gh0strat | df41ebd057040524d137711938752fef32872f8a3ed2f4ee10e6b7c05d7f4410

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

chrrmesetup.msi
Size

27.8MB
MD5

60b6321a22e3cfcecc3c1c68295cc868
SHA1

808a316ee3b0f4fc7bce63358ff4f744e628465b
SHA256

df41ebd057040524d137711938752fef32872f8a3ed2f4ee10e6b7c05d7f4410
SHA512

b4047e9ef64bf63933143d289ce88b11107d552d37ef2905c3139e414bc8a61f86f49b548ee2e8978d0d02f5acfdc407640def7d05a9bcaffacfcebd5d872b91
SSDEEP

786432:NURQ1YYLOtsId3pQof4c0RtYhGYrCw45alNJFOF:N2U9XeI8bwal8

Score

10^/10

gh0strat purplefox discovery evasion persistence privilege_escalation rat rootkit spyware stealer trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 3 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/4052-122-0x000000002C0E0000-0x000000002C29B000-memory.dmp	purplefox_rootkit
behavioral2/memory/4052-124-0x000000002C0E0000-0x000000002C29B000-memory.dmp	purplefox_rootkit
behavioral2/memory/4052-125-0x000000002C0E0000-0x000000002C29B000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/4052-122-0x000000002C0E0000-0x000000002C29B000-memory.dmp	family_gh0strat
behavioral2/memory/4052-124-0x000000002C0E0000-0x000000002C29B000-memory.dmp	family_gh0strat
behavioral2/memory/4052-125-0x000000002C0E0000-0x000000002C29B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\128.0.6613.138\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	gafcETxyYz4.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	gafcETxyYz4.exe
File opened (read-only)	\??\W:	gafcETxyYz4.exe
File opened (read-only)	\??\Y:	gafcETxyYz4.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	gafcETxyYz4.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	gafcETxyYz4.exe
File opened (read-only)	\??\U:	gafcETxyYz4.exe
File opened (read-only)	\??\V:	gafcETxyYz4.exe
File opened (read-only)	\??\X:	gafcETxyYz4.exe
File opened (read-only)	\??\E:	gafcETxyYz4.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	gafcETxyYz4.exe
File opened (read-only)	\??\K:	gafcETxyYz4.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	gafcETxyYz4.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	gafcETxyYz4.exe
File opened (read-only)	\??\Z:	gafcETxyYz4.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	gafcETxyYz4.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	gafcETxyYz4.exe
File opened (read-only)	\??\R:	gafcETxyYz4.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	gafcETxyYz4.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	gafcETxyYz4.exe
File opened (read-only)	\??\T:	gafcETxyYz4.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_058F778FC8346DE378B15A5652BAADD9	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_058F778FC8346DE378B15A5652BAADD9	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	updater.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\MEIPreload\preloaded_data.pb	setup.exe
File created	C:\Program Files\DeployEngineerCalm\xFVbVZKWVCwS.xml	RVMrLdYYerZH.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\PrivacySandboxAttestationsPreloaded\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\nl.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\sv.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\te.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\VisualElements\SmallLogo.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\chrome_elf.dll	setup.exe
File created	C:\Program Files\DeployEngineerCalm\Aspose.Pdf.dll	msiexec.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\ja.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\v8_context_snapshot.bin	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\et.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\libEGL.dll	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4196_92399480\Filtering Rules	chrome.exe
File created	C:\Program Files\DeployEngineerCalm\xFVbVZKWVCwS.exe	RVMrLdYYerZH.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\06a5ad2e-3b50-4f4a-9655-750c80e3cf5b.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\dxil.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\sw.pak	setup.exe
File created	C:\Program Files (x86)\Google4436_363831678\updater.7z	ChromeSetup.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\manifest.fingerprint	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\57ab44bf-4f18-40a9-9a59-37ca273f69a7.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\es-419.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\VisualElements\SmallLogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Application\128.0.6613.138\Installer\chrmstp.exe	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe580049.TMP	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\VisualElements\LogoCanary.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\VisualElements\SmallLogoCanary.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\id.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\hi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\ms.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\vk_swiftshader.dll	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\57ab44bf-4f18-40a9-9a59-37ca273f69a7.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\icudtl.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\am.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\nb.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\ro.pak	setup.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\CR_3D3A9.tmp\SETUP.EX_	128.0.6613.138_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\default_apps\external_extensions.json	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\d3dcompiler_47.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\es.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\uk.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\libGLESv2.dll	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4196_92399480\_metadata\verified_contents.json	chrome.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\ca2c8b82-6163-4906-a387-cabe570a960f.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\3096a466-8893-4b06-98f3-6f12ab12a642.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\cs.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\VisualElements\LogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe58d443.TMP	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe57d793.TMP	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\fil.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3172_2079618102\Chrome-bin\128.0.6613.138\Locales\lv.pak	setup.exe
File opened for modification	C:\Program Files\DeployEngineerCalm	gafcETxyYz4.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D69F7CFA-8DCB-4B75-8299-B13493DB5972}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC40B.tmp	msiexec.exe
File created	C:\Windows\Installer\e57c2c5.msi	msiexec.exe
File created	C:\Windows\Installer\e57c2c3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57c2c3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Executes dropped EXE 34 IoCs

pid	Process
3516	RVMrLdYYerZH.exe
4300	gafcETxyYz4.exe
4436	ChromeSetup.exe
2908	updater.exe
4616	xFVbVZKWVCwS.exe
4448	updater.exe
4540	updater.exe
2728	updater.exe
532	updater.exe
3916	updater.exe
1404	xFVbVZKWVCwS.exe
2044	xFVbVZKWVCwS.exe
3896	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
3892	128.0.6613.138_chrome_installer.exe
3172	setup.exe
1380	setup.exe
1616	setup.exe
4720	setup.exe
4196	chrome.exe
2808	chrome.exe
4328	chrome.exe
4372	chrome.exe
3964	elevation_service.exe
3232	chrome.exe
5052	chrome.exe
3116	chrome.exe
1216	chrome.exe
4672	chrome.exe
2440	chrome.exe
5388	updater.exe
5404	updater.exe
1680	chrome.exe
5092	chrome.exe

