:	A838FE7A6043A86804408841001A08AF7E3A18BA62640631DB8BE808727FC939
SHA-512:	B12AF2FE6F4B34E3954D7B4495532409F590BAE6AD754A5F3F7179164B180765DCBE5F0A6D17D9AFFF7BCA9ECF07D6A92D0AF5B12F78EB79C169A0451C547DC9
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "125.0.6422.113_chrome_installer.exe",. "version": "125.0.6422.113".}

C:\Windows\SystemTemp\chrome_url_fetcher_4180_2047592324\-8a69d345-d564-463c-aff1-a69d9e530f96-_125.0.6422.113_all_aogspox4cotu6xggqyym7s5hye.crx3

Download File

Process:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	113074060
Entropy (8bit):	7.999996405747687
Encrypted:	true
SSDEEP:	3145728:Jv8cKsTDLUh52zsZlIF82onGSGLPwvRmtXp2oewbnKO:N8nQebn/5Q2oewbKO
MD5:	D4C50F2A91605A1CCD69F9F400C97819
SHA1:	D0D1A817427CD45F7520E95C44B9D6A17403D3AD
SHA-256:	AF4056DFF86A0F736ADEEA2F1C9247C6FB37A611754450EB01E36582171805B6
SHA-512:	CDFF92E839A56A9A97C4AA2BFB8D641FDB68056B54AEDCDF734A78E20EEE7BAE33FF4665C012B8B6CA6F0138684DC77D9C62154836BEAB6AA87557F90D069DF3
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b...........}.f{.F...n)..j`0.>1.=..qm......}.y...Q...D..yN7....=....z..._c...K....96^w....3..g..5~n..k]..O.............5.........2..kHRb.o4..g......./.q.v+.....qv...#..h.n.o..f!L..p.)...YK..A..1+^/.{e;..........f].fn..L.....Y.....EY.R.S.A....1..r......0.."0....H.............0.............$.I0Y.._.......X.b.....U.h.Q.A_~....,X`.ytO...a........V.....P...s.a......O...v.Rj.j<..lgPF.....N...t..d...g3....i....e.i0...3[.....9a.C....4...t&..............=\.}.K....B- ...b..M......~....,..9...6.....a....p...1.mL.2...1....^...3....u..........l..l...fb(.i.Fk.....)..fD...H..2R{j../y..C+,G..<.d.^..m...`.}.J....\|s..0n../.....^C...@>..2!....%/s....0.B.}....@.R...l.?...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.7962273041061545
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	oBX1n79NgQ.exe
File size:	8'730'176 bytes
MD5:	de2e32e7e89454a112c83f0c5a86cc45
SHA1:	771a3a3272e20ce119b5090ca974095c0b831f52
SHA256:	8c3b98d51b59adb5b3d55a704304345930da7ed2d7fd78652bb700b0fc7fd556
SHA512:	0d23a0bb1e870570d8eff0efe831f9bcfab54dba8aa9152a4cb3b81a2c957f00440c654d84ff5d537f43658b809f29635e57cf0481e9d23f2d968e77c9706bc4
SSDEEP:	196608:WIVCzv5nF2CoAKQ5/X5bEN2tm5pOuU3TcLWGO7djZkrC5RQ:WIVCT5UJAKQNX5bENYm5IV3TcLWGO7tf
TLSH:	BD969D12F6A09135E9A33132B53D673E9D323E329F3589CB83842C942FB46D1653979B
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....H8f..........".......*..PZ...................@..........................`............@...........................3.U.....3.,..

File Icon


Icon Hash:	2f232d67b7934633

Static PE Info

General

Entrypoint:	0x53edc0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x663848AC [Mon May 6 03:04:12 2024 UTC]
TLS Callbacks:	0x4bfdd0, 0x53dcc0, 0x4b0790, 0x53d910, 0x47d470, 0x4bb0a0
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	34795544dc661f1ff917279b17571b81

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	02/07/2021 02:00:00 11/07/2024 01:59:59
Subject Chain	CN=Google LLC, O=Google LLC, L=Mountain View, S=California, C=US
Version:	3
Thumbprint MD5:	DC429A22AA63D23DB8E84F53D05D1D48
Thumbprint SHA-1:	2673EA6CC23BEFFDA49AC715B121544098A1284C
Thumbprint SHA-256:	7D3D117664F121E592EF897973EF9C159150E3D736326E9CD2755F71E0FEBC0C
Serial:	0E4418E2DEDE36DD2974C3443AFB5CE5

