gh0strat | 7fcaf225d0407d2274dd7ed72dc373d44acef7c0f8acb49bc2e533c646d5e1ef

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Googlups.msi
Size

18.4MB
MD5

e94eb6be9108f379432b4687c8118d8a
SHA1

ae6c7a88b243c5bbaf331ef7bf72aa849411a403
SHA256

7fcaf225d0407d2274dd7ed72dc373d44acef7c0f8acb49bc2e533c646d5e1ef
SHA512

2bafff3240c240ac22f6a85207e374bf919d4ba2cb1fea28936bfde9c38dd140cb066a7210eb585926c2af2861937472d44191c126170be9c4ffb304d55c681f
SSDEEP

393216:hQ0Frf5krXSujsG+tn43vEZMBsvuSqqVBRALiJ7AAP9dmQLQFH78XYEo8q:hQ05JQsG+54s0t7KR37AAPfrLQFgXw8q

Score

10^/10

gh0strat purplefox discovery evasion persistence privilege_escalation rat rootkit spyware stealer trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/1684-97-0x000000002BDE0000-0x000000002BF9B000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1684-97-0x000000002BDE0000-0x000000002BF9B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\128.0.6613.138\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_2E1554F9937BF8D3743D83D919742174	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_2E1554F9937BF8D3743D83D919742174	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\default_apps\external_extensions.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\chrome.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\eventlog_provider.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\9e94befe-a2d5-422a-b58a-eaad124796fa.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\VisualElements\LogoCanary.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\sl.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\dxcompiler.dll	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\el.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\mojo_core.dll	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\ur.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\VisualElements\SmallLogo.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\vk_swiftshader_icd.json	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\f84d366f-3d78-4268-82d9-d2dfbd8213f4.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\VisualElements\LogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\fa.pak	setup.exe
File created	C:\Program Files\AchieveAdvocateUnique\uxQTeZhsysKgAhmGAFbE	msiexec.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\ru.pak	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\AchieveAdvocateUnique	VoJdQmpoYW6.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\chrome.7z	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\zh-TW.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\WidevineCdm\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\VisualElements\SmallLogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\chrome_proxy.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\es-419.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\d3dcompiler_47.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\kn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\128.0.6613.138.manifest	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3472_40911558\LICENSE.txt	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\en-US.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\chrome.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\lv.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\vi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\WidevineCdm\LICENSE	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\optimization_guide_internal.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\he.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\it.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	ChromeSetup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3472_40911558\_metadata\verified_contents.json	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\ca.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\cs.pak	setup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\CR_716A7.tmp\CHROME.PACKED.7Z	128.0.6613.138_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\chrome_100_percent.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\Locales\uk.pak	setup.exe
File created	C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe	MrwBUjNvvYLA.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\libEGL.dll	setup.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\dfdb5b11-1b0a-4d09-86f5-2d5ca25a95dd.tmp	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe584c66.TMP	updater.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3472_38755764\crl-set	chrome.exe
File created	C:\Program Files (x86)\Google1316_1599037973\bin\updater.exe	ChromeSetup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4932_420246552\Chrome-bin\128.0.6613.138\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e579ef1.msi	msiexec.exe
File created	C:\Windows\Installer\e579eef.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e579eef.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8152C221-204D-4155-BDF7-5F8ECFA87E01}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9FF9.tmp	msiexec.exe

Executes dropped EXE 30 IoCs

pid	Process
2364	MrwBUjNvvYLA.exe
3428	VoJdQmpoYW6.exe
1316	ChromeSetup.exe
3616	updater.exe
1440	updater.exe
4492	updater.exe
4432	updater.exe
1684	VoJdQmpoYW6.exe
4944	updater.exe
3300	updater.exe
2296	128.0.6613.138_chrome_installer.exe
4932	setup.exe
2484	setup.exe
3944	setup.exe
3064	setup.exe
3472	chrome.exe
1112	chrome.exe
3052	chrome.exe
1160	chrome.exe
2224	chrome.exe
1612	chrome.exe
948	chrome.exe
2184	elevation_service.exe
2420	chrome.exe
3972	chrome.exe
5436	chrome.exe
5868	updater.exe
5884	updater.exe
5640	chrome.exe
3020	chrome.exe

