gh0strat | 4919a15c3de7bcc2b79073d559909837caac6ef0a732cf3c6dfcc162b0e678eb

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChromeSetup_1.msi
Size

19.6MB
MD5

60c37ac65e53ba837822c42debbccb21
SHA1

53dcb7a068ef330bf7b685128b1ed62004ec848a
SHA256

4919a15c3de7bcc2b79073d559909837caac6ef0a732cf3c6dfcc162b0e678eb
SHA512

1ef5b8b017857a8208392db2d9a9723163167313f818b35db82fadd361a61759a981fcc8b334937b34add3a086f06f3bb62019fbdc0553240654d0c232a0170e
SSDEEP

393216:VQ0Frf5krXSujsG+tn43vEZMBsvuSqqVBRALiJ7AAP9dmkLQFH78RXzQ9fjN:VQ05JQsG+54s0t7KR37AAPfrLQFgRXzA

Score

10^/10

gh0strat purplefox discovery evasion persistence privilege_escalation rat rootkit spyware stealer trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 2 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/1596-134-0x000000002B750000-0x000000002B90B000-memory.dmp	purplefox_rootkit
behavioral2/memory/1596-153-0x000000002B750000-0x000000002B90B000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/1596-134-0x000000002B750000-0x000000002B90B000-memory.dmp	family_gh0strat
behavioral2/memory/1596-153-0x000000002B750000-0x000000002B90B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\129.0.6668.72\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	jhhSXIZTmf4.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	jhhSXIZTmf4.exe
File opened (read-only)	\??\M:	jhhSXIZTmf4.exe
File opened (read-only)	\??\O:	jhhSXIZTmf4.exe
File opened (read-only)	\??\Q:	jhhSXIZTmf4.exe
File opened (read-only)	\??\S:	jhhSXIZTmf4.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	jhhSXIZTmf4.exe
File opened (read-only)	\??\X:	jhhSXIZTmf4.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	jhhSXIZTmf4.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	jhhSXIZTmf4.exe
File opened (read-only)	\??\U:	jhhSXIZTmf4.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	jhhSXIZTmf4.exe
File opened (read-only)	\??\K:	jhhSXIZTmf4.exe
File opened (read-only)	\??\P:	jhhSXIZTmf4.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	jhhSXIZTmf4.exe
File opened (read-only)	\??\N:	jhhSXIZTmf4.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	jhhSXIZTmf4.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	jhhSXIZTmf4.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	jhhSXIZTmf4.exe
File opened (read-only)	\??\Y:	jhhSXIZTmf4.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	jhhSXIZTmf4.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_058F778FC8346DE378B15A5652BAADD9	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_058F778FC8346DE378B15A5652BAADD9	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\CustomizeServiceMajestic\ChromeSetup.exe	msiexec.exe
File created	C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.exe	ieQswRWfRazA.exe
File created	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\3fbceb81-6dcf-4a36-b5f5-ce7fa18cb016.tmp	updater.exe
File opened for modification	C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.wrapper.log	WNbYFhazBDJx.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\fa.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\hi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\hr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\pt-BR.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\CR_A4398.tmp\CHROME.PACKED.7Z	129.0.6668.72_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\cs.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\optimization_guide_internal.dll	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\manifest.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\en-GB.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\ja.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\sv.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\WidevineCdm\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\libEGL.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\chrome_100_percent.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\af.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\ar.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\ml.pak	setup.exe
File created	C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.xml	ieQswRWfRazA.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\ur.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\zh-TW.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\PrivacySandboxAttestationsPreloaded\manifest.json	setup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\id.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\VisualElements\SmallLogo.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\chrome_wer.dll	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\314ef6eb-7a5f-49e7-bfb5-c4e32485db57.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\th.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\chrome.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\es.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\chrome.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\am.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\WidevineCdm\LICENSE	setup.exe
File created	C:\Program Files (x86)\Google1768_1385218428\bin\uninstall.cmd	ChromeSetup.exe
File opened for modification	C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.wrapper.log	WNbYFhazBDJx.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\fr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\mr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\Locales\sr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\CustomizeServiceMajestic\ieQswRWfRazA.exe	msiexec.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\v8_context_snapshot.bin	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\VisualElements\Logo.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\129.0.6668.72\os_update_handler.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source824_36000804\Chrome-bin\chrome.VisualElementsManifest.xml	setup.exe
File opened for modification	C:\Program Files\chrome_installer.log	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files\CustomizeServiceMajestic\jhhSXIZTmf4.exe	ieQswRWfRazA.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CE7B28C6-3A56-482E-8A7D-1E81ADEE4BB4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC63E.tmp	msiexec.exe
File created	C:\Windows\Installer\e57c536.msi	msiexec.exe
File created	C:\Windows\Installer\e57c534.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57c534.msi	msiexec.exe

Executes dropped EXE 34 IoCs

pid	Process
2920	ieQswRWfRazA.exe
5088	jhhSXIZTmf4.exe
1768	ChromeSetup.exe
1196	updater.exe
4432	updater.exe
1912	WNbYFhazBDJx.exe
1668	updater.exe
3092	updater.exe
4384	updater.exe
3356	updater.exe
3260	WNbYFhazBDJx.exe
4496	WNbYFhazBDJx.exe
1512	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
4336	129.0.6668.72_chrome_installer.exe
824	setup.exe
3740	setup.exe
2408	setup.exe
4328	setup.exe
4292	chrome.exe
4060	chrome.exe
1504	chrome.exe
2612	chrome.exe
2476	chrome.exe
4580	chrome.exe
4532	chrome.exe
4340	elevation_service.exe
4824	chrome.exe
5176	chrome.exe
5368	chrome.exe
5376	chrome.exe
5628	chrome.exe
5956	updater.exe
5972	updater.exe

