2e0f093aec2db43730e2b9e50e0156b7f69f9f30f7b744927ed95efa7f84ec2a

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2023 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FromEnergyBadx64.msi
Size

2.5MB
MD5

0a4f0faa78975c74260efbd859ac6282
SHA1

1df3d05c9847f7efc3dad5b8d31c48cff0ee69e2
SHA256

2e0f093aec2db43730e2b9e50e0156b7f69f9f30f7b744927ed95efa7f84ec2a
SHA512

ffaa480dc0ad2d4c5dc810efd03723fa7488298d364e06bbb273bb54f31d75f0caf00bcf37ab578374cf41b94689831a42a83124f908937b34859cb97a7c96eb
SSDEEP

49152:qVcMDa1y97n0d33BL8oeQjq6owuLpvKjjIcc5xPlBb7/nSej8ARI43AHsHoQD2w:Eckaod0dBL8Gq6owJIjbI43hR

Score

9^/10

persistence spyware stealer

Malware Config

Signatures

Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2088-2378-0x00000259C70B0000-0x00000259C70B4000-memory.dmp	ReflectiveLoader

Blocklisted process makes network request 1 IoCs

Processes:

wscript.exe

flow	pid	Process
47	2088	wscript.exe

Downloads MZ/PE file

Modifies Installed Components in the registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

setup.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\116.0.5845.97\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

GoogleUpdate.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

Executes dropped EXE 33 IoCs

Processes:

ChromeSetup.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exe116.0.5845.97_chrome_installer.exesetup.exesetup.exesetup.exesetup.exeGoogleUpdate.exeGoogleUpdateOnDemand.exeGoogleUpdate.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeelevation_service.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	Process
948	ChromeSetup.exe
3924	GoogleUpdate.exe
3128	GoogleUpdate.exe
4252	GoogleUpdate.exe
4856	GoogleUpdateComRegisterShell64.exe
824	GoogleUpdateComRegisterShell64.exe
4432	GoogleUpdateComRegisterShell64.exe
4244	GoogleUpdate.exe
4852	GoogleUpdate.exe
4376	GoogleUpdate.exe
3836	116.0.5845.97_chrome_installer.exe
3460	setup.exe
4800	setup.exe
1472	setup.exe
2636	setup.exe
3400	GoogleUpdate.exe
984	GoogleUpdateOnDemand.exe
3956	GoogleUpdate.exe
4908	chrome.exe
3844	chrome.exe
5028	chrome.exe
4188	chrome.exe
1268	chrome.exe
3948	chrome.exe
2576	chrome.exe
8	chrome.exe
4408	elevation_service.exe
2296	chrome.exe
4852	chrome.exe
2356	chrome.exe
4712	chrome.exe
1420	chrome.exe
924	chrome.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exerundll32.exerundll32.exerundll32.exerundll32.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	Process
4764	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
3400	MsiExec.exe
2680	rundll32.exe
2680	rundll32.exe
2680	rundll32.exe
2680	rundll32.exe
2680	rundll32.exe
3400	MsiExec.exe
5004	rundll32.exe
5004	rundll32.exe
5004	rundll32.exe
5004	rundll32.exe
5004	rundll32.exe
5004	rundll32.exe
5004	rundll32.exe
3400	MsiExec.exe
3732	rundll32.exe
3732	rundll32.exe
3732	rundll32.exe
3732	rundll32.exe
3732	rundll32.exe
3732	rundll32.exe
3732	rundll32.exe
3400	MsiExec.exe
4452	rundll32.exe
4452	rundll32.exe
4452	rundll32.exe
4452	rundll32.exe
4452	rundll32.exe
3924	GoogleUpdate.exe
3128	GoogleUpdate.exe
4252	GoogleUpdate.exe
4856	GoogleUpdateComRegisterShell64.exe
4252	GoogleUpdate.exe
824	GoogleUpdateComRegisterShell64.exe
4252	GoogleUpdate.exe
4432	GoogleUpdateComRegisterShell64.exe
4252	GoogleUpdate.exe
4244	GoogleUpdate.exe
4852	GoogleUpdate.exe
4376	GoogleUpdate.exe
4376	GoogleUpdate.exe
4852	GoogleUpdate.exe
3400	GoogleUpdate.exe
3956	GoogleUpdate.exe
3956	GoogleUpdate.exe
4908	chrome.exe
3844	chrome.exe
4908	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
4188	chrome.exe
1268	chrome.exe
4188	chrome.exe
1268	chrome.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 37 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

GoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exesetup.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\116.0.5845.97\\notification_helper.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\116.0.5845.97\\notification_helper.exe\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

setup.exeChromeSetup.exeGoogleUpdate.exe116.0.5845.97_chrome_installer.exe

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\fr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\VisualElements\SmallLogo.png	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_cs.dll	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\es.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_fr.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\116.0.5845.97.manifest	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_kn.dll	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\lv.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_id.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_vi.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_de.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_el.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\ca.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_fr.dll	ChromeSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_tr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_es-419.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\fa.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\fi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\he.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\sr.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_sr.dll	ChromeSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_ta.dll	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\elevation_service.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\kn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\ur.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\mojo_core.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\GoogleCrashHandler64.exe	ChromeSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_uk.dll	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\bg.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\it.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_lt.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_pt-BR.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\ko.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\libGLESv2.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\chrome.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\CR_CD038.tmp\setup.exe	116.0.5845.97_chrome_installer.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_es.dll	ChromeSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_zh-CN.dll	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\v8_context_snapshot.bin	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\VisualElements\LogoCanary.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_sv.dll	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\ro.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_sk.dll	ChromeSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_pl.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_th.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\CR_CD038.tmp\setup.exe	116.0.5845.97_chrome_installer.exe
File created	C:\Program Files\Crashpad\settings.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\116.0.5845.96.manifest	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_am.dll	ChromeSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_fi.dll	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\vk_swiftshader.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\et.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\chrome.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_mr.dll	ChromeSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\psmachine_64.dll	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\Locales\nl.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_sw.dll	ChromeSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateCore.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3460_1876224462\Chrome-bin\116.0.5845.97\default_apps\external_extensions.json	setup.exe

Drops file in Windows directory 32 IoCs

Processes:

rundll32.exemsiexec.exerundll32.exerundll32.exerundll32.exe

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI2843.tmp-\MSIBuilder.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\e5910a0.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DEB46EC9-C80C-4863-9128-7C89E8CE3C41}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A27.tmp	msiexec.exe
File created	C:\Windows\Installer\e5910a4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2843.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1EDC.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1A27.tmp-\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1EDC.tmp-\MSIBuilder.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2843.tmp-\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1236.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1236.tmp-\MSIBuilder.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1236.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1A27.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1A27.tmp-\MSIBuilder.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1A27.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1A27.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1EDC.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1EDC.tmp-\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2843.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1EDC.tmp-\WixSharp.dll	rundll32.exe
File created	C:\Windows\Installer\e5910a0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1236.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2843.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2843.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1236.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1236.tmp-\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI19F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EDC.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133370533335843476"	chrome.exe

Modifies registry class 64 IoCs

Processes:

GoogleUpdateComRegisterShell64.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exesetup.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ = "IGoogleUpdateCore"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachineFallback\CurVer\ = "GoogleUpdate.Update3WebMachineFallback.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ = "IProcessLauncher2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ = "IJobObserver"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods\ = "4"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\PROGID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ = "Update3COMClass"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\ = "CoCreateAsync"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreMachineClass.1\ = "Google Update Core Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ = "IAppWeb"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods\ = "41"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\PROGID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ = "IAppCommand2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ = "IAppCommand"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusSvc\CurVer\ = "GoogleUpdate.PolicyStatusSvc.1.0"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ = "IApp2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachineFallback\CLSID\ = "{598FE0E5-E02D-465D-9A9D-37974A28FD42}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ = "IAppCommandWeb"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe\AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\VersionIndependentProgID\ = "GoogleUpdate.PolicyStatusSvc"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{27634814-8E41-4C35-8577-980134A96544}\ = "IPolicyStatusValue"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine\CurVer\ = "GoogleUpdate.Update3WebMachine.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.htm	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods\ = "11"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.webp	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass.1\ = "Google Update Core Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods\ = "43"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ = "IProgressWndEvents"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods\ = "7"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdate.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