Loads dropped DLL 29 IoCs

pid	Process
4196	chrome.exe
2808	chrome.exe
4196	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4372	chrome.exe
4372	chrome.exe
3232	chrome.exe
3232	chrome.exe
4328	chrome.exe
3116	chrome.exe
4328	chrome.exe
4328	chrome.exe
5052	chrome.exe
3116	chrome.exe
5052	chrome.exe
1216	chrome.exe
1216	chrome.exe
4672	chrome.exe
4672	chrome.exe
2440	chrome.exe
2440	chrome.exe
1680	chrome.exe
1680	chrome.exe
5092	chrome.exe
5092	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2800	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gafcETxyYz4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RVMrLdYYerZH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gafcETxyYz4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gafcETxyYz4.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3892	128.0.6613.138_chrome_installer.exe
3172	setup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000532ba7f3274a467a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000532ba7f30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900532ba7f3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d532ba7f3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000532ba7f300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	gafcETxyYz4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	gafcETxyYz4.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\default_search_provider_data.template_url_data = "5092311EDEE0C824482910901508734670357DCC3F8B02C9A4B12CE0C827F0A0"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\Extensions	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\StabilityMetrics\user_experience_metrics.stability.exited_cleanly = "0"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\failed_count = "0"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	updater.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	updater.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\prefs.preference_reset_time = "F8CD0A75F32BF46430E6A18316DCD114EBD8BB3F62F4769B31185D07CAC8A72A"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nkeimhogjdpnpccoofpliimaahmaaome = "2095BB217607716F49EF532F55EA6A4757189C78016966926372021DD4F4A565"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\StabilityMetrics	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_username = "2B2E43DBC2A6ECFC18D4BA353808E4035F7CDF1B3B275005D3D913B4C0563E60"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ahfgeienlihckogmohjhadlkjgocpleb = "72C3C54019E4747E97078700FCCFE383F997A5F0147063631961EC118C1C48BB"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nmmhkkegccagdldgiimedpiccmgmieda = "345A6391887B39FE7701F017A2FEA1B7275C0C8C79E202465B76B18C34CA967F"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\media.cdm.origin_data = "BE9CB2E46CF5BB1566A2E56DA0432BF1F65C91F0F8E1AF70604A702E31ECF968"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	setup.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_signed_in_username = "D598B40EDAE66E60A1F56143CF0AFEC99A671BF150F8EC7FD674ACFD3BED03C2"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\safebrowsing.incidents_sent = "5C99DDC2487A2A0AAE58F9D195E96B5EBAE22499A15399D15F53C7302D2A4BEA"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\pinned_tabs = "93576CD6FE8FD3236AB18BD3C7BF89600FD8C6E87402E8771A5FBA325850071F"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\homepage_is_newtabpage = "712B8829C9B826C2477E09FA50DD59BA28BD2B3A0BBB6E23FE37C1A0CB89E9CB"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133714787212282887"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\search_provider_overrides = "667079FBC2B0033D65B050ADD2A432ABA1E360873B5C9528BE8B7B3041E2E9C7"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\dr = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi = "ABFA3E78C30EA69BDB8301F40A44C91328F3155DB3C6E3E28962ABF652499F26"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\InstallerPinned = "0"	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_account_id = "4397A7BC88EA48112E3AB957A43846EED616D5936F3FB9BC7D9FCE4DF60CA01F"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\lastrun = "13371478717920711"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\module_blocklist_cache_md5_digest = "16415691A33CB811036B7EC89D61BF0014E7279E319E489A028FCBCB4E9CA562"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\ = "IAppWebSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\4"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ = "IUpdaterSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{CCA9FC90-B200-5641-99C0-7907756A93CF}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A4B5D74-8832-5170-AB03-2415833EC703}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ = "IAppBundleWeb"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{699F07AD-304C-5F71-A2DA-ABD765965B54}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{CCA9FC90-B200-5641-99C0-7907756A93CF}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{44B969D4-48B7-5A30-9CD6-CAC179D81F9C}\ServiceParameters = "--com-service"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B685B009-DBC4-4F24-9542-A162C3793E77}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{44B969D4-48B7-5A30-9CD6-CAC179D81F9C}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\ = "IProcessLauncherSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{34527502-D3DB-4205-A69B-789B27EE0414}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AFC7F96DBCD857B428991B4339BD9527\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ = "IUpdaterCallbackSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\TypeLib\ = "{D106AB5F-A70E-400E-A21B-96208C1D8DBB}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{4DC034A8-4BFC-4D43-9250-914163356BB0}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\ = "IPolicyStatus3System"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AFC7F96DBCD857B428991B4339BD9527	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CCA9FC90-B200-5641-99C0-7907756A93CF}\TypeLib\ = "{CCA9FC90-B200-5641-99C0-7907756A93CF}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\1.0\ = "GoogleUpdater TypeLib for ICurrentStateSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CCA9FC90-B200-5641-99C0-7907756A93CF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\1.0	updater.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4024	msiexec.exe
