hxxps://www[.]google[.]com/chrome/next-steps[.]html?statcb=1&installdataindex=empty&defaultbrowser=0&brand=FKPE&ds_kid=43700078651390399&gad_source=1&gclid=EAIaIQobChMI_uXAlJ-EiAMVzGSRBR2DtigPEAAYASABEgIoMvD_BwE&gclsrc=aw[.]ds#

Resubmissions

23/08/2024, 00:12

240823-ahm64sxfkk 8

22/08/2024, 23:22

240822-3ch97atama 8

22/08/2024, 21:51

240822-1qneyszcrf 8

20/08/2024, 18:54

240820-xkd3jsxhmb 8

Analysis

max time kernel
151s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 00:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/chrome/next-steps.html?statcb=1&installdataindex=empty&defaultbrowser=0&brand=FKPE&ds_kid=43700078651390399&gad_source=1&gclid=EAIaIQobChMI_uXAlJ-EiAMVzGSRBR2DtigPEAAYASABEgIoMvD_BwE&gclsrc=aw.ds#

Score

8^/10

discovery evasion persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\127.0.6533.120\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	chrome.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 23 IoCs

pid	Process
1896	ChromeSetup.exe
3548	updater.exe
4688	updater.exe
5224	updater.exe
5252	updater.exe
5400	updater.exe
5424	updater.exe
5908	127.0.6533.120_chrome_installer.exe
5960	setup.exe
5992	setup.exe
6092	setup.exe
6112	setup.exe
1792	chrome.exe
5584	chrome.exe
5536	chrome.exe
5612	chrome.exe
5680	chrome.exe
5000	elevation_service.exe
4544	chrome.exe
3084	chrome.exe
1616	chrome.exe
5760	chrome.exe
5540	chrome.exe

Loads dropped DLL 25 IoCs

pid	Process
1792	chrome.exe
5584	chrome.exe
1792	chrome.exe
5612	chrome.exe
5536	chrome.exe
5612	chrome.exe
5680	chrome.exe
5680	chrome.exe
5536	chrome.exe
5536	chrome.exe
5536	chrome.exe
5536	chrome.exe
4544	chrome.exe
4544	chrome.exe
3084	chrome.exe
3084	chrome.exe
5536	chrome.exe
5536	chrome.exe
5536	chrome.exe
1616	chrome.exe
1616	chrome.exe
5760	chrome.exe
5760	chrome.exe
5540	chrome.exe
5540	chrome.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\chrome_200_percent.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\chrome.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\chrome.VisualElementsManifest.xml	setup.exe
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File created	C:\Program Files (x86)\Google1896_1316072207\UPDATER.PACKED.7Z	ChromeSetup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\CR_24417.tmp\setup.exe	127.0.6533.120_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\tr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\ar.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\fi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\ms.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\VisualElements\LogoBeta.png	setup.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\CR_24417.tmp\CHROME.PACKED.7Z	127.0.6533.120_chrome_installer.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\CR_24417.tmp\SETUP.EX_	127.0.6533.120_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\en-GB.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\resources.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\c519dba0-10ec-47f3-a54d-bd2f69a4cc21.tmp	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe587be2.TMP	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\hr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\VisualElements\SmallLogoBeta.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\chrome_elf.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\manifest.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\bn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\gu.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\zh-CN.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\VisualElements\LogoCanary.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\WidevineCdm\LICENSE	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\elevation_service.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\optimization_guide_internal.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\de.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\ur.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\MEIPreload\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\CR_24417.tmp\setup.exe	127.0.6533.120_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\ro.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\chrome_pwa_launcher.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\eventlog_provider.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\vk_swiftshader.dll	setup.exe
File created	C:\Program Files (x86)\Google1896_1592695514\bin\uninstall.cmd	ChromeSetup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\el.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\th.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\vk_swiftshader_icd.json	setup.exe
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\icudtl.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\ta.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\chrome.exe.sig	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad\settings.dat	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\d3dcompiler_47.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\it.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\ja.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\Locales\zh-TW.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Application\127.0.6533.120\Installer\setup.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\uninstall.cmd	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\3b39dae6-1cdc-4902-8f22-bd993294c1c9.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5960_1650501930\Chrome-bin\127.0.6533.120\127.0.6533.120.manifest	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeSetup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5908	127.0.6533.120_chrome_installer.exe
5960	setup.exe