msiexec.exeGoogleUpdate.exewscript.exeGoogleUpdate.exeGoogleUpdate.exechrome.exe

pid	Process
4640	msiexec.exe
4640	msiexec.exe
3924	GoogleUpdate.exe
3924	GoogleUpdate.exe
3924	GoogleUpdate.exe
3924	GoogleUpdate.exe
3924	GoogleUpdate.exe
3924	GoogleUpdate.exe
2088	wscript.exe
2088	wscript.exe
2088	wscript.exe
2088	wscript.exe
4852	GoogleUpdate.exe
4852	GoogleUpdate.exe
3400	GoogleUpdate.exe
3400	GoogleUpdate.exe
3924	GoogleUpdate.exe
3924	GoogleUpdate.exe
3924	GoogleUpdate.exe
3924	GoogleUpdate.exe
4908	chrome.exe
4908	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	Process
Token: SeShutdownPrivilege	2152	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2152	msiexec.exe
Token: SeSecurityPrivilege	4640	msiexec.exe
Token: SeCreateTokenPrivilege	2152	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2152	msiexec.exe
Token: SeLockMemoryPrivilege	2152	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2152	msiexec.exe
Token: SeMachineAccountPrivilege	2152	msiexec.exe
Token: SeTcbPrivilege	2152	msiexec.exe
Token: SeSecurityPrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeLoadDriverPrivilege	2152	msiexec.exe
Token: SeSystemProfilePrivilege	2152	msiexec.exe
Token: SeSystemtimePrivilege	2152	msiexec.exe
Token: SeProfSingleProcessPrivilege	2152	msiexec.exe
Token: SeIncBasePriorityPrivilege	2152	msiexec.exe
Token: SeCreatePagefilePrivilege	2152	msiexec.exe
Token: SeCreatePermanentPrivilege	2152	msiexec.exe
Token: SeBackupPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeShutdownPrivilege	2152	msiexec.exe
Token: SeDebugPrivilege	2152	msiexec.exe
Token: SeAuditPrivilege	2152	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2152	msiexec.exe
Token: SeChangeNotifyPrivilege	2152	msiexec.exe
Token: SeRemoteShutdownPrivilege	2152	msiexec.exe
Token: SeUndockPrivilege	2152	msiexec.exe
Token: SeSyncAgentPrivilege	2152	msiexec.exe
Token: SeEnableDelegationPrivilege	2152	msiexec.exe
Token: SeManageVolumePrivilege	2152	msiexec.exe
Token: SeImpersonatePrivilege	2152	msiexec.exe
Token: SeCreateGlobalPrivilege	2152	msiexec.exe
Token: SeCreateTokenPrivilege	2152	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2152	msiexec.exe
Token: SeLockMemoryPrivilege	2152	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2152	msiexec.exe
Token: SeMachineAccountPrivilege	2152	msiexec.exe
Token: SeTcbPrivilege	2152	msiexec.exe
Token: SeSecurityPrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeLoadDriverPrivilege	2152	msiexec.exe
Token: SeSystemProfilePrivilege	2152	msiexec.exe
Token: SeSystemtimePrivilege	2152	msiexec.exe
Token: SeProfSingleProcessPrivilege	2152	msiexec.exe
Token: SeIncBasePriorityPrivilege	2152	msiexec.exe
Token: SeCreatePagefilePrivilege	2152	msiexec.exe
Token: SeCreatePermanentPrivilege	2152	msiexec.exe
Token: SeBackupPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeShutdownPrivilege	2152	msiexec.exe
Token: SeDebugPrivilege	2152	msiexec.exe
Token: SeAuditPrivilege	2152	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2152	msiexec.exe
Token: SeChangeNotifyPrivilege	2152	msiexec.exe
Token: SeRemoteShutdownPrivilege	2152	msiexec.exe
Token: SeUndockPrivilege	2152	msiexec.exe
Token: SeSyncAgentPrivilege	2152	msiexec.exe
Token: SeEnableDelegationPrivilege	2152	msiexec.exe
Token: SeManageVolumePrivilege	2152	msiexec.exe
Token: SeImpersonatePrivilege	2152	msiexec.exe
Token: SeCreateGlobalPrivilege	2152	msiexec.exe
Token: SeCreateTokenPrivilege	2152	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2152	msiexec.exe
Token: SeLockMemoryPrivilege	2152	msiexec.exe

Suspicious use of FindShellTrayWindow 29 IoCs

Processes:

msiexec.exeMsiExec.exechrome.exe

pid	Process
2152	msiexec.exe
4764	MsiExec.exe
2152	msiexec.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMsiExec.exerundll32.exeChromeSetup.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exe116.0.5845.97_chrome_installer.exesetup.exesetup.exeGoogleUpdateOnDemand.exeGoogleUpdate.exe

description	pid	Process	procid_target
PID 4640 wrote to memory of 4764	4640	msiexec.exe	83
PID 4640 wrote to memory of 4764	4640	msiexec.exe	83
PID 4640 wrote to memory of 4764	4640	msiexec.exe	83
PID 4640 wrote to memory of 3916	4640	msiexec.exe	97
PID 4640 wrote to memory of 3916	4640	msiexec.exe	97
PID 4640 wrote to memory of 3400	4640	msiexec.exe	99
PID 4640 wrote to memory of 3400	4640	msiexec.exe	99
PID 4640 wrote to memory of 3400	4640	msiexec.exe	99
PID 3400 wrote to memory of 2680	3400	MsiExec.exe	100
PID 3400 wrote to memory of 2680	3400	MsiExec.exe	100
PID 3400 wrote to memory of 2680	3400	MsiExec.exe	100
PID 3400 wrote to memory of 5004	3400	MsiExec.exe	101
PID 3400 wrote to memory of 5004	3400	MsiExec.exe	101
PID 3400 wrote to memory of 5004	3400	MsiExec.exe	101
PID 3400 wrote to memory of 3732	3400	MsiExec.exe	102
PID 3400 wrote to memory of 3732	3400	MsiExec.exe	102
PID 3400 wrote to memory of 3732	3400	MsiExec.exe	102
PID 3732 wrote to memory of 2088	3732	rundll32.exe	103
PID 3732 wrote to memory of 2088	3732	rundll32.exe	103
PID 3400 wrote to memory of 4452	3400	MsiExec.exe	104
PID 3400 wrote to memory of 4452	3400	MsiExec.exe	104
PID 3400 wrote to memory of 4452	3400	MsiExec.exe	104
PID 4640 wrote to memory of 948	4640	msiexec.exe	105
PID 4640 wrote to memory of 948	4640	msiexec.exe	105
PID 4640 wrote to memory of 948	4640	msiexec.exe	105
PID 948 wrote to memory of 3924	948	ChromeSetup.exe	106
PID 948 wrote to memory of 3924	948	ChromeSetup.exe	106
PID 948 wrote to memory of 3924	948	ChromeSetup.exe	106
PID 3924 wrote to memory of 3128	3924	GoogleUpdate.exe	107
PID 3924 wrote to memory of 3128	3924	GoogleUpdate.exe	107
PID 3924 wrote to memory of 3128	3924	GoogleUpdate.exe	107
PID 3924 wrote to memory of 4252	3924	GoogleUpdate.exe	108
PID 3924 wrote to memory of 4252	3924	GoogleUpdate.exe	108
PID 3924 wrote to memory of 4252	3924	GoogleUpdate.exe	108
PID 4252 wrote to memory of 4856	4252	GoogleUpdate.exe	109
PID 4252 wrote to memory of 4856	4252	GoogleUpdate.exe	109
PID 4252 wrote to memory of 824	4252	GoogleUpdate.exe	110
PID 4252 wrote to memory of 824	4252	GoogleUpdate.exe	110
PID 4252 wrote to memory of 4432	4252	GoogleUpdate.exe	111
PID 4252 wrote to memory of 4432	4252	GoogleUpdate.exe	111
PID 3924 wrote to memory of 4244	3924	GoogleUpdate.exe	112
PID 3924 wrote to memory of 4244	3924	GoogleUpdate.exe	112
PID 3924 wrote to memory of 4244	3924	GoogleUpdate.exe	112
PID 3924 wrote to memory of 4852	3924	GoogleUpdate.exe	113
PID 3924 wrote to memory of 4852	3924	GoogleUpdate.exe	113
PID 3924 wrote to memory of 4852	3924	GoogleUpdate.exe	113
PID 4376 wrote to memory of 3836	4376	GoogleUpdate.exe	117
PID 4376 wrote to memory of 3836	4376	GoogleUpdate.exe	117
PID 3836 wrote to memory of 3460	3836	116.0.5845.97_chrome_installer.exe	118
PID 3836 wrote to memory of 3460	3836	116.0.5845.97_chrome_installer.exe	118
PID 3460 wrote to memory of 4800	3460	setup.exe	119
PID 3460 wrote to memory of 4800	3460	setup.exe	119
PID 3460 wrote to memory of 1472	3460	setup.exe	120
PID 3460 wrote to memory of 1472	3460	setup.exe	120
PID 1472 wrote to memory of 2636	1472	setup.exe	121
PID 1472 wrote to memory of 2636	1472	setup.exe	121
PID 4376 wrote to memory of 3400	4376	GoogleUpdate.exe	123
PID 4376 wrote to memory of 3400	4376	GoogleUpdate.exe	123
PID 4376 wrote to memory of 3400	4376	GoogleUpdate.exe	123
PID 984 wrote to memory of 3956	984	GoogleUpdateOnDemand.exe	125
PID 984 wrote to memory of 3956	984	GoogleUpdateOnDemand.exe	125
PID 984 wrote to memory of 3956	984	GoogleUpdateOnDemand.exe	125
PID 3956 wrote to memory of 4908	3956	GoogleUpdate.exe	126
PID 3956 wrote to memory of 4908	3956	GoogleUpdate.exe	126