4024	msiexec.exe
4300	gafcETxyYz4.exe
4300	gafcETxyYz4.exe
2908	updater.exe
2908	updater.exe
2908	updater.exe
2908	updater.exe
2908	updater.exe
2908	updater.exe
4540	updater.exe
4540	updater.exe
4540	updater.exe
4540	updater.exe
4540	updater.exe
4540	updater.exe
532	updater.exe
532	updater.exe
532	updater.exe
532	updater.exe
532	updater.exe
532	updater.exe
532	updater.exe
532	updater.exe
2044	xFVbVZKWVCwS.exe
2044	xFVbVZKWVCwS.exe
3896	gafcETxyYz4.exe
3896	gafcETxyYz4.exe
3896	gafcETxyYz4.exe
3896	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe
4052	gafcETxyYz4.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2800	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2800	msiexec.exe
Token: SeSecurityPrivilege	4024	msiexec.exe
Token: SeCreateTokenPrivilege	2800	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2800	msiexec.exe
Token: SeLockMemoryPrivilege	2800	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2800	msiexec.exe
Token: SeMachineAccountPrivilege	2800	msiexec.exe
Token: SeTcbPrivilege	2800	msiexec.exe
Token: SeSecurityPrivilege	2800	msiexec.exe
Token: SeTakeOwnershipPrivilege	2800	msiexec.exe
Token: SeLoadDriverPrivilege	2800	msiexec.exe
Token: SeSystemProfilePrivilege	2800	msiexec.exe
Token: SeSystemtimePrivilege	2800	msiexec.exe
Token: SeProfSingleProcessPrivilege	2800	msiexec.exe
Token: SeIncBasePriorityPrivilege	2800	msiexec.exe
Token: SeCreatePagefilePrivilege	2800	msiexec.exe
Token: SeCreatePermanentPrivilege	2800	msiexec.exe
Token: SeBackupPrivilege	2800	msiexec.exe
Token: SeRestorePrivilege	2800	msiexec.exe
Token: SeShutdownPrivilege	2800	msiexec.exe
Token: SeDebugPrivilege	2800	msiexec.exe
Token: SeAuditPrivilege	2800	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2800	msiexec.exe
Token: SeChangeNotifyPrivilege	2800	msiexec.exe
Token: SeRemoteShutdownPrivilege	2800	msiexec.exe
Token: SeUndockPrivilege	2800	msiexec.exe
Token: SeSyncAgentPrivilege	2800	msiexec.exe
Token: SeEnableDelegationPrivilege	2800	msiexec.exe
Token: SeManageVolumePrivilege	2800	msiexec.exe
Token: SeImpersonatePrivilege	2800	msiexec.exe
Token: SeCreateGlobalPrivilege	2800	msiexec.exe
Token: SeBackupPrivilege	4000	vssvc.exe
Token: SeRestorePrivilege	4000	vssvc.exe
Token: SeAuditPrivilege	4000	vssvc.exe
Token: SeBackupPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeBackupPrivilege	4788	srtasks.exe
Token: SeRestorePrivilege	4788	srtasks.exe
Token: SeSecurityPrivilege	4788	srtasks.exe
Token: SeTakeOwnershipPrivilege	4788	srtasks.exe
Token: SeBackupPrivilege	4788	srtasks.exe
Token: SeRestorePrivilege	4788	srtasks.exe
Token: SeSecurityPrivilege	4788	srtasks.exe
Token: SeTakeOwnershipPrivilege	4788	srtasks.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: 33	4436	ChromeSetup.exe
Token: SeIncBasePriorityPrivilege	4436	ChromeSetup.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2800	msiexec.exe
2800	msiexec.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 4788	4024	msiexec.exe	93
PID 4024 wrote to memory of 4788	4024	msiexec.exe	93
PID 4024 wrote to memory of 2284	4024	msiexec.exe	95
PID 4024 wrote to memory of 2284	4024	msiexec.exe	95
PID 4024 wrote to memory of 2284	4024	msiexec.exe	95
PID 2284 wrote to memory of 3516	2284	MsiExec.exe	96
PID 2284 wrote to memory of 3516	2284	MsiExec.exe	96
PID 2284 wrote to memory of 3516	2284	MsiExec.exe	96
PID 2284 wrote to memory of 4300	2284	MsiExec.exe	98
PID 2284 wrote to memory of 4300	2284	MsiExec.exe	98
PID 2284 wrote to memory of 4300	2284	MsiExec.exe	98
PID 2284 wrote to memory of 4436	2284	MsiExec.exe	99
PID 2284 wrote to memory of 4436	2284	MsiExec.exe	99
PID 2284 wrote to memory of 4436	2284	MsiExec.exe	99
PID 4436 wrote to memory of 2908	4436	ChromeSetup.exe	100
PID 4436 wrote to memory of 2908	4436	ChromeSetup.exe	100
PID 4436 wrote to memory of 2908	4436	ChromeSetup.exe	100
PID 2908 wrote to memory of 4448	2908	updater.exe	103
PID 2908 wrote to memory of 4448	2908	updater.exe	103
PID 2908 wrote to memory of 4448	2908	updater.exe	103
PID 4540 wrote to memory of 2728	4540	updater.exe	105
PID 4540 wrote to memory of 2728	4540	updater.exe	105
PID 4540 wrote to memory of 2728	4540	updater.exe	105
PID 532 wrote to memory of 3916	532	updater.exe	108
PID 532 wrote to memory of 3916	532	updater.exe	108
PID 532 wrote to memory of 3916	532	updater.exe	108
PID 2044 wrote to memory of 3896	2044	xFVbVZKWVCwS.exe	111
PID 2044 wrote to memory of 3896	2044	xFVbVZKWVCwS.exe	111
PID 2044 wrote to memory of 3896	2044	xFVbVZKWVCwS.exe	111
PID 3896 wrote to memory of 4052	3896	gafcETxyYz4.exe	112
PID 3896 wrote to memory of 4052	3896	gafcETxyYz4.exe	112
PID 3896 wrote to memory of 4052	3896	gafcETxyYz4.exe	112
PID 532 wrote to memory of 3892	532	updater.exe	114
PID 532 wrote to memory of 3892	532	updater.exe	114
PID 3892 wrote to memory of 3172	3892	128.0.6613.138_chrome_installer.exe	116
PID 3892 wrote to memory of 3172	3892	128.0.6613.138_chrome_installer.exe	116
PID 3172 wrote to memory of 1380	3172	setup.exe	117
PID 3172 wrote to memory of 1380	3172	setup.exe	117
PID 3172 wrote to memory of 1616	3172	setup.exe	118
PID 3172 wrote to memory of 1616	3172	setup.exe	118
PID 1616 wrote to memory of 4720	1616	setup.exe	119
PID 1616 wrote to memory of 4720	1616	setup.exe	119
PID 2908 wrote to memory of 4196	2908	updater.exe	121
PID 2908 wrote to memory of 4196	2908	updater.exe	121
PID 4196 wrote to memory of 2808	4196	chrome.exe	122
PID 4196 wrote to memory of 2808	4196	chrome.exe	122
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123
PID 4196 wrote to memory of 4328	4196	chrome.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\chrrmesetup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2800

