gh0strat | 60ccad58b390a02fdf64477e6cbfd545c43788c7abaeb1fbe4d26099e178fe4a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

googlups.msi
Size

27.6MB
MD5

1360b4beaf800c3ca4be311301cb2cb7
SHA1

f4d0724cf3df9d78779a5002c0414b1fcd76cbf8
SHA256

60ccad58b390a02fdf64477e6cbfd545c43788c7abaeb1fbe4d26099e178fe4a
SHA512

7e66cae3bbc27d7e55871e7ed06ded74b5aa222d4e21a0ed37b55b0c00fdcbd3817abc5ad303bc561ac54bb0bfa2a0cfe441226638f364ea7163977856046ab7
SSDEEP

786432:wURQ1YYLOtsId3pQof4c0RtYhGYrCw45almp:w2U9XeI8bwala

Score

10^/10

gh0strat purplefox discovery evasion persistence privilege_escalation rat rootkit spyware stealer trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 2 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/4504-121-0x000000002B4C0000-0x000000002B67B000-memory.dmp	purplefox_rootkit
behavioral2/memory/4504-131-0x000000002B4C0000-0x000000002B67B000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/4504-121-0x000000002B4C0000-0x000000002B67B000-memory.dmp	family_gh0strat
behavioral2/memory/4504-131-0x000000002B4C0000-0x000000002B67B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\128.0.6613.138\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	EDWJLBYgUE16.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	EDWJLBYgUE16.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	EDWJLBYgUE16.exe
File opened (read-only)	\??\X:	EDWJLBYgUE16.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	EDWJLBYgUE16.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	EDWJLBYgUE16.exe
File opened (read-only)	\??\O:	EDWJLBYgUE16.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	EDWJLBYgUE16.exe
File opened (read-only)	\??\W:	EDWJLBYgUE16.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	EDWJLBYgUE16.exe
File opened (read-only)	\??\U:	EDWJLBYgUE16.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	EDWJLBYgUE16.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	EDWJLBYgUE16.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	EDWJLBYgUE16.exe
File opened (read-only)	\??\J:	EDWJLBYgUE16.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	EDWJLBYgUE16.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	EDWJLBYgUE16.exe
File opened (read-only)	\??\S:	EDWJLBYgUE16.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_058F778FC8346DE378B15A5652BAADD9	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_058F778FC8346DE378B15A5652BAADD9	updater.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\0721193d-da79-4ad9-a038-880c6b86d498.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\am.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\kn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\os_update_handler.exe	setup.exe
File created	C:\Program Files\SecureRetailerTrusty\Aspose.Pdf.dll	msiexec.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\fil.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\ml.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\sl.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\sv.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\chrome.dll	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\4d8e146d-3101-4bfa-9115-7d95adb05122.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\chrome_100_percent.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\tr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\vk_swiftshader_icd.json	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe587990.TMP	updater.exe
File opened for modification	C:\Program Files\chrome_installer.log	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\ja.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\chrome.VisualElementsManifest.xml	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\gu.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\he.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\en-GB.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\id.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\pl.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\sk.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\PrivacySandboxAttestationsPreloaded\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\v8_context_snapshot.bin	setup.exe
File created	C:\Program Files (x86)\Google3548_85230628\bin\updater.exe	ChromeSetup.exe
File created	C:\Program Files (x86)\chrome_url_fetcher_3368_494120404\-8a69d345-d564-463c-aff1-a69d9e530f96-_128.0.6613.138_all_ac7ostd6fqlt2cf5noeuqwufe5na.crx3	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\CR_43957.tmp\setup.exe	128.0.6613.138_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\chrome.7z	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\it.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\lt.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\vulkan-1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\SecureRetailerTrusty\ChromeSetup.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\el.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files\SecureRetailerTrusty\IVgmTTGSKQEu.wrapper.log	IVgmTTGSKQEu.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\chrome_200_percent.pak	setup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\zh-TW.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\chrome_elf.dll	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\CR_43957.tmp\CHROME.PACKED.7Z	128.0.6613.138_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\dxil.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\ca.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\lv.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\sw.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\3bc68e1e-d0eb-4a76-bf17-df4d0ffc7551.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\37ccc67a-e5c8-406a-80d0-30da0e329a2a.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\en-US.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\nl.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3428_932935379\Chrome-bin\128.0.6613.138\Locales\vi.pak	setup.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{38390C27-414E-451F-BA54-1B8FE337F16E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D59.tmp	msiexec.exe
File created	C:\Windows\Installer\e579c32.msi	msiexec.exe
File created	C:\Windows\Installer\e579c30.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e579c30.msi	msiexec.exe

Executes dropped EXE 32 IoCs

pid	Process
2316	ivfFOaaBljLY.exe
4412	EDWJLBYgUE16.exe
3548	ChromeSetup.exe
3452	updater.exe
3360	updater.exe
2152	IVgmTTGSKQEu.exe
1544	updater.exe
4172	updater.exe
3368	updater.exe
60	updater.exe
5060	IVgmTTGSKQEu.exe
2096	IVgmTTGSKQEu.exe
3880	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
228	128.0.6613.138_chrome_installer.exe
3428	setup.exe
4232	setup.exe
3132	setup.exe
4508	setup.exe
3068	chrome.exe
4372	chrome.exe
4520	chrome.exe
3096	chrome.exe
4924	chrome.exe
1412	elevation_service.exe
3524	chrome.exe
5044	chrome.exe
4944	chrome.exe
744	chrome.exe
5508	chrome.exe
5836	updater.exe
5856	updater.exe