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\FromEnergyBadx64.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2152

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 902488DE130F6E58C97992B2FC25743A U
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:4764
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 91020FD5F3A9C9FBD2356178B97BDEE9
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI1236.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240718812 2 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2680
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI1A27.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240720484 11 WixSharp!WixSharp.ManagedProjectActions.WixSharp_BeforeInstall_Action
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5004
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI1EDC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240721687 18 WixSharp!WixSharp.ManagedProjectActions.WixSharp_AfterInstall_Action
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\SysNative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\ObtainBabyNeck\FromEnergyBad\StringShallKnow.vbs
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      PID:2088
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2843.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240724093 22 WixSharp!WixSharp.ManagedProjectActions.CancelRequestHandler
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4452
- C:\Users\Admin\AppData\Local\Temp\ObtainBabyNeck\FromEnergyBad\ChromeSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\ObtainBabyNeck\FromEnergyBad\ChromeSetup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={D7672CCF-CB0E-F7CC-229C-F5DCC6A24963}&lang=de&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=YTUH&installdataindex=empty"
    3⤵
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3924
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:3128
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4252
    - - C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4856
    - - C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:824
    - - C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4432
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjQxODI3ODktREYzMC00QTQ4LThGQUEtNURDNjY2MDA4NjQzfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezA4RTE1OERGLURDMTMtNDg1Qi05QkQ0LTQyN0M3RkJEOUY1N30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjE1MSIgbmV4dHZlcnNpb249IjEuMy4zNi4xMzIiIGxhbmc9ImRlIiBicmFuZD0iWVRVSCIgY2xpZW50PSIiIGlpZD0ie0Q3NjcyQ0NGLUNCMEUtRjdDQy0yMjlDLUY1RENDNkEyNDk2M30iPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMjk1MyIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4244
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={D7672CCF-CB0E-F7CC-229C-F5DCC6A24963}&lang=de&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=YTUH&installdataindex=empty" /installsource taggedmi /sessionid "{B4182789-DF30-4A48-8FAA-5DC666008643}"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:4852

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1256

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\116.0.5845.97_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\116.0.5845.97_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\gui8CF4.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\CR_CD038.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\CR_CD038.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\CR_CD038.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\gui8CF4.tmp"
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\CR_CD038.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\CR_CD038.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=116.0.5845.97 --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x7ff6f5d15958,0x7ff6f5d15968,0x7ff6f5d15978
      4⤵
      Executes dropped EXE
      PID:4800
  - - C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\CR_CD038.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\CR_CD038.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1472
    - - C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\CR_CD038.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{A2D4855A-257D-477E-874F-E5349226A8AA}\CR_CD038.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=116.0.5845.97 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff6f5d15958,0x7ff6f5d15968,0x7ff6f5d15978
        5⤵
        Executes dropped EXE
        
        PID:2636
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjQxODI3ODktREYzMC00QTQ4LThGQUEtNURDNjY2MDA4NjQzfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0NGOEI2NERFLUNENTMtNDkxQy1BOUY3LUYxNkI3RDc3N0M0Nn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTE2LjAuNTg0NS45NyIgYXA9Ing2NC1zdGFibGUtc3RhdHNkZWZfMSIgbGFuZz0iZGUiIGJyYW5kPSJZVFVIIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNDgiIGlpZD0ie0Q3NjcyQ0NGLUNCMEUtRjdDQy0yMjlDLUY1RENDNkEyNDk2M30iIGNvaG9ydD0iMTpndS9pMTk6IiBjb2hvcnRuYW1lPSJTdGFibGUgSW5zdGFsbHMgJmFtcDsgVmVyc2lvbiBQaW5zIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2NhZHJwaWplYm1ybDd2bXVzZXFlYWxqZ3plXzExNi4wLjU4NDUuOTcvMTE2LjAuNTg0NS45N19jaHJvbWVfaW5zdGFsbGVyLmV4ZSIgZG93bmxvYWRlZD0iOTcxNDQzNjgiIHRvdGFsPSI5NzE0NDM2OCIgZG93bmxvYWRfdGltZV9tcz0iNzYyNSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzEyIiBkb3dubG9hZF90aW1lX21zPSIxMDY4OCIgZG93bmxvYWRlZD0iOTcxNDQzNjgiIHRvdGFsPSI5NzE0NDM2OCIgaW5zdGFsbF90aW1lX21zPSI0MjI5NyIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3400

C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe
"C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe" -Embedding
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=116.0.5845.97 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff927503dc0,0x7ff927503dd0,0x7ff927503de0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1984 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2660 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1268
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:1
      4⤵
      Executes dropped EXE
      PID:2576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3144 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:1
      4⤵
      Executes dropped EXE
      PID:3948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4200 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:1
      4⤵
      Executes dropped EXE
      PID:8
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4612 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2296
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4612 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:1
      4⤵
      Executes dropped EXE
      PID:4712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4688 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:4852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4980 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4908 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5208 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:8
      4⤵
      PID:2872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5264 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:8
      4⤵
      PID:3080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5208 --field-trial-handle=2004,i,17582680233543042386,9777694136649015982,262144 /prefetch:8
      4⤵
      PID:1900

C:\Program Files\Google\Chrome\Application\116.0.5845.97\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\116.0.5845.97\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5910a3.rbs

Filesize
8KB

MD5
a7a893e85944400aabeba0047956f521

SHA1
0c30d324489d0b041e66d6a7760f635944f48a6c

SHA256
1af55b66dd4e727bc765f778689bad7d8ff49623013afa4e8abaed9810fceeef

SHA512
3b073f4498509c24ae8b914943b94fe38e2f6f31dddda50f626857cc895782ce20923d0a6997c89fa653a05ec480934119d9fe8d2266e8cbd809ac42bfe68b78

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\GoogleCrashHandler.exe

Filesize
299KB

MD5
b6b844cba41f7c190a001941a9a34e9a

SHA1
9496eba9714f323c7e17b61ea536acc6bbbe05ff

SHA256
03e91a5144ab49e6a39df0d920987e718fd36f8d5ca34e243506025e8da1db78

SHA512
4a4a6452234f56221743e0a2ac5efe2f546201b1ca3e97fe5bf3b82ef179918f0b0479845225ac4f459c349ac71894295a6bc0efa1e57da3d9c9267d265e725e

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\GoogleCrashHandler64.exe

Filesize
396KB

MD5
71e73162f75ef1c1094f8e8ac5e9bed3

SHA1
083bccb889e8a01cabe52941dfeb8bf51e560c70

SHA256
2ae4d76b2037bf4ea615e92c7064272c93fc6a5cd649a95502234f6f32b9b151

SHA512
6e05aa298723a52d27f3897c8332d6c3e3c4651fe0a1cbd55e6034810556162f0c3d07056f276577925de647a5ba847846d203c3b230f9fcfd012b03e15ba295

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\GoogleUpdate.exe

Filesize
164KB

MD5
e885bf92c289c674cd32f3e85ab2b922

SHA1
c0a98fd8c74d031f54fda658a1c67d8886b5e076

SHA256
63854e78780866d2ae56a58958a1fda017a71f54b71fe70cf5403958e961862a

SHA512
618d0cb1e6b50716ad877616da547d45099d92c6d00158da0ee2a76cf08f13ee540d365f747a031f0da96b238acc7fc9c0996c8de3feb7753966a9458e5f2512

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\GoogleUpdate.exe

Filesize
164KB

MD5
e885bf92c289c674cd32f3e85ab2b922

SHA1
c0a98fd8c74d031f54fda658a1c67d8886b5e076

SHA256
63854e78780866d2ae56a58958a1fda017a71f54b71fe70cf5403958e961862a

SHA512
618d0cb1e6b50716ad877616da547d45099d92c6d00158da0ee2a76cf08f13ee540d365f747a031f0da96b238acc7fc9c0996c8de3feb7753966a9458e5f2512

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\GoogleUpdateComRegisterShell64.exe

Filesize
187KB

MD5
54fdef34ec0349a9c8ee543cafa25109

SHA1
2b0c0ae0a7ef0ea23d5d9e0c3406cf5df969d50e

SHA256
974ec719d34ac9af4d37681a8a6dfeb24f3dd136b2681be09dbc86afb6d9f616

SHA512
02a381991259df41a15f2cd49e906fa926a5d979913596f8d606aa652a500ec3316d6dd7b35d836307081b1dc5344b352de92e6bd6f2f2c882764f3f976cb561