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D75E5DC120C3DE7155934966766CAA56 E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Program Files\DeployEngineerCalm\RVMrLdYYerZH.exe
    "C:\Program Files\DeployEngineerCalm\RVMrLdYYerZH.exe" x "C:\Program Files\DeployEngineerCalm\MSjpGFGbYdhVKRljAaZT" -o"C:\Program Files\DeployEngineerCalm\" -pCVtfwrfwUvBoTLjcdFbD -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3516
- - C:\Program Files\DeployEngineerCalm\gafcETxyYz4.exe
    "C:\Program Files\DeployEngineerCalm\gafcETxyYz4.exe" -number 250 -file file3 -mode mode3 -flag flag3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4300
- - C:\Program Files\DeployEngineerCalm\ChromeSetup.exe
    "C:\Program Files\DeployEngineerCalm\ChromeSetup.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Program Files (x86)\Google4436_363831678\bin\updater.exe
      "C:\Program Files (x86)\Google4436_363831678\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={FD39FE3E-F972-AC55-37EA-CE3FED473068}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
      4⤵
      Checks whether UAC is enabled
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2908
    - - C:\Program Files (x86)\Google4436_363831678\bin\updater.exe
        
        "C:\Program Files (x86)\Google4436_363831678\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xa8c694,0xa8c6a0,0xa8c6ac
        5⤵
        Drops file in Program Files directory
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4448
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        5⤵
        Checks system information in the registry
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4196
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6613.138 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfad26c28,0x7ffbfad26c34,0x7ffbfad26c40
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2808
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2020,i,2611600707175753278,12795742850618777290,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4328
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2200,i,2611600707175753278,12795742850618777290,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4372
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2328,i,2611600707175753278,12795742850618777290,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:3232
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3068,i,2611600707175753278,12795742850618777290,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5052
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,2611600707175753278,12795742850618777290,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3116
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4148,i,2611600707175753278,12795742850618777290,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1216
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4628,i,2611600707175753278,12795742850618777290,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4672
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4956,i,2611600707175753278,12795742850618777290,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:2440
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5292,i,2611600707175753278,12795742850618777290,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:1680
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5232,i,2611600707175753278,12795742850618777290,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5092

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Program Files\DeployEngineerCalm\xFVbVZKWVCwS.exe
"C:\Program Files\DeployEngineerCalm\xFVbVZKWVCwS.exe" install
1⤵
- Executes dropped EXE
PID:4616

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x136c694,0x136c6a0,0x136c6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2728

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:532
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x136c694,0x136c6a0,0x136c6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3916
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\128.0.6613.138_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\128.0.6613.138_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\06a5ad2e-3b50-4f4a-9655-750c80e3cf5b.tmp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\CR_3D3A9.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\CR_3D3A9.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\CR_3D3A9.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\06a5ad2e-3b50-4f4a-9655-750c80e3cf5b.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\CR_3D3A9.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\CR_3D3A9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6613.138 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff69f1446b8,0x7ff69f1446c4,0x7ff69f1446d0
      4⤵
      Executes dropped EXE
      PID:1380
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\CR_3D3A9.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\CR_3D3A9.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1616
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\CR_3D3A9.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\CR_3D3A9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6613.138 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff69f1446b8,0x7ff69f1446c4,0x7ff69f1446d0
        5⤵
        Executes dropped EXE
        
        PID:4720

C:\Program Files\DeployEngineerCalm\xFVbVZKWVCwS.exe
"C:\Program Files\DeployEngineerCalm\xFVbVZKWVCwS.exe" start
1⤵
- Executes dropped EXE
PID:1404

C:\Program Files\DeployEngineerCalm\xFVbVZKWVCwS.exe
"C:\Program Files\DeployEngineerCalm\xFVbVZKWVCwS.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files\DeployEngineerCalm\gafcETxyYz4.exe
  "C:\Program Files\DeployEngineerCalm\gafcETxyYz4.exe" -number 262 -file file3 -mode mode3 -flag flag3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Program Files\DeployEngineerCalm\gafcETxyYz4.exe
    "C:\Program Files\DeployEngineerCalm\gafcETxyYz4.exe" -number 362 -file file3 -mode mode3 -flag flag3
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4052

C:\Program Files\Google\Chrome\Application\128.0.6613.138\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\128.0.6613.138\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5136

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5388
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x136c694,0x136c6a0,0x136c6ac
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57c2c4.rbs

Filesize
7KB

MD5
ca5fd15d629499cb1676ffd7f1338de5

SHA1
357cc46bb55a5d05dcdda2dfed4799aa9cd9e13c

SHA256
a0458b769c94b01dcf88b356bcebe8669b734bf8b16887c7e235185e8ab2e956

SHA512
8c7f8c19f10fed1ef73a86110138945062ffabf87d577706c862f20f85191eb27a9410450ca45518a83f4409071bbec41483aaa6098e40a8d7561366558ed29b

Download Submit
C:\Program Files (x86)\Google4436_363831678\bin\updater.exe

Filesize
4.7MB

MD5
823816b4a601c69c89435ee17ef7b9e0

SHA1
2fc4c446243be4a18a6a0d142a68d5da7d2a6954

SHA256
c2a7c0fa80f228c2ce599e4427280997ea9e1a3f85ed32e5d5e4219dfb05ddb2

SHA512
f3b38807ed1eb96c932e850b9b37551554408a628bedf12aa32bde08c442ff3663bf584335e7eab193ce2cf7552bce456737c96a2ba9faa953150e6304068fc6