Entrypoint Preview

Instruction
call 00007F22C89CE4AAh
jmp 00007F22C89CE31Dh
mov ecx, dword ptr [0073E040h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F22C89CE4A6h
test esi, ecx
jne 00007F22C89CE4C8h
call 00007F22C89CE4D1h
mov ecx, eax
cmp ecx, edi
jne 00007F22C89CE4A9h
mov ecx, BB40E64Fh
jmp 00007F22C89CE4B0h
test esi, ecx
jne 00007F22C89CE4ACh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0073E040h], ecx
not ecx
pop edi
mov dword ptr [0073E080h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [00738BFCh]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00738B78h]
xor dword ptr [ebp-04h], eax
call dword ptr [00738B70h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00738CCCh]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F22C89DDC1Ah
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3381b4	0x55	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x33820c	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x358000	0x4f79b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x84ec00	0x4a40
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x850000	0x15d40	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x333a70	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x333800	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab188	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3388e0	0x5a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2a97a8	0x2a9800	2f88acde28e81b42411b94a1984870da	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2ab000	0x92708	0x92800	abf538394e67f67d1d56f603f4ec32d1	False	0.3593550021331058	data	6.194816279193363	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x33e000	0x18048	0x4e00	52c1e8694b1e9ae8ad489549ef1d27a1	False	0.12114383012820513	data	3.1732192699558626	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x357000	0x10d	0x200	8deaa2e44539b48d8052312d16240ff5	False	0.0625	data	0.22129049870095682	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x358000	0x4f79b4	0x4f7a00	4520146fde6f946a0fcb02b1d469653a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x850000	0x15d40	0x15e00	518d109385e92c766cd29b99061ae63e	False	0.6675892857142857	data	6.719868139750451	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
B7	0x35b6c0	0x492cf2	7-zip archive data, version 0.4	English	United States	0.5024223327636719
RT_ICON	0x7ee3b4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192, 16 important colors	English	United States	0.6317567567567568
RT_ICON	0x7ee4dc	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.5823699421965318
RT_ICON	0x7eea44	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640, 16 important colors	English	United States	0.5120967741935484
RT_ICON	0x7eed2c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.5455776173285198
RT_ICON	0x7ef5d4	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.36341463414634145
RT_ICON	0x7efc3c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.42350746268656714
RT_STRING	0x7f0ae4	0xd0a	data	English	United States	0.4682444577591372
RT_STRING	0x7f17f0	0xdd2	data	English	United States	0.38157150932730355
RT_STRING	0x7f25c4	0xc0c	data	English	United States	0.5239948119325551
RT_STRING	0x7f31d0	0xd3c	Targa image data - Color 1072 x 1093 x 32 +1083 +1075 "\257\0045\0044\004 "	English	United States	0.4542502951593861
RT_STRING	0x7f3f0c	0xbac	data	English	United States	0.499665327978581
RT_STRING	0x7f4ab8	0x396	data	English	United States	0.6285403050108932
RT_STRING	0x7f4e50	0x2dc	data	English	United States	0.4959016393442623
RT_STRING	0x7f512c	0x282	data	English	United States	0.7819314641744548
RT_STRING	0x7f53b0	0x2be	data	English	United States	0.603988603988604
RT_STRING	0x7f5670	0x2ce	data	English	United States	0.6782729805013927
RT_STRING	0x7f5940	0x1c6	data	English	United States	0.7026431718061674
RT_STRING	0x7f5b08	0x1d6	data	English	United States	0.5808510638297872
RT_STRING	0x7f5ce0	0x1f0	data	English	United States	0.7701612903225806
RT_STRING	0x7f5ed0	0x1d8	data	English	United States	0.6334745762711864
RT_STRING	0x7f60a8	0x1ca	data	English	United States	0.7183406113537117
RT_STRING	0x7f6274	0x21a	data	English	United States	0.6672862453531598
RT_STRING	0x7f6490	0x28e	data	English	United States	0.43577981651376146
RT_STRING	0x7f6720	0x27c	data	English	United States	0.7468553459119497
RT_STRING	0x7f699c	0x2ae	data	English	United States	0.6749271137026239
RT_STRING	0x7f6c4c	0x280	data	English	United States	0.6296875
RT_STRING	0x7f6ecc	0x152	data	English	United States	0.7958579881656804
RT_STRING	0x7f7020	0xcc	data	English	United States	0.7401960784313726
RT_STRING	0x7f70ec	0xd2	data	English	United States	0.8904761904761904
RT_STRING	0x7f71c0	0xea	data	English	United States	0.8974358974358975