Loads dropped DLL 29 IoCs

pid	Process
3472	chrome.exe
1112	chrome.exe
3472	chrome.exe
3052	chrome.exe
1160	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
1160	chrome.exe
2224	chrome.exe
2224	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
1612	chrome.exe
948	chrome.exe
1612	chrome.exe
948	chrome.exe
2420	chrome.exe
2420	chrome.exe
3972	chrome.exe
3972	chrome.exe
5436	chrome.exe
5436	chrome.exe
5640	chrome.exe
5640	chrome.exe
3020	chrome.exe
3020	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3784	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MrwBUjNvvYLA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoJdQmpoYW6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoJdQmpoYW6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2296	128.0.6613.138_chrome_installer.exe
4932	setup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b58935fac5ebb7730000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b58935fa0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b58935fa000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db58935fa000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b58935fa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\media.cdm.origin_data = "763DB92EB896743DF1EF2BDA479D998148385675861A604DD7E54C869096E593"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nmmhkkegccagdldgiimedpiccmgmieda = "DB5EA650900819D054593EC1E3F4EF373D0DAE2C19A97A550995FE062A17AED4"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_username = "CC1DA8F54018E236680089BC410E55955CC839636E57B30F84B4FB5C45C0C5F0"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\module_blocklist_cache_md5_digest = "06050DE43EDAE2616F7C157784FBC8DF2DF58DCB6A778147920BFBB307F7DA59"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\Extensions	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\StabilityMetrics\user_experience_metrics.stability.exited_cleanly = "0"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\version = "128.0.6613.138"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi = "0B49E6E9CA387F93E161F78274498F26C2FDD6791C8336B7BFC61298B4F2ADAB"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nmmhkkegccagdldgiimedpiccmgmieda = "C2289C93462A0C7BCF335DEA0516DF09F7B5B8446C1A89CBBF4FB599C5392406"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nmmhkkegccagdldgiimedpiccmgmieda = "84CA2F86A6B15C63912F17CBD55279A9DCC3CB0BEA45F277A574206C3E74408E"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\failed_count = "0"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_signed_in_username = "1A92AE484951D2D4894CDE5B34A512575E467EC1F63791A61C6E6AC1BC00FCA0"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\homepage = "F2B8DDEC0519E32A06E0951533C0ED6C47FCF77FF3F75D06037DADEC8082E8BD"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_account_id = "2062E00451F14ABA1FEB20A403E04D2FDDFEF0A7A6CA19DCDEF13C74173D4625"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\state = "1"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nkeimhogjdpnpccoofpliimaahmaaome = "90426915EC4ABECD81BBBA613243DC5E9CC36B8936E3BAE819951B7F10498F1A"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	updater.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.account_id = "D1CC6919CFB3FF27B6ACBC8B721F6FF651D53F8DFE9F2B16ED489FA8F7DA4120"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ahfgeienlihckogmohjhadlkjgocpleb = "1D3408BF0BB050A710B40D75F706864D8182267F8F367EDCD9682F6C47B81B33"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\pinned_tabs = "0CEB5F8FAA49DB230976D85B244A6661FB73761117C9AFB0399A906FD9DB6E84"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\StabilityMetrics	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\session.startup_urls = "AC1CC5A87EA1ADDC1C4FDDFDBF0D25DE4D61E8D4071935591EE5DA960CC8D84F"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\homepage_is_newtabpage = "F79D8DC4484383221E488B6B4FE4709CAF28932A109D4D6A8A4399E49F5DA29A"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\mhjfbmdgcfjbbpaeojofohoefgiehjai = "102967250FB4B868EA612565076EC4E1BD5E00F15F373CB0B98EF4ACE4562446"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\InstallerPinned = "0"	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi = "DA9760A00C62150A00F02136A3ACB8551ACF75D470ACCF5CBDB9742B84E3CF9F"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\dr = "1"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\search_provider_overrides = "703CC4CA1EBFC6CB74F9B3DFDAF7E903AD8BFDA7A0D556B128A22B43B1BA2BC2"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatusValue"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B685B009-DBC4-4F24-9542-A162C3793E77}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\1.0\ = "GoogleUpdater TypeLib for ICurrentState"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\ = "{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ = "IPolicyStatus"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\ = "TypeLib for Interface {463ABECF-410D-407F-8AF5-0DF35A005CC8}"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\TypeLib\ = "{247954F9-9EDC-4E68-8CC3-150C2B89EADF}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\TypeLib\ = "{34527502-D3DB-4205-A69B-789B27EE0414}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4B5D74-8832-5170-AB03-2415833EC703}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\5"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A4B5D74-8832-5170-AB03-2415833EC703}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ = "IUpdaterSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\ = "ICompleteStatusSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B685B009-DBC4-4F24-9542-A162C3793E77}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\ = "IPolicyStatus2System"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CCA9FC90-B200-5641-99C0-7907756A93CF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\TypeLib	updater.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\122C2518D4025514DB7FF5E8FC8AE710\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\GoogleUpdate.Update3WebMachine	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8476CE12-AE1F-4198-805C-BA0F9B783F57}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{34527502-D3DB-4205-A69B-789B27EE0414}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\TypeLib\ = "{05A30352-EB25-45B6-8449-BCA7B0542CE5}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0\ = "GoogleUpdater TypeLib for IUpdaterSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0\win64	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{CCA9FC90-B200-5641-99C0-7907756A93CF}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ = "ICurrentState"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{44B969D4-48B7-5A30-9CD6-CAC179D81F9C}\ServiceParameters = "--com-service"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\4"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{34527502-D3DB-4205-A69B-789B27EE0414}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0\0\win64	updater.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2848	msiexec.exe
