gh0strat | 7fcaf225d0407d2274dd7ed72dc373d44acef7c0f8acb49bc2e533c646d5e1ef

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fcaf225d0407d2274dd7ed72dc373d44acef7c0f8acb49bc2e533c646d5e1ef.msi
Size

18.4MB
MD5

e94eb6be9108f379432b4687c8118d8a
SHA1

ae6c7a88b243c5bbaf331ef7bf72aa849411a403
SHA256

7fcaf225d0407d2274dd7ed72dc373d44acef7c0f8acb49bc2e533c646d5e1ef
SHA512

2bafff3240c240ac22f6a85207e374bf919d4ba2cb1fea28936bfde9c38dd140cb066a7210eb585926c2af2861937472d44191c126170be9c4ffb304d55c681f
SSDEEP

393216:hQ0Frf5krXSujsG+tn43vEZMBsvuSqqVBRALiJ7AAP9dmQLQFH78XYEo8q:hQ05JQsG+54s0t7KR37AAPfrLQFgXw8q

Score

10^/10

gh0strat purplefox discovery evasion persistence privilege_escalation rat rootkit spyware stealer trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/1752-86-0x000000002BCD0000-0x000000002BE8B000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1752-86-0x000000002BCD0000-0x000000002BE8B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\128.0.6613.138\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_2E1554F9937BF8D3743D83D919742174	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_2E1554F9937BF8D3743D83D919742174	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\VisualElements\Logo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\416f35a3-12f3-4988-a1e9-2f70ccde2491.tmp	updater.exe
File opened for modification	C:\Program Files\chrome_installer.log	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\en-GB.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\uk.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\v8_context_snapshot.bin	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\libGLESv2.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\es-419.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\ur.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\03f5b9a5-0e6d-4397-b9db-3a5324ea3540.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\03f5b9a5-0e6d-4397-b9db-3a5324ea3540.tmp	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\manifest.fingerprint	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\cs.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\PrivacySandboxAttestationsPreloaded\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\a0cc673a-3bc5-4188-bf94-5ab16c7fd2ed.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File opened for modification	C:\Program Files\chrome_installer.log	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5136_1784111984\Filtering Rules	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\pl.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\chrome_elf.dll	setup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Application\128.0.6613.138\Installer\setup.exe	setup.exe
File created	C:\Program Files (x86)\Google468_1799404396\bin\updater.exe	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\it.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\nb.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\chrome.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\vk_swiftshader.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\chrome_wer.dll	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe58cd1f.TMP	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\fi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\gu.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\sr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\th.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\vi.pak	setup.exe
File created	C:\Program Files\AchieveAdvocateUnique\MrwBUjNvvYLA.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\chrome_url_fetcher_64_1500486219\-8a69d345-d564-463c-aff1-a69d9e530f96-_128.0.6613.138_all_ac7ostd6fqlt2cf5noeuqwufe5na.crx3	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\hi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\kn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\optimization_guide_internal.dll	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe5954fc.TMP	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat	updater.exe
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\lt.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\sv.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\chrome_proxy.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\elevation_service.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe	MrwBUjNvvYLA.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\chrome.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5136_1784111984\manifest.json	chrome.exe
File created	C:\Program Files\AchieveAdvocateUnique\ChromeSetup.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\Locales\sw.pak	setup.exe
File created	C:\Program Files\AchieveAdvocateUnique\uxQTeZhsysKgAhmGAFbE	msiexec.exe
File created	C:\Program Files\Google\Chrome\Temp\source5484_542622576\Chrome-bin\128.0.6613.138\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI91BC.tmp	msiexec.exe
File created	C:\Windows\Installer\e5890a4.msi	msiexec.exe
File created	C:\Windows\Installer\e5890a2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5890a2.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8152C221-204D-4155-BDF7-5F8ECFA87E01}	msiexec.exe

Executes dropped EXE 29 IoCs

pid	Process
4328	MrwBUjNvvYLA.exe
5008	VoJdQmpoYW6.exe
468	ChromeSetup.exe
3832	updater.exe
4416	updater.exe
1752	VoJdQmpoYW6.exe
2284	updater.exe
764	updater.exe
64	updater.exe
4364	updater.exe
5428	128.0.6613.138_chrome_installer.exe
5484	setup.exe
5508	setup.exe
5676	setup.exe
5700	setup.exe
5136	chrome.exe
3224	chrome.exe
5328	chrome.exe
3308	chrome.exe
5408	chrome.exe
5464	chrome.exe
5388	elevation_service.exe
5472	chrome.exe
5500	chrome.exe
5848	chrome.exe
5160	chrome.exe
5428	updater.exe
6052	updater.exe
4812	chrome.exe