Loads dropped DLL 25 IoCs

pid	Process
3068	chrome.exe
4372	chrome.exe
3068	chrome.exe
4520	chrome.exe
3096	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
3096	chrome.exe
4924	chrome.exe
4924	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
5044	chrome.exe
3524	chrome.exe
5044	chrome.exe
4944	chrome.exe
3524	chrome.exe
4944	chrome.exe
744	chrome.exe
744	chrome.exe
5508	chrome.exe
5508	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
220	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDWJLBYgUE16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDWJLBYgUE16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDWJLBYgUE16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ivfFOaaBljLY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
228	128.0.6613.138_chrome_installer.exe
3428	setup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000082ad35faf8c7b7730000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000082ad35fa0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090082ad35fa000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d82ad35fa000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000082ad35fa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EDWJLBYgUE16.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EDWJLBYgUE16.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\homepage_is_newtabpage = "F771649BFDA6AA09D1B13C0A3052DD905BFB4F0D490D0B23429708E808FCA496"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nkeimhogjdpnpccoofpliimaahmaaome = "9908585043B7FD002750B9969BA62EC2E2AEF90EF9E0FD1E23E2A92D7C5FBA5D"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nkeimhogjdpnpccoofpliimaahmaaome = "94A424A6AE761BE4EF51091BA85619BE9CEAB0A294F5DE202523C995BDBE6E89"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\lastrun = "13371504090184547"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\media.storage_id_salt = "38B74E2960683CBB048F0A38F0C2459F2D526FECBA05AB4DC2FB8EC6706FF7B3"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\prefs.preference_reset_time = "3B55CD90837996C1E9193E796103586544C609D686D0549A4D4E027BE860FD38"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\dr = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_username = "FA5D172A460C3DE48424F7CB63E09B90AE6D9EC4580303354A4C4569932ADB08"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\browser.show_home_button = "2B8282966A07716DF19BE758FB4174CA3F968F4CC0A8AE73EE1C9E150EE51867"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_signed_in_username = "A292ADAAF787689A8992FE9A6C5F6BE4DB77E3AA2C661C7D0A387BEF3D414487"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ahfgeienlihckogmohjhadlkjgocpleb = "8609A01D2F0EE6DA159517FA41E0C720E045568FE43AF02FF50A21B2B2EE8D39"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\enterprise_signin.policy_recovery_token = "14BEF56DE0277790AA4FA497EEFD06B992EF7D99076408CEED2857E07B672BFA"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\Extensions	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\module_blocklist_cache_md5_digest = "8051CCB91D16C491166EB58A45DE0A3458118402144C069C45A304BED182D530"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\InstallerPinned = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\StabilityMetrics	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\homepage = "3411AFFB8B76D15EB1F06BF6D21EF18DCF51E3E69A45B64201CAB2C895694207"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\state = "1"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\UsageStatsInSample = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\default_search_provider_data.template_url_data = "B2DBD6B8C7EFAD3A4CC47F03B235688B7E567EE9E78826232BD34D94EE5471B2"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	updater.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\StabilityMetrics\user_experience_metrics.stability.exited_cleanly = "0"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.account_id = "4159F4029358507FEC9D1EFDD9689A50F2C1FC3EAE96B0C69BAC3E36F164323B"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\session.startup_urls = "4354502848F1A88D90EDE9A6A6E813709F3FD6D95296C7E6A153DE882C3AD079"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\safebrowsing.incidents_sent = "F4D96C4D6C36690822B6ED40782931F1D15A51EFFECA33416136CEE1508B86AD"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{CCA9FC90-B200-5641-99C0-7907756A93CF}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1588C1A8-27D9-563E-9641-8D20767FB258}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{CCA9FC90-B200-5641-99C0-7907756A93CF}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ = "IGoogleUpdate3Web"	updater.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\72C09383E414F154AB45B1F83E731FE6\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\GoogleUpdate.Update3WebMachine	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{5F793925-C903-4E92-9AE3-77CA5EAB1716}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8A4B5D74-8832-5170-AB03-2415833EC703}\TypeLib	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\TypeLib\ = "{5F793925-C903-4E92-9AE3-77CA5EAB1716}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib\ = "{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\ = "IAppVersionWebSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{CCA9FC90-B200-5641-99C0-7907756A93CF}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1588C1A8-27D9-563E-9641-8D20767FB258}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\TypeLib\ = "{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\TypeLib\ = "{6430040A-5EBD-4E63-A56F-C71D5990F827}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ = "IPolicyStatus"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\128.0.6613.138\\notification_helper.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4B5D74-8832-5170-AB03-2415833EC703}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\5"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4B5D74-8832-5170-AB03-2415833EC703}\1.0\ = "GoogleUpdater TypeLib for IUpdaterInternalSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\LocalService = "GoogleUpdaterService128.0.6597.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\ = "{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\TypeLib\ = "{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\TypeLib\ = "{494B20CF-282E-4BDD-9F5D-B70CB09D351E}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}	updater.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3240	msiexec.exe