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\GoogleUpdateCore.exe

Filesize
222KB

MD5
2c6849cca1783f20415a54ff80bd6a82

SHA1
555691825d70c89152ee00932412a59eb7585ff6

SHA256
eae6d2053a0f4ea3af887c9244770d31cbacab69f165d4ac5fa49b619f0d6bc3

SHA512
a1e66f6260dd2e63f7b2e0cee4b45e35f5d2740e6c2f129b6ba1af88cc9c12a669d76d41a59a7a067ec610b53ddfc56e8beb31659fa79734655510d182bdc075

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdate.dll

Filesize
1.9MB

MD5
c0afc2fd557628f98ac9b7834ce7d966

SHA1
7ddfcc41f315d807d36dfef3b0217614aadb0151

SHA256
b31ed15eeb3e535d1318a566000adc069b793fd0f19ba9ae18342f7656121596

SHA512
b3a68dc8a2707d247f6224936c629bf162b72a29e50f48d763d151d0aa83d2b95e0e9a6110005f98e40e819fb41535f4c4e90a6ba95c94b4404b7e7eb1f4d4ba

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdate.dll

Filesize
1.9MB

MD5
c0afc2fd557628f98ac9b7834ce7d966

SHA1
7ddfcc41f315d807d36dfef3b0217614aadb0151

SHA256
b31ed15eeb3e535d1318a566000adc069b793fd0f19ba9ae18342f7656121596

SHA512
b3a68dc8a2707d247f6224936c629bf162b72a29e50f48d763d151d0aa83d2b95e0e9a6110005f98e40e819fb41535f4c4e90a6ba95c94b4404b7e7eb1f4d4ba

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_am.dll

Filesize
48KB

MD5
3d047b2327fdc1490d35de702cabfd87

SHA1
7e95b34cdd0e778c5f8e99a719084d6058752647

SHA256
dd0e5047fe6036f3fbea9d04c7563afdb31bd88e42f19879d75299c685c08dd5

SHA512
bb0103fe46fa005d4b979b0304f6c4df225427d4d5ead92c3ed6deb36feae26429664a2a6d4ac046db9ff3387dade1f9ef757f3e26b9a392663f99e920ff1837

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_ar.dll

Filesize
47KB

MD5
7129735aa717dae6a2dab0574e31ceff

SHA1
7851be57ed9f76de24ec2a9264352679fcf9ff8c

SHA256
f4a1a5b7749bafd84927ae0a281db0eee2e2a1ce9cd77ca08165f8bc587cc3b3

SHA512
cadf0a4c93798139ad7a5e95b12411a927d5cc78980389aa94be7a86b6d61e6c64f807bcfe2a494a02e9ef242cc4515566c004acf8fa5d6c33685171e87a6e32

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_bg.dll

Filesize
50KB

MD5
db8908b6627859104bfca1e777743b25

SHA1
c8f25b474747183c7d453616e82c0cbee299b5f2

SHA256
bb6569ad79623eed5f042982c2fe2808d8a9cd2b85b98d9bd0a0cf8999c31eba

SHA512
435f779820588cb885fcbf6aefd2dda37eccd569856a144621417aa8a8ea577ef0a11d4cc708af7cb2cfafe897c75d8e247de0fad6f0ea8e87e00c11b36a1519

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2BD9.tmp\goopdateres_de.dll

Filesize
51KB

MD5
35e401fe16fcb9c81aff7bf56becac57

SHA1
b23eb49d5dc11265b86d74c7eb93b76d5de23fc7

SHA256
5267fbbfb123d5603cbbb60f2d00a0d446dd5885a1e5f032887a49a8a3da08f1

SHA512
7f84d08778a83f32cad5b297ea559cc05cb6b52ae0e72c660e9d0ac8bdf903b797333953f8fc9aff63f997ba35bbb2012b2551e83b85ce985eb3503e30ba54bb

Download Submit
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateSetup.exe

Filesize
1.3MB

MD5
a8a9ff2c172ed623edaaa823a294d20e

SHA1
d09d6e1acdf3632ac981cadfb76135e30638c23d

SHA256
298e5d66d51ea5426ac1ad45be02879f4f14a6f5c1b35e8f2127f1c6adc0164e

SHA512
d7e327cdc4c46bfd33ba4adee2b3a01b7f98f4cf2948b008612b1aceabfdb6dbf9de2f9fc2a80e7139bb6e7fd2d9eb6a8cf8c629267e9c60f43bc0433f4a0d7e

Download Submit
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\116.0.5845.97\116.0.5845.97_chrome_installer.exe

Filesize
92.6MB

MD5
505502b90b5a2bc7d3f4725a508b71c0

SHA1
e36b8351720fa8dacf0dc155770b1ed79480f1eb

SHA256
47ad9a27a3fcab4736ef17989dbfec5ae6ad3323ad602659f47853cc5aab9f53

SHA512
221aff6a7f25c5730b1156c7936ea1f7bf033d6f4c20efb04ce6c8c377a6296aecad2df3c2215b9d054e669afbdb94c0891936c6966b45f4424fc2e1fb0e703c

Download Submit
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Filesize
164KB

MD5
e885bf92c289c674cd32f3e85ab2b922

SHA1
c0a98fd8c74d031f54fda658a1c67d8886b5e076

SHA256
63854e78780866d2ae56a58958a1fda017a71f54b71fe70cf5403958e961862a

SHA512
618d0cb1e6b50716ad877616da547d45099d92c6d00158da0ee2a76cf08f13ee540d365f747a031f0da96b238acc7fc9c0996c8de3feb7753966a9458e5f2512

Download Submit
C:\Program Files\Google\Chrome\Application\116.0.5845.97\Installer\setup.exe

Filesize
4.0MB

MD5
e635d7f4d4dfd0ec4c4fb625b1724bd6

SHA1
30f32109481f554ea4391d62534fbcfd3a416008

SHA256
78a8f56237870c41b9bab6b1ed86d507e58758d63e3789eb98aebfa5225ad6bc

SHA512
8a29c8ec0774f21f019f1b914b44c646af4fbd2317973ec64b66d3b0fa01af0177afb1ed7cbfa6e2b62fc76b2e524b82afed94af6be14e417fbcc358b1400a78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
baf2b94c7401fc664262afe0ed096666

SHA1
dc5b35ea80dfb8c496b260f4bca9c64f03099866

SHA256
e6a1f36847b92739a7aa29b0ba6f1959a5314ec27ff1e80dc4e1676371ac0e33

SHA512
585d9a7f24d43d2fe493ee9850d3517e6157a3091a8a65e579b9c8fdf5af569ea1903498dd402eacfd51544b00278a1af4886c3a1965a250986d1cc336a17728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Filesize
651B

MD5
9bbfe11735bac43a2ed1be18d0655fe2

SHA1
61141928bb248fd6e9cd5084a9db05a9b980fb3a

SHA256
549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

SHA512
a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12065\BootstrapperCore.dll

Filesize
90KB

MD5
67bc7530a6243ebcd8481ea0a15edc29

SHA1
57700bc53b2ed8c18d1f217489aa11aa0581050c

SHA256
ba478a319eb93d6f476a1c1924f86d220b6dd0cabff6d5d82c812e86ddaa4db2

SHA512
56c1d1a65c800abc8c9b0f3ad6bd8a7b05968372358ad1a4493a04b7e5f895c114a71d3e3de57a44e98cd91e11e799069ff8c45f652df04aa6fae6d0c37dd019

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12065\EmbeddedUI.config

Filesize
980B

MD5
c9c40af1656f8531eaa647caceb1e436

SHA1
907837497508de13d5a7e60697fc9d050e327e19

SHA256
1a67f60962ca1cbf19873b62a8518efe8c701a09cd609af4c50ecc7f0b468bb8

SHA512
0f7033686befa3f4acf3ed355c1674eaa6e349fba97e906446c8a7000be6876f157bc015bf5d3011fbbdc2c771bcbaea97918b8d24c064cbbd302741cc70cbc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12065\MSIBuilder.exe

Filesize
17KB

MD5
6b3d6d63c89256f58eb396b9e48b641d

SHA1
f91c70b792092bab478672d913e82846de9113f1

SHA256
d4723376337e730c3cf50c3b853c5d9d4c7dfbe3941eeb7df910280bf41e2252

SHA512
407e62d9848492b56420eed801aa5688cef731cc1442766953d189673f117c90947b28ac9e248a552ebeb546de1e2894b28bef69dc4a6d8d2cced21b25ea6146

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12065\Microsoft.Deployment.WindowsInstaller.dll

Filesize
182KB

MD5
82eb1ccf28f3af897c2db27282b41156

SHA1
9f945d8b18ff0fbb5f013efe5e2ff33aef136104

SHA256
ced6cab3c04c08ce5705af0b6986965dbdbfda17cbd66c973bb371ed3b95f37a

SHA512
9458fabeae4dabf8109b9736496a01d9168312faec1c17d6eed89e8f09cbb8287d74ff758948cf07838720c11005e87a734e920be4ead275354f46a0a6176f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12065\Microsoft.Deployment.WindowsInstaller.dll