Loads dropped DLL 27 IoCs

pid	Process
5136	chrome.exe
3224	chrome.exe
5136	chrome.exe
5328	chrome.exe
3308	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
3308	chrome.exe
5408	chrome.exe
5408	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5464	chrome.exe
5464	chrome.exe
5472	chrome.exe
5472	chrome.exe
5500	chrome.exe
5500	chrome.exe
5848	chrome.exe
5848	chrome.exe
5160	chrome.exe
5160	chrome.exe
4812	chrome.exe
4812	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
920	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoJdQmpoYW6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MrwBUjNvvYLA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoJdQmpoYW6.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5428	128.0.6613.138_chrome_installer.exe
5484	setup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f7b83aff83bcb26e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f7b83aff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f7b83aff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df7b83aff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f7b83aff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\session.restore_on_startup = "1C7AE9282E796901BFAC815755C1EF16E7B0F342A5701209D2999B64D555B1D0"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\media.storage_id_salt = "97CDA639D6E4122F774DD09C11B1AA4D1D8A2F4DD7EFFCDC8D8C02FECDA775B5"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nkeimhogjdpnpccoofpliimaahmaaome = "6EAAF5CF99CD6591C894385BE20CE63F11315C669473859AE578919E3CC8035F"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_signed_in_username = "0B5A99A88EE79016D5737999C5C14BCF9821C99BCC32012D2EF186FC9B475CE4"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\search_provider_overrides = "A99189D6BBF4434FBB7B1F09482CC3A81EB417167A1A97F500D174FB823AD4F1"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\StabilityMetrics\user_experience_metrics.stability.exited_cleanly = "0"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\homepage = "C1B50F42AE15403A80DBFEA6917CC1D0EDB40992E14F04EFE65995DDEF00DFD8"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nkeimhogjdpnpccoofpliimaahmaaome = "805FFED4B554C008B67B48100B60CE68BFFA95F208707B0E19525AB90D87C3D6"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\media.cdm.origin_data = "5FAB8DC81DEAB2E7C993E2C31E44C9C166DBBFDD0ECBE0BC29CFFF3AEB58A20E"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\module_blocklist_cache_md5_digest = "AB8EAF7B0D6A0873F4446E6791E8737FF67D973E542BD976C687D51D8463B6F9"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\homepage_is_newtabpage = "19C7CC09CD6591C838B476E571546167552228E0FFCC2CAFE8B5AE346BDED680"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\StabilityMetrics	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\UsageStatsInSample = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_username = "DBD7575AE3F1B3A7EA3E8F5587558D71128FAA66427C6D05EDF90B20E7149472"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.account_id = "D108AACAD9B2DF6D81528E2A2BC4CA2B55A1B5BB3CD5E51BFB42BC2B64CC6EB0"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi = "10A18494C95F19F714C9738E55DFF07DA93EE2F5427B9C1B97B5DA036CABE01A"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\session.startup_urls = "0C0C38B60E7FEE4850B61B505C3D662CC36179CC2EFAA474156B4CD25FE33F35"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\Extensions	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi = "E09B07B4F842EF869D12D97FF5B3C687CC401425174AC29E0808A448AE372E0B"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_account_id = "73496C238A2AAC9A9C0A5242943495352DC2B03B695CF008E55616D84B0DA811"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	updater.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133708055380199428"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\prefs.preference_reset_time = "E03D719912504A75BE51ED8D49B0C5420FCC1D26EFAA219405897A37D32B63B1"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\state = "1"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\lastrun = "13370805534233480"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nmmhkkegccagdldgiimedpiccmgmieda = "B51E688B949ADF1E499E11CA600AB52531B2DF4989A23439098277B9FD760F3A"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B685B009-DBC4-4F24-9542-A162C3793E77}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\ProxyStubClsid32	updater.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\122C2518D4025514DB7FF5E8FC8AE710\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A4B5D74-8832-5170-AB03-2415833EC703}\TypeLib\ = "{8A4B5D74-8832-5170-AB03-2415833EC703}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\TypeLib\ = "{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A4B5D74-8832-5170-AB03-2415833EC703}\ = "IUpdaterInternalSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ = "IUpdaterSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\ = "ICompleteStatusSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4334319-8210-469B-8262-DD03623FEB5B}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ = "ICurrentState"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4B5D74-8832-5170-AB03-2415833EC703}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\5"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{521FDB42-7130-4806-822A-FC5163FAD983}\LocalService = "GoogleUpdaterService128.0.6597.