3240	msiexec.exe
4412	EDWJLBYgUE16.exe
4412	EDWJLBYgUE16.exe
3452	updater.exe
3452	updater.exe
3452	updater.exe
3452	updater.exe
3452	updater.exe
3452	updater.exe
1544	updater.exe
1544	updater.exe
1544	updater.exe
1544	updater.exe
1544	updater.exe
1544	updater.exe
3368	updater.exe
3368	updater.exe
3368	updater.exe
3368	updater.exe
3368	updater.exe
3368	updater.exe
3368	updater.exe
3368	updater.exe
2096	IVgmTTGSKQEu.exe
2096	IVgmTTGSKQEu.exe
3880	EDWJLBYgUE16.exe
3880	EDWJLBYgUE16.exe
3880	EDWJLBYgUE16.exe
3880	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe
4504	EDWJLBYgUE16.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	220	msiexec.exe
Token: SeIncreaseQuotaPrivilege	220	msiexec.exe
Token: SeSecurityPrivilege	3240	msiexec.exe
Token: SeCreateTokenPrivilege	220	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	220	msiexec.exe
Token: SeLockMemoryPrivilege	220	msiexec.exe
Token: SeIncreaseQuotaPrivilege	220	msiexec.exe
Token: SeMachineAccountPrivilege	220	msiexec.exe
Token: SeTcbPrivilege	220	msiexec.exe
Token: SeSecurityPrivilege	220	msiexec.exe
Token: SeTakeOwnershipPrivilege	220	msiexec.exe
Token: SeLoadDriverPrivilege	220	msiexec.exe
Token: SeSystemProfilePrivilege	220	msiexec.exe
Token: SeSystemtimePrivilege	220	msiexec.exe
Token: SeProfSingleProcessPrivilege	220	msiexec.exe
Token: SeIncBasePriorityPrivilege	220	msiexec.exe
Token: SeCreatePagefilePrivilege	220	msiexec.exe
Token: SeCreatePermanentPrivilege	220	msiexec.exe
Token: SeBackupPrivilege	220	msiexec.exe
Token: SeRestorePrivilege	220	msiexec.exe
Token: SeShutdownPrivilege	220	msiexec.exe
Token: SeDebugPrivilege	220	msiexec.exe
Token: SeAuditPrivilege	220	msiexec.exe
Token: SeSystemEnvironmentPrivilege	220	msiexec.exe
Token: SeChangeNotifyPrivilege	220	msiexec.exe
Token: SeRemoteShutdownPrivilege	220	msiexec.exe
Token: SeUndockPrivilege	220	msiexec.exe
Token: SeSyncAgentPrivilege	220	msiexec.exe
Token: SeEnableDelegationPrivilege	220	msiexec.exe
Token: SeManageVolumePrivilege	220	msiexec.exe
Token: SeImpersonatePrivilege	220	msiexec.exe
Token: SeCreateGlobalPrivilege	220	msiexec.exe
Token: SeBackupPrivilege	4908	vssvc.exe
Token: SeRestorePrivilege	4908	vssvc.exe
Token: SeAuditPrivilege	4908	vssvc.exe
Token: SeBackupPrivilege	3240	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeBackupPrivilege	948	srtasks.exe
Token: SeRestorePrivilege	948	srtasks.exe
Token: SeSecurityPrivilege	948	srtasks.exe
Token: SeTakeOwnershipPrivilege	948	srtasks.exe
Token: SeBackupPrivilege	948	srtasks.exe
Token: SeRestorePrivilege	948	srtasks.exe
Token: SeSecurityPrivilege	948	srtasks.exe
Token: SeTakeOwnershipPrivilege	948	srtasks.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
220	msiexec.exe
220	msiexec.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 948	3240	msiexec.exe	87
PID 3240 wrote to memory of 948	3240	msiexec.exe	87
PID 3240 wrote to memory of 860	3240	msiexec.exe	89
PID 3240 wrote to memory of 860	3240	msiexec.exe	89
PID 3240 wrote to memory of 860	3240	msiexec.exe	89
PID 860 wrote to memory of 2316	860	MsiExec.exe	90
PID 860 wrote to memory of 2316	860	MsiExec.exe	90
PID 860 wrote to memory of 2316	860	MsiExec.exe	90
PID 860 wrote to memory of 4412	860	MsiExec.exe	92
PID 860 wrote to memory of 4412	860	MsiExec.exe	92
PID 860 wrote to memory of 4412	860	MsiExec.exe	92
PID 860 wrote to memory of 3548	860	MsiExec.exe	93
PID 860 wrote to memory of 3548	860	MsiExec.exe	93
PID 860 wrote to memory of 3548	860	MsiExec.exe	93
PID 3548 wrote to memory of 3452	3548	ChromeSetup.exe	94
PID 3548 wrote to memory of 3452	3548	ChromeSetup.exe	94
PID 3548 wrote to memory of 3452	3548	ChromeSetup.exe	94
PID 3452 wrote to memory of 3360	3452	updater.exe	95
PID 3452 wrote to memory of 3360	3452	updater.exe	95
PID 3452 wrote to memory of 3360	3452	updater.exe	95
PID 1544 wrote to memory of 4172	1544	updater.exe	99
PID 1544 wrote to memory of 4172	1544	updater.exe	99
PID 1544 wrote to memory of 4172	1544	updater.exe	99
PID 3368 wrote to memory of 60	3368	updater.exe	101
PID 3368 wrote to memory of 60	3368	updater.exe	101
PID 3368 wrote to memory of 60	3368	updater.exe	101
PID 2096 wrote to memory of 3880	2096	IVgmTTGSKQEu.exe	108
PID 2096 wrote to memory of 3880	2096	IVgmTTGSKQEu.exe	108
PID 2096 wrote to memory of 3880	2096	IVgmTTGSKQEu.exe	108
PID 3880 wrote to memory of 4504	3880	EDWJLBYgUE16.exe	110
PID 3880 wrote to memory of 4504	3880	EDWJLBYgUE16.exe	110
PID 3880 wrote to memory of 4504	3880	EDWJLBYgUE16.exe	110
PID 3368 wrote to memory of 228	3368	updater.exe	116
PID 3368 wrote to memory of 228	3368	updater.exe	116
PID 228 wrote to memory of 3428	228	128.0.6613.138_chrome_installer.exe	117
PID 228 wrote to memory of 3428	228	128.0.6613.138_chrome_installer.exe	117
PID 3428 wrote to memory of 4232	3428	setup.exe	118
PID 3428 wrote to memory of 4232	3428	setup.exe	118
PID 3428 wrote to memory of 3132	3428	setup.exe	119
PID 3428 wrote to memory of 3132	3428	setup.exe	119
PID 3132 wrote to memory of 4508	3132	setup.exe	120
PID 3132 wrote to memory of 4508	3132	setup.exe	120
PID 3452 wrote to memory of 3068	3452	updater.exe	122
PID 3452 wrote to memory of 3068	3452	updater.exe	122
PID 3068 wrote to memory of 4372	3068	chrome.exe	123
PID 3068 wrote to memory of 4372	3068	chrome.exe	123
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124
PID 3068 wrote to memory of 4520	3068	chrome.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\googlups.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:220