Loads dropped DLL 29 IoCs

pid	Process
4292	chrome.exe
4060	chrome.exe
4292	chrome.exe
1504	chrome.exe
2612	chrome.exe
1504	chrome.exe
2612	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
2476	chrome.exe
1504	chrome.exe
1504	chrome.exe
1504	chrome.exe
2476	chrome.exe
4532	chrome.exe
4580	chrome.exe
4532	chrome.exe
4580	chrome.exe
4824	chrome.exe
4824	chrome.exe
5176	chrome.exe
5176	chrome.exe
5368	chrome.exe
5376	chrome.exe
5368	chrome.exe
5376	chrome.exe
5628	chrome.exe
5628	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2380	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhhSXIZTmf4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ieQswRWfRazA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhhSXIZTmf4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhhSXIZTmf4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4336	129.0.6668.72_chrome_installer.exe
824	setup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c9aa8484b1ca68e90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c9aa84840000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c9aa8484000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc9aa8484000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c9aa848400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	jhhSXIZTmf4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	jhhSXIZTmf4.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_signed_in_username = "34977575716084F867AE811E7827842EEF2AC43D6DF0B86725835292CA0DEBFB"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\browser.show_home_button = "C7F74424D00A6B0A7A385A1873B59DAAE1DA72784FE8C106C3DF28C079446CC5"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\version = "129.0.6668.72"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nmmhkkegccagdldgiimedpiccmgmieda = "F1FDBE5D78209AE3E10910E4AB119F14B1484E3D119D3A6E741710F7E97EEE56"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\dr = "1"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\safebrowsing.incidents_sent = "8EE3092C259C869EC142C25EC3F41A294F3AB2F956DBADFE8E5AD8E375996234"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\pinned_tabs = "B1293DEB0C0F0723E263D135517D8130625D9722B47F7018D7D853B6549DDCD9"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nmmhkkegccagdldgiimedpiccmgmieda = "D31E6907F8B25785673DE19D22FF31F90782F1B8387A61E53D30C434F8F45A74"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\Extensions	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\media.cdm.origin_data = "C7F3B5E2E02CC227510233FB824C9066F2503E28032952A3AC1C06ECDF386C50"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.account_id = "3DA662ACE4121DD3CD786D48879EFA282CE4BEC3D447FBD4252845A0DFBABB15"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\failed_count = "0"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\InstallerPinned = "0"	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\module_blocklist_cache_md5_digest = "A5E0D5D8B74776DDA7E71C5ABF1BDCA36024266A46547B6D74343E228F8D7455"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_username = "3866C84E4480ABD0A32C7222C7F858F7266FC21E14AA030A0CDFB22A6D24601F"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi = "3D8E53BFDAC20E1142AC364D09151074BCF94591A8CAFFB1A4C3304928341F69"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\StabilityMetrics\user_experience_metrics.stability.exited_cleanly = "0"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nkeimhogjdpnpccoofpliimaahmaaome = "684EA617C6D91423F81A2A4B8C3ADF6A7186E447DBFA0ECE7BEC0C34F86050E6"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\StabilityMetrics	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\search_provider_overrides = "9B7FEF25FFBD12910EABC170DE2E1A527A0C5D67DDE980B1CE287DF91FD6ECCA"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\media.storage_id_salt = "C79FDD37487DC860FF930AE09905921114F18A650E3836D576E53642A52CD9B3"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ahfgeienlihckogmohjhadlkjgocpleb = "1CAECFDF999A9272D526308971E896AF6CBB958E7D14B3AB4123700665EA22FC"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	updater.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\mhjfbmdgcfjbbpaeojofohoefgiehjai = "BE5363B4821055F7DBCD987A1D169EDB8A0A06593292A658DA3B31CC066B9C50"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\session.startup_urls = "6A1C8EB8AACB913D743CA6CBAA4051ACE709A6521B1A02D606088A1A3E35F39A"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\TypeLib\ = "{F258BE54-7C5F-44A0-AAE0-730620A31D23}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ = "IProcessLauncher2"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{44B969D4-48B7-5A30-9CD6-CAC179D81F9C}\ServiceParameters = "--com-service"	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\LocalServer32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ = "IAppWeb"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{708860E0-F641-4611-8895-7D867DD3675B}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ServiceParameters = "--com-service"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\129.0.6668.72\\notification_helper.exe\""	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A4B5D74-8832-5170-AB03-2415833EC703}\TypeLib\ = "{8A4B5D74-8832-5170-AB03-2415833EC703}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ = "ICurrentState"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{CCA9FC90-B200-5641-99C0-7907756A93CF}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{699F07AD-304C-5F71-A2DA-ABD765965B54}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\4"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatus2System"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\ = "{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{34527502-D3DB-4205-A69B-789B27EE0414}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\1.0\ = "GoogleUpdater TypeLib for IGoogleUpdate3Web"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{44B969D4-48B7-5A30-9CD6-CAC179D81F9C}\LocalService = "GoogleUpdaterInternalService128.0.6597.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4B5D74-8832-5170-AB03-2415833EC703}\1.0\ = "GoogleUpdater TypeLib for IUpdaterInternalSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine\CLSID	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\TypeLib\ = "{34527502-D3DB-4205-A69B-789B27EE0414}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ = "IUpdaterSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{699F07AD-304C-5F71-A2DA-ABD765965B54}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\4"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\TypeLib\ = "{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4B5D74-8832-5170-AB03-2415833EC703}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\5"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\TypeLib\ = "{F258BE54-7C5F-44A0-AAE0-730620A31D23}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{44B969D4-48B7-5A30-9CD6-CAC179D81F9C}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib	updater.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