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8A4B5D74-8832-5170-AB03-2415833EC703}\1.0	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\LocalServer32	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ = "IUpdaterCallbackSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\TypeLib\ = "{F966A529-43C6-4710-8FF4-0B456324C8F4}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\4"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\1.0\ = "GoogleUpdater TypeLib for IAppCommandWeb"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{CCA9FC90-B200-5641-99C0-7907756A93CF}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\TypeLib\ = "{34527502-D3DB-4205-A69B-789B27EE0414}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\122C2518D4025514DB7FF5E8FC8AE710\Version = "151322628"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{44B969D4-48B7-5A30-9CD6-CAC179D81F9C}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\TypeLib\ = "{D106AB5F-A70E-400E-A21B-96208C1D8DBB}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A4B5D74-8832-5170-AB03-2415833EC703}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{699F07AD-304C-5F71-A2DA-ABD765965B54}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ServiceParameters = "--com-service"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\1.0\ = "GoogleUpdater TypeLib for IProcessLauncherSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{708860E0-F641-4611-8895-7D867DD3675B}	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3160	msiexec.exe
3160	msiexec.exe
5008	VoJdQmpoYW6.exe
5008	VoJdQmpoYW6.exe
1752	VoJdQmpoYW6.exe
1752	VoJdQmpoYW6.exe
3832	updater.exe
3832	updater.exe
3832	updater.exe
3832	updater.exe
3832	updater.exe
3832	updater.exe
2284	updater.exe
2284	updater.exe
2284	updater.exe
2284	updater.exe
2284	updater.exe
2284	updater.exe
64	updater.exe
64	updater.exe
64	updater.exe
64	updater.exe
64	updater.exe
64	updater.exe
64	updater.exe
64	updater.exe
3832	updater.exe
3832	updater.exe
5136	chrome.exe
5136	chrome.exe
5428	updater.exe
5428	updater.exe
5428	updater.exe
5428	updater.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	920	msiexec.exe
Token: SeIncreaseQuotaPrivilege	920	msiexec.exe
Token: SeSecurityPrivilege	3160	msiexec.exe
Token: SeCreateTokenPrivilege	920	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	920	msiexec.exe
Token: SeLockMemoryPrivilege	920	msiexec.exe
Token: SeIncreaseQuotaPrivilege	920	msiexec.exe
Token: SeMachineAccountPrivilege	920	msiexec.exe
Token: SeTcbPrivilege	920	msiexec.exe
Token: SeSecurityPrivilege	920	msiexec.exe
Token: SeTakeOwnershipPrivilege	920	msiexec.exe
Token: SeLoadDriverPrivilege	920	msiexec.exe
Token: SeSystemProfilePrivilege	920	msiexec.exe
Token: SeSystemtimePrivilege	920	msiexec.exe
Token: SeProfSingleProcessPrivilege	920	msiexec.exe
Token: SeIncBasePriorityPrivilege	920	msiexec.exe
Token: SeCreatePagefilePrivilege	920	msiexec.exe
Token: SeCreatePermanentPrivilege	920	msiexec.exe
Token: SeBackupPrivilege	920	msiexec.exe
Token: SeRestorePrivilege	920	msiexec.exe
Token: SeShutdownPrivilege	920	msiexec.exe
Token: SeDebugPrivilege	920	msiexec.exe
Token: SeAuditPrivilege	920	msiexec.exe
Token: SeSystemEnvironmentPrivilege	920	msiexec.exe
Token: SeChangeNotifyPrivilege	920	msiexec.exe
Token: SeRemoteShutdownPrivilege	920	msiexec.exe
Token: SeUndockPrivilege	920	msiexec.exe
Token: SeSyncAgentPrivilege	920	msiexec.exe
Token: SeEnableDelegationPrivilege	920	msiexec.exe
Token: SeManageVolumePrivilege	920	msiexec.exe
Token: SeImpersonatePrivilege	920	msiexec.exe
Token: SeCreateGlobalPrivilege	920	msiexec.exe
Token: SeBackupPrivilege	4468	vssvc.exe
Token: SeRestorePrivilege	4468	vssvc.exe
Token: SeAuditPrivilege	4468	vssvc.exe
Token: SeBackupPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
920	msiexec.exe
920	msiexec.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 1096	3160	msiexec.exe	108
PID 3160 wrote to memory of 1096	3160	msiexec.exe	108
PID 3160 wrote to memory of 1652	3160	msiexec.exe	110
PID 3160 wrote to memory of 1652	3160	msiexec.exe	110
PID 3160 wrote to memory of 1652	3160	msiexec.exe	110
PID 1652 wrote to memory of 4328	1652	MsiExec.exe	111
PID 1652 wrote to memory of 4328	1652	MsiExec.exe	111
PID 1652 wrote to memory of 4328	1652	MsiExec.exe	111
PID 1652 wrote to memory of 5008	1652	MsiExec.exe	113
PID 1652 wrote to memory of 5008	1652	MsiExec.exe	113
PID 1652 wrote to memory of 5008	1652	MsiExec.exe	113
PID 1652 wrote to memory of 468	1652	MsiExec.exe	114
PID 1652 wrote to memory of 468	1652	MsiExec.exe	114
PID 1652 wrote to memory of 468	1652	MsiExec.exe	114
PID 468 wrote to memory of 3832	468	ChromeSetup.exe	115
PID 468 wrote to memory of 3832	468	ChromeSetup.exe	115
PID 468 wrote to memory of 3832	468	ChromeSetup.exe	115
PID 3832 wrote to memory of 4416	3832	updater.exe	116
PID 3832 wrote to memory of 4416	3832	updater.exe	116
PID 3832 wrote to memory of 4416	3832	updater.exe	116
PID 2284 wrote to memory of 764	2284	updater.exe	119
PID 2284 wrote to memory of 764	2284	updater.exe	119
PID 2284 wrote to memory of 764	2284	updater.exe	119
PID 64 wrote to memory of 4364	64	updater.exe	121
PID 64 wrote to memory of 4364	64	updater.exe	121
PID 64 wrote to memory of 4364	64	updater.exe	121
PID 64 wrote to memory of 5428	64	updater.exe	123
PID 64 wrote to memory of 5428	64	updater.exe	123
PID 5428 wrote to memory of 5484	5428	128.0.6613.138_chrome_installer.exe	124
PID 5428 wrote to memory of 5484	5428	128.0.6613.138_chrome_installer.exe	124
PID 5484 wrote to memory of 5508	5484	setup.exe	125
PID 5484 wrote to memory of 5508	5484	setup.exe	125
PID 5484 wrote to memory of 5676	5484	setup.exe	127
PID 5484 wrote to memory of 5676	5484	setup.exe	127
PID 5676 wrote to memory of 5700	5676	setup.exe	128
PID 5676 wrote to memory of 5700	5676	setup.exe	128
PID 3832 wrote to memory of 5136	3832	updater.exe	130
PID 3832 wrote to memory of 5136	3832	updater.exe	130
PID 5136 wrote to memory of 3224	5136	chrome.exe	131
PID 5136 wrote to memory of 3224	5136	chrome.exe	131
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132
PID 5136 wrote to memory of 5328	5136	chrome.exe	132

