gh0strat | 536024eb83741570d957775695d977793c6eb1dfa1229ffe14342943e5be9e85

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChromeSetup_2.msi
Size

20.3MB
MD5

d2dfcd8a7f448d9f4fda391c2db85681
SHA1

c0b17f94163e1d9220f574ce3dc1221cecacc018
SHA256

536024eb83741570d957775695d977793c6eb1dfa1229ffe14342943e5be9e85
SHA512

8ab31b75814743baf84455d00d5447a1eabbfeef500bf418487716378ff5f4eba14dfe3d36ed37d6299158f4fb2833236e0ce7fc0b85b7c5c17c9ad9c4402578
SSDEEP

393216:iQ0Frf5krXSujsfipBNG4P6SziFEzLi9rBXTMbickIY6W1aeIlrbDhdwdhG/hPAe:iQ05JQs6pGfSoELqrBXTMGcju12fDPwW

Score

10^/10

gh0strat purplefox discovery evasion persistence privilege_escalation rat rootkit spyware stealer trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 3 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/4508-132-0x000000002B6A0000-0x000000002B85B000-memory.dmp	purplefox_rootkit
behavioral2/memory/4508-134-0x000000002B6A0000-0x000000002B85B000-memory.dmp	purplefox_rootkit
behavioral2/memory/4508-150-0x000000002B6A0000-0x000000002B85B000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/4508-132-0x000000002B6A0000-0x000000002B85B000-memory.dmp	family_gh0strat
behavioral2/memory/4508-134-0x000000002B6A0000-0x000000002B85B000-memory.dmp	family_gh0strat
behavioral2/memory/4508-150-0x000000002B6A0000-0x000000002B85B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\129.0.6668.89\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	LyHdRfaUXB12.exe
File opened (read-only)	\??\R:	LyHdRfaUXB12.exe
File opened (read-only)	\??\V:	LyHdRfaUXB12.exe
File opened (read-only)	\??\X:	LyHdRfaUXB12.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	LyHdRfaUXB12.exe
File opened (read-only)	\??\T:	LyHdRfaUXB12.exe
File opened (read-only)	\??\S:	LyHdRfaUXB12.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	LyHdRfaUXB12.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	LyHdRfaUXB12.exe
File opened (read-only)	\??\W:	LyHdRfaUXB12.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	LyHdRfaUXB12.exe
File opened (read-only)	\??\L:	LyHdRfaUXB12.exe
File opened (read-only)	\??\Z:	LyHdRfaUXB12.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	LyHdRfaUXB12.exe
File opened (read-only)	\??\Q:	LyHdRfaUXB12.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	LyHdRfaUXB12.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	LyHdRfaUXB12.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	LyHdRfaUXB12.exe
File opened (read-only)	\??\Y:	LyHdRfaUXB12.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	LyHdRfaUXB12.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	LyHdRfaUXB12.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	LyHdRfaUXB12.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xPVvDzTmMXBf.exe.log	xPVvDzTmMXBf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_058F778FC8346DE378B15A5652BAADD9	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_058F778FC8346DE378B15A5652BAADD9	updater.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\bn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\hi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\id.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\kn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\ru.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\sw.pak	setup.exe
File created	C:\Program Files (x86)\Google2104_1569459742\updater.7z	ChromeSetup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\chrome.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\dxcompiler.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\hr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\hu.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\sk.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\VisualElements\SmallLogoBeta.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\chrome.VisualElementsManifest.xml	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\CR_61746.tmp\SETUP.EX_	129.0.6668.89_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\pt-BR.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe57b6fc.TMP	updater.exe
File opened for modification	C:\Program Files\chrome_installer.log	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\da.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\el.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\ms.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\chrome.dll.sig	setup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File opened for modification	C:\Program Files\PlanAdvocateClever\LyHdRfaUXB12.exe	lqxQEcVCcklQ.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\optimization_guide_internal.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\vulkan-1.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\lt.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe5864df.TMP	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\544c3dcf-90be-439f-ac09-ac080115de12.tmp	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\CR_61746.tmp\setup.exe	129.0.6668.89_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\VisualElements\LogoBeta.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\te.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\VisualElements\SmallLogoCanary.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\chrome_elf.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\libGLESv2.dll	setup.exe
File created	C:\Program Files (x86)\Google2104_1569459742\bin\updater.exe	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\ko.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\chrome.exe.sig	setup.exe
File created	C:\Program Files\PlanAdvocateClever\ChromeSetup.exe	msiexec.exe
File created	C:\Program Files (x86)\Google2104_1569459742\bin\uninstall.cmd	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\notification_helper.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\vk_swiftshader.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Application\129.0.6668.89\Installer\chrmstp.exe	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\411c0069-eb2d-4245-bb82-0f4df0c4c1f4.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\a58120e4-df69-4382-881f-0ef01dabb3fa.tmp	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\_metadata\verified_contents.json	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\CR_61746.tmp\CHROME.PACKED.7Z	129.0.6668.89_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\bg.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source312_431533352\Chrome-bin\129.0.6668.89\Locales\sv.pak	setup.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D0A2D50F-2025-403A-88FC-60D986066527}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA613.tmp	msiexec.exe
File created	C:\Windows\Installer\e57a4be.msi	msiexec.exe
File created	C:\Windows\Installer\e57a4bc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57a4bc.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 36 IoCs