Filesize
182KB

MD5
82eb1ccf28f3af897c2db27282b41156

SHA1
9f945d8b18ff0fbb5f013efe5e2ff33aef136104

SHA256
ced6cab3c04c08ce5705af0b6986965dbdbfda17cbd66c973bb371ed3b95f37a

SHA512
9458fabeae4dabf8109b9736496a01d9168312faec1c17d6eed89e8f09cbb8287d74ff758948cf07838720c11005e87a734e920be4ead275354f46a0a6176f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12065\Microsoft.Deployment.WindowsInstaller.dll

Filesize
182KB

MD5
82eb1ccf28f3af897c2db27282b41156

SHA1
9f945d8b18ff0fbb5f013efe5e2ff33aef136104

SHA256
ced6cab3c04c08ce5705af0b6986965dbdbfda17cbd66c973bb371ed3b95f37a

SHA512
9458fabeae4dabf8109b9736496a01d9168312faec1c17d6eed89e8f09cbb8287d74ff758948cf07838720c11005e87a734e920be4ead275354f46a0a6176f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12065\WixSharp.UI.CA.dll

Filesize
494KB

MD5
78965732bc518175a3c2d2a602342a1d

SHA1
8186f4a4ecf95c6779436afb2af3de635e422135

SHA256
562f0f553e24a2adc9ac023d4791828e478977e0dd5186ea17fb02a639f01066

SHA512
c689a65f8906f9448f60d7be0ab14bb07becee9cb8fdbecb57ac2002c4b028529efd3fe002d830b31717ce939b866b39aadb01395401e4fda71416ee3f214d61

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12065\WixSharp.UI.CA.dll

Filesize
494KB

MD5
78965732bc518175a3c2d2a602342a1d

SHA1
8186f4a4ecf95c6779436afb2af3de635e422135

SHA256
562f0f553e24a2adc9ac023d4791828e478977e0dd5186ea17fb02a639f01066

SHA512
c689a65f8906f9448f60d7be0ab14bb07becee9cb8fdbecb57ac2002c4b028529efd3fe002d830b31717ce939b866b39aadb01395401e4fda71416ee3f214d61

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12065\WixSharp.UI.dll

Filesize
239KB

MD5
629bbfbfda3c302696db6db2e4bd8948

SHA1
15a9c0b71b274235b77a80a8733dca3dd91b612d

SHA256
5954b02f956bde8e09be98c5e1a429fa3b462db7864c80a51d90c1ee7decc2c1

SHA512
f923602823680451873db2c81a5c422c0e13a31a5ee5b76d5c36925f4c5fedc88ad15788d5f650e63e628ce03ca6a02bebb4b8c33e472d79f019ebb71c02d543

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12065\WixSharp.UI.dll

Filesize
239KB

MD5
629bbfbfda3c302696db6db2e4bd8948

SHA1
15a9c0b71b274235b77a80a8733dca3dd91b612d

SHA256
5954b02f956bde8e09be98c5e1a429fa3b462db7864c80a51d90c1ee7decc2c1

SHA512
f923602823680451873db2c81a5c422c0e13a31a5ee5b76d5c36925f4c5fedc88ad15788d5f650e63e628ce03ca6a02bebb4b8c33e472d79f019ebb71c02d543

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12065\WixSharp.UI.dll

Filesize
239KB

MD5
629bbfbfda3c302696db6db2e4bd8948

SHA1
15a9c0b71b274235b77a80a8733dca3dd91b612d

SHA256
5954b02f956bde8e09be98c5e1a429fa3b462db7864c80a51d90c1ee7decc2c1

SHA512
f923602823680451873db2c81a5c422c0e13a31a5ee5b76d5c36925f4c5fedc88ad15788d5f650e63e628ce03ca6a02bebb4b8c33e472d79f019ebb71c02d543

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12065\WixSharp.dll

Filesize
431KB

MD5
6718a452df12b05b01df40b5053a990d

SHA1
e229d3e3c0f9b2f974bc4a00a3336c75fd7e2df9

SHA256
91c2bc9c56cbc0609d96f030887c59831b275daf58a727e74bbdb2db7987d9ef

SHA512
7e0557c24cb3465f3323a0976a48888adf6811ab37ca64b3b7088803c0da907a0f05067b0f95131137befe302da319ed7241faf76beda372a68506be111a793b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12065\WixSharp.dll

Filesize
431KB

MD5
6718a452df12b05b01df40b5053a990d

SHA1
e229d3e3c0f9b2f974bc4a00a3336c75fd7e2df9

SHA256
91c2bc9c56cbc0609d96f030887c59831b275daf58a727e74bbdb2db7987d9ef

SHA512
7e0557c24cb3465f3323a0976a48888adf6811ab37ca64b3b7088803c0da907a0f05067b0f95131137befe302da319ed7241faf76beda372a68506be111a793b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12065\WixSharp.dll

Filesize
431KB

MD5
6718a452df12b05b01df40b5053a990d

SHA1
e229d3e3c0f9b2f974bc4a00a3336c75fd7e2df9

SHA256
91c2bc9c56cbc0609d96f030887c59831b275daf58a727e74bbdb2db7987d9ef

SHA512
7e0557c24cb3465f3323a0976a48888adf6811ab37ca64b3b7088803c0da907a0f05067b0f95131137befe302da319ed7241faf76beda372a68506be111a793b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ObtainBabyNeck\FromEnergyBad\ChromeSetup.exe

Filesize
1.3MB

MD5
a8a9ff2c172ed623edaaa823a294d20e

SHA1
d09d6e1acdf3632ac981cadfb76135e30638c23d

SHA256
298e5d66d51ea5426ac1ad45be02879f4f14a6f5c1b35e8f2127f1c6adc0164e

SHA512
d7e327cdc4c46bfd33ba4adee2b3a01b7f98f4cf2948b008612b1aceabfdb6dbf9de2f9fc2a80e7139bb6e7fd2d9eb6a8cf8c629267e9c60f43bc0433f4a0d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ObtainBabyNeck\FromEnergyBad\ChromeSetup.exe

Filesize
1.3MB

MD5
a8a9ff2c172ed623edaaa823a294d20e

SHA1
d09d6e1acdf3632ac981cadfb76135e30638c23d

SHA256
298e5d66d51ea5426ac1ad45be02879f4f14a6f5c1b35e8f2127f1c6adc0164e

SHA512
d7e327cdc4c46bfd33ba4adee2b3a01b7f98f4cf2948b008612b1aceabfdb6dbf9de2f9fc2a80e7139bb6e7fd2d9eb6a8cf8c629267e9c60f43bc0433f4a0d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ObtainBabyNeck\FromEnergyBad\StringShallKnow.vbs

Filesize
236KB

MD5
1b842a5f434bca9a1d396f3d1d8bd2da

SHA1
a35bc1c7c4e09499752db1e1514f9ead9097cc51

SHA256
b1c0cde97930bbfd18ca72f10db85ab335e87a72b685f59ded5f34f3476397ce

SHA512
230afce301230e39f89cf12d332ed7ea94e4e488a242d3a01e029e9eb2906eb738bc5997f1b0acc6506b4f8ec7e7dad5a0ba526036576a33e505588fa7db5334

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4908_589581485\d7f66c97-a0fb-46d4-969e-419ec5e5710e.tmp

Filesize
242KB

MD5
541f52e24fe1ef9f8e12377a6ccae0c0

SHA1
189898bb2dcae7d5a6057bc2d98b8b450afaebb6

SHA256
81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82

SHA512
d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88

Download Submit
C:\Windows\Installer\MSI1236.tmp

Filesize
470KB

MD5
abb7b72f6b515e05e58751a54f343c6c

SHA1
e847dfd57d519da49d7e66f0987b983e4b163e1e

SHA256
1f9588303213c5fb9d49d4779f704448bb60288d343a238fc90fda8449fd44d0

SHA512
189e972f900c016269e3eb959fb4a9e0c2e25ded06cf1c8ca7b014c17703e09e905272ed7e38039963fa3bc398dbdfd230c7cd0d0785d2f4129b6700545bbb26

Download Submit
C:\Windows\Installer\MSI1236.tmp

Filesize
470KB

MD5
abb7b72f6b515e05e58751a54f343c6c

SHA1
e847dfd57d519da49d7e66f0987b983e4b163e1e

SHA256
1f9588303213c5fb9d49d4779f704448bb60288d343a238fc90fda8449fd44d0

SHA512
189e972f900c016269e3eb959fb4a9e0c2e25ded06cf1c8ca7b014c17703e09e905272ed7e38039963fa3bc398dbdfd230c7cd0d0785d2f4129b6700545bbb26