612	msiexec.exe
612	msiexec.exe
5088	jhhSXIZTmf4.exe
5088	jhhSXIZTmf4.exe
1196	updater.exe
1196	updater.exe
1196	updater.exe
1196	updater.exe
1196	updater.exe
1196	updater.exe
1668	updater.exe
1668	updater.exe
1668	updater.exe
1668	updater.exe
1668	updater.exe
1668	updater.exe
4384	updater.exe
4384	updater.exe
4384	updater.exe
4384	updater.exe
4384	updater.exe
4384	updater.exe
4384	updater.exe
4384	updater.exe
4496	WNbYFhazBDJx.exe
4496	WNbYFhazBDJx.exe
1512	jhhSXIZTmf4.exe
1512	jhhSXIZTmf4.exe
1512	jhhSXIZTmf4.exe
1512	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe
1596	jhhSXIZTmf4.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2380	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2380	msiexec.exe
Token: SeSecurityPrivilege	612	msiexec.exe
Token: SeCreateTokenPrivilege	2380	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2380	msiexec.exe
Token: SeLockMemoryPrivilege	2380	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2380	msiexec.exe
Token: SeMachineAccountPrivilege	2380	msiexec.exe
Token: SeTcbPrivilege	2380	msiexec.exe
Token: SeSecurityPrivilege	2380	msiexec.exe
Token: SeTakeOwnershipPrivilege	2380	msiexec.exe
Token: SeLoadDriverPrivilege	2380	msiexec.exe
Token: SeSystemProfilePrivilege	2380	msiexec.exe
Token: SeSystemtimePrivilege	2380	msiexec.exe
Token: SeProfSingleProcessPrivilege	2380	msiexec.exe
Token: SeIncBasePriorityPrivilege	2380	msiexec.exe
Token: SeCreatePagefilePrivilege	2380	msiexec.exe
Token: SeCreatePermanentPrivilege	2380	msiexec.exe
Token: SeBackupPrivilege	2380	msiexec.exe
Token: SeRestorePrivilege	2380	msiexec.exe
Token: SeShutdownPrivilege	2380	msiexec.exe
Token: SeDebugPrivilege	2380	msiexec.exe
Token: SeAuditPrivilege	2380	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2380	msiexec.exe
Token: SeChangeNotifyPrivilege	2380	msiexec.exe
Token: SeRemoteShutdownPrivilege	2380	msiexec.exe
Token: SeUndockPrivilege	2380	msiexec.exe
Token: SeSyncAgentPrivilege	2380	msiexec.exe
Token: SeEnableDelegationPrivilege	2380	msiexec.exe
Token: SeManageVolumePrivilege	2380	msiexec.exe
Token: SeImpersonatePrivilege	2380	msiexec.exe
Token: SeCreateGlobalPrivilege	2380	msiexec.exe
Token: SeBackupPrivilege	464	vssvc.exe
Token: SeRestorePrivilege	464	vssvc.exe
Token: SeAuditPrivilege	464	vssvc.exe
Token: SeBackupPrivilege	612	msiexec.exe
Token: SeRestorePrivilege	612	msiexec.exe
Token: SeRestorePrivilege	612	msiexec.exe
Token: SeTakeOwnershipPrivilege	612	msiexec.exe
Token: SeRestorePrivilege	612	msiexec.exe
Token: SeTakeOwnershipPrivilege	612	msiexec.exe
Token: SeBackupPrivilege	2468	srtasks.exe
Token: SeRestorePrivilege	2468	srtasks.exe
Token: SeSecurityPrivilege	2468	srtasks.exe
Token: SeTakeOwnershipPrivilege	2468	srtasks.exe
Token: SeBackupPrivilege	2468	srtasks.exe
Token: SeRestorePrivilege	2468	srtasks.exe
Token: SeSecurityPrivilege	2468	srtasks.exe
Token: SeTakeOwnershipPrivilege	2468	srtasks.exe
Token: SeRestorePrivilege	612	msiexec.exe
Token: SeTakeOwnershipPrivilege	612	msiexec.exe
Token: SeRestorePrivilege	612	msiexec.exe
Token: SeTakeOwnershipPrivilege	612	msiexec.exe
Token: SeRestorePrivilege	612	msiexec.exe
Token: SeTakeOwnershipPrivilege	612	msiexec.exe
Token: SeRestorePrivilege	612	msiexec.exe
Token: SeTakeOwnershipPrivilege	612	msiexec.exe
Token: SeRestorePrivilege	612	msiexec.exe
Token: SeTakeOwnershipPrivilege	612	msiexec.exe
Token: SeRestorePrivilege	612	msiexec.exe
Token: SeTakeOwnershipPrivilege	612	msiexec.exe
Token: SeRestorePrivilege	612	msiexec.exe
Token: SeTakeOwnershipPrivilege	612	msiexec.exe
Token: SeRestorePrivilege	612	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2380	msiexec.exe
2380	msiexec.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 2468	612	msiexec.exe	89
PID 612 wrote to memory of 2468	612	msiexec.exe	89
PID 612 wrote to memory of 4584	612	msiexec.exe	93
PID 612 wrote to memory of 4584	612	msiexec.exe	93
PID 4584 wrote to memory of 2920	4584	MsiExec.exe	94
PID 4584 wrote to memory of 2920	4584	MsiExec.exe	94
PID 4584 wrote to memory of 2920	4584	MsiExec.exe	94
PID 4584 wrote to memory of 5088	4584	MsiExec.exe	96
PID 4584 wrote to memory of 5088	4584	MsiExec.exe	96
PID 4584 wrote to memory of 5088	4584	MsiExec.exe	96
PID 4584 wrote to memory of 1768	4584	MsiExec.exe	97
PID 4584 wrote to memory of 1768	4584	MsiExec.exe	97
PID 4584 wrote to memory of 1768	4584	MsiExec.exe	97
PID 1768 wrote to memory of 1196	1768	ChromeSetup.exe	99
PID 1768 wrote to memory of 1196	1768	ChromeSetup.exe	99
PID 1768 wrote to memory of 1196	1768	ChromeSetup.exe	99
PID 1196 wrote to memory of 4432	1196	updater.exe	100
PID 1196 wrote to memory of 4432	1196	updater.exe	100
PID 1196 wrote to memory of 4432	1196	updater.exe	100
PID 1668 wrote to memory of 3092	1668	updater.exe	104
PID 1668 wrote to memory of 3092	1668	updater.exe	104
PID 1668 wrote to memory of 3092	1668	updater.exe	104
PID 4384 wrote to memory of 3356	4384	updater.exe	106
PID 4384 wrote to memory of 3356	4384	updater.exe	106
PID 4384 wrote to memory of 3356	4384	updater.exe	106
PID 4496 wrote to memory of 1512	4496	WNbYFhazBDJx.exe	112
PID 4496 wrote to memory of 1512	4496	WNbYFhazBDJx.exe	112
PID 4496 wrote to memory of 1512	4496	WNbYFhazBDJx.exe	112
PID 1512 wrote to memory of 1596	1512	jhhSXIZTmf4.exe	113
PID 1512 wrote to memory of 1596	1512	jhhSXIZTmf4.exe	113
PID 1512 wrote to memory of 1596	1512	jhhSXIZTmf4.exe	113
PID 4384 wrote to memory of 4336	4384	updater.exe	115
PID 4384 wrote to memory of 4336	4384	updater.exe	115
PID 4336 wrote to memory of 824	4336	129.0.6668.72_chrome_installer.exe	116
PID 4336 wrote to memory of 824	4336	129.0.6668.72_chrome_installer.exe	116
PID 824 wrote to memory of 3740	824	setup.exe	117
PID 824 wrote to memory of 3740	824	setup.exe	117
PID 824 wrote to memory of 2408	824	setup.exe	119
PID 824 wrote to memory of 2408	824	setup.exe	119
PID 2408 wrote to memory of 4328	2408	setup.exe	120
PID 2408 wrote to memory of 4328	2408	setup.exe	120
PID 1196 wrote to memory of 4292	1196	updater.exe	122
PID 1196 wrote to memory of 4292	1196	updater.exe	122
PID 4292 wrote to memory of 4060	4292	chrome.exe	123
PID 4292 wrote to memory of 4060	4292	chrome.exe	123
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124
PID 4292 wrote to memory of 1504	4292	chrome.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ChromeSetup_1.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2380