RT_STRING	0x7f72ac	0xe8	data	English	United States	0.7931034482758621
RT_STRING	0x7f7394	0x124	data	English	United States	0.8561643835616438
RT_STRING	0x7f74b8	0x20c	Targa image data - RLE 1083 x 1103 x 32 +1077 +1075 "A\0045\004."	English	United States	0.601145038167939
RT_STRING	0x7f76c4	0x21c	data	English	United States	0.6611111111111111
RT_STRING	0x7f78e0	0x24c	data	English	United States	0.7261904761904762
RT_STRING	0x7f7b2c	0x1d2	data	English	United States	0.6609442060085837
RT_STRING	0x7f7d00	0x200	data	English	United States	0.75
RT_STRING	0x7f7f00	0x2ce	data	English	United States	0.564066852367688
RT_STRING	0x7f81d0	0x298	data	English	United States	0.6204819277108434
RT_STRING	0x7f8468	0x278	data	English	United States	0.7848101265822784
RT_STRING	0x7f86e0	0x2d2	Targa image data - Color 2379 x 2337 x 32 +2344 +2354 "8\011.\011M\011*\011(\011M\011(\011 "	English	United States	0.6481994459833795
RT_STRING	0x7f89b4	0x29a	data	English	United States	0.7087087087087087
RT_STRING	0x7f8c50	0x488	data	English	United States	0.5198275862068965
RT_STRING	0x7f90d8	0x476	data	English	United States	0.4956217162872154
RT_STRING	0x7f9550	0x49c	data	English	United States	0.6466101694915254
RT_STRING	0x7f99ec	0x456	data	English	United States	0.5540540540540541
RT_STRING	0x7f9e44	0x3f8	data	English	United States	0.5974409448818898
RT_STRING	0x7fa23c	0x460	data	English	United States	0.575
RT_STRING	0x7fa69c	0x4b4	data	English	United States	0.46677740863787376
RT_STRING	0x7fab50	0x478	data	English	United States	0.6354895104895105
RT_STRING	0x7fafc8	0x470	data	English	United States	0.5598591549295775
RT_STRING	0x7fb438	0x41c	data	English	United States	0.5807984790874525
RT_STRING	0x7fb854	0x426	data	English	United States	0.5790960451977402
RT_STRING	0x7fbc7c	0x488	data	English	United States	0.45775862068965517
RT_STRING	0x7fc104	0x424	data	English	United States	0.6490566037735849
RT_STRING	0x7fc528	0x42c	data	English	United States	0.5608614232209738
RT_STRING	0x7fc954	0x43a	data	English	United States	0.6090573012939002
RT_STRING	0x7fcd90	0x43c	data	English	United States	0.6199261992619927
RT_STRING	0x7fd1cc	0x59c	data	English	United States	0.435933147632312
RT_STRING	0x7fd768	0x500	Targa image data - Color 2379 x 2337 x 32 +2344 +2354 "\025\011@\011 "	English	United States	0.6640625
RT_STRING	0x7fdc68	0x59c	data	English	United States	0.5682451253481894
RT_STRING	0x7fe204	0x536	data	English	United States	0.5907046476761619
RT_STRING	0x7fe73c	0x8e6	data	English	United States	0.5258999122036875
RT_STRING	0x7ff024	0xc92	data	English	United States	0.3334369173399627
RT_STRING	0x7ffcb8	0xbf4	data	English	United States	0.5320261437908497
RT_STRING	0x8008ac	0xc5e	data	English	United States	0.48673404927353126
RT_STRING	0x80150c	0xcd8	data	English	United States	0.4382603406326034
RT_STRING	0x8021e4	0x92c	data	English	United States	0.5404599659284497
RT_STRING	0x802b10	0x9ce	data	English	United States	0.3669322709163347
RT_STRING	0x8034e0	0x962	data	English	United States	0.5104079933388843
RT_STRING	0x803e44	0x986	data	English	United States	0.5332239540607056
RT_STRING	0x8047cc	0x9d8	data	English	United States	0.4765873015873016
RT_STRING	0x8051a4	0x8ec	data	English	United States	0.563922942206655
RT_STRING	0x805a90	0xcc6	data	English	United States	0.382262996941896
RT_STRING	0x806758	0xca8	data	English	United States	0.4367283950617284
RT_STRING	0x807400	0xcbe	data	English	United States	0.5076640098099325
RT_STRING	0x8080c0	0xd0c	data	English	United States	0.4224550898203593
RT_STRING	0x808dcc	0x8a6	data	English	United States	0.5519421860885275
RT_STRING	0x809674	0x256	data	English	United States	0.4983277591973244
RT_STRING	0x8098cc	0x260	data	English	United States	0.5444078947368421
RT_STRING	0x809b2c	0x22e	data	English	United States	0.6505376344086021
RT_STRING	0x809d5c	0x23a	data	English	United States	0.5333333333333333
RT_STRING	0x809f98	0x1e6	data	English	United States	0.6296296296296297
RT_STRING	0x80a180	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x80a260	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x80a340	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x80a420	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x80a500	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x80a5e0	0x2f4	AmigaOS bitmap font "f", fc_YSize 14848, 16640 elements, 2nd "$", 3rd "n"	English	United States	0.6362433862433863
RT_STRING	0x80a8d4	0x314	data	English	United States	0.47588832487309646
RT_STRING	0x80abe8	0x2d0	data	English	United States	0.6777777777777778
RT_STRING	0x80aeb8	0x2fa	data	English	United States	0.5931758530183727
RT_STRING	0x80b1b4	0x2fa	data	English	United States	0.6286089238845144
RT_STRING	0x80b4b0	0x2ea	data	English	United States	0.6005361930294906
RT_STRING	0x80b79c	0x2de	data	English	United States	0.44005449591280654