Checks SCSI registry key(s) 3 TTPs 39 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\InstallerPinned = "0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133688456636639896"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	setup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4757239-55B2-5C3D-8B06-DDE147267C2D}\ = "IUpdaterInternalSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib\ = "{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\129.0.6651.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\1.0\ = "GoogleUpdater TypeLib for IAppCommandWebSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0\ = "GoogleUpdater TypeLib for IUpdaterAppStateSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\1.0\ = "GoogleUpdater TypeLib for ICompleteStatusSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0\win32\ = "C:\\Program Files\\Google\\Chrome\\Application\\127.0.6533.120\\elevation_service.exe"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\VersionIndependentProgID	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4}\ServiceParameters = "--com-service"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0\win64	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\ = "IPolicyStatus3System"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ServiceParameters = "--com-service"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\ = "IPolicyStatus2System"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4757239-55B2-5C3D-8B06-DDE147267C2D}\TypeLib\Version = "1.0"	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ProgID	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{521FDB42-7130-4806-822A-FC5163FAD983}\ServiceParameters = "--com-service"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ = "IAppVersionWeb"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1588C1A8-27D9-563E-9641-8D20767FB258}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\LocalService = "GoogleUpdaterService129.0.6651.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{119413E1-D553-5881-9669-43EB131F5143}\1.0\ = "GoogleUpdater TypeLib for IUpdaterInternalCallbackSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\LocalService = "GoogleUpdaterService129.0.6651.0"	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine\CLSID	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\129.0.6651.0\\updater.exe\\4"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib\ = "{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{05A30352-EB25-45B6-8449-BCA7B0542CE5}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1588C1A8-27D9-563E-9641-8D20767FB258}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\TypeLib\ = "{85AE4AE3-8530-516B-8BE4-A456BF2637D3}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ = "Interface {463ABECF-410D-407F-8AF5-0DF35A005CC8}"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34527502-D3DB-4205-A69B-789B27EE0414}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\129.0.6651.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{1B0B4516-F3B8-4883-95D0-A43DEEB0C4C2}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}	updater.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 462244.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3484	msedge.exe
3484	msedge.exe
4832	identity_helper.exe
4832	identity_helper.exe
1432	msedge.exe
1432	msedge.exe
3548	updater.exe
3548	updater.exe
3548	updater.exe
3548	updater.exe
3548	updater.exe
3548	updater.exe
5224	updater.exe
5224	updater.exe
5224	updater.exe
5224	updater.exe
5224	updater.exe
5224	updater.exe
5400	updater.exe
5400	updater.exe
5400	updater.exe
5400	updater.exe
5400	updater.exe
5400	updater.exe
5400	updater.exe
5400	updater.exe
3548	updater.exe
3548	updater.exe
1792	chrome.exe
1792	chrome.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1896	ChromeSetup.exe
Token: SeIncBasePriorityPrivilege	1896	ChromeSetup.exe
Token: 33	5908	127.0.6533.120_chrome_installer.exe
Token: SeIncBasePriorityPrivilege	5908	127.0.6533.120_chrome_installer.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe
6996	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6548	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 4868	3484	msedge.exe	86
PID 3484 wrote to memory of 4868	3484	msedge.exe	86
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 4252	3484	msedge.exe	87
PID 3484 wrote to memory of 3544	3484	msedge.exe	88
PID 3484 wrote to memory of 3544	3484	msedge.exe	88
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89
PID 3484 wrote to memory of 2532	3484	msedge.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/chrome/next-steps.html?statcb=1&installdataindex=empty&defaultbrowser=0&brand=FKPE&ds_kid=43700078651390399&gad_source=1&gclid=EAIaIQobChMI_uXAlJ-EiAMVzGSRBR2DtigPEAAYASABEgIoMvD_BwE&gclsrc=aw.ds#
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb95f46f8,0x7ffbb95f4708,0x7ffbb95f4718
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432
- C:\Users\Admin\Downloads\ChromeSetup.exe
  "C:\Users\Admin\Downloads\ChromeSetup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- - C:\Program Files (x86)\Google1896_1592695514\bin\updater.exe
    "C:\Program Files (x86)\Google1896_1592695514\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={D8A7DEF3-2903-7F59-42FD-FF99D21A47DB}&lang=en&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&brand=FKPE&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:3548
  - - C:\Program Files (x86)\Google1896_1592695514\bin\updater.exe
      "C:\Program Files (x86)\Google1896_1592695514\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=129.0.6651.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x5c06cc,0x5c06d8,0x5c06e4
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:4688
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1792
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=127.0.6533.120 --initial-client-data=0x118,0x11c,0x120,0x40,0x124,0x7ffba5c9e790,0x7ffba5c9e79c,0x7ffba5c9e7a8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5584
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1808,i,1492101809880354715,4248167815923274551,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1804 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5536
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1900,i,1492101809880354715,4248167815923274551,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2108 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5612
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2304,i,1492101809880354715,4248167815923274551,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2428 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5680
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3192,i,1492101809880354715,4248167815923274551,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3204 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,1492101809880354715,4248167815923274551,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3236 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3084
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4448,i,1492101809880354715,4248167815923274551,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4528 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1616
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4912,i,1492101809880354715,4248167815923274551,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4948 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5760
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4900,i,1492101809880354715,4248167815923274551,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4820 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14809962243440002963,4906963572739749034,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5224
- C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=129.0.6651.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xe006cc,0xe006d8,0xe006e4
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5252