2848	msiexec.exe
3616	updater.exe
3616	updater.exe
3616	updater.exe
3616	updater.exe
3616	updater.exe
3616	updater.exe
3428	VoJdQmpoYW6.exe
3428	VoJdQmpoYW6.exe
4492	updater.exe
4492	updater.exe
4492	updater.exe
4492	updater.exe
4492	updater.exe
4492	updater.exe
4944	updater.exe
4944	updater.exe
4944	updater.exe
4944	updater.exe
4944	updater.exe
4944	updater.exe
4944	updater.exe
4944	updater.exe
1684	VoJdQmpoYW6.exe
1684	VoJdQmpoYW6.exe
3616	updater.exe
3616	updater.exe
3472	chrome.exe
3472	chrome.exe
5868	updater.exe
5868	updater.exe
5868	updater.exe
5868	updater.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3784	msiexec.exe
Token: SeSecurityPrivilege	2848	msiexec.exe
Token: SeCreateTokenPrivilege	3784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3784	msiexec.exe
Token: SeLockMemoryPrivilege	3784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3784	msiexec.exe
Token: SeMachineAccountPrivilege	3784	msiexec.exe
Token: SeTcbPrivilege	3784	msiexec.exe
Token: SeSecurityPrivilege	3784	msiexec.exe
Token: SeTakeOwnershipPrivilege	3784	msiexec.exe
Token: SeLoadDriverPrivilege	3784	msiexec.exe
Token: SeSystemProfilePrivilege	3784	msiexec.exe
Token: SeSystemtimePrivilege	3784	msiexec.exe
Token: SeProfSingleProcessPrivilege	3784	msiexec.exe
Token: SeIncBasePriorityPrivilege	3784	msiexec.exe
Token: SeCreatePagefilePrivilege	3784	msiexec.exe
Token: SeCreatePermanentPrivilege	3784	msiexec.exe
Token: SeBackupPrivilege	3784	msiexec.exe
Token: SeRestorePrivilege	3784	msiexec.exe
Token: SeShutdownPrivilege	3784	msiexec.exe
Token: SeDebugPrivilege	3784	msiexec.exe
Token: SeAuditPrivilege	3784	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3784	msiexec.exe
Token: SeChangeNotifyPrivilege	3784	msiexec.exe
Token: SeRemoteShutdownPrivilege	3784	msiexec.exe
Token: SeUndockPrivilege	3784	msiexec.exe
Token: SeSyncAgentPrivilege	3784	msiexec.exe
Token: SeEnableDelegationPrivilege	3784	msiexec.exe
Token: SeManageVolumePrivilege	3784	msiexec.exe
Token: SeImpersonatePrivilege	3784	msiexec.exe
Token: SeCreateGlobalPrivilege	3784	msiexec.exe
Token: SeBackupPrivilege	4252	vssvc.exe
Token: SeRestorePrivilege	4252	vssvc.exe
Token: SeAuditPrivilege	4252	vssvc.exe
Token: SeBackupPrivilege	2848	msiexec.exe
Token: SeRestorePrivilege	2848	msiexec.exe
Token: SeRestorePrivilege	2848	msiexec.exe
Token: SeTakeOwnershipPrivilege	2848	msiexec.exe
Token: SeRestorePrivilege	2848	msiexec.exe
Token: SeTakeOwnershipPrivilege	2848	msiexec.exe
Token: SeBackupPrivilege	3204	srtasks.exe
Token: SeRestorePrivilege	3204	srtasks.exe
Token: SeSecurityPrivilege	3204	srtasks.exe
Token: SeTakeOwnershipPrivilege	3204	srtasks.exe
Token: SeBackupPrivilege	3204	srtasks.exe
Token: SeRestorePrivilege	3204	srtasks.exe
Token: SeSecurityPrivilege	3204	srtasks.exe
Token: SeTakeOwnershipPrivilege	3204	srtasks.exe
Token: SeRestorePrivilege	2848	msiexec.exe
Token: SeTakeOwnershipPrivilege	2848	msiexec.exe
Token: SeRestorePrivilege	2848	msiexec.exe
Token: SeTakeOwnershipPrivilege	2848	msiexec.exe
Token: SeRestorePrivilege	2848	msiexec.exe
Token: SeTakeOwnershipPrivilege	2848	msiexec.exe
Token: SeRestorePrivilege	2848	msiexec.exe
Token: SeTakeOwnershipPrivilege	2848	msiexec.exe
Token: SeRestorePrivilege	2848	msiexec.exe
Token: SeTakeOwnershipPrivilege	2848	msiexec.exe
Token: SeRestorePrivilege	2848	msiexec.exe
Token: SeTakeOwnershipPrivilege	2848	msiexec.exe
Token: SeRestorePrivilege	2848	msiexec.exe
Token: SeTakeOwnershipPrivilege	2848	msiexec.exe
Token: SeRestorePrivilege	2848	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3784	msiexec.exe
3784	msiexec.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3204	2848	msiexec.exe	98
PID 2848 wrote to memory of 3204	2848	msiexec.exe	98
PID 2848 wrote to memory of 1940	2848	msiexec.exe	100
PID 2848 wrote to memory of 1940	2848	msiexec.exe	100
PID 2848 wrote to memory of 1940	2848	msiexec.exe	100
PID 1940 wrote to memory of 2364	1940	MsiExec.exe	101
PID 1940 wrote to memory of 2364	1940	MsiExec.exe	101
PID 1940 wrote to memory of 2364	1940	MsiExec.exe	101
PID 1940 wrote to memory of 3428	1940	MsiExec.exe	103
PID 1940 wrote to memory of 3428	1940	MsiExec.exe	103
PID 1940 wrote to memory of 3428	1940	MsiExec.exe	103
PID 1940 wrote to memory of 1316	1940	MsiExec.exe	104
PID 1940 wrote to memory of 1316	1940	MsiExec.exe	104
PID 1940 wrote to memory of 1316	1940	MsiExec.exe	104
PID 1316 wrote to memory of 3616	1316	ChromeSetup.exe	105
PID 1316 wrote to memory of 3616	1316	ChromeSetup.exe	105
PID 1316 wrote to memory of 3616	1316	ChromeSetup.exe	105
PID 3616 wrote to memory of 1440	3616	updater.exe	106
PID 3616 wrote to memory of 1440	3616	updater.exe	106
PID 3616 wrote to memory of 1440	3616	updater.exe	106
PID 4492 wrote to memory of 4432	4492	updater.exe	108
PID 4492 wrote to memory of 4432	4492	updater.exe	108
PID 4492 wrote to memory of 4432	4492	updater.exe	108
PID 4944 wrote to memory of 3300	4944	updater.exe	111
PID 4944 wrote to memory of 3300	4944	updater.exe	111
PID 4944 wrote to memory of 3300	4944	updater.exe	111
PID 4944 wrote to memory of 2296	4944	updater.exe	112
PID 4944 wrote to memory of 2296	4944	updater.exe	112
PID 2296 wrote to memory of 4932	2296	128.0.6613.138_chrome_installer.exe	113
PID 2296 wrote to memory of 4932	2296	128.0.6613.138_chrome_installer.exe	113
PID 4932 wrote to memory of 2484	4932	setup.exe	114
PID 4932 wrote to memory of 2484	4932	setup.exe	114
PID 4932 wrote to memory of 3944	4932	setup.exe	117
PID 4932 wrote to memory of 3944	4932	setup.exe	117
PID 3944 wrote to memory of 3064	3944	setup.exe	118
PID 3944 wrote to memory of 3064	3944	setup.exe	118
PID 3616 wrote to memory of 3472	3616	updater.exe	120
PID 3616 wrote to memory of 3472	3616	updater.exe	120
PID 3472 wrote to memory of 1112	3472	chrome.exe	121
PID 3472 wrote to memory of 1112	3472	chrome.exe	121
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122
PID 3472 wrote to memory of 3052	3472	chrome.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Googlups.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3784