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 943D3F9D8148AB99186C8527E1DF2D72 E Global\MSI0000
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Program Files\CustomizeServiceMajestic\ieQswRWfRazA.exe
    "C:\Program Files\CustomizeServiceMajestic\ieQswRWfRazA.exe" x "C:\Program Files\CustomizeServiceMajestic\rtILwtuFoNZyAVPbDhNs" -o"C:\Program Files\CustomizeServiceMajestic\" -pIaAIdXoLkRGuqvANJtWV -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2920
- - C:\Program Files\CustomizeServiceMajestic\jhhSXIZTmf4.exe
    "C:\Program Files\CustomizeServiceMajestic\jhhSXIZTmf4.exe" -number 242 -file file3 -mode mode3 -flag flag3
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5088
- - C:\Program Files\CustomizeServiceMajestic\ChromeSetup.exe
    "C:\Program Files\CustomizeServiceMajestic\ChromeSetup.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Program Files (x86)\Google1768_1385218428\bin\updater.exe
      "C:\Program Files (x86)\Google1768_1385218428\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={FD39FE3E-F972-AC55-37EA-CE3FED473068}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1196
    - - C:\Program Files (x86)\Google1768_1385218428\bin\updater.exe
        
        "C:\Program Files (x86)\Google1768_1385218428\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x66c694,0x66c6a0,0x66c6ac
        5⤵
        Drops file in Program Files directory
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4432
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        5⤵
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4292
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=129.0.6668.72 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb3eb17bf8,0x7ffb3eb17c04,0x7ffb3eb17c10
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4060
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1992,i,8553433286769232234,1597231048591032811,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1504
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=2192,i,8553433286769232234,1597231048591032811,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:2612
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2364,i,8553433286769232234,1597231048591032811,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:2476
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,8553433286769232234,1597231048591032811,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4580
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,8553433286769232234,1597231048591032811,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4532
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4120,i,8553433286769232234,1597231048591032811,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4824
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4576,i,8553433286769232234,1597231048591032811,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5176
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4800,i,8553433286769232234,1597231048591032811,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5368
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4984,i,8553433286769232234,1597231048591032811,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5376
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5260,i,8553433286769232234,1597231048591032811,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5628

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.exe
"C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.exe" install
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:1912

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x87c694,0x87c6a0,0x87c6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3092