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat

Filesize
40B

MD5
dc2534f339abef5cc12d0d83824a3024

SHA1
152a3c7109d7d0337311ea4530537420ddc2f57e

SHA256
a97d6eb75380dcdc15933efb4fbfcd38206dd44882bbc0c578e04d6544e1e91c

SHA512
053f017fbac85c33ee046330ce43a8c10d6853ef27bc61fbd344f673fc8f2812ddedb3a5853d431ff8ef65c3a750d3560cf37dffad59217513e2ec73a88de2be

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
500B

MD5
cd0d6979a8131ee0228c13aa82b15161

SHA1
41aa329e130732658ca807abf6196352d7d44194

SHA256
18db162cbec0feaef51ae83bb150abcea04667b9ba64ccd748fb63a9f38319c8

SHA512
38cedfc2de53176abc2fe9efb7e9041d2353e3be326c26b282cc4d76c18580b1821e0ff25d31012071ffb7e5cace22e43b180ff0342031d2284756ec1173451b

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
354B

MD5
d4927578fc92dc543365aa4e43b202ba

SHA1
5e1aeb950ac6ac3f071fa02f90a4fbc0c8e5304c

SHA256
4ac029c04a6e82f4c588237f57a798b4285c818bdbb4250c20f11a5b95d4ecd1

SHA512
4c6cbf4bfb4279edc6d6bd816ca4d1d4dbc8b7f06d875493ffeea3a8782568f49911db28aae743a41962bbe4fe34afc531e119be58888a2acf0623e99df38e95

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
600B

MD5
1fcabd8a2cf9046245d58ac17e45d4f7

SHA1
1c07c43a96a49d7fba8cf38902f02520abd2a43a

SHA256
47ea82645ee0979d4fd7e5f77087c681e12bd9ee874a994bf4bee8bbd3d0b008

SHA512
8785e2c57b5cb48a7c9e5af84626a417d043306693aa794f071f13f14b419b6781f0a2533c832903e80dd03a47bf0d1485cfdc1b9efc3e39597211dbf154e87b

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
49B

MD5
7b693a82168c33ec9e8cf276859ddf7f

SHA1
d396dbbe299fe7754a6244d01e97cc4edd0693eb

SHA256
84a9a7f43db56cd6e9a408f88244e8ba5efbe48a5b5168d321f112b8c8fd8e3f

SHA512
4064c158d753d19a72e1be1c8bd5fe7f22e2032d67d1dd7ea1d85ce652d63c69b85a4292c4403b0f7729b05607f3d1ccfaf4d27d04ad09ffcec70082450320ab

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
600B

MD5
0404b6c12b7acee77a1f3bfbc14b2c7e

SHA1
f30cd4034688cf8d36fac5f9b429cca76fa01c36

SHA256
64c0b1e3c441620f814c806f1f86ca682a25831d4e25a3b991a448c453b682e5

SHA512
7e743a30f23870240da303eb21b6b41f95655b6f677bb551854c2ba9e64d4cca32667832ef1679ced1391922788a8331e2683f1bf5f1dcb448a87514c544c8db

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
904ab7f6bd639db49cc37c55cd82866f

SHA1
8d970671a335655a55e1361713d61a40b5ff36d5

SHA256
1febe316cde9a1ec438996bb232901400edd50935e36e101a6e3cebfbfded7cd

SHA512
c81e622020d7f14176b690c6c6032c566ee059162358380f440707086f9c513d062b2c4fc03f4295faad7ad735d303881b0cb26144cdf9ef4aacf7e135d9782b

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
2KB

MD5
f7a1b8d211a134916be9cd580547a8a3

SHA1
e5c69997db2de1e23880ae7814b48b9fb6b5898c

SHA256
ccfb96257d485da1011c22b635ce729e482243587961ab0c86c2ef40ade868b2

SHA512
ad133e8ec561563ed6a7fd8278aefd90fdbdc3d97e9124eddf939d94a057522adf145997acba3ffabadefd57469d18c530baa18885d45ca72265b173c1645bf4

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
4KB

MD5
65d545ae9bb517ebc1ab070cb1ad88b9

SHA1
0af910bda341bb32330c446b7ae1a41491365db2

SHA256
9d45b54ce146b3f6547d28565697d35819053df363f7542076d5e666f0369d42

SHA512
7ccdedb58e9cb94f860198f4698ebe2320f75cebf4bd89f9400b51b6afe4c8f630fc64758c51d6ba78c5219f5e6e8933140b140b56fb410bf5c68dd8a86a8a59

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
6KB

MD5
d8efe0a6a52a2fa956428b5611e31b6b

SHA1
a63a81f073c78732314d8d224948ed5b8bfcc968

SHA256
98273f8283cd700fa0c7b69e5295672ec70797953b8478d9225997a8d3903b24

SHA512
ab6904bea640bd69716a5af415a57784b73c91aa4a6ad6ea0ca54beddb0e919478d766223f2e3117e0b37a429dc2a17ee5ae74c3a8dddb06a75620629b58ecb8

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
9KB

MD5
72a540fa82948e9a34d3aa485a3bed3b

SHA1
ee7848aff3b3d85bcb78aebe59795ab2501efe12

SHA256
74c832416fb99de4622592aad9458926587a0bc65bd1822228987dc2177afb91

SHA512
19e46837b1102eb72f5f91542c8c0ab504f72256841d3950523b1d7ab8da0616f230732a573d78c2303fbcf0a314a0007c671d5b0d599607109f29700b8d4b51

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
11KB

MD5
2d4f20729f47879563d47567af747a56

SHA1
7a364595aae2c9f9f239d8bbc5032427c0c169f4

SHA256
bee426c3c430a2c16efd4883702c71d93d44e3b229cdb937387a6113ec150682

SHA512
b140d59792c96abc86475871373bd4df90fbbbba9f674b1bd0198740aef02ad3eec320639f64ea5b8187c8959bfa205d5f1f90e0bedf3f96f8f77f0849cfd533