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3204
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FD7399D0E92A61EB22FA33A28153A161 E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Program Files\AchieveAdvocateUnique\MrwBUjNvvYLA.exe
    "C:\Program Files\AchieveAdvocateUnique\MrwBUjNvvYLA.exe" x "C:\Program Files\AchieveAdvocateUnique\uxQTeZhsysKgAhmGAFbE" -o"C:\Program Files\AchieveAdvocateUnique\" -pRqmkCHAqYDofrFbTRHzi -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2364
- - C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe
    "C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe" -number 200 -file file3 -mode mode3 -flag flag3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3428
- - C:\Program Files\AchieveAdvocateUnique\ChromeSetup.exe
    "C:\Program Files\AchieveAdvocateUnique\ChromeSetup.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Program Files (x86)\Google1316_1599037973\bin\updater.exe
      "C:\Program Files (x86)\Google1316_1599037973\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={FD39FE3E-F972-AC55-37EA-CE3FED473068}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
      4⤵
      Checks whether UAC is enabled
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3616
    - - C:\Program Files (x86)\Google1316_1599037973\bin\updater.exe
        
        "C:\Program Files (x86)\Google1316_1599037973\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x79c694,0x79c6a0,0x79c6ac
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1440
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        5⤵
        Checks system information in the registry
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3472
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6613.138 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e0876c28,0x7ff8e0876c34,0x7ff8e0876c40
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1112
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1988,i,8516558053492754753,18438905014728141130,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:3052
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1876,i,8516558053492754753,18438905014728141130,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:1160
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2364,i,8516558053492754753,18438905014728141130,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:2224
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,8516558053492754753,18438905014728141130,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:1612
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,8516558053492754753,18438905014728141130,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:948
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4424,i,8516558053492754753,18438905014728141130,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2420
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4676,i,8516558053492754753,18438905014728141130,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:3972
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4292,i,8516558053492754753,18438905014728141130,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5436
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5352,i,8516558053492754753,18438905014728141130,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5640
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5280,i,8516558053492754753,18438905014728141130,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:3020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x72c694,0x72c6a0,0x72c6ac
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4432

C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe
"C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe" -file file3 -mode mode3 -flag flag3 -number 200
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1684

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x72c694,0x72c6a0,0x72c6ac
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3300
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\128.0.6613.138_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\128.0.6613.138_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\dfdb5b11-1b0a-4d09-86f5-2d5ca25a95dd.tmp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\CR_716A7.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\CR_716A7.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\CR_716A7.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\dfdb5b11-1b0a-4d09-86f5-2d5ca25a95dd.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\CR_716A7.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\CR_716A7.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6613.138 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff6c8e646b8,0x7ff6c8e646c4,0x7ff6c8e646d0
      4⤵
      Executes dropped EXE
      PID:2484
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\CR_716A7.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\CR_716A7.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:3944
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\CR_716A7.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\CR_716A7.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6613.138 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff6c8e646b8,0x7ff6c8e646c4,0x7ff6c8e646d0
        5⤵
        Executes dropped EXE
        
        PID:3064

C:\Program Files\Google\Chrome\Application\128.0.6613.138\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\128.0.6613.138\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5516

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5868
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x72c694,0x72c6a0,0x72c6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e579ef0.rbs

Filesize
7KB

MD5
a92fc066c5b086226133af57731cf1c2

SHA1
afcbeda02248442da13545bd04b9e1f0890d99c4

SHA256
96fa3d26e5a1e4de9d55097b22b762aad6b79cf4cbd171748d9cfb0f9c38fa1a

SHA512
c279642a6d9b9dfdba5c13d6f584b94434a6edb1b3d8e4c0e3919c2515cd6ee1e3ed2af4b73747c3f6a96cbc40dc74b1085cb8835d9137421e25cd10c9bf2d69

Download Submit
C:\Program Files (x86)\Google1316_1599037973\bin\updater.exe

Filesize
4.7MB

MD5
823816b4a601c69c89435ee17ef7b9e0

SHA1
2fc4c446243be4a18a6a0d142a68d5da7d2a6954

SHA256
c2a7c0fa80f228c2ce599e4427280997ea9e1a3f85ed32e5d5e4219dfb05ddb2

SHA512
f3b38807ed1eb96c932e850b9b37551554408a628bedf12aa32bde08c442ff3663bf584335e7eab193ce2cf7552bce456737c96a2ba9faa953150e6304068fc6