Download Submit
C:\Windows\Installer\MSI1236.tmp

Filesize
470KB

MD5
abb7b72f6b515e05e58751a54f343c6c

SHA1
e847dfd57d519da49d7e66f0987b983e4b163e1e

SHA256
1f9588303213c5fb9d49d4779f704448bb60288d343a238fc90fda8449fd44d0

SHA512
189e972f900c016269e3eb959fb4a9e0c2e25ded06cf1c8ca7b014c17703e09e905272ed7e38039963fa3bc398dbdfd230c7cd0d0785d2f4129b6700545bbb26

Download Submit
C:\Windows\Installer\MSI1236.tmp-\CustomAction.config

Filesize
980B

MD5
c9c40af1656f8531eaa647caceb1e436

SHA1
907837497508de13d5a7e60697fc9d050e327e19

SHA256
1a67f60962ca1cbf19873b62a8518efe8c701a09cd609af4c50ecc7f0b468bb8

SHA512
0f7033686befa3f4acf3ed355c1674eaa6e349fba97e906446c8a7000be6876f157bc015bf5d3011fbbdc2c771bcbaea97918b8d24c064cbbd302741cc70cbc7

Download Submit
C:\Windows\Installer\MSI1236.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
182KB

MD5
82eb1ccf28f3af897c2db27282b41156

SHA1
9f945d8b18ff0fbb5f013efe5e2ff33aef136104

SHA256
ced6cab3c04c08ce5705af0b6986965dbdbfda17cbd66c973bb371ed3b95f37a

SHA512
9458fabeae4dabf8109b9736496a01d9168312faec1c17d6eed89e8f09cbb8287d74ff758948cf07838720c11005e87a734e920be4ead275354f46a0a6176f84

Download Submit
C:\Windows\Installer\MSI1236.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
182KB

MD5
82eb1ccf28f3af897c2db27282b41156

SHA1
9f945d8b18ff0fbb5f013efe5e2ff33aef136104

SHA256
ced6cab3c04c08ce5705af0b6986965dbdbfda17cbd66c973bb371ed3b95f37a

SHA512
9458fabeae4dabf8109b9736496a01d9168312faec1c17d6eed89e8f09cbb8287d74ff758948cf07838720c11005e87a734e920be4ead275354f46a0a6176f84

Download Submit
C:\Windows\Installer\MSI1236.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
182KB

MD5
82eb1ccf28f3af897c2db27282b41156

SHA1
9f945d8b18ff0fbb5f013efe5e2ff33aef136104

SHA256
ced6cab3c04c08ce5705af0b6986965dbdbfda17cbd66c973bb371ed3b95f37a

SHA512
9458fabeae4dabf8109b9736496a01d9168312faec1c17d6eed89e8f09cbb8287d74ff758948cf07838720c11005e87a734e920be4ead275354f46a0a6176f84

Download Submit
C:\Windows\Installer\MSI1236.tmp-\WixSharp.dll

Filesize
431KB

MD5
6718a452df12b05b01df40b5053a990d

SHA1
e229d3e3c0f9b2f974bc4a00a3336c75fd7e2df9

SHA256
91c2bc9c56cbc0609d96f030887c59831b275daf58a727e74bbdb2db7987d9ef

SHA512
7e0557c24cb3465f3323a0976a48888adf6811ab37ca64b3b7088803c0da907a0f05067b0f95131137befe302da319ed7241faf76beda372a68506be111a793b

Download Submit
C:\Windows\Installer\MSI1236.tmp-\WixSharp.dll

Filesize
431KB

MD5
6718a452df12b05b01df40b5053a990d

SHA1
e229d3e3c0f9b2f974bc4a00a3336c75fd7e2df9

SHA256
91c2bc9c56cbc0609d96f030887c59831b275daf58a727e74bbdb2db7987d9ef

SHA512
7e0557c24cb3465f3323a0976a48888adf6811ab37ca64b3b7088803c0da907a0f05067b0f95131137befe302da319ed7241faf76beda372a68506be111a793b

Download Submit
C:\Windows\Installer\MSI1236.tmp-\WixSharp.dll

Filesize
431KB

MD5
6718a452df12b05b01df40b5053a990d

SHA1
e229d3e3c0f9b2f974bc4a00a3336c75fd7e2df9

SHA256
91c2bc9c56cbc0609d96f030887c59831b275daf58a727e74bbdb2db7987d9ef

SHA512
7e0557c24cb3465f3323a0976a48888adf6811ab37ca64b3b7088803c0da907a0f05067b0f95131137befe302da319ed7241faf76beda372a68506be111a793b

Download Submit
C:\Windows\Installer\MSI1A27.tmp

Filesize
470KB

MD5
abb7b72f6b515e05e58751a54f343c6c

SHA1
e847dfd57d519da49d7e66f0987b983e4b163e1e

SHA256
1f9588303213c5fb9d49d4779f704448bb60288d343a238fc90fda8449fd44d0

SHA512
189e972f900c016269e3eb959fb4a9e0c2e25ded06cf1c8ca7b014c17703e09e905272ed7e38039963fa3bc398dbdfd230c7cd0d0785d2f4129b6700545bbb26

Download Submit
C:\Windows\Installer\MSI1A27.tmp

Filesize
470KB

MD5
abb7b72f6b515e05e58751a54f343c6c

SHA1
e847dfd57d519da49d7e66f0987b983e4b163e1e

SHA256
1f9588303213c5fb9d49d4779f704448bb60288d343a238fc90fda8449fd44d0

SHA512
189e972f900c016269e3eb959fb4a9e0c2e25ded06cf1c8ca7b014c17703e09e905272ed7e38039963fa3bc398dbdfd230c7cd0d0785d2f4129b6700545bbb26

Download Submit
C:\Windows\Installer\MSI1A27.tmp

Filesize
470KB

MD5
abb7b72f6b515e05e58751a54f343c6c

SHA1
e847dfd57d519da49d7e66f0987b983e4b163e1e

SHA256
1f9588303213c5fb9d49d4779f704448bb60288d343a238fc90fda8449fd44d0

SHA512
189e972f900c016269e3eb959fb4a9e0c2e25ded06cf1c8ca7b014c17703e09e905272ed7e38039963fa3bc398dbdfd230c7cd0d0785d2f4129b6700545bbb26

Download Submit
C:\Windows\Installer\MSI1A27.tmp-\MSIBuilder.exe

Filesize
17KB

MD5
6b3d6d63c89256f58eb396b9e48b641d

SHA1
f91c70b792092bab478672d913e82846de9113f1

SHA256
d4723376337e730c3cf50c3b853c5d9d4c7dfbe3941eeb7df910280bf41e2252

SHA512
407e62d9848492b56420eed801aa5688cef731cc1442766953d189673f117c90947b28ac9e248a552ebeb546de1e2894b28bef69dc4a6d8d2cced21b25ea6146

Download Submit
C:\Windows\Installer\MSI1A27.tmp-\MSIBuilder.exe

Filesize
17KB

MD5
6b3d6d63c89256f58eb396b9e48b641d

SHA1
f91c70b792092bab478672d913e82846de9113f1

SHA256
d4723376337e730c3cf50c3b853c5d9d4c7dfbe3941eeb7df910280bf41e2252

SHA512
407e62d9848492b56420eed801aa5688cef731cc1442766953d189673f117c90947b28ac9e248a552ebeb546de1e2894b28bef69dc4a6d8d2cced21b25ea6146

Download Submit
C:\Windows\Installer\MSI1A27.tmp-\MSIBuilder.exe

Filesize
17KB

MD5
6b3d6d63c89256f58eb396b9e48b641d

SHA1
f91c70b792092bab478672d913e82846de9113f1

SHA256
d4723376337e730c3cf50c3b853c5d9d4c7dfbe3941eeb7df910280bf41e2252

SHA512
407e62d9848492b56420eed801aa5688cef731cc1442766953d189673f117c90947b28ac9e248a552ebeb546de1e2894b28bef69dc4a6d8d2cced21b25ea6146

Download Submit
C:\Windows\Installer\MSI1A27.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
182KB

MD5
82eb1ccf28f3af897c2db27282b41156

SHA1
9f945d8b18ff0fbb5f013efe5e2ff33aef136104

SHA256
ced6cab3c04c08ce5705af0b6986965dbdbfda17cbd66c973bb371ed3b95f37a

SHA512
9458fabeae4dabf8109b9736496a01d9168312faec1c17d6eed89e8f09cbb8287d74ff758948cf07838720c11005e87a734e920be4ead275354f46a0a6176f84

Download Submit
C:\Windows\Installer\MSI1A27.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
182KB

MD5
82eb1ccf28f3af897c2db27282b41156

SHA1
9f945d8b18ff0fbb5f013efe5e2ff33aef136104

SHA256
ced6cab3c04c08ce5705af0b6986965dbdbfda17cbd66c973bb371ed3b95f37a

SHA512
9458fabeae4dabf8109b9736496a01d9168312faec1c17d6eed89e8f09cbb8287d74ff758948cf07838720c11005e87a734e920be4ead275354f46a0a6176f84