RT_STRING	0x80ba7c	0x296	data	English	United States	0.676737160120846
RT_STRING	0x80bd14	0x2f6	data	English	United States	0.5620052770448549
RT_STRING	0x80c00c	0x2f4	data	English	United States	0.623015873015873
RT_STRING	0x80c300	0x25a	data	English	United States	0.6495016611295681
RT_STRING	0x80c55c	0x2ba	data	English	United States	0.4355300859598854
RT_STRING	0x80c818	0x26e	data	English	United States	0.7138263665594855
RT_STRING	0x80ca88	0x29a	data	English	United States	0.581081081081081
RT_STRING	0x80cd24	0x280	data	English	United States	0.5953125
RT_STRING	0x80cfa4	0x2c6	data	English	United States	0.647887323943662
RT_STRING	0x80d26c	0x328	data	English	United States	0.44925742574257427
RT_STRING	0x80d594	0x320	data	English	United States	0.6825
RT_STRING	0x80d8b4	0x350	data	English	United States	0.6096698113207547
RT_STRING	0x80dc04	0x37e	data	English	United States	0.5391498881431768
RT_STRING	0x80df84	0x37c	data	English	United States	0.6390134529147982
RT_STRING	0x80e300	0x478	data	English	United States	0.42395104895104896
RT_STRING	0x80e778	0x462	data	English	United States	0.5811051693404634
RT_STRING	0x80ebdc	0x400	data	English	United States	0.6123046875
RT_STRING	0x80efdc	0x4b0	data	English	United States	0.5016666666666667
RT_STRING	0x80f48c	0x276	data	English	United States	0.6825396825396826
RT_STRING	0x80f704	0xd0	data	English	United States	0.7836538461538461
RT_STRING	0x80f7d4	0xca	data	English	United States	0.8613861386138614
RT_STRING	0x80f8a0	0xdc	data	English	United States	0.9045454545454545
RT_STRING	0x80f97c	0xd8	data	English	United States	0.7268518518518519
RT_STRING	0x80fa54	0x306	data	English	United States	0.6950904392764858
RT_STRING	0x80fd5c	0xbc4	data	English	United States	0.42363877822045154
RT_STRING	0x810920	0xba2	data	English	United States	0.46474143720617866
RT_STRING	0x8114c4	0xac8	data	English	United States	0.5876811594202899
RT_STRING	0x811f8c	0xb36	data	English	United States	0.47560975609756095
RT_STRING	0x812ac4	0x8da	data	English	United States	0.5728155339805825
RT_STRING	0x8133a0	0x220	AmigaOS bitmap font ",\0061\006J\006 ", fc_YSize 26880, 10758 elements, 2nd "l", 3rd "i"	English	United States	0.6066176470588235
RT_STRING	0x8135c0	0x20a	data	English	United States	0.6264367816091954
RT_STRING	0x8137cc	0x232	data	English	United States	0.7633451957295374
RT_STRING	0x813a00	0x202	data	English	United States	0.6108949416342413
RT_STRING	0x813c04	0x1f6	data	English	United States	0.6852589641434262
RT_STRING	0x813dfc	0x2e4	data	English	United States	0.6
RT_STRING	0x8140e0	0x32c	data	English	United States	0.5517241379310345
RT_STRING	0x81440c	0x2b0	data	English	United States	0.7659883720930233
RT_STRING	0x8146bc	0x2e6	data	English	United States	0.6145552560646901
RT_STRING	0x8149a4	0x2a8	data	English	United States	0.6838235294117647
RT_STRING	0x814c4c	0x256	data	English	United States	0.5836120401337793
RT_STRING	0x814ea4	0x288	data	English	United States	0.4521604938271605
RT_STRING	0x81512c	0x226	data	English	United States	0.6854545454545454
RT_STRING	0x815354	0x206	data	English	United States	0.527027027027027
RT_STRING	0x81555c	0x26c	data	English	United States	0.6193548387096774
RT_STRING	0x8157c8	0x5f6	data	English	United States	0.5321100917431193
RT_STRING	0x815dc0	0x820	data	English	United States	0.35865384615384616
RT_STRING	0x8165e0	0x70a	data	English	United States	0.5832408435072142
RT_STRING	0x816cec	0x7f2	data	English	United States	0.47000983284169123
RT_STRING	0x8174e0	0x76a	data	English	United States	0.5068493150684932
RT_STRING	0x817c4c	0x7ce	data	English	United States	0.5125125125125125
RT_STRING	0x81841c	0xa82	data	English	United States	0.3252788104089219
RT_STRING	0x818ea0	0x9ce	data	English	United States	0.5091633466135458
RT_STRING	0x819870	0xa2e	data	English	United States	0.4716039907904835
RT_STRING	0x81a2a0	0xa44	data	English	United States	0.4257990867579909
RT_STRING	0x81ace4	0x464	Targa image data - Color 1089 x 1103 x 32 +1083 +1072 "?\004>\004<\0048\004;\004:\0040\004."	English	United States	0.604982206405694
RT_STRING	0x81b148	0x212	data	English	United States	0.4830188679245283
RT_STRING	0x81b35c	0x1d4	AmigaOS bitmap font "n", fc_YSize 30725, 18688 elements, 2nd "t\005& \013", 3rd	English	United States	0.6645299145299145
RT_STRING	0x81b530	0x20a	data	English	United States	0.6800766283524904
RT_STRING	0x81b73c	0x210	data	English	United States	0.5852272727272727
RT_STRING	0x81b94c	0x3aa	AmigaOS bitmap font "3\016%\0161\016\007\016\025\0164\016\024\016\025\0161\016I\016\007\016.", fc_YSize 25856, 270 elements, 2nd "C", 3rd "%\0065\006/\006'\0061\006K\006'\006 "	English	United States	0.5565031982942431
RT_STRING	0x81bcf8	0x710	data	English	United States	0.3407079646017699