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\7fcaf225d0407d2274dd7ed72dc373d44acef7c0f8acb49bc2e533c646d5e1ef.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:920

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 76FE94DA2B5B25B919CDD2E19A70C84E E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Program Files\AchieveAdvocateUnique\MrwBUjNvvYLA.exe
    "C:\Program Files\AchieveAdvocateUnique\MrwBUjNvvYLA.exe" x "C:\Program Files\AchieveAdvocateUnique\uxQTeZhsysKgAhmGAFbE" -o"C:\Program Files\AchieveAdvocateUnique\" -pRqmkCHAqYDofrFbTRHzi -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4328
- - C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe
    "C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe" -number 200 -file file3 -mode mode3 -flag flag3
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5008
- - C:\Program Files\AchieveAdvocateUnique\ChromeSetup.exe
    "C:\Program Files\AchieveAdvocateUnique\ChromeSetup.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Program Files (x86)\Google468_1799404396\bin\updater.exe
      "C:\Program Files (x86)\Google468_1799404396\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={FD39FE3E-F972-AC55-37EA-CE3FED473068}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
      4⤵
      Checks whether UAC is enabled
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3832
    - - C:\Program Files (x86)\Google468_1799404396\bin\updater.exe
        
        "C:\Program Files (x86)\Google468_1799404396\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x22c,0x25c,0x280,0x238,0x284,0x4fc694,0x4fc6a0,0x4fc6ac
        5⤵
        Drops file in Program Files directory
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4416
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        5⤵
        Checks system information in the registry
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5136
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6613.138 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbeeb16c28,0x7ffbeeb16c34,0x7ffbeeb16c40
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3224
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1960,i,474348940906306961,5884500367471509371,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5328
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2156,i,474348940906306961,5884500367471509371,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:3308
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=1712,i,474348940906306961,5884500367471509371,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5408
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,474348940906306961,5884500367471509371,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5472
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3228,i,474348940906306961,5884500367471509371,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5464
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4416,i,474348940906306961,5884500367471509371,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5500
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4572,i,474348940906306961,5884500367471509371,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5848
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4956,i,474348940906306961,5884500367471509371,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5160
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5208,i,474348940906306961,5884500367471509371,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4812

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4248,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
1⤵
PID:3772

C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe
"C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe" -file file3 -mode mode3 -flag flag3 -number 200
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1752

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xd9c694,0xd9c6a0,0xd9c6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:764

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:64
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xd9c694,0xd9c6a0,0xd9c6ac
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4364
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\128.0.6613.138_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\128.0.6613.138_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\fc06851a-c155-4e2b-a2ec-6d087c7a7c35.tmp"
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\CR_46DA2.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\CR_46DA2.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\CR_46DA2.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\fc06851a-c155-4e2b-a2ec-6d087c7a7c35.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\CR_46DA2.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\CR_46DA2.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6613.138 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff642d346b8,0x7ff642d346c4,0x7ff642d346d0
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:5508
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\CR_46DA2.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\CR_46DA2.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:5676
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\CR_46DA2.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\CR_46DA2.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6613.138 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff642d346b8,0x7ff642d346c4,0x7ff642d346d0
        5⤵
        Executes dropped EXE
        
        PID:5700

C:\Program Files\Google\Chrome\Application\128.0.6613.138\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\128.0.6613.138\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5340

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5428
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xd9c694,0xd9c6a0,0xd9c6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5890a3.rbs

Filesize
7KB

MD5
29189fe01ecce17ac791871a1880fedc

SHA1
ec832e448113f4c67ff270846f9abe1aecc8f286

SHA256
6f838df579d2611935b93a4b465fbcdd069535b7926d58f1bae62a4d1322ba40

SHA512
917eb9455b059438e7b90ac29b663ccaf7757514e6c135034457babeb0564e3fd85efa389c75883eed5066597f6728a1e4717971216de3ba3c4bfbd7c71eaf25

Download Submit
C:\Program Files (x86)\Google468_1799404396\bin\updater.exe

Filesize
4.7MB

MD5
823816b4a601c69c89435ee17ef7b9e0

SHA1
2fc4c446243be4a18a6a0d142a68d5da7d2a6954

SHA256
c2a7c0fa80f228c2ce599e4427280997ea9e1a3f85ed32e5d5e4219dfb05ddb2

SHA512
f3b38807ed1eb96c932e850b9b37551554408a628bedf12aa32bde08c442ff3663bf584335e7eab193ce2cf7552bce456737c96a2ba9faa953150e6304068fc6

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat

Filesize
40B

MD5
2560a4f571f5c1e1971363c4d0ef7c97

SHA1
6de99625d549a21394304b9cef2d56d443aac352

SHA256
86b0634cdc4cc06f3686d94e44299677c36b2c246aa9d63c32ca1fee9fa074c3

SHA512
31dbb7ba042ddc9679a73fa1f5b238baf2a4a3841e3d9715ff51d442230041652a98f48956d37952f71fb1209f64f483db88f5adfb4db10843f81904898eb661