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x87c694,0x87c6a0,0x87c6ac
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3356
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\129.0.6668.72_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\129.0.6668.72_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\38ba832a-d452-4337-94cd-a9d49ccc1d05.tmp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\CR_A4398.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\CR_A4398.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\CR_A4398.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\38ba832a-d452-4337-94cd-a9d49ccc1d05.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\CR_A4398.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\CR_A4398.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=129.0.6668.72 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff72a8b9628,0x7ff72a8b9634,0x7ff72a8b9640
      4⤵
      Executes dropped EXE
      PID:3740
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\CR_A4398.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\CR_A4398.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2408
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\CR_A4398.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\CR_A4398.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=129.0.6668.72 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff72a8b9628,0x7ff72a8b9634,0x7ff72a8b9640
        5⤵
        Executes dropped EXE
        
        PID:4328

C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.exe
"C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.exe" start
1⤵
- Executes dropped EXE
PID:3260

C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.exe
"C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files\CustomizeServiceMajestic\jhhSXIZTmf4.exe
  "C:\Program Files\CustomizeServiceMajestic\jhhSXIZTmf4.exe" -number 147 -file file3 -mode mode3 -flag flag3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Program Files\CustomizeServiceMajestic\jhhSXIZTmf4.exe
    "C:\Program Files\CustomizeServiceMajestic\jhhSXIZTmf4.exe" -number 362 -file file3 -mode mode3 -flag flag3
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1596

C:\Program Files\Google\Chrome\Application\129.0.6668.72\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\129.0.6668.72\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5704

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:5956
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x87c694,0x87c6a0,0x87c6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57c535.rbs

Filesize
7KB

MD5
8a3f48f0b25fb96cff0ca06d4f2d841e

SHA1
a0ffaab27bd4149ee47464a419b1373b6cf184c8

SHA256
452032dae0a70389e934dbff643d1861c0ba1fbda4a3f923fac4ba06a7264e6f

SHA512
39c387874d4c451d0bb8c00c03dede79695b42cc7a105d87c1109a76b20a728062678b608c28b3e712b9a2f4f0bac93fa84d99c067b4fd4574bcc3be9faa310c

Download Submit
C:\Program Files (x86)\Google1768_1385218428\bin\updater.exe

Filesize
4.7MB

MD5
823816b4a601c69c89435ee17ef7b9e0

SHA1
2fc4c446243be4a18a6a0d142a68d5da7d2a6954

SHA256
c2a7c0fa80f228c2ce599e4427280997ea9e1a3f85ed32e5d5e4219dfb05ddb2

SHA512
f3b38807ed1eb96c932e850b9b37551554408a628bedf12aa32bde08c442ff3663bf584335e7eab193ce2cf7552bce456737c96a2ba9faa953150e6304068fc6

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat

Filesize
40B

MD5
6b06f9f8dbb63eea6ed70f38be8a2264

SHA1
842dfa6579617e690a3af69925f9b5d54d447764

SHA256
08b5d8784d2191cc4c6bf1c34a3a24868d846c989466a35f650923e08730bf86

SHA512
31fea4ee6542e2bb27756ebbeebeef443c37602e33248db37150015fbf4c3dc43c54dff920228f3c0c53f15cfec7099dfcb329bbd9baa288f836f4d5d17f0187

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
503B

MD5
c145b66404fa1db7c2384b48863148e6

SHA1
544832212960e30ea7b7e475ef6707575a8b5740

SHA256
8596bccbd9f8c7b1e6054254ee2e5d14821069142700e679af372bca1a956488

SHA512
f18d28b501ee7bd7a9602e62c3128b6da4b9ba97b8540ad8db1deb207ad4e35261f5aa8f9083ea6fc33b52e1989c6aeb541a4527d20adeb3bd29b009b9b8459e

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
354B

MD5
d4927578fc92dc543365aa4e43b202ba

SHA1
5e1aeb950ac6ac3f071fa02f90a4fbc0c8e5304c

SHA256
4ac029c04a6e82f4c588237f57a798b4285c818bdbb4250c20f11a5b95d4ecd1

SHA512
4c6cbf4bfb4279edc6d6bd816ca4d1d4dbc8b7f06d875493ffeea3a8782568f49911db28aae743a41962bbe4fe34afc531e119be58888a2acf0623e99df38e95

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
602B

MD5
9bfc15e99fc36de9e36efd898dc6e7ab

SHA1
2ecb70e32ce516d65c8116bb506de86d80d49c44

SHA256
87576e46aea982e16cbf55297fa900cc91c93eaa279a33035835780d40d2f756

SHA512
3f9a98ed039bc80a7ab42e54087d672779ef8a6aa52d2cd583380241c22efc15428db993053ec0f4f424d67df16ccdfd7861089ed67abf9a5c9a8a236a70e002

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
49B

MD5
7b693a82168c33ec9e8cf276859ddf7f

SHA1
d396dbbe299fe7754a6244d01e97cc4edd0693eb

SHA256
84a9a7f43db56cd6e9a408f88244e8ba5efbe48a5b5168d321f112b8c8fd8e3f

SHA512
4064c158d753d19a72e1be1c8bd5fe7f22e2032d67d1dd7ea1d85ce652d63c69b85a4292c4403b0f7729b05607f3d1ccfaf4d27d04ad09ffcec70082450320ab

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
602B

MD5
395e4e44ad3c42231d18131f9f7c5b3e

SHA1
15c97b0c42cbc42d27a394f5dce91c5e825e705c

SHA256
6e81e1979e245fd5c6f7eb686c6953ba82e8e4d4f4a84d5ab2bf7fe1f98b79c5

SHA512
52d781d4146dde78d0670505d1a05334735abd4a11a9177bfc529f6a12919bdfebf50bd4e0b670635c86503eec6eb49abba53fe4fcd203f36446fcaa59f496f6