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:948
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 21046820348B5806B5E39F2F9CCECC13 E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Program Files\SecureRetailerTrusty\ivfFOaaBljLY.exe
    "C:\Program Files\SecureRetailerTrusty\ivfFOaaBljLY.exe" x "C:\Program Files\SecureRetailerTrusty\EvUYYnXAbyuPvELXKSQP" -o"C:\Program Files\SecureRetailerTrusty\" -pFpTMTtJmTTolePKAwdwa -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2316
- - C:\Program Files\SecureRetailerTrusty\EDWJLBYgUE16.exe
    "C:\Program Files\SecureRetailerTrusty\EDWJLBYgUE16.exe" -number 123 -file file3 -mode mode3 -flag flag3
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4412
- - C:\Program Files\SecureRetailerTrusty\ChromeSetup.exe
    "C:\Program Files\SecureRetailerTrusty\ChromeSetup.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Program Files (x86)\Google3548_85230628\bin\updater.exe
      "C:\Program Files (x86)\Google3548_85230628\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={FD39FE3E-F972-AC55-37EA-CE3FED473068}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
      4⤵
      Checks whether UAC is enabled
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3452
    - - C:\Program Files (x86)\Google3548_85230628\bin\updater.exe
        
        "C:\Program Files (x86)\Google3548_85230628\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x8ac694,0x8ac6a0,0x8ac6ac
        5⤵
        Drops file in Program Files directory
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3360
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        5⤵
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3068
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6613.138 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd806d6c28,0x7ffd806d6c34,0x7ffd806d6c40
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4372
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2032,i,17399348414218770151,8509173499857638201,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4520
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2200,i,17399348414218770151,8509173499857638201,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:3096
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2352,i,17399348414218770151,8509173499857638201,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4924
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,17399348414218770151,8509173499857638201,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:3524
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,17399348414218770151,8509173499857638201,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5044
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4308,i,17399348414218770151,8509173499857638201,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4944
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4596,i,17399348414218770151,8509173499857638201,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:744
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4452,i,17399348414218770151,8509173499857638201,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5508

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xbac694,0xbac6a0,0xbac6ac
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4172

C:\Program Files\SecureRetailerTrusty\IVgmTTGSKQEu.exe
"C:\Program Files\SecureRetailerTrusty\IVgmTTGSKQEu.exe" install
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:2152

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0xbac694,0xbac6a0,0xbac6ac
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:60
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\128.0.6613.138_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\128.0.6613.138_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\0721193d-da79-4ad9-a038-880c6b86d498.tmp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\CR_43957.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\CR_43957.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\CR_43957.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\0721193d-da79-4ad9-a038-880c6b86d498.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\CR_43957.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\CR_43957.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6613.138 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff6dc9446b8,0x7ff6dc9446c4,0x7ff6dc9446d0
      4⤵
      Executes dropped EXE
      PID:4232
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\CR_43957.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\CR_43957.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:3132
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\CR_43957.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\CR_43957.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6613.138 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff6dc9446b8,0x7ff6dc9446c4,0x7ff6dc9446d0
        5⤵
        Executes dropped EXE
        
        PID:4508

C:\Program Files\SecureRetailerTrusty\IVgmTTGSKQEu.exe
"C:\Program Files\SecureRetailerTrusty\IVgmTTGSKQEu.exe" start
1⤵
- Executes dropped EXE
PID:5060

C:\Program Files\SecureRetailerTrusty\IVgmTTGSKQEu.exe
"C:\Program Files\SecureRetailerTrusty\IVgmTTGSKQEu.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files\SecureRetailerTrusty\EDWJLBYgUE16.exe
  "C:\Program Files\SecureRetailerTrusty\EDWJLBYgUE16.exe" -number 184 -file file3 -mode mode3 -flag flag3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Program Files\SecureRetailerTrusty\EDWJLBYgUE16.exe
    "C:\Program Files\SecureRetailerTrusty\EDWJLBYgUE16.exe" -number 362 -file file3 -mode mode3 -flag flag3
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4504

C:\Program Files\Google\Chrome\Application\128.0.6613.138\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\128.0.6613.138\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5532

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5836
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xbac694,0xbac6a0,0xbac6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e579c31.rbs

Filesize
7KB

MD5
45667f33746ba795c3d0454720a24361

SHA1
0db1a3f6cbe1652a53d2635b891d0666a425ddb8

SHA256
90390a97dbc6c42cfb9a1f006d75d98f7cc3204a080b1d48134f8cef419293bc

SHA512
d002f0713a2756e7bee478d62b0c73ae51654d54a4acfb7de2143993da13e097f583cfad59cec90c812eaad6ce99f3d3266b0d16da593658f69a6f94ba282d69