pid	Process
3996	lqxQEcVCcklQ.exe
3352	LyHdRfaUXB12.exe
2104	ChromeSetup.exe
5064	updater.exe
3288	xPVvDzTmMXBf.exe
4428	updater.exe
4532	updater.exe
764	updater.exe
4988	updater.exe
4420	updater.exe
4728	xPVvDzTmMXBf.exe
224	xPVvDzTmMXBf.exe
4332	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4344	129.0.6668.89_chrome_installer.exe
312	setup.exe
3200	setup.exe
4576	setup.exe
3432	setup.exe
888	chrome.exe
5032	chrome.exe
692	chrome.exe
3256	chrome.exe
4504	chrome.exe
4696	chrome.exe
4552	chrome.exe
4312	elevation_service.exe
1148	chrome.exe
1856	chrome.exe
5144	chrome.exe
5188	chrome.exe
5248	chrome.exe
5316	chrome.exe
5540	chrome.exe
5968	updater.exe
5984	updater.exe

Loads dropped DLL 33 IoCs

pid	Process
888	chrome.exe
5032	chrome.exe
888	chrome.exe
692	chrome.exe
3256	chrome.exe
3256	chrome.exe
4504	chrome.exe
692	chrome.exe
4504	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
4552	chrome.exe
4696	chrome.exe
4696	chrome.exe
4552	chrome.exe
692	chrome.exe
692	chrome.exe
692	chrome.exe
1148	chrome.exe
1148	chrome.exe
1856	chrome.exe
1856	chrome.exe
5144	chrome.exe
5144	chrome.exe
5188	chrome.exe
5188	chrome.exe
5248	chrome.exe
5248	chrome.exe
5316	chrome.exe
5316	chrome.exe
5540	chrome.exe
5540	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4820	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LyHdRfaUXB12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LyHdRfaUXB12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lqxQEcVCcklQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LyHdRfaUXB12.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4344	129.0.6668.89_chrome_installer.exe
312	setup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000082ad35faf8c7b7730000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000082ad35fa0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090082ad35fa000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d82ad35fa000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000082ad35fa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LyHdRfaUXB12.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LyHdRfaUXB12.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\neajdppkdcdipfabeoofebfddakdcjhd = "6396195A7CA254279A65167156D4C2964CDEA5AC9ED5CBA7E4ED8442EA66A3B6"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\prefs.preference_reset_time = "3B55CD90837996C1E9193E796103586544C609D686D0549A4D4E027BE860FD38"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\StabilityMetrics\user_experience_metrics.stability.exited_cleanly = "0"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\module_blocklist_cache_md5_digest = "8051CCB91D16C491166EB58A45DE0A3458118402144C069C45A304BED182D530"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\session.restore_on_startup = "274F7666EA42108127452F2CD739A4BA0E369817CFDB8F180558CCAA016267B5"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\enterprise_signin.policy_recovery_token = "14BEF56DE0277790AA4FA497EEFD06B992EF7D99076408CEED2857E07B672BFA"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\state = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133724107074588844"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\Extensions	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nkeimhogjdpnpccoofpliimaahmaaome = "94A424A6AE761BE4EF51091BA85619BE9CEAB0A294F5DE202523C995BDBE6E89"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi = "2D22BB09D9244779219CE623910E9A784D85E56A67A0433F93A88737D5EAA325"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\default_search_provider_data.template_url_data = "B2DBD6B8C7EFAD3A4CC47F03B235688B7E567EE9E78826232BD34D94EE5471B2"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\safebrowsing.incidents_sent = "F4D96C4D6C36690822B6ED40782931F1D15A51EFFECA33416136CEE1508B86AD"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\version = "129.0.6668.89"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\pinned_tabs = "C0DE541A023AE19720040E5AE1E577A2B0094CDD063CE8EC929CEE9C04A93734"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\search_provider_overrides = "2872EA996D8EB7336E90BB22CCD377D6D620E8571D69501BB12764FBF805C739"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.account_id = "4159F4029358507FEC9D1EFDD9689A50F2C1FC3EAE96B0C69BAC3E36F164323B"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\UsageStatsInSample = "0"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F05D2A0D5202A30488CF069D68605672	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{CCA9FC90-B200-5641-99C0-7907756A93CF}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\TypeLib\ = "{85AE4AE3-8530-516B-8BE4-A456BF2637D3}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{CCA9FC90-B200-5641-99C0-7907756A93CF}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\TypeLib\ = "{1588C1A8-27D9-563E-9641-8D20767FB258}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ = "IGoogleUpdate3Web"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\ = "IPolicyStatusSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CCA9FC90-B200-5641-99C0-7907756A93CF}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{CCA9FC90-B200-5641-99C0-7907756A93CF}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8A4B5D74-8832-5170-AB03-2415833EC703}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\ = "IPolicyStatus2System"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4DC034A8-4BFC-4D43-9250-914163356BB0}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatusValueSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib\ = "{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ = "IGoogleUpdate3Web"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8A4B5D74-8832-5170-AB03-2415833EC703}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4334319-8210-469B-8262-DD03623FEB5B}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CCA9FC90-B200-5641-99C0-7907756A93CF}\TypeLib\ = "{CCA9FC90-B200-5641-99C0-7907756A93CF}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4}\LocalService = "GoogleUpdaterService128.0.6597.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2524	msiexec.exe
2524	msiexec.exe
3352	LyHdRfaUXB12.exe
3352	LyHdRfaUXB12.exe
5064	updater.exe
5064	updater.exe
5064	updater.exe
5064	updater.exe
5064	updater.exe
5064	updater.exe
4532	updater.exe
4532	updater.exe
4532	updater.exe
4532	updater.exe
4532	updater.exe
4532	updater.exe
4988	updater.exe
4988	updater.exe
4988	updater.exe
4988	updater.exe
4988	updater.exe
4988	updater.exe
4988	updater.exe
4988	updater.exe
224	xPVvDzTmMXBf.exe
224	xPVvDzTmMXBf.exe
4332	LyHdRfaUXB12.exe
4332	LyHdRfaUXB12.exe
4332	LyHdRfaUXB12.exe
4332	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe
4508	LyHdRfaUXB12.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4820	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4820	msiexec.exe
Token: SeSecurityPrivilege	2524	msiexec.exe
Token: SeCreateTokenPrivilege	4820	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4820	msiexec.exe
Token: SeLockMemoryPrivilege	4820	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4820	msiexec.exe
Token: SeMachineAccountPrivilege	4820	msiexec.exe
Token: SeTcbPrivilege	4820	msiexec.exe
Token: SeSecurityPrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeLoadDriverPrivilege	4820	msiexec.exe
Token: SeSystemProfilePrivilege	4820	msiexec.exe
Token: SeSystemtimePrivilege	4820	msiexec.exe
Token: SeProfSingleProcessPrivilege	4820	msiexec.exe
Token: SeIncBasePriorityPrivilege	4820	msiexec.exe
Token: SeCreatePagefilePrivilege	4820	msiexec.exe