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\06a5ad2e-3b50-4f4a-9655-750c80e3cf5b.tmp

Filesize
680KB

MD5
812d91a558285499df51f3a4e24c2ca2

SHA1
9331f773a25ecec1b3c2876f3d4b5ecd228fb899

SHA256
cc2d9a74e4733effb40f8a65caf2f796219bcc0faaa36a4b579356d6c983bf1d

SHA512
1a4adbb7a40af6f558270fff2fb5a1bd9ab239bf945507a53307d523af56fe01795ebe04cab3fa599aa2cca3fc74c90a512584946ef60a895e60eed1fc05c0fd

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping532_701611470\CR_3D3A9.tmp\setup.exe

Filesize
4.1MB

MD5
f6a169eb6b8b2e18f7615e71451c8d1b

SHA1
574de22fbe45c4906b1090a0dee80dacf90324cd

SHA256
a71658b5a01ee0580da332b4695dea1602e71ea7ce2e43b35cd27be0e5730515

SHA512
a859bc4342737ae04f31212cae02ac32d18b969f9797e267e060b88feb0dfaa9ec422a9960019ed81de42d610b22ba01f03118693f59fce684d3e7f9402b96cd

Download Submit
C:\Program Files\Crashpad\settings.dat

Filesize
40B

MD5
b2d84ea227a0bb50fceccc097dafa45e

SHA1
d12f28a2955c98166ebbb253aca2019462830e15

SHA256
f3be9db1d7559c09767f84e3bd5306cd8d8a7a0d6d9a6d930d1b975a1fd8eea9

SHA512
a2357b3b88f7ddbe94a0ea1f16df6a399af05a74240af6f95c29e2216eef1c3aa20785afa50503256cdccc85f3ba88393729ebd32d98b0e63953f2a2425cf79f

Download Submit
C:\Program Files\DeployEngineerCalm\ChromeSetup.exe

Filesize
8.5MB

MD5
5adff4313fbd074df44b4eb5b7893c5e

SHA1
d27388ef6cf34d40e0e7666f6381fcc5bbafa0f7

SHA256
d0c7a4390bdd6b442b96fc76f8a38f7b756ba2c16752ea259844420161865cae

SHA512
f5d639922b91878cf83d97563288a3aa4cba94db3ad5e8ac11d24ef7c44b019383a4414aeba6171b4c7bfa83ea1eafc1231cc9233e3b82b5ca7dc0b3ffacbf60

Download Submit
C:\Program Files\DeployEngineerCalm\MSjpGFGbYdhVKRljAaZT

Filesize
1.9MB

MD5
af02d33c55b6178318bf59b6f26b3b5d

SHA1
80d56ade2e9f52347d5aa7be46bcf970a93cd689

SHA256
c135cb4f3c7b7f480499187109dde41281a1e8f29259fae95893ee53d744f1da

SHA512
8d86f7de37c3e22dd5223cf3bd6140f58ff57019ad1560c43ffaff17a83ee181b64fbe210b77ed6548e0125c412bb2a9912f5aa04344e01d53454fd5bfcd6d6a

Download Submit
C:\Program Files\DeployEngineerCalm\RVMrLdYYerZH.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Program Files\DeployEngineerCalm\gafcETxyYz4.exe

Filesize
3.2MB

MD5
61c267c568496d0621a0107c0fecb047

SHA1
d1d02d62bfcb4ea245fd54eb1507150d2d344284

SHA256
f7db71cf62374b28b0b635a1fbedb5524d84773ff14ea9a579f0d45ca945a059

SHA512
5e6cd5c304c5e7effd58c4eb08a4b71236d0697b6cf6e4b82c5ab980daeb3b9e7691915d7b086dd4f9dbefe49a45c3036a9f91f520be516e4872d4bd8cfe3983

Download Submit
C:\Program Files\DeployEngineerCalm\xFVbVZKWVCwS.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\DeployEngineerCalm\xFVbVZKWVCwS.wrapper.log

Filesize
422B

MD5
f36dc788a1331086c79f8840b0a466ba

SHA1
8444049bd2180a5617f63ecb31d184e6f0f0cf0a

SHA256
a85179efc95215cd88b9da3d1d8e11a18851eac2ac66f5977cd61e17b7108c55

SHA512
c8c657d5c892520f5eee64be8a533c9969c0e735c953db36a5930115c09607d242f958b5f2776b86b49dfce3d0391e5ee085d679122285c94d4c0f4d5ca762d3

Download Submit
C:\Program Files\DeployEngineerCalm\xFVbVZKWVCwS.wrapper.log

Filesize
486B

MD5
1548e4d21ce604c013f13c496478f69f

SHA1
489bccc8bb38e4b0ac1cf484313e5dee954b89eb

SHA256
a9aef6ccbb1076f771f2c8c4ce8c9c3dee54db7706cb78c9eac626cf018bea80

SHA512
20e42295df771e07f5ed3c81f34473c54a34378ca289eba886929825ad5c43ee23c08be7a05be1fb4b7f7e75156200f94eef0794fcb646e1c71c50220d076fbe

Download Submit
C:\Program Files\DeployEngineerCalm\xFVbVZKWVCwS.wrapper.log

Filesize
774B

MD5
e1c6373cca0af151e82d3b1ec88c0491

SHA1
b5047bcb332de7c0250cea6b37ecd1835c8bb2ee

SHA256
7837b6dfbba6ba00f890dff1d4bb71312d616889f62b2e7d5e466859f5f5cace

SHA512
de33f290b7e38d8b55c51503058ce6f23289df543d9357b5ec04f5a6bf31fedddd2651546d91c0fc1954e246ea81ba252d6fe75f4865cedd0d681bf4426b4c20