Download Submit
C:\Program Files (x86)\Google3548_85230628\bin\updater.exe

Filesize
4.7MB

MD5
823816b4a601c69c89435ee17ef7b9e0

SHA1
2fc4c446243be4a18a6a0d142a68d5da7d2a6954

SHA256
c2a7c0fa80f228c2ce599e4427280997ea9e1a3f85ed32e5d5e4219dfb05ddb2

SHA512
f3b38807ed1eb96c932e850b9b37551554408a628bedf12aa32bde08c442ff3663bf584335e7eab193ce2cf7552bce456737c96a2ba9faa953150e6304068fc6

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat

Filesize
40B

MD5
cdd0b4fea09cd5dbb7d00fbf7173cdbe

SHA1
0428c96c3069ef92677db3b223a6e5da80268f44

SHA256
f381a56cf69a3d433e3637465e1e89446bea9436de0a63a6f3bb709666ff7773

SHA512
ed492a5476ad91632cb4bb7446b6d789333869788dd586cf0e404e5311398851a37610b9e6e37cdda542a6cb2c02d814697ced94ab1cacd69a5d9c52f4dbe42f

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
500B

MD5
fcf2f0da1de0d62255c1f556832ac516

SHA1
c349e547a6299c7d2041aa9f7dfb0d7bb8714cd3

SHA256
ca4b65e7e74fa5428421ce1caafc749f667a9f39d8f6a33bcfcccff38b3df591

SHA512
1bd34728377c89e4e799f7ccce8554387a78828fdd5d24908bbd093437ec2f24f561ac5cccaabc6ec5c39d0262498c76d8129deaaf029f6cf0cbe82439ea7145

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
354B

MD5
d4927578fc92dc543365aa4e43b202ba

SHA1
5e1aeb950ac6ac3f071fa02f90a4fbc0c8e5304c

SHA256
4ac029c04a6e82f4c588237f57a798b4285c818bdbb4250c20f11a5b95d4ecd1

SHA512
4c6cbf4bfb4279edc6d6bd816ca4d1d4dbc8b7f06d875493ffeea3a8782568f49911db28aae743a41962bbe4fe34afc531e119be58888a2acf0623e99df38e95

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
600B

MD5
ed23b238968ffccd258eee3575bf0ada

SHA1
303fd63422b2899f5a1173e3dc3da66c82eb12c0

SHA256
79deb7b9f3d280c79ce9ddf7d6bf0de000e5cfac3ae36c64c00fd181b34bdd48

SHA512
4b2143bee1196491cb49f3d71bde1f0f09dd5d6b0dfc40a139345dcee5b692d257c034b32616525a758073100c3e2f7b4fd21074762347f8dee784ef946621f0

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
600B

MD5
3fc767674a1e46045d2a0e159d3e24cd

SHA1
6dddfdf386262d85664e511d33b5649031c7f11c

SHA256
806648cd5a34b6de38c76b6e1bf1a6ea4ec1a2d2fb8d607d99a36aa5b975b6c0

SHA512
f70becb01cb99cc5f1dc8946a02e6d261e7c3c7ed95794f750e126dc76b5ae7f278e5b4b05d932cce9f513876027d2191c9d00d697568dac38d4a17a19f1e5ef

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
49B

MD5
7b693a82168c33ec9e8cf276859ddf7f

SHA1
d396dbbe299fe7754a6244d01e97cc4edd0693eb

SHA256
84a9a7f43db56cd6e9a408f88244e8ba5efbe48a5b5168d321f112b8c8fd8e3f

SHA512
4064c158d753d19a72e1be1c8bd5fe7f22e2032d67d1dd7ea1d85ce652d63c69b85a4292c4403b0f7729b05607f3d1ccfaf4d27d04ad09ffcec70082450320ab

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
c599d93a6bb2a0ebf2ccefc07b3951c5

SHA1
e855cec9c03c76c91b7a5f94ea7646d2a4659f14

SHA256
9637a517bfc4c5adb0c33b7b082f7715d59cad28cc52ff0960e061bf8c8ef1d8

SHA512
a1361c39a8508ee61d4e2542c1d7b03045b2341d48621bebd3d81f96b103ed0b5f2f99f7b00ae2113f172ab451a9b335bc0070cde839a34286d7711cd67c6dc6

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
2KB

MD5
397eb8b4ffed066817bc317ce24f8c09

SHA1
9699aaf4dea6aa01afcc6b06e68f71d8726587d3

SHA256
ff4e560a47bcf78494242fbfbfc9e89b9b07a7ff8c4526b88847d5d78bc96e8b

SHA512
be57e3cfa9c43da528da6b58b9c39d1c98a7b6961ba67a7fd99087e31d36b4eaf30c694d753deca144523b5d85723f0907ae7c5fc0c91e7e1404507c7b222e9c

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
4KB

MD5
ae6658a681c159487f03f7da86e94b88

SHA1
91063e15b56225f1d8b30e470490b5aaa0ca4a59

SHA256
0eb4046fd4fe1f1b107f000cd57227d2e55bfa0e351dc402ff117cf595c6fe0a

SHA512
f54fbfa3d325a7db550f94e30239f64087a4912063ddfd09ecf7b41843a5bff011591fb8a0dc236014f3550f758a14b432d04c388a32fc7694ff5b41346a264d

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
5KB

MD5
e511f966f20b08e230438f5b0fd20acc

SHA1
175de11a7a68a47854fcd63f6ea2920b76df4f6b

SHA256
91ddb1abfe3c5d1a17ec3a5b4b806de0d74345a4f915930f13dfbac0dda4a261

SHA512
464c890a5112693956f10ad9ae65c0a0c277e832371ae648469bf58fe223a0abd5d7ec2fafdee2e70f320c38c56610f978ef86e0e1355e0d0ca208b1f9719af4