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat

Filesize
40B

MD5
2aa66f556bd56ad559c455307034ef2d

SHA1
dfcb1f28f6b9d1439c0fb80c6086290d875b6ee3

SHA256
f27ea7e62102228799f58f498e591ecb0190664db216fe05a5878d1caa14bf32

SHA512
4266087faedbbe46a2e4f415cfa253b381f387672ffec77c49b261771c4d6f3c03d607e49025844eb41c9ddbfe50c1cb1b827a5e9f80e6b99c0aea979efb4a53

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
502B

MD5
d934ab3be77768057682cf147af4f47d

SHA1
410cb0e900959610bb99bda4800fec07f129a565

SHA256
412368a254badf3959a6daa86d75311fbc1705e3e31795a4ee58a7804c4b888d

SHA512
0491cb37f98e1ac5895af70a3f6898d45685f36a2719ad6e84e1eed4c20d2d7cec248617eab2438d1a1c9aa6ae37f1ced6ac220e7f1204053deeb19dad4af469

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
602B

MD5
a53ee513e23b1d0a13a896f55e81cd94

SHA1
40267306ce756b68b7b71bd4ed3483c221194677

SHA256
912c45ab105e9f9afe6ef7c071dd34f9b416376270a65dd0cf57f123d4ba5afc

SHA512
4320419934554f4a079a477964726239071ada14ece839495653d0a4e93042a49de1090c4fad4b06941b20853d2e005e61f2ee6cf7335abfb8a756a918d024ff

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
354B

MD5
d4927578fc92dc543365aa4e43b202ba

SHA1
5e1aeb950ac6ac3f071fa02f90a4fbc0c8e5304c

SHA256
4ac029c04a6e82f4c588237f57a798b4285c818bdbb4250c20f11a5b95d4ecd1

SHA512
4c6cbf4bfb4279edc6d6bd816ca4d1d4dbc8b7f06d875493ffeea3a8782568f49911db28aae743a41962bbe4fe34afc531e119be58888a2acf0623e99df38e95

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
602B

MD5
f266f82e44bed9f5dd59dc789dae47d4

SHA1
86fc0899dc5985ace4da970d0062cea0e4b45397

SHA256
b52448da89b9fe7ec097788fe496c217738fdc86e6d876a47c2bee733edfb747

SHA512
60a2077fd5cf7417a833bed8bb3800dcaabeafa1d29dc59bef5a38b0ce5c05f2862293144ad03c1fe2de6c42546105c518e1cab0b9c10b232bcd32a572319b8b

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
49B

MD5
7b693a82168c33ec9e8cf276859ddf7f

SHA1
d396dbbe299fe7754a6244d01e97cc4edd0693eb

SHA256
84a9a7f43db56cd6e9a408f88244e8ba5efbe48a5b5168d321f112b8c8fd8e3f

SHA512
4064c158d753d19a72e1be1c8bd5fe7f22e2032d67d1dd7ea1d85ce652d63c69b85a4292c4403b0f7729b05607f3d1ccfaf4d27d04ad09ffcec70082450320ab

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
56c9dc5e58fbe05d6e26224e90dc3f1d

SHA1
4c4d82b1594ef8572ecae1ecba0dc73f8dd1cd31

SHA256
b771f6dc9880aa68e9c43be6d9d49f4484ee7d237bbe67f4623e41f7afcc48a3

SHA512
291ce73b60e7edde9a9f7714017cf55a4e958e58e13d16cd12da70193f01f97fa307017c22110672e06584b282716eccb00112f14e77700575a087127474882f

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
2KB

MD5
7599cc0842db14153b28fe86a8aeb165

SHA1
6c722d4cc41033ef313dafad22d199a232c20ebd

SHA256
ff61389c3c075cd54132bcc19e6a824225ab5c04a3db65e3f27072201a012d2d

SHA512
4c82e2937882671313a6974a1604a73d14750c8922cfbb8083e2ffa0b4ad2afd649fc44dfce65a9f944d4ea0276ae5ade24a84a8b302a9012d045abe23363b56

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
6KB

MD5
17b4d9a48da61c423155ba113578738a

SHA1
f3ed065b4fd780473d5a396bda361612a062ee60

SHA256
8daeb85fdb1b07fefe309be509f15e682c30f81d5518121d707c8aceb158194a

SHA512
1ee7ce20f6ecb7a3f904293293eb865e439e70f36df2c829faada0695bc0241d41697790011763d5736d88927578b25bb1decc0e453475f40444bef0bca59177

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
14KB

MD5
2fbc8e497a0792ab96e9f061a3b80fe7

SHA1
509c8c00072baf7a6f45012774f60bdd9feefd46

SHA256
f603ea9e208cdfa51be16fb91be883214c5b491adb509425f8e4a69ac9afc247

SHA512
14329f59aa4af651ded78f1e79ff39e92ba4a9f113b554d61b203539a529f2f5cd8a8d4d2596d054106f67a0e9fb4cbd76e715319305a00a841964327a2647a9