C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5400
- C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=129.0.6651.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xe006cc,0xe006d8,0xe006e4
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5424
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\127.0.6533.120_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\127.0.6533.120_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\18e7f3e9-228d-444b-88fe-974ad49b7592.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5908
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\CR_24417.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\CR_24417.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\CR_24417.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\18e7f3e9-228d-444b-88fe-974ad49b7592.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies registry class
    PID:5960
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\CR_24417.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\CR_24417.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=127.0.6533.120 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7a05541f8,0x7ff7a0554204,0x7ff7a0554210
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:5992
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\CR_24417.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\CR_24417.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:6092
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\CR_24417.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\CR_24417.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=127.0.6533.120 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7a05541f8,0x7ff7a0554204,0x7ff7a0554210
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:6112

C:\Program Files\Google\Chrome\Application\127.0.6533.120\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\127.0.6533.120\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3904

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:6996

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:5508

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:6548

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
PID:7164

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:60

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5484

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4536

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:220

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:6224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google1896_1592695514\bin\updater.exe

Filesize
4.7MB

MD5
a1361c84ae51ae71617978842d129712

SHA1
b4aa7a27da802454cc1a06d49020ef5f85096dad

SHA256
c06bf6776aa78e9aa48f7b1f19ae9b77b7e3277066003c653ab501304d8c2f10

SHA512
eb4bd87f78a16ea215c067781d664837bb8e1dd50c59a66dd4f7ed1fda13cd16741c3f351b319ecb9d63c2b9d99695fc0e0f15a3f22ece8bb02bfef5c8a2f99d

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\129.0.6651.0\Crashpad\settings.dat

Filesize
40B

MD5
4fcd0e08f3b94d4d7c04cde78e236757

SHA1
5f650086647ef8ba6035a9bdca983806610551c3

SHA256
80e5b4b152a000513ba3734d8a5bee4942ecbb13cd97686fbef620914bb62b20

SHA512
5b4925153eeac8a8452bcb256bf326b219a72fd05916b9e6febabec7173949c7c37030ef4ac1fa47df8ffc60a23f9e7ccc0983b34bee346e2871c70c309b7431