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
9KB

MD5
46cdba7be7e044bca0cf70d83714b985

SHA1
8b2bc20aa9329bc963aab5fc5b09ef30803fdf09

SHA256
b17aa8d3989d27b1d556acbce68b09e6de7694359b55b5e092dfa87bd0a2e58d

SHA512
e530cf51818d83874fb7b4d482bfc322476eed3903f64cf823365fc56fd6109c87c3b286f97b6959fee7a93bfad9d5fec05a21b74be54cf0ea7319a4b51260cc

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
11KB

MD5
f7ff64144750a1a7ec279ccde131e4a1

SHA1
ad363a4dd8f7fd80a796381f4d0cc8936c6fe4bc

SHA256
457c4321ecbd7e00af976866b914f593f8bf5b3e2f686a5ff291a95da47160d4

SHA512
d3ab3aff4ee98241dc0748954eab23bdca1ef21b3638dc3d2b5b4c14d32f044efbd436e60b63f5513293e1327855d7b13fcfe9552e89d7748762ab5cea29cd01

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\0721193d-da79-4ad9-a038-880c6b86d498.tmp

Filesize
680KB

MD5
812d91a558285499df51f3a4e24c2ca2

SHA1
9331f773a25ecec1b3c2876f3d4b5ecd228fb899

SHA256
cc2d9a74e4733effb40f8a65caf2f796219bcc0faaa36a4b579356d6c983bf1d

SHA512
1a4adbb7a40af6f558270fff2fb5a1bd9ab239bf945507a53307d523af56fe01795ebe04cab3fa599aa2cca3fc74c90a512584946ef60a895e60eed1fc05c0fd

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3368_1732713536\CR_43957.tmp\setup.exe

Filesize
4.1MB

MD5
f6a169eb6b8b2e18f7615e71451c8d1b

SHA1
574de22fbe45c4906b1090a0dee80dacf90324cd

SHA256
a71658b5a01ee0580da332b4695dea1602e71ea7ce2e43b35cd27be0e5730515

SHA512
a859bc4342737ae04f31212cae02ac32d18b969f9797e267e060b88feb0dfaa9ec422a9960019ed81de42d610b22ba01f03118693f59fce684d3e7f9402b96cd

Download Submit
C:\Program Files\Crashpad\settings.dat

Filesize
40B

MD5
1f29661577d73d34562cfa83922a8705

SHA1
8c5d38f6eb3813c1d1150017f05f8930e61c0094

SHA256
190e8f98579bece07125bca4c381358033766dc5aca06dd0b282442b814add69

SHA512
ab47ef3d1cf83ab70da597184f518480440048635a9915065f76fc98c6aeaecd75c5f27319c9dc224625a8534c230303cd0a2844a07c892ab30f331438b64f3a

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\chrome_elf.dll

Filesize
1.2MB

MD5
bb7d6e99cc8298b544b75af2bb46873c

SHA1
3b9d3f6e0e392e89b3cba820c4c6271dbd09e2d9

SHA256
959dc64d6759f48b72580a0fa51a1006f3bacdf679574882f946aa6b80cef25e

SHA512
7964dce8d57995594b0adb112f2b305c9246154faf7ff137f49747a70c9317769841e7d405c2cc7626b971f51e1f59ec2dc0ade678914369c4420ae731b896be

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\libEGL.dll

Filesize
492KB

MD5
5908dcd30b71522a2a8347cd6b2f1d7e

SHA1
0ef72404e28715857851f25aeb7a35ee56bfcd5e

SHA256
04b51945bb5fa676c9f307273e89770a01874e72587049d9dd7c7bd6daf26fa3

SHA512
e4125ffffd5c05dbab8470a942adbca17ed3bed217772ebfc7d0ac562f16771f6a679a8d298114e498e933d231cc46353f3a03adce5c8bfb3d111aae313704c4

Download Submit
C:\Program Files\Google\Chrome\Application\128.0.6613.138\libGLESv2.dll

Filesize
7.9MB

MD5
a6d92c98fa63e69847bef71e2bf95d28

SHA1
2b29db0cbf0a1e697f710cbeeef7f649e8d98bfc

SHA256
94e8dfa902fd1f4600bca20bf66372fdda55f8415a95d80e142fed47e75d261b

SHA512
2fc5436bd925eb3646bb30e8a389b9d6d4d156d03eefe8c09153c8d27097a42d9e64f6a409d087799383955353513112649151ab1460abb3c776511451b04e05

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.6MB

MD5
db46628ea19f23def3d3639e33431ad6

SHA1
29b97b1a7c807d8af01ec4d1177a005c38057a73

SHA256
ecfe5833564738f2434c6b826cd32888cbee451c84ef68537d3e86ad6bbcc0cf

SHA512
28ffd3cc91c66d549e3887e855521ac0c207e0a6dcd4d047e94ea9bc4a7e18634a8dbcaa94977e32aeb1387a497027baacd358cb84c9cb6c79bfa67e3a9afb60

Download Submit
C:\Program Files\SecureRetailerTrusty\ChromeSetup.exe

Filesize
8.5MB

MD5
5adff4313fbd074df44b4eb5b7893c5e

SHA1
d27388ef6cf34d40e0e7666f6381fcc5bbafa0f7

SHA256
d0c7a4390bdd6b442b96fc76f8a38f7b756ba2c16752ea259844420161865cae

SHA512
f5d639922b91878cf83d97563288a3aa4cba94db3ad5e8ac11d24ef7c44b019383a4414aeba6171b4c7bfa83ea1eafc1231cc9233e3b82b5ca7dc0b3ffacbf60