Download Submit
C:\Windows\Installer\MSI1A27.tmp-\WixSharp.dll

Filesize
431KB

MD5
6718a452df12b05b01df40b5053a990d

SHA1
e229d3e3c0f9b2f974bc4a00a3336c75fd7e2df9

SHA256
91c2bc9c56cbc0609d96f030887c59831b275daf58a727e74bbdb2db7987d9ef

SHA512
7e0557c24cb3465f3323a0976a48888adf6811ab37ca64b3b7088803c0da907a0f05067b0f95131137befe302da319ed7241faf76beda372a68506be111a793b

Download Submit
C:\Windows\Installer\MSI1A27.tmp-\WixSharp.dll

Filesize
431KB

MD5
6718a452df12b05b01df40b5053a990d

SHA1
e229d3e3c0f9b2f974bc4a00a3336c75fd7e2df9

SHA256
91c2bc9c56cbc0609d96f030887c59831b275daf58a727e74bbdb2db7987d9ef

SHA512
7e0557c24cb3465f3323a0976a48888adf6811ab37ca64b3b7088803c0da907a0f05067b0f95131137befe302da319ed7241faf76beda372a68506be111a793b

Download Submit
C:\Windows\Installer\MSI1EDC.tmp

Filesize
470KB

MD5
abb7b72f6b515e05e58751a54f343c6c

SHA1
e847dfd57d519da49d7e66f0987b983e4b163e1e

SHA256
1f9588303213c5fb9d49d4779f704448bb60288d343a238fc90fda8449fd44d0

SHA512
189e972f900c016269e3eb959fb4a9e0c2e25ded06cf1c8ca7b014c17703e09e905272ed7e38039963fa3bc398dbdfd230c7cd0d0785d2f4129b6700545bbb26

Download Submit
C:\Windows\Installer\MSI1EDC.tmp

Filesize
470KB

MD5
abb7b72f6b515e05e58751a54f343c6c

SHA1
e847dfd57d519da49d7e66f0987b983e4b163e1e

SHA256
1f9588303213c5fb9d49d4779f704448bb60288d343a238fc90fda8449fd44d0

SHA512
189e972f900c016269e3eb959fb4a9e0c2e25ded06cf1c8ca7b014c17703e09e905272ed7e38039963fa3bc398dbdfd230c7cd0d0785d2f4129b6700545bbb26

Download Submit
C:\Windows\Installer\MSI1EDC.tmp

Filesize
470KB

MD5
abb7b72f6b515e05e58751a54f343c6c

SHA1
e847dfd57d519da49d7e66f0987b983e4b163e1e

SHA256
1f9588303213c5fb9d49d4779f704448bb60288d343a238fc90fda8449fd44d0

SHA512
189e972f900c016269e3eb959fb4a9e0c2e25ded06cf1c8ca7b014c17703e09e905272ed7e38039963fa3bc398dbdfd230c7cd0d0785d2f4129b6700545bbb26

Download Submit
C:\Windows\Installer\MSI1EDC.tmp

Filesize
470KB

MD5
abb7b72f6b515e05e58751a54f343c6c

SHA1
e847dfd57d519da49d7e66f0987b983e4b163e1e

SHA256
1f9588303213c5fb9d49d4779f704448bb60288d343a238fc90fda8449fd44d0

SHA512
189e972f900c016269e3eb959fb4a9e0c2e25ded06cf1c8ca7b014c17703e09e905272ed7e38039963fa3bc398dbdfd230c7cd0d0785d2f4129b6700545bbb26

Download Submit
C:\Windows\Installer\MSI1EDC.tmp-\MSIBuilder.exe

Filesize
17KB

MD5
6b3d6d63c89256f58eb396b9e48b641d

SHA1
f91c70b792092bab478672d913e82846de9113f1

SHA256
d4723376337e730c3cf50c3b853c5d9d4c7dfbe3941eeb7df910280bf41e2252

SHA512
407e62d9848492b56420eed801aa5688cef731cc1442766953d189673f117c90947b28ac9e248a552ebeb546de1e2894b28bef69dc4a6d8d2cced21b25ea6146

Download Submit
C:\Windows\Installer\MSI1EDC.tmp-\MSIBuilder.exe

Filesize
17KB

MD5
6b3d6d63c89256f58eb396b9e48b641d

SHA1
f91c70b792092bab478672d913e82846de9113f1

SHA256
d4723376337e730c3cf50c3b853c5d9d4c7dfbe3941eeb7df910280bf41e2252

SHA512
407e62d9848492b56420eed801aa5688cef731cc1442766953d189673f117c90947b28ac9e248a552ebeb546de1e2894b28bef69dc4a6d8d2cced21b25ea6146

Download Submit
C:\Windows\Installer\MSI1EDC.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
182KB

MD5
82eb1ccf28f3af897c2db27282b41156

SHA1
9f945d8b18ff0fbb5f013efe5e2ff33aef136104

SHA256
ced6cab3c04c08ce5705af0b6986965dbdbfda17cbd66c973bb371ed3b95f37a

SHA512
9458fabeae4dabf8109b9736496a01d9168312faec1c17d6eed89e8f09cbb8287d74ff758948cf07838720c11005e87a734e920be4ead275354f46a0a6176f84

Download Submit
C:\Windows\Installer\MSI1EDC.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
182KB

MD5
82eb1ccf28f3af897c2db27282b41156

SHA1
9f945d8b18ff0fbb5f013efe5e2ff33aef136104

SHA256
ced6cab3c04c08ce5705af0b6986965dbdbfda17cbd66c973bb371ed3b95f37a

SHA512
9458fabeae4dabf8109b9736496a01d9168312faec1c17d6eed89e8f09cbb8287d74ff758948cf07838720c11005e87a734e920be4ead275354f46a0a6176f84

Download Submit
C:\Windows\Installer\MSI1EDC.tmp-\WixSharp.UI.dll

Filesize
239KB

MD5
629bbfbfda3c302696db6db2e4bd8948

SHA1
15a9c0b71b274235b77a80a8733dca3dd91b612d

SHA256
5954b02f956bde8e09be98c5e1a429fa3b462db7864c80a51d90c1ee7decc2c1

SHA512
f923602823680451873db2c81a5c422c0e13a31a5ee5b76d5c36925f4c5fedc88ad15788d5f650e63e628ce03ca6a02bebb4b8c33e472d79f019ebb71c02d543

Download Submit
C:\Windows\Installer\MSI1EDC.tmp-\WixSharp.dll

Filesize
431KB

MD5
6718a452df12b05b01df40b5053a990d

SHA1
e229d3e3c0f9b2f974bc4a00a3336c75fd7e2df9

SHA256
91c2bc9c56cbc0609d96f030887c59831b275daf58a727e74bbdb2db7987d9ef

SHA512
7e0557c24cb3465f3323a0976a48888adf6811ab37ca64b3b7088803c0da907a0f05067b0f95131137befe302da319ed7241faf76beda372a68506be111a793b

Download Submit
C:\Windows\Installer\MSI1EDC.tmp-\WixSharp.dll

Filesize
431KB

MD5
6718a452df12b05b01df40b5053a990d

SHA1
e229d3e3c0f9b2f974bc4a00a3336c75fd7e2df9

SHA256
91c2bc9c56cbc0609d96f030887c59831b275daf58a727e74bbdb2db7987d9ef

SHA512
7e0557c24cb3465f3323a0976a48888adf6811ab37ca64b3b7088803c0da907a0f05067b0f95131137befe302da319ed7241faf76beda372a68506be111a793b

Download Submit
C:\Windows\Installer\MSI2843.tmp

Filesize
470KB

MD5
abb7b72f6b515e05e58751a54f343c6c

SHA1
e847dfd57d519da49d7e66f0987b983e4b163e1e

SHA256
1f9588303213c5fb9d49d4779f704448bb60288d343a238fc90fda8449fd44d0

SHA512
189e972f900c016269e3eb959fb4a9e0c2e25ded06cf1c8ca7b014c17703e09e905272ed7e38039963fa3bc398dbdfd230c7cd0d0785d2f4129b6700545bbb26

Download Submit
C:\Windows\Installer\MSI2843.tmp

Filesize
470KB

MD5
abb7b72f6b515e05e58751a54f343c6c

SHA1
e847dfd57d519da49d7e66f0987b983e4b163e1e

SHA256
1f9588303213c5fb9d49d4779f704448bb60288d343a238fc90fda8449fd44d0

SHA512
189e972f900c016269e3eb959fb4a9e0c2e25ded06cf1c8ca7b014c17703e09e905272ed7e38039963fa3bc398dbdfd230c7cd0d0785d2f4129b6700545bbb26