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
502B

MD5
6316ab8a08b22fcbb77a5a1880a33ffe

SHA1
4c7c25272200f8cd5e29707a5dcee1576347f016

SHA256
4cbe66837366421e7816dc818f903a3bb4394802589104fb94f4f15179d11d53

SHA512
91e8e98fb4696be99b0d7bf2073792b6c7f1f3221cf6ea2749da6e991c7cab34aebfbe4e1e2dae7bf453aa7cf687b4409a17556853d93ae59a59a81d000f97e0

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
354B

MD5
d4927578fc92dc543365aa4e43b202ba

SHA1
5e1aeb950ac6ac3f071fa02f90a4fbc0c8e5304c

SHA256
4ac029c04a6e82f4c588237f57a798b4285c818bdbb4250c20f11a5b95d4ecd1

SHA512
4c6cbf4bfb4279edc6d6bd816ca4d1d4dbc8b7f06d875493ffeea3a8782568f49911db28aae743a41962bbe4fe34afc531e119be58888a2acf0623e99df38e95

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
602B

MD5
fd6969bd737bba76bb749724fa859f22

SHA1
e4e35266a357bc42313ea6f7faa98a3dfd5761e2

SHA256
ec86ba7b6282ca69a89bbe059a1d13bbb11c03e5516be389dedb25909421ad74

SHA512
b05583182e419a3fc535fde769a2b38b14a9c836095835fc91707a89da04135b00c64b4c3a5166bf4a8c949b28e332f3d81867daac9a20fbb45dd214c162019e

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
49B

MD5
7b693a82168c33ec9e8cf276859ddf7f

SHA1
d396dbbe299fe7754a6244d01e97cc4edd0693eb

SHA256
84a9a7f43db56cd6e9a408f88244e8ba5efbe48a5b5168d321f112b8c8fd8e3f

SHA512
4064c158d753d19a72e1be1c8bd5fe7f22e2032d67d1dd7ea1d85ce652d63c69b85a4292c4403b0f7729b05607f3d1ccfaf4d27d04ad09ffcec70082450320ab

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
602B

MD5
c59a6be4abdcaa35ac58db9a98c2d625

SHA1
56203f843b775ae9cc70fc9abdd5bfcca8202f46

SHA256
af6ac330f5a65e8d21cd6ea5176abb33f4cf771f25bc75d71f27fbc1aef73168

SHA512
2991afd8d981f548f21a58bb703a8a52e60978409b7e4ddc7e227de25946540d7e55a534aeecc14661f6261b3fcefcb8105dd38b9ffd445c508ac7a294e00298

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
1d0616b0fa74c9755dc8f8c889013454

SHA1
844061ddd13a82b70b0e430af145c18be6384354

SHA256
2d372b2733ad56e73e09952b18df067026fbc39c0b1cf962756672498af1e49d

SHA512
f81654462d67669aa6343e6a36b23d4b511642452a81a1f151f8c6af99321c789fde6079f8682e061f99b3ccd9ab2301aa885160265a3ae056c2764b5219f346

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
2KB

MD5
b46421078a7508c4412c281f3e2a46c2

SHA1
4744a1bbb25a81dcaa5e6b8e28f6cf77cf182f07

SHA256
e5dce5c6f8ff235dafd95cf6f448dda205128ac7a449bc4abce1b7b1baaeede5

SHA512
746f2efd5ff2bdf3ff87add3bb4d47cacfaacd525293a02724b67817e54df3558a8af05101539ea43ae9ff03311aedefff31bf59b867603ddc88522b26ecaa1d

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
4KB

MD5
acc5fd45e0922f8e40585680242ffa8a

SHA1
2cee0cca8d0d7bb15828faa48a52f25127dc1e1d

SHA256
8923691fb963c9061ebe03c5428ec8c890969c69a0b2d68c251074b4b9f32326

SHA512
e7e0d20563f1303de572ae11485d954f857647e3271d339803b7e03434021920a0d7e6ee319ed71d3edbd785b597970a54bf8a0d0d2209cf03883070350a4faa

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
6KB

MD5
a04d7d9c8fc39afdf0bc0acf26b892df

SHA1
1d8de9648c10b4d42a1397c6ad4deb7bb77b272a

SHA256
b66a097fa8da58eac96ab22e6211e0dc9cf3b8c1f671685af4ed6528249deb5e

SHA512
a16863de34613a883d6eb523ab4dce0e28a4bb259804bdb6f3ecee055993e6bc447944c90ce47a2a1c0ba635c661daeebf663a0c0c169910114cbc24b281f1c6

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
9KB

MD5
d2b5f4aaf78b93be04b6cd634b9f249e

SHA1
e4cadf70a508e7b4dd8927ace2f97b9b602e58b0

SHA256
a264ce28e7d506d3fc5bd6cc20291c7bb6c6b5edc02652cf7464d62017ddf57e

SHA512
d7907b1456d03d8cf0e5768a4a6d00a9d12d693a3bd5699ec7c02570351495add59b56e071d5cd6a61c323909df0fb24fc2444ec74cc1a299d2d663afdc9e24b