Download Submit
C:\Program Files\SecureRetailerTrusty\EDWJLBYgUE16.exe

Filesize
2.9MB

MD5
9b00446b1873b8f20daff14b661bbacd

SHA1
42e34fb9765eb68e778cc563c0785a40c7d2bcb0

SHA256
d982712ae57d4b1110392d310eca2b45ab147daabb9d40ed88880b7dca32de6b

SHA512
c81ad99db9bdaf36814447041616f0d06562062d910e0b4a61666f1f60eae6af9494f214e8e21b0d61dd6157ee920871846ed825ed3c22e2b87a0effe2c06a6a

Download Submit
C:\Program Files\SecureRetailerTrusty\EvUYYnXAbyuPvELXKSQP

Filesize
1.7MB

MD5
206da7cd1a42c14a1be878ebc5364c48

SHA1
3291599dfd884ea782fee8a061c053a1c7556718

SHA256
fc4190690f79d82f665c3f4ac2c6061b0f89d3ad7667d327e22f40f0d9de8c30

SHA512
c46cf62d59d7c340087bf1a45fcbf76b796ae50a8ea737cb3b47c01899e691373f49767b574a0efb2c849fed4329fe8e9f1186b1b8995d0dc066c251b039ace8

Download Submit
C:\Program Files\SecureRetailerTrusty\IVgmTTGSKQEu.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\SecureRetailerTrusty\IVgmTTGSKQEu.wrapper.log

Filesize
419B

MD5
0161b623ac234ab7882124d4ad6d2f51

SHA1
5f172af0bfacb6fc2ddfd377f94fc735ca672f98

SHA256
71c48f94c12625f08033a71ca1bae5c1b23da57996346420476a8cf65f8c7805

SHA512
1cd05d9a4026d7903c646c0e74838f99c4a7ced842745d37c5fb28f869410acf73b5fd17afe9f1e89919af0c60c0a35634e5489213dcba87dc9d612cabd5509d

Download Submit
C:\Program Files\SecureRetailerTrusty\IVgmTTGSKQEu.wrapper.log

Filesize
916B

MD5
77396aaa4d020953bf8d1275c0a52193

SHA1
3633a5c7d9c83d1c7fabe4532684bdb96bde0b17

SHA256
7d0b87b4903c52febdedeca192ba3278e43027bc83a205389a1198ba38f5d82a

SHA512
d974c998fd51bc10115c9e2e1e84c583e33d68a4629bbb153572a821f070b3a26b4be60dbbcf57ff6739d02d4a51bb8f10a548973e0f3c2faba5658ce9eef4be

Download Submit
C:\Program Files\SecureRetailerTrusty\IVgmTTGSKQEu.wrapper.log

Filesize
264B

MD5
cc9e86d6030a07c5ea40b3ba2e66c769

SHA1
cc6c8ce13097f7dcf27dd54ccab33680b79824fb

SHA256
ed0438b8bb9bd4dfcc32adf6e5947bf5422f70484e8daff39ce391eed93666aa

SHA512
f4be89ab57d4dfb72fe0ccaaa7991ebafe9799791c83eb4fa77ca0e6224287f334743cd444344377197df9c968008ee376ef722f67cf503cf5492eb8d1c8d813

Download Submit
C:\Program Files\SecureRetailerTrusty\IVgmTTGSKQEu.xml

Filesize
436B

MD5
63c6711f0453c3ef2bcdd751bd3ebdcf

SHA1
7230aff7a7ca03a71d2ceacbbca65af4098cdde1

SHA256
a60da9ccb1f3b0cc2ccc89d0931367ce546f54e60d1c2242b0e88c1a0d5c9aa2

SHA512
0a8c6d93b923124895f75a40b73549841bfcd556443b4f2226a9fb6425da974fed56305de09be19e23961844f1284f678440e192396a20fe52b518e5cbbc709e

Download Submit
C:\Program Files\SecureRetailerTrusty\ivfFOaaBljLY.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Program Files\chrome_installer.log

Filesize
21KB

MD5
b83ddce633af3559833ca60201ffcf08

SHA1
28fa9af354b8cd078e8ce32d67ea0444bdbbb77c

SHA256
be65dee12448995da13c2ac48869968f7f66f3c4a6e7d70ee2d39841024fc33f

SHA512
eec30ee60537cb71747bbee86c96d3cce7e0498e336c861219a33050f35a2a1bdcb12eeb8c8bcbe4ede0d7c0f86e9c196eba1cda9ce35f55f0b192355e22b79a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
dea0fd38bc47fc24436e063bb3bdb9b0

SHA1
02c717f61330d49d1b3bb70bfa1078a05a4e0a6e

SHA256
d28528fccf3eff63a913488ee0fb7d84d4346f88dcdff9510392db771f381c65

SHA512
e219416c55e80dbc0a47443f7e29fb217907047bcf000808bf2f31d6ecba0b8f0040ccafc87d9fc232294c636a99785940463247e485b0abe0f585101d834387

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
275e9ae4923a6f54b061ad05bad12800

SHA1
5a33283de65718897f47a18720687d4bbad4f5eb

SHA256
6462fd92019cec190b744b6966bcd8cfe640e4fee5e057559b73f519587b4f72

SHA512
355620fa13898a829c327bf2a2e802fa452faf743c8cb5f1b1e456f40f9f12add8e7ebcbaf75199fdbb500b7a2f9a765cee8f0779394c5fef46baf4c520186ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
352B