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
354B

MD5
04831982e260c4237ad64c96c00f179a

SHA1
dd5238f72ab6550a91dfc6f185ba7df3dab55912

SHA256
6ee1418c440156a58504bbc3419be33aa266b7917d1751478c29667f30cc9983

SHA512
5466b8dde7b38dbb9c4540fa63aa6a4976bbd71edcd7a14bbc23221c6c0ec9eb69672eb063a5267452e4a9d1c04c32c2f98c6a3142c3ec55e64167b9c8f4da98

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
500B

MD5
f6c4f216eab24802525766b544333a7c

SHA1
a7fc3a09f2add68177d603edc547b76c7ee30f0b

SHA256
bbf8c7db598de1543d71bb4cee038ecac6b8fec9c617e7668f916b509cbe661c

SHA512
d1f67a2d9495d4bd387bdc66d770ef8377ab9a22f2541cdc80dc0d237057bf5056c53413450c3f0a97ddbddb8401e5e8de526b671e94478bc1ef8f3d24ae6bc2

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
600B

MD5
480bba8cd53dc769a112d2d0f9b340c9

SHA1
ccf81977a970b2c3e954ad2d1ad4b7253e2e68dc

SHA256
cc751ccfd920dce5a6e77877ecf3aad8f76b91309d0d310747266686d2bd9477

SHA512
618b5d619b3ae48f9bb63f44d9b4b7732c4e13c33cb0ae3a782feb856f65fe5399eacd4b1bdfef8722abb543c28692c68ea5df005bad0b30748f931ec2ecea50

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
49B

MD5
aecbd8fe3f7b64ddf70a33b920fd4bb4

SHA1
e4225361cb957a152b9fa94b060bad56ca0fc4ed

SHA256
8bb68574186a8c571e687af459dc5917a5fe2fb8ead1048e6286e74a87ad06a3

SHA512
0ff0f418a15f6fa0230cd5277003620ec13b87bb3f00dda64453fbeacecc0c1d0d3c5d0697692b1fb6be0be8cff03c919bc10589bc7685983bfdfe859273a4bf

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
925B

MD5
e198cfb9c15c6d124d66035c92bfee03

SHA1
2c65b1ee69955a0b19c0bf6eaf6e29e1774c9b6f

SHA256
bf92bd14f462941f2c315a98772da2bd4cd658d5b44fe4050a6e47c59a083899

SHA512
58e86174e486033a63717bb3b9d66e5247d4ac533be555feaad5fb55621129a8e8a876bff91a880398111e49e219205965e1fa793205054e76d643a64ce2e80b

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
2KB

MD5
a3675c1cd4b2a94514c8a9471a1091e4

SHA1
04830922e258b19ccd2368efda87a8852669c75f

SHA256
0af74e9cea0ed207364069a4a12459f673cb6f5e15dd97c8faa0910de86f29bc

SHA512
dbc4e1ccb25fee6b491dcc45c017b7d06f6c0408c49a59e86ff62053b8652c8f993044cdc8f9c451ff04aaf13671b362b4949446357dc768509093ea93324730

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
5KB

MD5
dee7d8d61b6bd87c2ed2fe63d9377626

SHA1
c2c9a2ea3fe71b9cc576ad17511c03421a818145

SHA256
900525aa737886da8c099d4672ed69c65a100d61b748dafebe91701658fad0e9

SHA512
48c40bebd30409ae1b0a91c82b5b4d588b98f889e7bf0b822e44953bfa64ef4d90338a950ce9f6a33c735be94a9884faeec028ceff144b36be91e42c078cbe7e

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
9KB

MD5
1887eabf2496027ba942c01667c9a08a

SHA1
14b8f8ac15631ed06d08c701135567e50e5c7a1b

SHA256
577dc751472a4e5b754f1cab6d5d2e2418e724cb0aca86f6b447950bd29b3570

SHA512
496b67853996ccbc95c564e51e83a836df1e410acc26ca7da4ba01884f3fb04edae192e40d1b7b1a1eff43322cd414cfd3733f21e9dfb551e07af44b9fa4579e