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
835809003048d88d097e6c3f7fefbdff

SHA1
984935519d1d54683fcd265710af7df00e91f70f

SHA256
9d717e8cf2dfb743b9f5b5143734a89d04ffccceb0c1d0b7107714a22402ecba

SHA512
7977270b14ebb05864d1b3437dc9e5c9aca267d6812d27589bcc01593078f837b0c98d08c7323da9b31c5d9dc8ba77da5cdb6ee0d6e43cadfcad905dec9c0394

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
2KB

MD5
78df26ad085a9feebdaa5f35f0339f41

SHA1
40b80b9bb3290e93b085f3971795bc39173c1351

SHA256
bc10ca132d0c5526d3dfb13f48267399dc18f4aa7098dae25143e5f9b1354187

SHA512
a384e694e963dfa2bad7da46861061c68af6fd9dea59447e9b925491541ee5bf9646311a88572a5fb2f8088ad30975a27e6152e5340cc59b0d056796d54c93b0

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
6KB

MD5
471d6f5e4358523280948f3f979fe5e5

SHA1
982c9db59a724e7a8d43d2e52f5acb747ee62c33

SHA256
08537ea089df42d9b7023835eedd30d56ca8fcf43e48d9f93026d65f282fd5a4

SHA512
4a471e013cfce2983624510f375f3342028b55c20cf8511ee1e7ea37ffb9a46749ef64ffe8054c5e37d456f142f75ac862cca1a454d01a660563ef446f187258

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
9KB

MD5
379146eed3467405164269aaaf308189

SHA1
340a0d0438673531d78d5ecfa78a9230ac916964

SHA256
3407fb779517bc5ee643ed2d3ca1b0e139bc8e13487fad1470b80fd1fcda83c3

SHA512
256eb8fe02418a868ac4d4fa42de9d57be87fefab91affbb353cb3cec2e59cbfe1a01ea76292d40c6ccc55f3a17ec8f96352686dff6d802194c3c8db4027f7b5

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
11KB

MD5
2fb8721691dc610658b5cb27f57bded5

SHA1
de33dffdad5ae45e684517296e0a6a405e435424

SHA256
8bac1d44359089e66029b408eff7e912564967051c62198679aded5599542a13

SHA512
4c8632927d2fd7714aa0cf4699246818fde53e820f741b3fcd58ff01e93b5fbbedcaa1e2ee4cdd1efcb035d83f152e7f48a262aec2c80084cce93b95667bbd3e

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\38ba832a-d452-4337-94cd-a9d49ccc1d05.tmp

Filesize
679KB

MD5
377a006e7c7726b6f2a3f057b485cdec

SHA1
b6e9b7779e660cc534ac79b02e2f12a7a2665ea4

SHA256
43743afc098fc8a26bb0348077ac0c4b6dde20ce3dfb886be530a9bc9a80fe91

SHA512
e4be802a4dfd2c60150ac4b6690634e0b5ee8729bdd13fc9641cccb01b1fcf55ad114e36cefe25b712d1e7a77a35207e6d989928b9aa1ebb15c58ba964598ddc

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4384_471334059\CR_A4398.tmp\setup.exe

Filesize
5.8MB

MD5
45c814cbc966211dc237c7b17c283836

SHA1
497c2d1c5583f71ec05030499de554e2c338f7df

SHA256
97a18f773f924b4ff82f0189694502c11a0b4582d624068db482b1d4de6209ab

SHA512
d0210ec856defbd0c5fb80fb58c04f88d3a6f7d05741f74600c93f4ad0b62e354e46d4cf950ba1d89e7fb159aa988279e6aaef9d86e3e68e2d4de68fc9e0e3f8

Download Submit
C:\Program Files\CustomizeServiceMajestic\ChromeSetup.exe

Filesize
8.5MB

MD5
5adff4313fbd074df44b4eb5b7893c5e

SHA1
d27388ef6cf34d40e0e7666f6381fcc5bbafa0f7

SHA256
d0c7a4390bdd6b442b96fc76f8a38f7b756ba2c16752ea259844420161865cae

SHA512
f5d639922b91878cf83d97563288a3aa4cba94db3ad5e8ac11d24ef7c44b019383a4414aeba6171b4c7bfa83ea1eafc1231cc9233e3b82b5ca7dc0b3ffacbf60

Download Submit
C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.wrapper.log

Filesize
495B

MD5
26dd8e0d71bd2b55c00a9383a2da89e6

SHA1
e2a19f2f5b72787625e7cface00e01d5dbec3700

SHA256
c2386e47c4bcb0f233151c6db2fd642bfab13969f807b7af530fd55f864b9d19

SHA512
57067b5318a260a6dc7ff9a6e043ad7b0ea7be8faa0c2cadaf58b88d3840eb95189c0df555fdbcd5fef457a840194400873dcfc6801dd4664c94ce1a51905ca0

Download Submit
C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.wrapper.log

Filesize
643B

MD5
a197c350992c16dd6c0931d863cd87ef

SHA1
96662f2ae746bc1d3410ec9bc0ab5f55980537db

SHA256
1b7f47dc382909659188db320bcaf4af916300a029eac18114531ae46a320b2b

SHA512
4d33566b79586dd4cf488409955941486ce97368c0181b990bffa1f5ef76ec17f921d0a8bc65e3adc8a8d84633ddfe014190e5013956869b9dfc1abe0e6d3e33

Download Submit
C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.wrapper.log