MD5
b89333330a591b631de9d8d8ee568657

SHA1
b7d1428a196040177c6585672e887fe4d12c52f4

SHA256
1092bb832b78e379cead5c025be9f71949633eb6e087a844f7f55393b4cf528c

SHA512
d420de4d34d5685c7b4cd26e6c91c0bb0ab5e9735b4e62a84736c6ad75f4fbbb14a9daf5e86c3123ee94407467dc0caa818b4e5beebfb734aa3dccc5affe4fe8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2df15b8e4dc4f3a0eba05f051ce33327

SHA1
9b19cca663b1c54748c76bbcc715d8f5d62e2d64

SHA256
eda2d979dd510c5f7dbe9b27af1cc01f78f77804d4537cc4fa4c6747f0a2ac22

SHA512
db4c0f4e5d1df3e720261f805c72f35c3bb908e471bca8379e045e769cca1ed4512e47b93c06953a28a0c2dfd14af70c11c4a103229a36879b77657fbb67dabd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
38b4e481b90c72513aa16538ca962df5

SHA1
aa2912234af174bfb87a0d3763d07213282f38d2

SHA256
ee7f4431a3ace1e5e7601d9d5df449260d0733405834c2178eaaadc2a0abd88c

SHA512
e132d246a2543480996555420124fcddf055c57f5d05a1b390fb7c8ad096495f0f835db56278deea25d508c4b0408d20f67f802be6d84da56ae5fd8dd24f382c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
192KB

MD5
dbd96f276c0c28a44954e92cd91e5a5d

SHA1
ac8b67dcaf087605200d192aed27046d368fcf35

SHA256
380e84eda08d1474c46e3b3abfc27237620633a725ab74a56ec37367592d7d7e

SHA512
d5ec79b254e08412bb44a3fddeeea23ff3b1d5307e8248206f90d9ca77525617fbdce64cf74270b42a5084afe9856f713d8ad65eabd64b67815bb81a0200c9a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
192KB

MD5
50dd0a01cd4ea64202b4588e22b3dc4d

SHA1
924f644f737894e1e447fe1ffcfc9dae7759e4a6

SHA256
588f8261607ef4efcddcbaef5935ac153d68975f501ecdbd432d8d6480be89a7

SHA512
b0739dd180df17e1ca2f87b410a63a1c7dce0f897cc91fc6b78aff4e4f9c932c1831c50b38fa88a4353d23b158f9cfb0e14e5aeda5b0c07123a853921a31bf77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
253b0bb4106a3c5ec15b27abc26e35dc

SHA1
e972f6d9d833dc15d4e7094f37917f37457a17ea

SHA256
895b0b0cd6ecc0dd86d8f94a9dce098d4bb7e78f33bc46aee9acb58789b1a83d

SHA512
2301ffd95930658ba7682ea6a1aeeacbd018560beb3bfeef81fd7288d326489e6ae676fc59bbf7b2a47612418762c9759595794ea169c0c1a789cfd788b80714

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
bb8333ecb57c4cc42b21ce48d0511929

SHA1
29f0c6fc68bcc3fc582f755f2023024ebb0e32c1

SHA256
9976b12aa06894d8170475aa3fd9d42235efbd769a753e287741698e69d59fe1

SHA512
de09a8b642375a33ca892569c5cf868e2bcf982758c4cb6cf1e960d5e27f359784a1066d6d66de0ee36e25c0261458a7fb0c172275077983f818eeee2de3c5fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\IVgmTTGSKQEu.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
C:\Windows\Installer\e579c30.msi

Filesize
27.6MB

MD5
1360b4beaf800c3ca4be311301cb2cb7

SHA1
f4d0724cf3df9d78779a5002c0414b1fcd76cbf8

SHA256
60ccad58b390a02fdf64477e6cbfd545c43788c7abaeb1fbe4d26099e178fe4a

SHA512
7e66cae3bbc27d7e55871e7ed06ded74b5aa222d4e21a0ed37b55b0c00fdcbd3817abc5ad303bc561ac54bb0bfa2a0cfe441226638f364ea7163977856046ab7

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
9cdafcd1707b646e44bf78409c315d15

SHA1
33e9c5b94c7130d533b7bfbf364d4a87b5e2039a

SHA256
244f5100d87decb5a37db453852be8529297c80c4a602e9f6b428026d538a521

SHA512
535704af7ce928a100d73ed02de3d723d88d6770aa2766a47788a2a734439533256f6a8fc30c65b863324236847e8d8500cb36a558bf9d0f2ca0a0942ed9fe78

Download Submit
\??\Volume{fa35ad82-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{15eaece8-f9ca-41de-902e-2e365a8076b5}_OnDiskSnapshotProp

Filesize
6KB

MD5
9c810cd28933cb37f1b1756aa62dc616

SHA1
4c0c9a10135a571c341fe5ebf5c7501af7e3ddf6

SHA256
7e34d28f52e40c113d6683f5984605c4e66ce13d34d806ec71e14c225eb25af8

SHA512
011bfc834decd5ef0eb7ee752f6f6ec0bda180173e33ec9ecf78159d2871d0e042622c32b6e6e8e2547a247bb393cf2915b08a49e247721572308cb32ff967dd

Download Submit
memory/2152-76-0x0000000000FE0000-0x00000000010B6000-memory.dmp

Filesize
856KB

Download
memory/4412-46-0x000000002A350000-0x000000002A37A000-memory.dmp

Filesize
168KB

Download
memory/4504-121-0x000000002B4C0000-0x000000002B67B000-memory.dmp

Filesize
1.7MB

Download
memory/4504-131-0x000000002B4C0000-0x000000002B67B000-memory.dmp

Filesize
1.7MB

Download