RT_STRING	0x81c408	0x79c	data	English	United States	0.4029774127310062
RT_STRING	0x81cba4	0x848	data	English	United States	0.45943396226415095
RT_STRING	0x81d3ec	0x728	data	English	United States	0.36899563318777295
RT_STRING	0x81db14	0x5f4	data	English	United States	0.4678477690288714
RT_STRING	0x81e108	0x350	data	English	United States	0.5283018867924528
RT_STRING	0x81e458	0x37e	data	English	United States	0.5760626398210291
RT_STRING	0x81e7d8	0x320	data	English	United States	0.69125
RT_STRING	0x81eaf8	0x368	data	English	United States	0.5538990825688074
RT_STRING	0x81ee60	0x30c	data	English	United States	0.6641025641025641
RT_STRING	0x81f16c	0x80a	data	English	United States	0.49173955296404276
RT_STRING	0x81f978	0x7ce	data	English	United States	0.4934934934934935
RT_STRING	0x820148	0x64c	data	English	United States	0.6625310173697271
RT_STRING	0x820794	0x79a	data	English	United States	0.5190133607399794
RT_STRING	0x820f30	0x640	data	English	United States	0.595
RT_STRING	0x821570	0x52a	data	English	United States	0.5612708018154312
RT_STRING	0x821a9c	0x5a0	data	English	United States	0.4888888888888889
RT_STRING	0x82203c	0x498	data	English	United States	0.6870748299319728
RT_STRING	0x8224d4	0x546	Targa image data - Color 1072 x 1078 x 32 +1083 +1075 "G\0040\0044\004A\0040\004=\0043\004\257\0049\004."	English	United States	0.5733333333333334
RT_STRING	0x822a1c	0x4a6	data	English	United States	0.6226890756302521
RT_STRING	0x822ec4	0x80a	data	English	United States	0.5262390670553936
RT_STRING	0x8236d0	0x95e	data	English	United States	0.390325271059216
RT_STRING	0x824030	0x792	data	English	United States	0.6062951496388029
RT_STRING	0x8247c4	0x896	data	English	United States	0.4899909008189263
RT_STRING	0x82505c	0x87e	data	English	United States	0.547378104875805
RT_STRING	0x8258dc	0x82e	data	English	United States	0.543935052531041
RT_STRING	0x82610c	0xaae	data	English	United States	0.35515727871250913
RT_STRING	0x826bbc	0x96a	data	English	United States	0.549792531120332
RT_STRING	0x827528	0xa08	data	English	United States	0.470404984423676
RT_STRING	0x827f30	0x9fe	data	English	United States	0.4980453479280688
RT_STRING	0x828930	0x304	data	English	United States	0.6282383419689119
RT_STRING	0x828c34	0x142	data	English	United States	0.5341614906832298
RT_STRING	0x828d78	0x10e	data	English	United States	0.8740740740740741
RT_STRING	0x828e88	0x16c	data	English	United States	0.7307692307692307
RT_STRING	0x828ff4	0x140	data	English	United States	0.7
RT_STRING	0x829134	0x586	data	English	United States	0.574964639321075
RT_STRING	0x8296bc	0xc0a	data	English	United States	0.36632057105775473
RT_STRING	0x82a2c8	0xbbe	data	English	United States	0.49933466400532267
RT_STRING	0x82ae88	0xad6	data	English	United States	0.5475847152126893
RT_STRING	0x82b960	0xb66	data	English	United States	0.4609321453050034
RT_STRING	0x82c4c8	0xa64	data	English	United States	0.5789473684210527
RT_STRING	0x82cf2c	0xde2	data	English	United States	0.4127743387732133
RT_STRING	0x82dd10	0xd9c	data	English	United States	0.46039035591274396
RT_STRING	0x82eaac	0xe30	data	English	United States	0.5341409691629956
RT_STRING	0x82f8dc	0xeb4	data	English	United States	0.4585547290116897
RT_STRING	0x830790	0x99c	data	English	United States	0.582520325203252
RT_STRING	0x83112c	0x3d2	data	English	United States	0.5224948875255624
RT_STRING	0x831500	0x3be	data	English	United States	0.5845511482254697
RT_STRING	0x8318c0	0x2d2	data	English	United States	0.7686980609418282
RT_STRING	0x831b94	0x3ae	data	English	United States	0.5859872611464968
RT_STRING	0x831f44	0x3d6	data	English	United States	0.6446028513238289
RT_STRING	0x83231c	0xa3a	data	English	United States	0.45110771581359815
RT_STRING	0x832d58	0xa06	data	English	United States	0.44232268121590024
RT_STRING	0x833760	0x8f8	data	English	United States	0.5971254355400697
RT_STRING	0x834058	0x9aa	data	English	United States	0.4773645917542441
RT_STRING	0x834a04	0x852	data	English	United States	0.5629107981220657
RT_STRING	0x835258	0x282	data	English	United States	0.6682242990654206
RT_STRING	0x8354dc	0x2c0	data	English	United States	0.5582386363636364
RT_STRING	0x83579c	0x276	data	English	United States	0.7793650793650794
RT_STRING	0x835a14	0x2a4	data	English	United States	0.643491124260355
RT_STRING	0x835cb8	0x278	data	English	United States	0.7104430379746836
RT_STRING	0x835f30	0x226	data	English	United States	0.7127272727272728
RT_STRING	0x836158	0x252	data	English	United States	0.5589225589225589
RT_STRING	0x8363ac	0x224	data	English	United States	0.8029197080291971
RT_STRING	0x8365d0	0x278	data	English	United States	0.6329113924050633
RT_STRING	0x836848	0x272	data	English	United States	0.7060702875399361
RT_STRING	0x836abc	0x628	data	English	United States	0.565989847715736