Filesize
272B

MD5
8cdb78482c81b967052531313cc00986

SHA1
8c3588cc4abcfacd51ec53f3bd667e83776064cf

SHA256
1318059f81bc1a9a74707c3efaf7b5dde2ceb700043cbcd1f39949b4466f8b38

SHA512
20538fdb3fb922636ed6d58e6b78764e870141659432afd0247ed01c026e9465bc081f8de6a79817c09d61ec8caecafb931a199e34c9fa00c4de25c463914a4d

Download Submit
C:\Program Files\CustomizeServiceMajestic\WNbYFhazBDJx.xml

Filesize
447B

MD5
38fc4450643aa3d4af4d91a5786e2f25

SHA1
00d52d36a3a9a9a22dbe9bb096cba88c3232b4cf

SHA256
e0b40909d89824729ad380d5e35311e6a59bedaefedeb12b9b3c19ea2583df3e

SHA512
7a9258d6603ea7e2c82010098adc240e9a9be5a7328fd33c7ca1c5c4fdce8368440a70e1da8e027ebcb8c556deac444b899ca6c23b5d869e2e0e0b1a51eb3fa7

Download Submit
C:\Program Files\CustomizeServiceMajestic\ieQswRWfRazA.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Program Files\CustomizeServiceMajestic\jhhSXIZTmf4.exe

Filesize
3.2MB

MD5
74567b61104889600646919fdbfdf5fe

SHA1
112bb3f28f6745e5f078a7915ac96d911a572258

SHA256
7d84f665ef41c20063bdd26189574b01d5b6407ee7180773de0132c91bf34390

SHA512
860f88a2b33b7a3abb07e7e60f52174f6671f5382952a8ddf7200c43c6dc8f0610eb5f257410212ab35596d18d8871919227d6e2c0bbd5e794e01bcc3b691946

Download Submit
C:\Program Files\CustomizeServiceMajestic\rtILwtuFoNZyAVPbDhNs

Filesize
2.0MB

MD5
1eeb7a7676c4a0896fd72702f68515ff

SHA1
f5926c115feda43bb88bb37d2b29bcc2a844d465

SHA256
2cc22abf218082b82099ac77a8eeb7df79fe27cb8c8100f22ea3441261818ac8

SHA512
068b740b6ec105bbaabce8dc3c43190be58d483b5ab3c611ccdc32bf13e7da6fa33d4753689621436c592730482630d1b0aee617042a30af1c67d21083ae8f6f

Download Submit
C:\Program Files\Google\Chrome\Application\129.0.6668.72\chrome_elf.dll

Filesize
1.2MB

MD5
39e537846b3f01b806337100ea6801a9

SHA1
f0d4bc3aeee2125827d100892c7a91347aa39982

SHA256
88a70a9f2829c29313392e1aa9d565c6cf79bc56d02823fbe872367c39f36a07

SHA512
b97634f640570b779146257625edde2fb9c464c328f31f7f4059c0bbd364afc890c21954589a1976a012ddc3eae36c51d8d6c08db5e9e896a8279b4093b20667

Download Submit
C:\Program Files\Google\Chrome\Application\129.0.6668.72\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Program Files\Google\Chrome\Application\129.0.6668.72\libGLESv2.dll

Filesize
7.9MB

MD5
8e27db80f77c2551c6d497a01d0a58ed

SHA1
b92cb57567893ac0f11339cb092811ec87dfb388

SHA256
a3eb6b9ad140e493514a856bafe059c2d2b36b7ed0d8280f92428e467f31494b

SHA512
badd260bab9400a5e58b3b825d19cfa9fa9575da96ca862f69f7e6bb5066c5ab246148e56577898d97fe379f7f40ee53295e76f38c720f004dc4513782f59277

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.6MB

MD5
17e6c7baa71f6cb2cf1538e58a1d61d6

SHA1
bf028e1bdc490224c665f1c73122577e47e28806

SHA256
72007d5e7f2569395865ff327dda26f08d189915027a1fdc9b935a435ae1fbe9

SHA512
b114cccd4d9afe6fb7b83a2aa9535b5b3bca5309c75f03ab8fed68f25199959f06427f77e0d6674e517fbc33a85c14437c01b35b7878f775bd49301f57584a1b

Download Submit
C:\Program Files\chrome_installer.log

Filesize
21KB

MD5
a598820ce579e9ff4754019405a80719

SHA1
56f848177d349681b547f08970da02cd27ebada1

SHA256
5aa8e6781f7618541b9f784bc9d4bdeb397d4cfd4bad12924385d4742236ef71

SHA512
763c249af133c70aef905b72722ed54eb8860693266725599f5dfec942d9cdf9214dbd06d428892f707c70fad6ea36ac267fedd7205803434b8e712a6b55a72a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
4170cdc8dedfafad041b5f3add6683ba

SHA1
5160736bccb034e72ca13524f29a9185b3c1adb9

SHA256
c51fd56f0c85175d2181db63b0562bfdf03c7226d8d2b90bb9c38656284f694e

SHA512
0df03027f8e60075574888eff9ffdb1a9b113ea0a6f5c3eef4562373dd3ea194d1584b5d0041db6377b509af114fe8568a042555821b8a1d0e9100e9f12ce395

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
fb3efecc0e4317d38d3b00b07e82f790

SHA1
4e84fae0b6bb4779646ce951c834d808d288cda9

SHA256
252642742d31ed953f237f17c58fd5f1277ab085ca6e5a390cdb4303fb4d760e

SHA512
086f31e9c28254ef8d03ce3a7556c538e7ae66374a92e41b61fb38c3921f2001412d91dba4bf997776b3316dd5e31d6d3aa180aa73e943374a9ed42085d9a53b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
4908c62da562f00892e07fddff0c7cfd