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
11KB

MD5
ceb97a0cd548c52b45969990b4fa5171

SHA1
27bb197d4a1174f50f8d21d15e145c3e670dc1fd

SHA256
639808b7b111a39d9f6f12da921b9c21250e4cca4044df50e22c617b21f863d9

SHA512
8ee94152647c37bba872b11e208b8e38998ea433c2d7925d963fcc707768835fd7836fdcbc6053e05f8cc1baa01b51b7061e9886f7415bf07052c3034e8c2094

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\18e7f3e9-228d-444b-88fe-974ad49b7592.tmp

Filesize
666KB

MD5
a68b536fe5c44462da32ff099db38c3d

SHA1
1b081536522a4cf30f0da429bdfdac85f584391a

SHA256
6b65b011dc88452d8bfbb409a06f57cfec87962f9d139f0aeff4981263006971

SHA512
c6b6af0e9ce52cddb83cabe463b7b2c61670a7ce73561ce9131b4327da5f61c81db927cd2a7c071cb490347ae501d3a71c59b30f464abbf600a2acdc61e57058

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping5400_1562565151\CR_24417.tmp\setup.exe

Filesize
3.9MB

MD5
5aa8ebc484fabcfaba8d10170d0b4b59

SHA1
522c14c36b2a515426b0a97c97d9a11b20605fcb

SHA256
fcdf6ee87d81342d7949eb27d5716de504b0b0c7feb9ade2e24a4f83f2fc4165

SHA512
fd6f029b11908bf19532b4991cdd02a398d1be1bdbcc4b59adba2ae72a3cf3430b52a94be0b6487844b8b74b094aa91d1f514116ea14ae585ca65382f95c702d

Download Submit
C:\Program Files\Crashpad\settings.dat

Filesize
40B

MD5
ad38723daf25eeb45360e1a63a20f802

SHA1
b19d4c01bb52e408badaad4d371ebbdae33e7f62

SHA256
3af166d103dce85798c77f32544a2fb80fc5d51822a73e89b6023a6b2ba1d996

SHA512
7acacb74a55623b231a607c183c5a95fc46e63f161ac28cb078c3c0e0f31f495a77c52bddc6ab14a592c0c3b5043941a45b7562262ad13032cd7046def7a6a5b

Download Submit
C:\Program Files\Google\Chrome\Application\127.0.6533.120\chrome_elf.dll

Filesize
1.2MB

MD5
e8538474d747cde1d4bcb6303d90cb11

SHA1
d26f3fdbe13795196ec8d23c97ed1f31eea13d7d

SHA256
0b7e7c093545bdbefd2ec2e59903b7287fca7ca216c60f5f1982dc75cf0a8586

SHA512
b555591707def59356a2ff12fab77953be8210f81fbe4b1ad5fa4c24d1871a8d18bd3531691635300c39151d700594e253cafe7bd94de98e10ac363783d9a7e6

Download Submit
C:\Program Files\Google\Chrome\Application\127.0.6533.120\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Program Files\Google\Chrome\Application\127.0.6533.120\elevation_service.exe

Filesize
1.6MB

MD5
6b7c2a9314b4ef96211995da04ca87cf

SHA1
22ff904c04413fd19400b6d69026d84ad51c3d45

SHA256
808cb23c042c35c854504c2cc70c2adb8fb302d45c41f089b02544d839fd26e8

SHA512
d61d08385dd063278fecfd120518c25aca826f28586b6da7e106434d61194f61405b5d47568be5c6d8dc8d2b8caa51fab22130271512589d05e66f274af5d58a

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.4MB

MD5
11bf7ee17e0981bb17582dd82e0dea5e

SHA1
fca2b81a62ebac5b47e530bed6500eebc8afbf7e

SHA256
aae6e30eb238996e0d09d43b7420b06570aa6e339878440ef09226541a31f305

SHA512
c497c09e9c0a0bd7e30d62459edb9f3b879cfea79e77382da806695734a245120a00b2055f386d7e724c9c5741139f790e2e36a604bf4fe442076bc8034275db