RT_STRING	0x8370e4	0x8a8	data	English	United States	0.4056859205776173
RT_STRING	0x83798c	0x814	data	English	United States	0.6276595744680851
RT_STRING	0x8381a0	0x7f0	data	English	United States	0.514763779527559
RT_STRING	0x838990	0x82a	data	English	United States	0.561244019138756
RT_STRING	0x8391bc	0x3ba	data	English	United States	0.6666666666666666
RT_STRING	0x839578	0x2a0	data	English	United States	0.4568452380952381
RT_STRING	0x839818	0x2c2	data	English	United States	0.7407932011331445
RT_STRING	0x839adc	0x2f2	data	English	United States	0.6790450928381963
RT_STRING	0x839dd0	0x2b8	data	English	United States	0.6379310344827587
RT_STRING	0x83a088	0x1ee	data	English	United States	0.7510121457489879
RT_STRING	0x83a278	0x1b6	data	English	United States	0.6164383561643836
RT_STRING	0x83a430	0x1fa	data	English	United States	0.7055335968379447
RT_STRING	0x83a62c	0x1de	data	English	United States	0.694560669456067
RT_STRING	0x83a80c	0x1fa	data	English	United States	0.6521739130434783
RT_STRING	0x83aa08	0x4ec	data	English	United States	0.6246031746031746
RT_STRING	0x83aef4	0xb86	data	English	United States	0.4277966101694915
RT_STRING	0x83ba7c	0xb7c	data	English	United States	0.48435374149659866
RT_STRING	0x83c5f8	0xbc6	data	English	United States	0.5517584605175846
RT_STRING	0x83d1c0	0xc76	data	English	United States	0.46206896551724136
RT_STRING	0x83de38	0xa0e	data	English	United States	0.5687645687645687
RT_STRING	0x83e848	0xac4	data	English	United States	0.4386792452830189
RT_STRING	0x83f30c	0xb18	data	English	United States	0.4721830985915493
RT_STRING	0x83fe24	0xa6e	data	English	United States	0.5928838951310862
RT_STRING	0x840894	0xbba	data	English	United States	0.47401732178547634
RT_STRING	0x841450	0x9a4	data	English	United States	0.5559157212317666
RT_STRING	0x841df4	0xac0	data	English	United States	0.46257267441860467
RT_STRING	0x8428b4	0xb5e	data	English	United States	0.45738831615120273
RT_STRING	0x843414	0xa02	data	English	United States	0.594847775175644
RT_STRING	0x843e18	0xb7c	data	English	United States	0.48367346938775513
RT_STRING	0x844994	0xa08	data	English	United States	0.5323208722741433
RT_STRING	0x84539c	0x742	data	English	United States	0.5285252960172229
RT_STRING	0x845ae0	0x808	data	English	United States	0.44455252918287935
RT_STRING	0x8462e8	0x71e	data	English	United States	0.6009879253567508
RT_STRING	0x846a08	0x774	Targa image data - Color 1072 x 1093 x 32 +1083 +1075 "1\004>\004;\004>\004<\0046\0043\004\257\0049\004."	English	United States	0.5361635220125787
RT_STRING	0x84717c	0x6ac	data	English	United States	0.5837236533957846
RT_STRING	0x847828	0x79a	data	English	United States	0.5303186022610483
RT_STRING	0x847fc4	0x906	data	English	United States	0.40346320346320347
RT_STRING	0x8488cc	0x7c2	data	English	United States	0.6047331319234642
RT_STRING	0x849090	0x818	data	English	United States	0.48986486486486486
RT_STRING	0x8498a8	0x842	data	English	United States	0.5402081362346263
RT_STRING	0x84a0ec	0x6da	data	English	United States	0.5775370581527937
RT_STRING	0x84a7c8	0x8b0	data	English	United States	0.3776978417266187
RT_STRING	0x84b078	0x7bc	data	English	United States	0.597979797979798
RT_STRING	0x84b834	0x822	data	English	United States	0.4966378482228626
RT_STRING	0x84c058	0x844	data	English	United States	0.5363894139886578
RT_STRING	0x84c89c	0x256	data	English	United States	0.7224080267558528
RT_STRING	0x84caf4	0xcc	data	English	United States	0.7009803921568627
RT_STRING	0x84cbc0	0xce	data	English	United States	0.970873786407767
RT_STRING	0x84cc90	0xf2	data	English	United States	0.871900826446281
RT_STRING	0x84cd84	0xdc	data	English	United States	0.7909090909090909
RT_STRING	0x84ce60	0x242	data	English	United States	0.6678200692041523
RT_STRING	0x84d0a4	0x3ae	data	English	United States	0.4447983014861996
RT_STRING	0x84d454	0x366	data	English	United States	0.6091954022988506
RT_STRING	0x84d7bc	0x3b0	data	English	United States	0.6038135593220338
RT_STRING	0x84db6c	0x390	data	English	United States	0.5537280701754386
RT_STRING	0x84defc	0x2f4	data	English	United States	0.6917989417989417
RT_STRING	0x84e1f0	0x332	Targa image data - RLE 1074 x 1072 x 32 +1072 +1082 "A\0045\004 "	English	United States	0.5158924205378973
RT_STRING	0x84e524	0x36c	data	English	United States	0.5901826484018264
RT_STRING	0x84e890	0x376	data	English	United States	0.6557562076749436
RT_STRING	0x84ec08	0x33e	data	English	United States	0.5783132530120482
RT_STRING	0x84ef48	0x1ee	data	English	United States	0.7246963562753036
RT_GROUP_ICON	0x84f138	0x5a	data	English	United States	0.7333333333333333
RT_VERSION	0x84f194	0x44c	data	English	United States	0.43636363636363634
RT_MANIFEST	0x84f5e0	0x3d2	XML 1.0 document, ASCII text, with very long lines (864)	English	United States	0.5398773006134969