Download Submit
C:\Program Files\DeployEngineerCalm\xFVbVZKWVCwS.wrapper.log

Filesize
266B

MD5
406cf5d0352f89810bc81e118df5ec4c

SHA1
55be80f3cd3bc76aad7cd968fd3d79f076263a2d

SHA256
939c39ba5d2c395b2ab4fd1acb8260da5bd8fada494e3f24ccf556079cbc1d1e

SHA512
21fee1b17fa084fcc6b5ecbfee1b116a02605bd960e1f094b7c5df701e11c266f8af17753f227822bd233a9e7489bc9aecbd744ebfa527f82724d1f664c053f5

Download Submit
C:\Program Files\DeployEngineerCalm\xFVbVZKWVCwS.xml

Filesize
435B

MD5
7034999fa66d69bf7436e28abbee7449

SHA1
507b6b981d54ebb4c7bdb11b048aa902cd10aff5

SHA256
f1b3f90f0527270c65710bb56f9ced773ce23feeee9f4551a1bf72fd297ab3ee

SHA512
616a70bd97b745d84e9d65dfcf9268282c74c1ac55691a81bb312ec689b15181914909ac2e83c51bcc6ceec0c9fe94bab3ddfc54de5fc16bec6cff9ab9473a4f

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\chrome_elf.dll

Filesize
1.2MB

MD5
bb7d6e99cc8298b544b75af2bb46873c

SHA1
3b9d3f6e0e392e89b3cba820c4c6271dbd09e2d9

SHA256
959dc64d6759f48b72580a0fa51a1006f3bacdf679574882f946aa6b80cef25e

SHA512
7964dce8d57995594b0adb112f2b305c9246154faf7ff137f49747a70c9317769841e7d405c2cc7626b971f51e1f59ec2dc0ade678914369c4420ae731b896be

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\libEGL.dll

Filesize
492KB

MD5
5908dcd30b71522a2a8347cd6b2f1d7e

SHA1
0ef72404e28715857851f25aeb7a35ee56bfcd5e

SHA256
04b51945bb5fa676c9f307273e89770a01874e72587049d9dd7c7bd6daf26fa3

SHA512
e4125ffffd5c05dbab8470a942adbca17ed3bed217772ebfc7d0ac562f16771f6a679a8d298114e498e933d231cc46353f3a03adce5c8bfb3d111aae313704c4

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\libGLESv2.dll

Filesize
7.9MB

MD5
a6d92c98fa63e69847bef71e2bf95d28

SHA1
2b29db0cbf0a1e697f710cbeeef7f649e8d98bfc

SHA256
94e8dfa902fd1f4600bca20bf66372fdda55f8415a95d80e142fed47e75d261b

SHA512
2fc5436bd925eb3646bb30e8a389b9d6d4d156d03eefe8c09153c8d27097a42d9e64f6a409d087799383955353513112649151ab1460abb3c776511451b04e05

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.6MB

MD5
db46628ea19f23def3d3639e33431ad6

SHA1
29b97b1a7c807d8af01ec4d1177a005c38057a73

SHA256
ecfe5833564738f2434c6b826cd32888cbee451c84ef68537d3e86ad6bbcc0cf

SHA512
28ffd3cc91c66d549e3887e855521ac0c207e0a6dcd4d047e94ea9bc4a7e18634a8dbcaa94977e32aeb1387a497027baacd358cb84c9cb6c79bfa67e3a9afb60

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4196_92399480\Filtering Rules

Filesize
72KB

MD5
b23dd5b6eccb460003ea37ba0f5e3730

SHA1
fd444553cb7699f84ce7e5664232771673dcf67d

SHA256
7f7f432c27d97dee184dcd3ea20f731674c008be849c0136f9c5358e359f3ea9

SHA512
7e47bd172c4bd4c65f063a8fa3fb33ed47f29156eb20e42d4e8ea73c6f02526a30ffe907be5b7c1406d4eaa71fbec7c0d557c376dccd0a1a961e2f61b3431181

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4196_92399480\manifest.json

Filesize
114B

MD5
3448d97da638c7ef0fbca9b6949ffc8f

SHA1
36d8434f26f0316fab4627f7856fca7291fe8adf

SHA256
1700a11fd1e58367b450a41b2ae5fd26ecb5cdb459869c796c7dde18f1d30f73

SHA512
9bf9055b2ef82bd1d2a1e94009fed2d3481fe2dc336d306fa0db786658efa5b72c9a9a214a829b9fcc4222476051871ff012009c64f09b9109072abdf3def8cc

Download Submit
C:\Program Files\chrome_installer.log

Filesize
21KB

MD5
bccea9615fc1587552c3f6a5b2cfd755

SHA1
07cb46ef6fa385dfd44eb14cbff24360442c40f0

SHA256
ee91e47d6e6806ee01538890f2a38e5ee9e449a448277ffbae797f73ce0c5ecf

SHA512
cbd12e6174bf4715009b768833c89c549a2b3d1f1daa61bdbf76133b136763bc9bd4838db215f8218047d4e7ed91908ae8c8cd89c526a3a83b77deaf36c88894

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
9ff865f4c5f4ef9e9210bff580778cf1

SHA1
94dfcbcd457c3b4d0b86bd823d3d9e67ea9379ff

SHA256
0dab8f487358cb874bb6a10f9144e6f3e4149fdb87636c7a19f8a011cdea71fc

SHA512
e770b2d6c865dc0a115f59189db38d2fc5d33270dbc830a8118d68d8d0d7eec8bb7d8e3cd0ecdc96ee4f65c913b902610ad9bdbeb61965b3d871d3fe5af3ceb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
848a39781a5c95dc16e86919bb3f3c61

SHA1
63198e2c100bd6b44ed080ae1782581d95145998

SHA256
4b1a7c0cd053c5d6cba8bb161ab436a65c0094bcffa7a329969c0152344d826c

SHA512
9e08fbe3a0725fd9f8cb167b859c9485f423fbcdacb2098ca58ab916cd1f14d055927adbdb4e9f6c3bf2f95e8163c300022edf4fe9aa83e54850420e1d9495b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
72506576b917bfcc242dfe51db10839d