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

Filesize
2KB

MD5
38725c80064a325987f16c87ef4b72a7

SHA1
4bfa2158c9b671915d51fded97fdc111cd8878a8

SHA256
ade44e82995a3a8c9243f7eeed57181572da16e7fd69bd0069299409dff5e425

SHA512
4f4c7b9829c55f0ca887ab2b592221f7a207d6e017fc6c1b14b6d7d7177f8be78be27f0f82e1962dab62d84591277576baec5d4a4cb930b095cd259e91075cdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
9de36c2f8f5509b6bc271742260db37b

SHA1
a6dbf978ae60ffff03ab352a68f79a884ef89cd4

SHA256
657e1ad484efe43d3ae102ee50188e94568c434a5f521ebd67601c7aa672331e

SHA512
c1a209967f37aeb26463445fe88d2221e54499536eddca625f239b17daab7b2247fccaf3f1ec6ca101e753cf14829677963fc00ca2c47dcb8264dd1989a0a9dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
15a58d97a50243b440cb3a6c4e2193df

SHA1
db19f66724ac27a4134d2c9bd9da1735230c7617

SHA256
2527d57fe2ca6c29b991c23336acc43cf8e07bcc56ab4dbf34f49a33a99a6b07

SHA512
da72e8eff9fed496e57d3192e8bd66145a364ca9f841a07c082467b4a3822a600118d998ad96f401f61b777dde293fe81f70d112b13daaf83d1d244e12897a6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
352B

MD5
f338993039451ed86de5bc92d817fe12

SHA1
da83076869bbcb3dab45405191b31d8eb75d590b

SHA256
ff74669cc1d95f26ddf3d92f2b9d9525b2192c3a24b71ed162b96eaef8e6df8e

SHA512
b841d8df1f59892937c36ea982b121ea34d2a452e689dad079969b0f9481d4c9058cce2911a6a32cd50fd1458e72f0eb23e9dd594598285f7f5d9a34afe01d73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
57cbbb72c5d055a5bd5ac2cbed7e53ef

SHA1
61a6dccb9909f77125c48200ad017a1a779372a6

SHA256
92032969476083372959f226b45407f85f43d5591d82c7a92bb6fae52ff80b50

SHA512
2517d0cca0acb756ca00ef5f4acb9b209d8895c0ecdb253ae7dd6ddc86f76b569744a63babf05e5876a322690e4f4dc384ca2bb87efa3cb1e0c2d0a89732f9c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
b6e08f7803966b16ece0626318d61fd3

SHA1
b9c6f1454e6eaa2be3959f0afd6b6fbb87bcef09

SHA256
289095064103dfb2da553bbb04d1c805871700e2b77df4753ed232828f2d4d32

SHA512
a804106e821ef05512cca4026e2e4773863e6edf517a050fff53ee944b970a949b6ff3408dccbe5d14d168b6ad0ce8bc6e9a8d0504f5826d270e83770f1bcc2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
0bf665f1489bd46cbccddc1a4407df3e

SHA1
1b0e3b4e3a462c1909659dc013b0521b3fd57105

SHA256
4f6c248ee5aedb1ee11d001a8572b10805c9eddfe6d691fce067e7c588dfb6de

SHA512
412cefeabfeab7ad5b9da13a7e9adb88c765cf3e2ff45b3d1f3d26652ae4799ae6dba999da82f786abb871b0b7c2746c9ec2b4f2226e04500b6cf1a3d092fccb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
238544b6af7d27f3fb78c267f6e86caf

SHA1
cd0d209114e696606c50a0bf68299d9cc0aefe78

SHA256
bc2c8f3d5b7f835b3c93254c601c931c4f49c08dce64ef2e35ebb2a85312d0db

SHA512
f2d2b54ba9904752b0628faea03782195f371792a2555da36628f5539d7d85cac58c2cdd8ee076eba7cc0e0ca0b4fe744b9a362551f06a58d22501217a1750e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
188KB

MD5
7ca4ea4896c923c5b31332fbe8dad46b

SHA1
5f0427a910a22e0d8d789ee726190a081eb446c9

SHA256
7f66ed5193394543f6d731148040aa1eaf2f27f450a8ece0868604aee51b79c2

SHA512
d731d6fe669e09c2167deb9ceebc4beaf0b731cb6127fa659a8c67c78253c286689a960179f7fc2f77d23701a845c2a63ff8e2434127b14bce4889f7ca64f336