Imports

DLL	Import
ADVAPI32.dll	AddAce, AllocateAndInitializeSid, BuildTrusteeWithSidW, ChangeServiceConfigW, CheckTokenMembership, CloseServiceHandle, ConvertSidToStringSidW, ConvertStringSidToSidW, CopySid, CreateProcessAsUserW, CreateServiceW, DeleteService, DuplicateTokenEx, EqualSid, FreeSid, GetAce, GetAclInformation, GetLengthSid, GetNamedSecurityInfoW, GetSecurityDescriptorControl, GetSecurityDescriptorDacl, GetSecurityDescriptorGroup, GetSecurityDescriptorLength, GetSecurityDescriptorOwner, GetSecurityDescriptorSacl, GetSecurityInfo, GetSidIdentifierAuthority, GetSidLengthRequired, GetSidSubAuthority, GetSidSubAuthorityCount, GetTokenInformation, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, ImpersonateLoggedOnUser, InitializeAcl, InitializeSecurityDescriptor, InitializeSid, IsValidAcl, IsValidSecurityDescriptor, IsValidSid, LookupAccountSidW, MakeAbsoluteSD, MakeSelfRelativeSD, OpenProcessToken, OpenSCManagerW, OpenServiceW, OpenThreadToken, QueryServiceConfigW, RegCloseKey, RegCreateKeyExW, RegDeleteKeyExW, RegDeleteValueW, RegEnumKeyExW, RegEnumValueW, RegOpenKeyExW, RegQueryInfoKeyW, RegQueryValueExW, RegSetValueExW, RegisterTraceGuidsW, RevertToSelf, SetEntriesInAclW, SetNamedSecurityInfoW, SetSecurityDescriptorDacl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, SetSecurityInfo, TraceEvent, UnregisterTraceGuids
dbghelp.dll	SymCleanup, SymFromAddr, SymGetLineFromAddr64, SymGetSearchPathW, SymInitialize, SymSetOptions, SymSetSearchPathW
OLEAUT32.dll	LoadTypeLib, SafeArrayAccessData, SafeArrayCreateVector, SafeArrayDestroy, SafeArrayGetDim, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayGetVartype, SafeArrayUnaccessData, SysAllocString, SysAllocStringByteLen, SysAllocStringLen, SysFreeString, SysStringLen, SystemTimeToVariantTime, VariantClear
SHELL32.dll	CommandLineToArgvW, SHGetFolderPathW, SHGetKnownFolderPath, ShellExecuteExW
USER32.dll	AllowSetForegroundWindow, CharUpperW, CreateWindowExW, DestroyWindow, GetActiveWindow, GetClientRect, GetMonitorInfoW, GetParent, GetWindow, GetWindowLongW, GetWindowRect, MapWindowPoints, MessageBoxExW, MonitorFromWindow, SetForegroundWindow, SetWindowPos, UnregisterClassW
KERNEL32.dll	AcquireSRWLockExclusive, AcquireSRWLockShared, AssignProcessToJobObject, CloseHandle, CompareStringW, CopyFileW, CreateDirectoryW, CreateEventW, CreateFileA, CreateFileMappingW, CreateFileW, CreateMutexW, CreateProcessW, CreateToolhelp32Snapshot, DecodePointer, DeleteCriticalSection, DeleteFileW, DeleteProcThreadAttributeList, DuplicateHandle, EncodePointer, EnterCriticalSection, EnumResourceNamesW, EnumSystemLocalesW, ExitProcess, ExpandEnvironmentStringsW, FileTimeToLocalFileTime, FileTimeToSystemTime, FindClose, FindFirstFileExW, FindNextFileW, FindResourceW, FlushFileBuffers, FlushViewOfFile, FormatMessageW, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetComputerNameW, GetConsoleMode, GetConsoleOutputCP, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetDateFormatW, GetDriveTypeW, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesExW, GetFileAttributesW, GetFileInformationByHandle, GetFileSizeEx, GetFileType, GetFullPathNameW, GetLastError, GetLocalTime, GetLocaleInfoW, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetNativeSystemInfo, GetOEMCP, GetProcAddress, GetProcessHeap, GetProcessId, GetProcessMitigationPolicy, GetProcessTimes, GetProductInfo, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetTempPathW, GetThreadPreferredUILanguages, GetThreadPriority, GetTickCount, GetTimeFormatW, GetTimeZoneInformation, GetUserDefaultLCID, GetUserPreferredUILanguages, GetVersionExW, GetWindowsDirectoryW, GlobalAlloc, GlobalFree, GlobalMemoryStatusEx, HeapAlloc, HeapDestroy, HeapFree, HeapReAlloc, HeapSetInformation, HeapSize, InitOnceExecuteOnce, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeProcThreadAttributeList, InitializeSListHead, InitializeSRWLock, InterlockedPushEntrySList, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, IsWow64Process, LCMapStringW, LeaveCriticalSection, LoadLibraryExA, LoadLibraryExW, LoadLibraryW, LoadResource, LocalFree, LockFileEx, LockResource, MapViewOfFile, MoveFileExW, MoveFileW, MultiByteToWideChar, OpenProcess, OutputDebugStringA, OutputDebugStringW, Process32FirstW, Process32NextW, ProcessIdToSessionId, QueryFullProcessImageNameW, QueryPerformanceCounter, QueryPerformanceFrequency, QueryThreadCycleTime, RaiseException, ReadConsoleW, ReadFile, ReleaseMutex, ReleaseSRWLockExclusive, ReleaseSRWLockShared, RemoveDirectoryW, ReplaceFileW, ResetEvent, RtlCaptureStackBackTrace, RtlUnwind, SetCurrentDirectoryW, SetEndOfFile, SetEnvironmentVariableW, SetEvent, SetFileAttributesW, SetFileInformationByHandle, SetFilePointer, SetFilePointerEx, SetFileTime, SetHandleInformation, SetLastError, SetProcessWorkingSetSize, SetStdHandle, SetThreadInformation, SetThreadPriority, SetUnhandledExceptionFilter, SizeofResource, Sleep, SleepConditionVariableSRW, SwitchToThread, SystemTimeToFileTime, SystemTimeToTzSpecificLocalTime, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, TzSpecificLocalTimeToSystemTime, UnhandledExceptionFilter, UnlockFileEx, UnmapViewOfFile, UnregisterWaitEx, UpdateProcThreadAttribute, VerSetConditionMask, VerifyVersionInfoW, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WTSGetActiveConsoleSessionId, WaitForSingleObject, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile, lstrcmpiW
ole32.dll	CoAddRefServerProcess, CoCreateInstance, CoImpersonateClient, CoInitializeEx, CoRegisterClassObject, CoRegisterInitializeSpy, CoReleaseServerProcess, CoResumeClassObjects, CoRevertToSelf, CoRevokeClassObject, CoRevokeInitializeSpy, CoSetProxyBlanket, CoTaskMemFree, CoUninitialize, IIDFromString, StringFromGUID2
Secur32.dll	GetUserNameExW
WTSAPI32.dll	WTSEnumerateSessionsW, WTSFreeMemory, WTSQuerySessionInformationW
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, EnterCriticalPolicySection, LeaveCriticalPolicySection, UnloadUserProfile
WINHTTP.dll	WinHttpAddRequestHeaders, WinHttpCloseHandle, WinHttpConnect, WinHttpGetProxyForUrl, WinHttpOpen, WinHttpOpenRequest, WinHttpQueryHeaders, WinHttpReadData, WinHttpReceiveResponse, WinHttpSendRequest, WinHttpSetOption, WinHttpSetStatusCallback
SHLWAPI.dll	PathMatchSpecW
ntdll.dll	NtDeleteKey
WINMM.dll	timeGetTime