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\CR_716A7.tmp\setup.exe

Filesize
4.1MB

MD5
f6a169eb6b8b2e18f7615e71451c8d1b

SHA1
574de22fbe45c4906b1090a0dee80dacf90324cd

SHA256
a71658b5a01ee0580da332b4695dea1602e71ea7ce2e43b35cd27be0e5730515

SHA512
a859bc4342737ae04f31212cae02ac32d18b969f9797e267e060b88feb0dfaa9ec422a9960019ed81de42d610b22ba01f03118693f59fce684d3e7f9402b96cd

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4944_55311705\dfdb5b11-1b0a-4d09-86f5-2d5ca25a95dd.tmp

Filesize
678KB

MD5
ea24139dc7536c817a2ddd80ee15003a

SHA1
b3d9b3fe97b761abe17d9a79302fc5ecb5b290b2

SHA256
2f2a8080578efba688d915ce547dec012cf5bfe492144230920437fbf80d9132

SHA512
3db4060bf60580149f2fd64a809bc0e12d2db69b2d2cf44a380e819787928dcf79acc6e09d8abfaa6538920ed2de34103ee860d2c11ef74fdfe1a1d6bbb88896

Download Submit
C:\Program Files\AchieveAdvocateUnique\ChromeSetup.exe

Filesize
8.5MB

MD5
5adff4313fbd074df44b4eb5b7893c5e

SHA1
d27388ef6cf34d40e0e7666f6381fcc5bbafa0f7

SHA256
d0c7a4390bdd6b442b96fc76f8a38f7b756ba2c16752ea259844420161865cae

SHA512
f5d639922b91878cf83d97563288a3aa4cba94db3ad5e8ac11d24ef7c44b019383a4414aeba6171b4c7bfa83ea1eafc1231cc9233e3b82b5ca7dc0b3ffacbf60

Download Submit
C:\Program Files\AchieveAdvocateUnique\MrwBUjNvvYLA.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe

Filesize
2.1MB

MD5
1c65da3b593605961fe66bb4d4084498

SHA1
57f5be5cdf0b6716caf41290ab6753a01ff29954

SHA256
0393a96233c4d9a48767bc8ade9684a742068ddf5269c378a7f9f2379b0329d1

SHA512
6f81dadc8060dc852a136db9bb9714bf705b94a3d789a67916d01b793fb4a09fbd44818981956f374d03a2aa5c99b70b09d6c6ac02dca8b78e4421a611f955b5

Download Submit
C:\Program Files\AchieveAdvocateUnique\uxQTeZhsysKgAhmGAFbE

Filesize
765KB

MD5
d77d7a492861b33040238ad414540106

SHA1
3036572891a017157580854a650348f05037f70e

SHA256
dd34f06a206c139155d1855739c7da96752d4a464c952cc710fd7e9e58d18132

SHA512
95d3911a9aec01a22bba3f75a8e93d8410c69defdfa93bf122a7f9d205a6d2e76e1ad5d1c07bc8824aaaa488ce0b2123fb053635c3210b7b21c8754c656068c5

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\chrome_elf.dll

Filesize
1.2MB

MD5
bb7d6e99cc8298b544b75af2bb46873c

SHA1
3b9d3f6e0e392e89b3cba820c4c6271dbd09e2d9

SHA256
959dc64d6759f48b72580a0fa51a1006f3bacdf679574882f946aa6b80cef25e

SHA512
7964dce8d57995594b0adb112f2b305c9246154faf7ff137f49747a70c9317769841e7d405c2cc7626b971f51e1f59ec2dc0ade678914369c4420ae731b896be

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\dxcompiler.dll

Filesize
20.8MB

MD5
c1b97201166d804a2f122df7f41818e4

SHA1
bab8073265086b7ca5a55dfa5bab597140636302

SHA256
4618006ff45db38a0f6101a1a0621bc25c0b724cbdac2ed980bbf9c01550511e

SHA512
5217518c53a5bf9bf1d9887c58f2278f2335dde3adecfc745f1cbf80f2670a90b569520720bca5f92dd44665c74da05ed41d559f8b97854fc51f7ef48dac906d

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\dxil.dll

Filesize
1.4MB

MD5
30da04b06e0abec33fecc55db1aa9b95

SHA1
de711585acfe49c510b500328803d3a411a4e515

SHA256
a5fe1d8d9caa2ff29daffd53f73a9a4e19c250351b2abe4fc7b57e60ce67ac68

SHA512
67790874377e308d1448d0e41df9dd353a5f63686df4eb9a8e70a4da449b0c63a5d3655ab38d24b145ad3c57971b1c6793ea6c5ac2257b6eb2e8964a44ab0f08

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\libEGL.dll

Filesize
492KB

MD5
5908dcd30b71522a2a8347cd6b2f1d7e

SHA1
0ef72404e28715857851f25aeb7a35ee56bfcd5e

SHA256
04b51945bb5fa676c9f307273e89770a01874e72587049d9dd7c7bd6daf26fa3

SHA512
e4125ffffd5c05dbab8470a942adbca17ed3bed217772ebfc7d0ac562f16771f6a679a8d298114e498e933d231cc46353f3a03adce5c8bfb3d111aae313704c4

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\libGLESv2.dll

Filesize
7.9MB

MD5
a6d92c98fa63e69847bef71e2bf95d28

SHA1
2b29db0cbf0a1e697f710cbeeef7f649e8d98bfc

SHA256
94e8dfa902fd1f4600bca20bf66372fdda55f8415a95d80e142fed47e75d261b

SHA512
2fc5436bd925eb3646bb30e8a389b9d6d4d156d03eefe8c09153c8d27097a42d9e64f6a409d087799383955353513112649151ab1460abb3c776511451b04e05