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
188KB

MD5
4448758d8c9089a85c83960f9d6016d1

SHA1
a5a61d837547e6782875ead484cc80cfc9114f12

SHA256
bd5f85bd535c97eea29a5e683eaa40961816fcb1e3582af7a743fb5b19155940

SHA512
20dabc30975dfbc4cef0f10074140e3ceaa8aa3fe9349268b0e13638b03a6602e07205c226b8649ce32c63aba5e6d4cda5c3ed65de96b38415968a2d01bc0849

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
aab96a4abe3826a6520cd878d3d2c12c

SHA1
21afaf61b6a0299e995638a0fcffffb404a7658f

SHA256
381f7f2f9c633bbcecfe12a701b2a1c764be9e3be69fa53d444bc36b682f388d

SHA512
edf81312e13051bc5f6e5086f5995617284b4276f18dd520bca53df61a511c7cb5f1b2ed5f515511a6167cfa6333daaee4ac6e065222f0169c719c606aa946c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
15aff838e7f2b8e825005d9f64a8268c

SHA1
8731a1a07f3010356d70a20197b1dfe36493094d

SHA256
7d7dc1bb7f2a39275d68592a9bac3176111df411ee9d00b5ae8600c0edf83eb7

SHA512
91f80966cdeca286ef8bb82084adf4264542f6d748de4d301389baadb710c0ba9d85e866b4ad5c113d861abb3b0220fa1cc2758f2a5a96395e1505a6c5db6b9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8f54f26eda498e1bb3b69848bdf32fc0

SHA1
37b3e4f539023fe03bad27a54d58a68c51cfc7b6

SHA256
f995124a9272572266170353a49603582ba3fe98fa94a477ad5279bb794bf8e5

SHA512
a9289e8b6db71edfff8974efa57a946c07773928268d13a7c761ae3a07fb93577cc06c5c942c74aa2ed0dab2db33eef64ed5fbce1a78acdf71ad6d05a7757c8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc8c484eb38fb792d173d3f086b07085

SHA1
d5a5fd59ea8bacd59901939efd32bcb2db967bc8

SHA256
3b45001d6fe34b389ce69274e97c6bf6d40861a6d0322016c6be44c475436d31

SHA512
a52e818d42841b346169b7a248cb8bfd83990d20adc04ae8116edf205e49fb592c95e677de29afd8e23006b3c98582da67b54dfaf7d0abc0afc4a10ffb44e8c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
514eadf18ebec1a9292dad08dc2733b8

SHA1
585dbbf87b5c1c4a9ba79b316cc1462816065c56

SHA256
fbbb1efd0626d75df708180b4eac4543a71e61eb49d87d1544675628d4407dfb

SHA512
b81942f8f4766578a9e2abfb031cc2745de99c5c82411a2e8f772b0d4ed4736e223eeddcd96affc6946cfea836d9629f39789f8a33196e2f0b5493b7573684ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8487f1e46c53c0ea638aeb29d579b319

SHA1
40636b7c1ac0b993e5a8836d05e9886ba375c5c8

SHA256
be4d9e75eabff83e5e976637d6a9f23e47fcbeb3b5af1ea37aff83e7130206cd

SHA512
a919b36fe39ccea42685bbcb6c28c696d72f4d7a117d281a75bce6258ce90538a0ade726e82e8b3b5fcaad0ed776dd09d92bb592a5a39291d69a5741fbe15fdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
23fec4ee4032d48439a745a17ab810c8

SHA1
21c28fca8e88e90cb70fd710caf90e5f2555c7ba

SHA256
47af725744d789e5493b46ba51cbb20d0cb130f0c63142d92bd7d0b08cbe9b84

SHA512
af7b74101a176e225f436dbb774e1522796b226b746885b430470a07f71a8a3b75395c7355a0e879b580c4229c48d9e3db82dbed839418e2e28a3b037f5245b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7db534787a2784a5c393c999ddbd6f6d