Download Submit
C:\Windows\Installer\MSI2843.tmp

Filesize
470KB

MD5
abb7b72f6b515e05e58751a54f343c6c

SHA1
e847dfd57d519da49d7e66f0987b983e4b163e1e

SHA256
1f9588303213c5fb9d49d4779f704448bb60288d343a238fc90fda8449fd44d0

SHA512
189e972f900c016269e3eb959fb4a9e0c2e25ded06cf1c8ca7b014c17703e09e905272ed7e38039963fa3bc398dbdfd230c7cd0d0785d2f4129b6700545bbb26

Download Submit
C:\Windows\Installer\MSI2843.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
182KB

MD5
82eb1ccf28f3af897c2db27282b41156

SHA1
9f945d8b18ff0fbb5f013efe5e2ff33aef136104

SHA256
ced6cab3c04c08ce5705af0b6986965dbdbfda17cbd66c973bb371ed3b95f37a

SHA512
9458fabeae4dabf8109b9736496a01d9168312faec1c17d6eed89e8f09cbb8287d74ff758948cf07838720c11005e87a734e920be4ead275354f46a0a6176f84

Download Submit
C:\Windows\Installer\MSI2843.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
182KB

MD5
82eb1ccf28f3af897c2db27282b41156

SHA1
9f945d8b18ff0fbb5f013efe5e2ff33aef136104

SHA256
ced6cab3c04c08ce5705af0b6986965dbdbfda17cbd66c973bb371ed3b95f37a

SHA512
9458fabeae4dabf8109b9736496a01d9168312faec1c17d6eed89e8f09cbb8287d74ff758948cf07838720c11005e87a734e920be4ead275354f46a0a6176f84

Download Submit
C:\Windows\Installer\MSI2843.tmp-\WixSharp.dll

Filesize
431KB

MD5
6718a452df12b05b01df40b5053a990d

SHA1
e229d3e3c0f9b2f974bc4a00a3336c75fd7e2df9

SHA256
91c2bc9c56cbc0609d96f030887c59831b275daf58a727e74bbdb2db7987d9ef

SHA512
7e0557c24cb3465f3323a0976a48888adf6811ab37ca64b3b7088803c0da907a0f05067b0f95131137befe302da319ed7241faf76beda372a68506be111a793b

Download Submit
C:\Windows\Installer\MSI2843.tmp-\WixSharp.dll

Filesize
431KB

MD5
6718a452df12b05b01df40b5053a990d

SHA1
e229d3e3c0f9b2f974bc4a00a3336c75fd7e2df9

SHA256
91c2bc9c56cbc0609d96f030887c59831b275daf58a727e74bbdb2db7987d9ef

SHA512
7e0557c24cb3465f3323a0976a48888adf6811ab37ca64b3b7088803c0da907a0f05067b0f95131137befe302da319ed7241faf76beda372a68506be111a793b

Download Submit
C:\Windows\Installer\e5910a0.msi

Filesize
2.5MB

MD5
0a4f0faa78975c74260efbd859ac6282

SHA1
1df3d05c9847f7efc3dad5b8d31c48cff0ee69e2

SHA256
2e0f093aec2db43730e2b9e50e0156b7f69f9f30f7b744927ed95efa7f84ec2a

SHA512
ffaa480dc0ad2d4c5dc810efd03723fa7488298d364e06bbb273bb54f31d75f0caf00bcf37ab578374cf41b94689831a42a83124f908937b34859cb97a7c96eb

Download Submit
C:\Windows\Temp\text_log.dbg

Filesize
7KB

MD5
70376b88598cb4c3b077664293137ad9

SHA1
d2bbf410505a2c4f59338f69782a614958056eb2

SHA256
2e8dc402a9eab0ed66d96ab458a82ed7d85a2a3fb02bee93f9eae3d147a9cb81

SHA512
39d110c3c1025394f00721039872f3b3c8ae28c70985c33e8ce274f4dbce4d55904ed7270446a726a31d10e04201bc346d15944db4b55fe89d1d53c7574b34b7

Download Submit
C:\Windows\Temp\text_log.dbg

Filesize
7KB

MD5
c151a434919605d02a98f1e8e761a778

SHA1
41977ee14a0c832f88ede79ced6d572ac05beaa7

SHA256
6a3811d694bb107f926b0f8d1efc54166348fbe42d30eecce260369dda263da7

SHA512
1f0553f4fa0c900d134f10075c8796c796ea904c2ae428e197b58e4826af075fe74951f2af596cac0ba124d290ddb141aed2b77d9de1744d4241b435100c4c79

Download Submit
C:\Windows\Temp\text_log.dbg

Filesize
7KB

MD5
c151a434919605d02a98f1e8e761a778

SHA1
41977ee14a0c832f88ede79ced6d572ac05beaa7

SHA256
6a3811d694bb107f926b0f8d1efc54166348fbe42d30eecce260369dda263da7

SHA512
1f0553f4fa0c900d134f10075c8796c796ea904c2ae428e197b58e4826af075fe74951f2af596cac0ba124d290ddb141aed2b77d9de1744d4241b435100c4c79

Download Submit
C:\Windows\Temp\text_log.dbg

Filesize
7KB

MD5
c151a434919605d02a98f1e8e761a778

SHA1
41977ee14a0c832f88ede79ced6d572ac05beaa7

SHA256
6a3811d694bb107f926b0f8d1efc54166348fbe42d30eecce260369dda263da7

SHA512
1f0553f4fa0c900d134f10075c8796c796ea904c2ae428e197b58e4826af075fe74951f2af596cac0ba124d290ddb141aed2b77d9de1744d4241b435100c4c79

Download Submit
memory/2088-2388-0x00000259C70B0000-0x00000259C70B4000-memory.dmp

Filesize
16KB

Download
memory/2088-2378-0x00000259C70B0000-0x00000259C70B4000-memory.dmp

Filesize
16KB

Download
memory/2088-2394-0x00000259C7160000-0x00000259C7162000-memory.dmp

Filesize
8KB

Download
memory/2088-2395-0x00000259C7290000-0x00000259C7295000-memory.dmp

Filesize
20KB

Download
memory/2088-2391-0x00000259C70C0000-0x00000259C70C6000-memory.dmp

Filesize
24KB

Download
memory/2088-2392-0x00000259C70C0000-0x00000259C70C6000-memory.dmp

Filesize
24KB

Download
memory/2088-2396-0x00000259C7160000-0x00000259C7162000-memory.dmp

Filesize
8KB

Download
memory/2088-2390-0x00000259C70C0000-0x00000259C70C6000-memory.dmp

Filesize
24KB

Download
memory/2088-2387-0x00000259C70C0000-0x00000259C70C6000-memory.dmp

Filesize
24KB

Download
memory/2088-2397-0x00000259C7290000-0x00000259C7295000-memory.dmp

Filesize
20KB

Download
memory/2088-420-0x00000259E0D80000-0x00000259E0EFE000-memory.dmp

Filesize
1.5MB

Download
memory/2088-2386-0x00000259DF880000-0x00000259DF890000-memory.dmp

Filesize
64KB

Download
memory/2088-2385-0x00000259C70C0000-0x00000259C70C6000-memory.dmp

Filesize
24KB

Download
memory/2088-2400-0x00000259C7290000-0x00000259C7295000-memory.dmp

Filesize
20KB

Download
memory/2088-2399-0x00000259C70C0000-0x00000259C70C6000-memory.dmp

Filesize
24KB

Download
memory/2088-406-0x00000259DF880000-0x00000259DF890000-memory.dmp

Filesize
64KB

Download
memory/2088-570-0x00000259E1430000-0x00000259E1958000-memory.dmp

Filesize
5.2MB

Download
memory/2088-2130-0x00007FF925AA0000-0x00007FF926561000-memory.dmp

Filesize
10.8MB

Download
memory/2088-303-0x00007FF925AA0000-0x00007FF926561000-memory.dmp

Filesize
10.8MB

Download
memory/2680-188-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/2680-189-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/2680-195-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/2680-193-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/2680-194-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/2680-208-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/3732-270-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download
memory/3732-271-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download
memory/3732-288-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/3732-269-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download
memory/3732-268-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/4452-312-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/4452-2131-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/4452-305-0x0000000005200000-0x0000000005210000-memory.dmp

Filesize
64KB

Download
memory/4764-163-0x0000000004D10000-0x0000000004DA2000-memory.dmp

Filesize
584KB

Download
memory/4764-144-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/4764-149-0x00000000029A0000-0x00000000029CE000-memory.dmp

Filesize
184KB

Download
memory/4764-164-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/4764-150-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/4764-154-0x0000000004A60000-0x0000000004AA2000-memory.dmp

Filesize
264KB

Download
memory/4764-159-0x0000000005180000-0x0000000005724000-memory.dmp

Filesize
5.6MB

Download
memory/4764-407-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/4764-158-0x0000000004B50000-0x0000000004BC2000-memory.dmp

Filesize
456KB

Download
memory/5004-224-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/5004-246-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/5004-236-0x0000000004B80000-0x0000000004B8A000-memory.dmp

Filesize
40KB

Download
memory/5004-223-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/5004-229-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/5004-225-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download