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\vk_swiftshader.dll

Filesize
5.0MB

MD5
90ec592b8de9dd4ad2addbf2be1bfd7c

SHA1
4e493a5dd3f4b49b384d598e0193cb24e0c2ba2d

SHA256
e22fa5d9970363145ca533c795a46845b32bd27cead23321091adf1ea891a169

SHA512
4f412732f8c6f4270f519c279492b2c1c2cb5db3f8f953abe38aa6a5d274468878e10cbca26ca843866048f3e332c223609c229efab5f6157bff20e6546c3cb6

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.6MB

MD5
db46628ea19f23def3d3639e33431ad6

SHA1
29b97b1a7c807d8af01ec4d1177a005c38057a73

SHA256
ecfe5833564738f2434c6b826cd32888cbee451c84ef68537d3e86ad6bbcc0cf

SHA512
28ffd3cc91c66d549e3887e855521ac0c207e0a6dcd4d047e94ea9bc4a7e18634a8dbcaa94977e32aeb1387a497027baacd358cb84c9cb6c79bfa67e3a9afb60

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3472_40911558\Filtering Rules

Filesize
72KB

MD5
b23dd5b6eccb460003ea37ba0f5e3730

SHA1
fd444553cb7699f84ce7e5664232771673dcf67d

SHA256
7f7f432c27d97dee184dcd3ea20f731674c008be849c0136f9c5358e359f3ea9

SHA512
7e47bd172c4bd4c65f063a8fa3fb33ed47f29156eb20e42d4e8ea73c6f02526a30ffe907be5b7c1406d4eaa71fbec7c0d557c376dccd0a1a961e2f61b3431181

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3472_40911558\manifest.json

Filesize
114B

MD5
3448d97da638c7ef0fbca9b6949ffc8f

SHA1
36d8434f26f0316fab4627f7856fca7291fe8adf

SHA256
1700a11fd1e58367b450a41b2ae5fd26ecb5cdb459869c796c7dde18f1d30f73

SHA512
9bf9055b2ef82bd1d2a1e94009fed2d3481fe2dc336d306fa0db786658efa5b72c9a9a214a829b9fcc4222476051871ff012009c64f09b9109072abdf3def8cc

Download Submit
C:\Program Files\chrome_installer.log

Filesize
21KB

MD5
c21cc16e6379031947c275ad1697e005

SHA1
504def08ffe3a3481f6ee92838a3b0ba6211e22a

SHA256
bfea0a6e05a33e6043d8d168674cc909ac908ef9dd56dd93c6e23f2960412995

SHA512
9f18f458a81c01dc0424cdddcef04df8e1c0a01eef08da16704db2d402dcfce81f8d4b28f615f76a41484fc9a06b7d177291b828ed08ab5c183c1205da233ed3

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

Filesize
2KB

MD5
7a8f8cb3231f3d7ae1339048372fd3a1

SHA1
2c1f6861b4f2617c7b28a8867b4f2b552321e510

SHA256
3df93943e59af9409f20cf6ae3209d3af3c0dda6fafad5e6c0e651e2dc7a5dd4

SHA512
5a91e88c6940a97bde9e589107bff93e2bd0cf989607eb7df6185d667db6e7386127fc4583c5e14834276b8b9b969351af1d799f08667a8780f9d127fe06abed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
e1fab5795a973e6f5a79f3d1206106cd

SHA1
a3b030368f7ed0d8e81d4fdcae2e4fb2d1b1b7b4

SHA256
2e4e851834bf33216a902ed31e29bc23c8a37ed0008f8f24a624c471cbe02d78

SHA512
d4a3e295166d0f4e48617aa9c6d363a0704ecfd70546085599794a954a0b63735c222924ecaf73ea1aa531c4de7f4836bb371550f1b351a266a866b9c2b4c6d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
2c7a2dce7db8e2ba4e2c11ad8e433436

SHA1
5a7b0b04a00374ab7cc4022ebef6adcabac6cb2c

SHA256
455117c1b0527751430b0d889ba7c2442d97111f9df71c4fdfe8ea0c5c0558c3

SHA512
947445bdf598506779d0768fcdde884eb15effbe7952de25207b3601ab8c1329afdf8c5b0c7303d9b061eaf08e08d029a4a76959b7d141a8e8551da539d6e440

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
0fac8d7d8d0cf07c4df1b3de21f3b044

SHA1
597a13af9d654a94c1c47eea22da4de71d45a23f

SHA256
ab5e3e51cf54a479a44f83b934ef1dd7eb7de6772bfd56de0d576ce0bb1a7164

SHA512
244df6a504ab7b95d639b19dccdcd881ffb241a549078e91ddbb5e5e099426fa1ab57f94980df9aa09047a5bedee07f27fbd06122057ccac7682b403db9dea1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
65f0d216d5384367bfed080a35568994

SHA1
d172702f100f024096f496b3d3e9cd35a5e7032b

SHA256
3fa2ef2e83afd9078356a62a425620ed63daa8f45e4ed92ab0212e3d99ed9996

SHA512
330ed9dd28da0e0e0fa121ada9f5affbd743ded2ea3d5262280e28c849b272905500db81baa872766a729626a513e57d3e6dd26924728573d6ee784b7b12c86d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ae9f67a798568f3f03756e2113adcef0

SHA1
9fecd4a09cff2c8ff156457b322f19ac979e80f8

SHA256
d10f3f8d82f9ce75d9ace1146ac5302b373d396a83e14d659bfe629c220ef67f

SHA512
4f6cb05a432618ff00e4831821bc87c98cfeb08d7de9970505cf730210763c7f56931945282edb392af0376be36f46bdec7ba8125203aa6a46335debbce9a891