SHA1
96f1667e08b6065595f3c4adf284aa1a39514e8d

SHA256
bd41ff93991d33f1bbd7d3b8b7df28b2d83e33b0c34dd07a993ea4b38b468032

SHA512
3e9555c817758ecb1b2f5a88b4808a6de2200b0c2e2fb81649cf7bdbb54a14e93754a258ba91c18a6dcb705fd7c1b312beaff13521589a6653f6d22889cbb819

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 462244.crdownload

Filesize
8.5MB

MD5
aefb027a8cab4adcee8e48fac5832807

SHA1
4771e267ccc918908db64f6fba7ca1498202257c

SHA256
8834c0f8724bb31fb1e9e78b0d864c6bce59486f5ffd20b5476a7c2053398a1c

SHA512
4f083488a85eee1a98a25dc59e7a165d89f624ebbb4e68278a647c09e845519ed600726ae1c063c1911a97386eee5abe96db30fabd3931d5cf6d9182c7a45f2c

Download Submit
C:\Windows\TEMP\chrome_installer.log

Filesize
21KB

MD5
698d8455d5d2861cc0257592cb5f9a23

SHA1
2f401a23542be625a0de365574076e39169fcec9

SHA256
7c2304664d79cde767daa88a51c35562a8150c60eb8dc6e111d1a23d68d39cea

SHA512
b27f9a184e1a0d20e35a0152e333c97af09b702b0b8670cd1bd57d7c08e3cd631be6c1ad7a2253dde6aaa05961f63ebf2174af38de66e7723784f23dd40b46e2

Download Submit
memory/4536-671-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/5484-533-0x0000020CE4D60000-0x0000020CE4D80000-memory.dmp

Filesize
128KB

Download
memory/5484-528-0x0000020CE3C00000-0x0000020CE3D00000-memory.dmp

Filesize
1024KB

Download
memory/5484-564-0x0000020CE5130000-0x0000020CE5150000-memory.dmp

Filesize
128KB

Download
memory/5484-541-0x0000020CE4D20000-0x0000020CE4D40000-memory.dmp

Filesize
128KB

Download
memory/5484-529-0x0000020CE3C00000-0x0000020CE3D00000-memory.dmp

Filesize
1024KB

Download
memory/6224-673-0x0000028B32F40000-0x0000028B33040000-memory.dmp

Filesize
1024KB

Download
memory/6224-699-0x0000028B34480000-0x0000028B344A0000-memory.dmp

Filesize
128KB

Download
memory/6224-689-0x0000028B33E60000-0x0000028B33E80000-memory.dmp

Filesize
128KB

Download
memory/6224-678-0x0000028B33EA0000-0x0000028B33EC0000-memory.dmp

Filesize
128KB

Download
memory/6224-674-0x0000028B32F40000-0x0000028B33040000-memory.dmp

Filesize
1024KB

Download
memory/6996-453-0x000002340AAC0000-0x000002340AAC1000-memory.dmp

Filesize
4KB

Download
memory/6996-463-0x000002340AAC0000-0x000002340AAC1000-memory.dmp

Filesize
4KB

Download
memory/6996-454-0x000002340AAC0000-0x000002340AAC1000-memory.dmp

Filesize
4KB

Download
memory/6996-464-0x000002340AAC0000-0x000002340AAC1000-memory.dmp

Filesize
4KB

Download
memory/6996-465-0x000002340AAC0000-0x000002340AAC1000-memory.dmp

Filesize
4KB

Download
memory/6996-461-0x000002340AAC0000-0x000002340AAC1000-memory.dmp

Filesize
4KB

Download
memory/6996-459-0x000002340AAC0000-0x000002340AAC1000-memory.dmp

Filesize
4KB

Download
memory/6996-462-0x000002340AAC0000-0x000002340AAC1000-memory.dmp

Filesize
4KB

Download
memory/6996-455-0x000002340AAC0000-0x000002340AAC1000-memory.dmp

Filesize
4KB

Download
memory/6996-460-0x000002340AAC0000-0x000002340AAC1000-memory.dmp

Filesize
4KB

Download
memory/7164-526-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download