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
10KB

MD5
dac142ae906d6a7f843bc1d2be9b889f

SHA1
0f4d16986b6c1cceec0c6731002360d6c74ff06d

SHA256
7396c8b5c9af280aae0f4933e8efbb60c4bec098e4f84693c4c45327144786bb

SHA512
80520cd16623cae841dddf773f4c716531f40de3bfbedf17786bd10683eb8619cf806247f2c17136c3cae0cb38dd6cbe8f961093bc37e43fd55f5811965dc299

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\CR_46DA2.tmp\setup.exe

Filesize
4.1MB

MD5
f6a169eb6b8b2e18f7615e71451c8d1b

SHA1
574de22fbe45c4906b1090a0dee80dacf90324cd

SHA256
a71658b5a01ee0580da332b4695dea1602e71ea7ce2e43b35cd27be0e5730515

SHA512
a859bc4342737ae04f31212cae02ac32d18b969f9797e267e060b88feb0dfaa9ec422a9960019ed81de42d610b22ba01f03118693f59fce684d3e7f9402b96cd

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping64_1092489088\fc06851a-c155-4e2b-a2ec-6d087c7a7c35.tmp

Filesize
678KB

MD5
ea24139dc7536c817a2ddd80ee15003a

SHA1
b3d9b3fe97b761abe17d9a79302fc5ecb5b290b2

SHA256
2f2a8080578efba688d915ce547dec012cf5bfe492144230920437fbf80d9132

SHA512
3db4060bf60580149f2fd64a809bc0e12d2db69b2d2cf44a380e819787928dcf79acc6e09d8abfaa6538920ed2de34103ee860d2c11ef74fdfe1a1d6bbb88896

Download Submit
C:\Program Files\AchieveAdvocateUnique\ChromeSetup.exe

Filesize
8.5MB

MD5
5adff4313fbd074df44b4eb5b7893c5e

SHA1
d27388ef6cf34d40e0e7666f6381fcc5bbafa0f7

SHA256
d0c7a4390bdd6b442b96fc76f8a38f7b756ba2c16752ea259844420161865cae

SHA512
f5d639922b91878cf83d97563288a3aa4cba94db3ad5e8ac11d24ef7c44b019383a4414aeba6171b4c7bfa83ea1eafc1231cc9233e3b82b5ca7dc0b3ffacbf60

Download Submit
C:\Program Files\AchieveAdvocateUnique\MrwBUjNvvYLA.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe

Filesize
2.1MB

MD5
1c65da3b593605961fe66bb4d4084498

SHA1
57f5be5cdf0b6716caf41290ab6753a01ff29954

SHA256
0393a96233c4d9a48767bc8ade9684a742068ddf5269c378a7f9f2379b0329d1

SHA512
6f81dadc8060dc852a136db9bb9714bf705b94a3d789a67916d01b793fb4a09fbd44818981956f374d03a2aa5c99b70b09d6c6ac02dca8b78e4421a611f955b5

Download Submit
C:\Program Files\AchieveAdvocateUnique\uxQTeZhsysKgAhmGAFbE

Filesize
765KB

MD5
d77d7a492861b33040238ad414540106

SHA1
3036572891a017157580854a650348f05037f70e

SHA256
dd34f06a206c139155d1855739c7da96752d4a464c952cc710fd7e9e58d18132

SHA512
95d3911a9aec01a22bba3f75a8e93d8410c69defdfa93bf122a7f9d205a6d2e76e1ad5d1c07bc8824aaaa488ce0b2123fb053635c3210b7b21c8754c656068c5

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\chrome_elf.dll

Filesize
1.2MB

MD5
bb7d6e99cc8298b544b75af2bb46873c

SHA1
3b9d3f6e0e392e89b3cba820c4c6271dbd09e2d9

SHA256
959dc64d6759f48b72580a0fa51a1006f3bacdf679574882f946aa6b80cef25e

SHA512
7964dce8d57995594b0adb112f2b305c9246154faf7ff137f49747a70c9317769841e7d405c2cc7626b971f51e1f59ec2dc0ade678914369c4420ae731b896be

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\dxil.dll

Filesize
1.4MB

MD5
30da04b06e0abec33fecc55db1aa9b95

SHA1
de711585acfe49c510b500328803d3a411a4e515

SHA256
a5fe1d8d9caa2ff29daffd53f73a9a4e19c250351b2abe4fc7b57e60ce67ac68

SHA512
67790874377e308d1448d0e41df9dd353a5f63686df4eb9a8e70a4da449b0c63a5d3655ab38d24b145ad3c57971b1c6793ea6c5ac2257b6eb2e8964a44ab0f08

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\elevation_service.exe

Filesize
1.7MB

MD5
97918b9778f8ecd7f2956a307bdecacc

SHA1
a7c0365ce233b07f4113937615589c98ba8ca291

SHA256
6bbc4669147f2ce352a645d2262c5b32834912bc8b9e65bb6a3f07af916b3923

SHA512
47ce26f45177b98f1eb95cbf73557a831cd456d9e53ab36b06b61245278ba2d411895d42f32101b8ee7898a4cf59494576e55657c7eaff0030f589c75fa881ae