Exports

Name	Ordinal	Address
GetHandleVerifier	1	0x4a8a90

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	02:31:15
Start date:	27/05/2024
Path:	C:\Users\user\Desktop\oBX1n79NgQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\oBX1n79NgQ.exe"
Imagebase:	0x430000
File size:	8'730'176 bytes
MD5 hash:	DE2E32E7E89454A112C83F0C5A86CC45
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	02:31:15
Start date:	27/05/2024
Path:	C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={8D0CD419-2DAC-C85B-BCFF-DB2D99044B99}&lang=en&browser=5&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=/components/winhttp/=1,/components/update_client/=2,/chrome/updater/=2
Imagebase:	0x4d0000
File size:	4'794'656 bytes
MD5 hash:	95222FAEEAB2CEBE9502F2E123D5DD2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:31:16
Start date:	27/05/2024
Path:	C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SystemTemp\Google7068_1700592644\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x8d965c,0x8d9668,0x8d9674
Imagebase:	0x4d0000
File size:	4'794'656 bytes
MD5 hash:	95222FAEEAB2CEBE9502F2E123D5DD2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	02:31:17
Start date:	27/05/2024
Path:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --system --windows-service --service=update-internal
Imagebase:	0xd40000
File size:	4'794'656 bytes
MD5 hash:	95222FAEEAB2CEBE9502F2E123D5DD2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:31:17
Start date:	27/05/2024
Path:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x114965c,0x1149668,0x1149674
Imagebase:	0xd40000
File size:	4'794'656 bytes
MD5 hash:	95222FAEEAB2CEBE9502F2E123D5DD2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:31:18
Start date:	27/05/2024
Path:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --system --windows-service --service=update
Imagebase:	0xd40000
File size:	4'794'656 bytes
MD5 hash:	95222FAEEAB2CEBE9502F2E123D5DD2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	02:31:18
Start date:	27/05/2024
Path:	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x114965c,0x1149668,0x1149674
Imagebase:	0xd40000
File size:	4'794'656 bytes
MD5 hash:	95222FAEEAB2CEBE9502F2E123D5DD2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:31:22
Start date:	27/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:31:28
Start date:	27/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:31:28
Start date:	27/05/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7648e0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	02:31:29
Start date:	27/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	02:31:29
Start date:	27/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	02:31:29
Start date:	27/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	02:31:29
Start date:	27/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	02:32:29
Start date:	27/05/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff773c00000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:32:29
Start date:	27/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:33:12
Start date:	27/05/2024
Path:	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\125.0.6422.113_chrome_installer.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\125.0.6422.113_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4180_536941199\bdefe0a9-9fa1-476d-abba-f730b9c95120.tmp"
Imagebase:
File size:	113'062'448 bytes
MD5 hash:	081A95E1BC6A90E22F4ABA75947B111A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report oBX1n79NgQ.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Google\GoogleUpdater\0b1b1fa9-587b-42ab-9a21-d311142c0a99.tmp

C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\20d7be24-7f19-48ac-bb8d-ec2ede596347.tmp

C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\prefs.json (copy)

C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\uninstall.cmd

C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe

C:\Program Files (x86)\Google\GoogleUpdater\a551b306-09a1-4111-8ae6-4879d84e3582.tmp

C:\Program Files (x86)\Google\GoogleUpdater\e7a85879-b109-406f-9f99-949ca8274942.tmp

C:\Program Files (x86)\Google\GoogleUpdater\f786af1e-3b2e-487d-a4b6-bf2235b87f24.tmp

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json (copy)

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RF5a14f9.TMP (copy)

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RF5a8c0d.TMP (copy)

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RF5aba32.TMP (copy)

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.f89ee6fd-e514-48d1-a431-e731cf2d05b9.1.etl

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\{8a69d345-d564-463c-aff1-a69d9e530f96}[1].bmp

C:\Users\user\AppData\Local\Temp\~DFD6B7B8DB9D6FB665.TMP

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Windows Analysis Report
oBX1n79NgQ.exe