SHA1
addf92ed3ab96d5edaf1bdb653c6dd298375b95e

SHA256
fe48ba3f3903c91c59cfa888cdfa7011a87f6d82f86d82e7d57dfd5536846bbf

SHA512
7a71a757f694e5a02b179178ab25d03be5921db98ebe390b2acb60f577c4ce7f171284fea54974bb1cb8418775371219c015bdf41d456a039becf2163fdbaaa4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
fde96a18a3fab254e6c568fed0150bfa

SHA1
f161a07728b93a6f04309492c6e5837d90ad5cc3

SHA256
abe2bb585cd000e1e04806bb3bf7ff5402ea38ad9d1f43ba6c576c6638e6f908

SHA512
4e659528f3257915dc617ebc096dccb91fb151fe69caf24b8ff0d60b53dfe906a4bd29430b41eb768c740b6985a41d2c8f073a4ed5fc2be1de94b101e40e637c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
0852df33434dc1ef1615e947e8656613

SHA1
8a1662dac124bea56a42fae6fe6bcb45e4153294

SHA256
20ee2302bf95dac5d728ae5e832b06d61230438d753ad5b3cb547526d550a14b

SHA512
c2a84f22bb5a7ca15a951d0279d7294bd04e7c863317f8cf64c20cd62a8f328b20e0ca3593a7347ed176e909f0b30c59320c0607490993527089b36c93732415

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
192KB

MD5
86892e275e4656d3b2e48bba88674f09

SHA1
122d7b005cf95719c654aee1a91f7fac97b448d8

SHA256
f8d3285d89867883c364827e93dc6cfe4b392db1a091c26de4dea52dec9c4cc7

SHA512
3144e3dab53d9b0324026ec0bcb4487044fa13eaffb16c25cffb13725a50011dc3b24321e4f07c7709ea92249c2a493d6a3891496dd3d77e7fffafcf43ae7805

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
192KB

MD5
19997c94f829c631246f5b8ce5864278

SHA1
d372f630b46a650958939020f9a81a7a080a10a0

SHA256
26734af67fdc65d20f2efb1ee1a5f0b4aeb2ba373de4eadc2dde837eb08ee10d

SHA512
f95049577a5379196b3bf28a6e1dde972e645fa91c941301c135b8b802006f1d18c42c79ddf0abff1c5f4f771fc0e0967ac27528c7b4d675b7f3bfaaa2eb4bb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
0c8dad972af057a4e63c90990326dbf0

SHA1
7f881cc7169d7b609ab6767bf2803bab93d34f45

SHA256
4ae669be2f878483561c122a7c78606ee3ee9af32c356bd2af6c0a4c38783ea4

SHA512
530bf808972353b5a36a05fef738e17bcd28c5aaa57cb98e536a9a0c1de154816c53a6e6a63c04f320bdc1da508c032ab1f0c5042970c14f2fff8c66077c7c84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
eea77724c11ac5995b97a129b33b27f8

SHA1
973f4d8c55d2f9cb231a37159d0f61b05ab145dc

SHA256
aff4abf7ea7f7054e5219746ab525b1c943f87bed4645a1d267265d23b578b14

SHA512
98f6a71d9c30a565cd8292d7ebe12e6392fb8c2d3cdd7ad1823d333c537f85aa1538eabe596b7c2d68b9a4d693829931af8c94e97d03f766b97cd0e4fe29685a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xFVbVZKWVCwS.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
C:\Windows\Installer\e57c2c3.msi

Filesize
27.8MB

MD5
60b6321a22e3cfcecc3c1c68295cc868

SHA1
808a316ee3b0f4fc7bce63358ff4f744e628465b

SHA256
df41ebd057040524d137711938752fef32872f8a3ed2f4ee10e6b7c05d7f4410

SHA512
b4047e9ef64bf63933143d289ce88b11107d552d37ef2905c3139e414bc8a61f86f49b548ee2e8978d0d02f5acfdc407640def7d05a9bcaffacfcebd5d872b91

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
35b82c1453bf524cfdd0e7fb6c54edad

SHA1
b988a268e0ac2e0c6902750484766b3f851c35c5

SHA256
5712d47764d7a06095e6cbfa8aec6deb0671de6df286a3af731e316fff845aec

SHA512
f20542c99bb32f05c550e883c031dca5ee88803a997f9d6a74f50cdd30316491f55e3f68f6c5db21dc9a831fb5f221e2b032088b10216140ef9466af2d531d39

Download Submit
\??\Volume{f3a72b53-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{289d9289-9275-4472-b3fe-1e96b92fdff9}_OnDiskSnapshotProp

Filesize
6KB

MD5
0a800e9b88e34141431768670765502b

SHA1
2f956a3017b33030b9af6f49b92c4117a2c330b9

SHA256
a7527d353c2287e472f124c1c98a51e55cca2a15c9ad8d834c13b8efadce64cb

SHA512
57350f1030714d0b8d4afb91f4e3d288cfd04038d55867b48450b627cbad3d2552dad6ae3156fbf2f0e4465290c6fb95e2d7a56510bd5ec4e7aaf2eb80dfb6a0

Download Submit
memory/4052-121-0x0000000009FB0000-0x0000000009FF3000-memory.dmp

Filesize
268KB

Download
memory/4052-125-0x000000002C0E0000-0x000000002C29B000-memory.dmp

Filesize
1.7MB

Download
memory/4052-122-0x000000002C0E0000-0x000000002C29B000-memory.dmp

Filesize
1.7MB

Download
memory/4052-124-0x000000002C0E0000-0x000000002C29B000-memory.dmp

Filesize
1.7MB

Download
memory/4300-27-0x0000000009BD0000-0x0000000009BFA000-memory.dmp

Filesize
168KB

Download
memory/4616-67-0x0000000000CF0000-0x0000000000DC6000-memory.dmp

Filesize
856KB

Download