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\libEGL.dll

Filesize
492KB

MD5
5908dcd30b71522a2a8347cd6b2f1d7e

SHA1
0ef72404e28715857851f25aeb7a35ee56bfcd5e

SHA256
04b51945bb5fa676c9f307273e89770a01874e72587049d9dd7c7bd6daf26fa3

SHA512
e4125ffffd5c05dbab8470a942adbca17ed3bed217772ebfc7d0ac562f16771f6a679a8d298114e498e933d231cc46353f3a03adce5c8bfb3d111aae313704c4

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\libGLESv2.dll

Filesize
7.9MB

MD5
a6d92c98fa63e69847bef71e2bf95d28

SHA1
2b29db0cbf0a1e697f710cbeeef7f649e8d98bfc

SHA256
94e8dfa902fd1f4600bca20bf66372fdda55f8415a95d80e142fed47e75d261b

SHA512
2fc5436bd925eb3646bb30e8a389b9d6d4d156d03eefe8c09153c8d27097a42d9e64f6a409d087799383955353513112649151ab1460abb3c776511451b04e05

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\vk_swiftshader.dll

Filesize
5.0MB

MD5
90ec592b8de9dd4ad2addbf2be1bfd7c

SHA1
4e493a5dd3f4b49b384d598e0193cb24e0c2ba2d

SHA256
e22fa5d9970363145ca533c795a46845b32bd27cead23321091adf1ea891a169

SHA512
4f412732f8c6f4270f519c279492b2c1c2cb5db3f8f953abe38aa6a5d274468878e10cbca26ca843866048f3e332c223609c229efab5f6157bff20e6546c3cb6

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.6MB

MD5
db46628ea19f23def3d3639e33431ad6

SHA1
29b97b1a7c807d8af01ec4d1177a005c38057a73

SHA256
ecfe5833564738f2434c6b826cd32888cbee451c84ef68537d3e86ad6bbcc0cf

SHA512
28ffd3cc91c66d549e3887e855521ac0c207e0a6dcd4d047e94ea9bc4a7e18634a8dbcaa94977e32aeb1387a497027baacd358cb84c9cb6c79bfa67e3a9afb60

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5136_1784111984\Filtering Rules

Filesize
72KB

MD5
b23dd5b6eccb460003ea37ba0f5e3730

SHA1
fd444553cb7699f84ce7e5664232771673dcf67d

SHA256
7f7f432c27d97dee184dcd3ea20f731674c008be849c0136f9c5358e359f3ea9

SHA512
7e47bd172c4bd4c65f063a8fa3fb33ed47f29156eb20e42d4e8ea73c6f02526a30ffe907be5b7c1406d4eaa71fbec7c0d557c376dccd0a1a961e2f61b3431181

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5136_1784111984\manifest.json

Filesize
114B

MD5
3448d97da638c7ef0fbca9b6949ffc8f

SHA1
36d8434f26f0316fab4627f7856fca7291fe8adf

SHA256
1700a11fd1e58367b450a41b2ae5fd26ecb5cdb459869c796c7dde18f1d30f73

SHA512
9bf9055b2ef82bd1d2a1e94009fed2d3481fe2dc336d306fa0db786658efa5b72c9a9a214a829b9fcc4222476051871ff012009c64f09b9109072abdf3def8cc

Download Submit
C:\Program Files\chrome_installer.log

Filesize
21KB

MD5
20084a2f85dc25c500b6f770e443c20b

SHA1
33eb249be49c969f39dfd0bafed5655de5a7c833

SHA256
c9841a0bb0917c409e136aabfe8d61cbe939f85c80403865c058a098792cdd1d

SHA512
49577a12ccc55f1f6f0bab0ec6db198254d86bf8e419be64298887baca68664f7a54c16897ddf33b643d3113f1b450deb649d83e5a889fa1ef750621cccdd789

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

Filesize
2KB

MD5
063d44b35713de423867bd6a2262cb78

SHA1
9a9eb159b3b0f411ccafa8ce9db4569f29913b11

SHA256
9ddba97ba1d9622afb00f887ccdc5a39a20ee41b4e91cbca47048ee4f21cb97c

SHA512
3b6357aa0c37cad71b7fb47ee0b8bd81504685539d54a07272920b4134b524ab8f180ab489fffe91aa78f5c2b927f5791f44d00ed20805d484a9de8fd0bda7be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
501d6be2329f16c51dd03c992902ddd4

SHA1
ca82d97c414385757931b5aa3b356f81d7369f56

SHA256
5ec5c47838e8ec7c76e74eee2b66253358695b6b2c25a47b632f68016cacf138

SHA512
59a81b8d7c8c5a47168b794ed6b41cde14ab0028a99accd33fc70fa4fce8c7d3ef151a6a6c41f20ed314fe3bb37c2f9b2571d358c54b2ca26c3734b4632bb5e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
4478684e046bff1e3315e26ebe63a654

SHA1
57ae8c15bcc4ab01574b5f2d5d8aa7c413bf69d7

SHA256
84e37df47d6622cb7dbffef0a7e4d00d17fe702e493cb5a36faf969d08e79b73

SHA512
5e4b8fe480411131535bda8e6e71940bf66f15547f117d87f2acefdf7513e2bde50bc24e98be49055bfd50c6f6033e1ca5956837b33d996084a57a6e32991f7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
58ac46d4894a85c26f4d28dcf89c7982