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
6d279d7f36643b4caabdbd4bc4765a72

SHA1
90547c44b56a8d6b6e8836d02f5e9900b43d96b5

SHA256
96df1d05074eaeda62d3f70cd4a94225940ba845e6c7d26e7efd7b00cde056c6

SHA512
7d4e0157ce5f6a4f6b1f8ef0cb60572c1a570b206965391bde1c728978fcc7962b47f35e6548f9a3b2a4547b94af6f9b1382028d744e86ebd4d76c079430ec95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
83138ccb524311181b511bb9555a0c77

SHA1
9601ccb4e6d7eacc417efcbe067d11a3ee972058

SHA256
a14cbcb288c2d570cfeea67debb13fb84718b0dc80ad02f955c9e40cfe7f154e

SHA512
1680460d1a4722504bfbc8734213d55ebb3f2d3dc9803696adf915881adbd41547d7591683a87e3a27dfca7ea5be4a21c3f7762ca8b31ad77c4cc62db830ed94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
189KB

MD5
5faab58c7fa6bf6cb7a3a7a1662aaa28

SHA1
b9df6223d79991f597990a6e7abdc6b4366f47bf

SHA256
669c2277a294c68ed6222f506aa133f190dee064a2fdb46ef840548253234c33

SHA512
d97396c0fcd8503bd636eb968452644ca530a7a810cec039903d7e31d6d84bf104fe2e4f92e15c452376108c2e474a4bf0e542e76106ed4fdafcb0f0dc759e44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
dba7418d5df822fdf5981d035f758aca

SHA1
ddcb1c48a47398f669cb06c32f156ae3fe10945a

SHA256
fbc76b557a592f4f1790738ed538827504cd1c1a9cc45d6d3d97138508fe8a4a

SHA512
9a4556d3aa5b96e8af009dd1b50e5f484bba4ffc38aac2499ba2620fe09efd5a3e2c778f082357e51c66ce1dca5618abaa52dabc285df5ed7f4275bd10423892

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
3ee1a7dcb9b4e7b4f685a3880725683c

SHA1
632cba02d512f65867c0141fa5d6f3c2e5d64ca7

SHA256
eee8ed9ef2e98ec0791cbac316483fb31f28e66a36726ce83fe846517cc247a1

SHA512
36a9606d7927209c9bbaf62ad60600da8e1e6b89a18265815a112a81dc5581d72a1d6ef67cdc60e7e925dfb526c63af0e7554ebe6213088bb80088bae86e1d57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
192KB

MD5
309ef584dd717e46c3d2a0f4fafd7af9

SHA1
3aebccafbe0b7ca254b83acf26c02f697e5bd029

SHA256
fcbd5dd63cdd2e1ea300a3d37515557a752f341580d0ddc64b9b9bccdd58bc35

SHA512
782719c5344722ebc72daaf8c25d7bb1f21e184586517fa9efb45b1dc3e1fc2cb9d43485e16e9836a9d4d29fa97e9e9e952b672e1c000488cc7a09ec079bc783

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
188KB

MD5
8fda6e9b0b73801e40efdd9ed7f408a0

SHA1
cfcc558dbfb9438e497764d284bd7b1b10681db6

SHA256
df54020959aad5d2233d93f72d4156141e8f4bdb37de9197e3df5f5e703b62be

SHA512
e0a361e2880b61035fbcc6b44ba1a887081370320a48a5b15d4a9d39b831682a4e721b41700b9492084785deeefe053820d6003b1095afddb300805ad83bb6eb

Download Submit
C:\Windows\Installer\e579eef.msi

Filesize
18.4MB

MD5
e94eb6be9108f379432b4687c8118d8a

SHA1
ae6c7a88b243c5bbaf331ef7bf72aa849411a403

SHA256
7fcaf225d0407d2274dd7ed72dc373d44acef7c0f8acb49bc2e533c646d5e1ef

SHA512
2bafff3240c240ac22f6a85207e374bf919d4ba2cb1fea28936bfde9c38dd140cb066a7210eb585926c2af2861937472d44191c126170be9c4ffb304d55c681f

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
ec6c3e84de4995bd3eadd37b876794ec

SHA1
c28ddc9beb57e5fabd7dd669d2d81adc75660874

SHA256
bce76bbef122970e4b256b3b02ca044adc130522d61ef340343cb297e405f52f

SHA512
b37df2b15b87f0c9523522b697c148f56698efbc60581c26aecf0cd851db16571450a9c1e5c88ab17ab948054dc8f3258c565848ae5cdf391934439059d18677

Download Submit
\??\Volume{fa3589b5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{607a7b55-523d-471f-b11c-7cb0e12530bc}_OnDiskSnapshotProp

Filesize
6KB

MD5
a7f654de14954496cbd15f8916a1e231

SHA1
856831358991fee98e1503bc569f856ecc77373c

SHA256
17ff4f4cb3bab23147842ba208643efbd5b72a21fe6effbd307c2c55effe564e

SHA512
0db487c6a80954bc3409b74440c3b042597c9473b8f7cad5a5130f8836a8eacd061bb0056a269366ae187e08f94558a19d817f2ae50bc6de3138ba35fed48c54

Download Submit
memory/1684-97-0x000000002BDE0000-0x000000002BF9B000-memory.dmp

Filesize
1.7MB

Download