SHA1
6e36927bcaf03764bb3a737a49a51d814c5a9496

SHA256
6ab87c701ef5421070cbe96ec30f39479bca691b909631f3348249528137e1c6

SHA512
e34fcbd20a4580a6fc6a22f11a740c351d7626b3d676129e6f1c3798230e895a51bc68c0409e36b87bd33da966acc93ba7e90050378923402a760c955b6f8735

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
87dec5d9071c7d735144aabd713b4065

SHA1
90ce2f77ef8d0489e3dceda0060f51092372a45d

SHA256
8624bbd8c9a5c7b23bfbe108194b0e9d13f7a409f04ab534b4e789f020ddd909

SHA512
0abe65abf287b865199c781ececcea9d811ae034d159b77140f1add00f3ff16b0df30a96cd51fea7d76f220fc4df895a0228bfe7d01263574cc6ed6d06fab749

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
29f01f9d757ae8761c9582f00e985edc

SHA1
af4d1c5dbd22ceeaeaae3451b1aa269b04f559c9

SHA256
7228af67e44f47d8f37e78f9bc24d2ad40e6ed838d1f1638c81e4549a1937bc2

SHA512
90d8442dc032641018208e758e2da393ded606017c13ecced438753335eea4ebd4dff7a04f4b0e80b26375836c843ffb0ef1cae9eceee9172c20db51ffa7c085

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
183KB

MD5
6804e722523a119dd361fb45db29b890

SHA1
c5eda2c38d3bffad1ff6a473449100b5166a2f8b

SHA256
0c5ff03e6073e643f8185d0ac1ce6b741507b115287084b9266edfb2d2d497bc

SHA512
3cab23a49971c46b6bf61b64e91abc780ddde7362b473b94986ee858db5d74312ce3624e7bb2bf29f7033be73ede582b530192000a6194fd875b1485720b2df0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
a0d8bec921688e8c8e56166bda7e5c29

SHA1
26ee780c5a9ea44d246404d05f3d084e97875099

SHA256
ba483105acc24d3e7c9a829a3413ae93df0278184afc250720a826e06b08650b

SHA512
40f291018dbc10566bec21fa75b8cd722c23994d66887e8da09c092938b6847bbc44eee49800a2280862a97a19f2251175092a68b1ec8c1aa6a7abeecfdc0c0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
3d0402a6a6633df53ca3b7a4922fddf8

SHA1
ff53141b9d3a6086d6b2eb3c352aa71b5be54cd7

SHA256
27aa0d6eeec6bb59a5552f13658553b1f2d2cd48a9d5fe214f5574cbf7e84650

SHA512
009a4ef0008e7d45cd64d30e359a9cad39c256b9b834490467ae2c1479bf25adfc83ded0a56c65cf1f3e4ad2791162a8929e60f3a370fb8a7fa3c0ec22d99104

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
183KB

MD5
46199cb87edd9e5002ed87ec58f3b9b0

SHA1
41d08af5e31e401e670e55d762a848ffee55e3c1

SHA256
73830f1ffcc612129b82bdeddee617d99d87ab950cf699ff2e7e7f83f27b54d5

SHA512
6e192c21c4baba0b126588438757ec6b6e457d9a6467b9c8af62f9c2d818be7eab19015e01adbce25548cac28bdbe8740810c30972a7183be4c18eb09fc19e18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WNbYFhazBDJx.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
C:\Windows\Installer\e57c534.msi

Filesize
19.6MB

MD5
60c37ac65e53ba837822c42debbccb21

SHA1
53dcb7a068ef330bf7b685128b1ed62004ec848a

SHA256
4919a15c3de7bcc2b79073d559909837caac6ef0a732cf3c6dfcc162b0e678eb

SHA512
1ef5b8b017857a8208392db2d9a9723163167313f818b35db82fadd361a61759a981fcc8b334937b34add3a086f06f3bb62019fbdc0553240654d0c232a0170e

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
6bda7739b5a02d602a69eae2fa78f1b7

SHA1
d5c26a34b19a8a770b7ad17aa79b013ded2f636a

SHA256
e21361dc4840e8f31e1bd315d3a3e0acf36bb2677708dc021f1ca5fd7e0d224b

SHA512
e3ba295c5707cc7dde7e642756f5be9dc6cf0ddd3dc17376a9d9d9105eb27316e327760994771f0e096705530fb4b5b127c50a8aefe8a638924c4a0f43636cd5

Download Submit
\??\Volume{8484aac9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{de4044e0-7e69-4b6d-97e6-bf01b14a37c9}_OnDiskSnapshotProp

Filesize
6KB

MD5
4701f9bd14546a7a8b8812bc25617d42

SHA1
6d2b356a58c2157c2e828d7d074e8f04fa384f1f

SHA256
88247d676090bc2cd23b5465e2a9311c102162ed0951ffd98e17775cbbedc9e0

SHA512
d183e6c97032c6c61633c1fc79ecc60423629d6c574eb392751b06650e5e6be5b7fae4372830b1c1e4329fe37bce023943c1e0fd8de0198cb3d70426a831c5e1

Download Submit
memory/1596-153-0x000000002B750000-0x000000002B90B000-memory.dmp

Filesize
1.7MB

Download
memory/1596-134-0x000000002B750000-0x000000002B90B000-memory.dmp

Filesize
1.7MB

Download
memory/1596-133-0x0000000029A00000-0x0000000029A43000-memory.dmp

Filesize
268KB

Download
memory/1912-66-0x0000000000580000-0x0000000000656000-memory.dmp

Filesize
856KB

Download