SHA1
64d47696284a5bb25d727795ddbaee9fce47ab2b

SHA256
8f57f2f261790d36e4012188db928158560e68500da0c634eebdae40b1ca688b

SHA512
47c9214a8dc5ac00b3eb2f67f3c2777b5f358a2378931f55a7cacfb9cbf06024fb3ed7f01223f1986c1fdcc79d9d5480f0d8fe8980c2db27863b601fb89f7565

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4ce6a641f2abcbf5cc34ebd63877ec24

SHA1
6b316f4ade21a26a3dd89fb2668ec264f50d0c72

SHA256
bbca97cd32005f7b5abc049033d3b5ee67806ba2588ed99f709f0a996a8b0a48

SHA512
2716774d69519e6c296654209fd27c14bd4624ec8b5fbc7d1bda8c7a5c6084d8846eea117e475895f9e5c2fb6151539d6cbe180bf7c6414fcac87bdf850bf6e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
a5582b5f927309fa4070e06da45d53eb

SHA1
27161ea62de2f1c804946dded653a34c0688db6c

SHA256
836be0bb253044952241ccd6faa4a71e4087b7ab4554afc3f2d2b34a5e274f77

SHA512
6d6f2a75a21f819f1bb747db160e3fbcad32f9892b6f9c74061c741658c5940b7329b4fd94c4571b0ffa33327d2a1f418f14dbed2be78dae382d7577399c7ffe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
189KB

MD5
d63c715a31887997d5a5bbaeeec21d7f

SHA1
4aca4949a2c4dbb35190e734801199fbd5053c1e

SHA256
4579f031e7bd46dc3a1fd9ab4ca094ee475f3e03d841b9f866c34cf96e46cdfe

SHA512
09088aa25a28205286c395988a06413b24050a77698755f09b30ccacb14c7c32d79540fa48062952c65936d7164c208f961961f5fdfac22d991704e86ee94ca6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
188KB

MD5
3c743acc2b42a2a7451103e3bde7ff7b

SHA1
0a5ecb85128cd61a4b9481d64ded07cf1f000935

SHA256
e5f988f39495a32d29ef70bd76229b242b6a236ac3001f50d280a4d44bfc16c1

SHA512
e82c1145d8c5963d1243d64d1a944c800348336a1871d858fd1add15cefe3d2edb2f2a6da3a64a192cf4d6433de2a1d0ace682d62173e87032d30d5b2f783841

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
194KB

MD5
cdda34e98c69fbd9e6099969fa0963e8

SHA1
0fe1147d0b3a0a4c623a5aab340412aec376b547

SHA256
faaa271dafd56d519c7daab2745cf7b3636bdb642d425a847e25e2eb49ee3fef

SHA512
03b8ac6999360b225fc7befdd75b4c9412fbab25c677c84181bd7d98cdc2e2b31b7a27a110c7d696651337f4e6609bde0331df6264bf862d712f71e608811131

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
7c97bc85fdb7d0ac7bc18ffba58e5218

SHA1
69d63622c5e6a64dfe08b72bbc6bce93db4b111b

SHA256
19f4ccd13011e8fbeea5c5bf4f45e1bbe94b65ad52897b78c48c6c2bb98ecf2a

SHA512
d9fd33240bcb27708bb6898255e5fc78cf1456f2b6f1861bdff77b09001ec9c35ed9ea72f36caccaf8d5a1d939130b99d0542a728f67c53ea67e6988538aba62

Download Submit
C:\Windows\Installer\e5890a2.msi

Filesize
18.4MB

MD5
e94eb6be9108f379432b4687c8118d8a

SHA1
ae6c7a88b243c5bbaf331ef7bf72aa849411a403

SHA256
7fcaf225d0407d2274dd7ed72dc373d44acef7c0f8acb49bc2e533c646d5e1ef

SHA512
2bafff3240c240ac22f6a85207e374bf919d4ba2cb1fea28936bfde9c38dd140cb066a7210eb585926c2af2861937472d44191c126170be9c4ffb304d55c681f

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
795970e54efd5943949e6332bbcb6727

SHA1
6cf3ed107f1e8d2da230956eba1fb07897005e01

SHA256
eb9341caae8f6955f6b8638eb34f6a6aca3c3c48a0db8e9d053cc6c64162242d

SHA512
098fd324c7ac1f5c6e13f234425c2ed2ef72023db426531d81edc3d3b36938184a868f379744e50c1738cde9403f252df3b757923076b9c2771d40f72cd1ba4f

Download Submit
\??\Volume{ff3ab8f7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{98c0fa3a-1a03-4016-b1f9-8f090eae4b16}_OnDiskSnapshotProp

Filesize
6KB

MD5
00fcf0cb2529f507c71725ac149d2efd

SHA1
cdb3b110b7385f859bdb066521e9ddebf0d7f623

SHA256
8c6dc904a40fffeb658a7c06cb6d1f06f9158c552fdf7fc93bb37defdf26398a

SHA512
0b3de1f235885127ed03653cdb82c7e6efb8996b29888f06f398db34aad08e144614b1497a66fcdc235caf7f09e94cd0678323f6c1756e823dec24a7bb07c32d

Download Submit
memory/1752-86-0x000000002BCD0000-0x000000002BE8B000-memory.dmp

Filesize
1.7MB

Download