Token: SeCreatePermanentPrivilege	4820	msiexec.exe
Token: SeBackupPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeShutdownPrivilege	4820	msiexec.exe
Token: SeDebugPrivilege	4820	msiexec.exe
Token: SeAuditPrivilege	4820	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4820	msiexec.exe
Token: SeChangeNotifyPrivilege	4820	msiexec.exe
Token: SeRemoteShutdownPrivilege	4820	msiexec.exe
Token: SeUndockPrivilege	4820	msiexec.exe
Token: SeSyncAgentPrivilege	4820	msiexec.exe
Token: SeEnableDelegationPrivilege	4820	msiexec.exe
Token: SeManageVolumePrivilege	4820	msiexec.exe
Token: SeImpersonatePrivilege	4820	msiexec.exe
Token: SeCreateGlobalPrivilege	4820	msiexec.exe
Token: SeBackupPrivilege	5024	vssvc.exe
Token: SeRestorePrivilege	5024	vssvc.exe
Token: SeAuditPrivilege	5024	vssvc.exe
Token: SeBackupPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeBackupPrivilege	64	srtasks.exe
Token: SeRestorePrivilege	64	srtasks.exe
Token: SeSecurityPrivilege	64	srtasks.exe
Token: SeTakeOwnershipPrivilege	64	srtasks.exe
Token: SeBackupPrivilege	64	srtasks.exe
Token: SeRestorePrivilege	64	srtasks.exe
Token: SeSecurityPrivilege	64	srtasks.exe
Token: SeTakeOwnershipPrivilege	64	srtasks.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4820	msiexec.exe
4820	msiexec.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe
888	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 64	2524	msiexec.exe	87
PID 2524 wrote to memory of 64	2524	msiexec.exe	87
PID 2524 wrote to memory of 2160	2524	msiexec.exe	89
PID 2524 wrote to memory of 2160	2524	msiexec.exe	89
PID 2160 wrote to memory of 3996	2160	MsiExec.exe	90
PID 2160 wrote to memory of 3996	2160	MsiExec.exe	90
PID 2160 wrote to memory of 3996	2160	MsiExec.exe	90
PID 2160 wrote to memory of 3352	2160	MsiExec.exe	92
PID 2160 wrote to memory of 3352	2160	MsiExec.exe	92
PID 2160 wrote to memory of 3352	2160	MsiExec.exe	92
PID 2160 wrote to memory of 2104	2160	MsiExec.exe	93
PID 2160 wrote to memory of 2104	2160	MsiExec.exe	93
PID 2160 wrote to memory of 2104	2160	MsiExec.exe	93
PID 2104 wrote to memory of 5064	2104	ChromeSetup.exe	94
PID 2104 wrote to memory of 5064	2104	ChromeSetup.exe	94
PID 2104 wrote to memory of 5064	2104	ChromeSetup.exe	94
PID 5064 wrote to memory of 4428	5064	updater.exe	96
PID 5064 wrote to memory of 4428	5064	updater.exe	96
PID 5064 wrote to memory of 4428	5064	updater.exe	96
PID 4532 wrote to memory of 764	4532	updater.exe	99
PID 4532 wrote to memory of 764	4532	updater.exe	99
PID 4532 wrote to memory of 764	4532	updater.exe	99
PID 4988 wrote to memory of 4420	4988	updater.exe	101
PID 4988 wrote to memory of 4420	4988	updater.exe	101
PID 4988 wrote to memory of 4420	4988	updater.exe	101
PID 224 wrote to memory of 4332	224	xPVvDzTmMXBf.exe	109
PID 224 wrote to memory of 4332	224	xPVvDzTmMXBf.exe	109
PID 224 wrote to memory of 4332	224	xPVvDzTmMXBf.exe	109
PID 4332 wrote to memory of 4508	4332	LyHdRfaUXB12.exe	110
PID 4332 wrote to memory of 4508	4332	LyHdRfaUXB12.exe	110
PID 4332 wrote to memory of 4508	4332	LyHdRfaUXB12.exe	110
PID 4988 wrote to memory of 4344	4988	updater.exe	115
PID 4988 wrote to memory of 4344	4988	updater.exe	115
PID 4344 wrote to memory of 312	4344	129.0.6668.89_chrome_installer.exe	116
PID 4344 wrote to memory of 312	4344	129.0.6668.89_chrome_installer.exe	116
PID 312 wrote to memory of 3200	312	setup.exe	117
PID 312 wrote to memory of 3200	312	setup.exe	117
PID 312 wrote to memory of 4576	312	setup.exe	119
PID 312 wrote to memory of 4576	312	setup.exe	119
PID 4576 wrote to memory of 3432	4576	setup.exe	120
PID 4576 wrote to memory of 3432	4576	setup.exe	120
PID 5064 wrote to memory of 888	5064	updater.exe	122
PID 5064 wrote to memory of 888	5064	updater.exe	122
PID 888 wrote to memory of 5032	888	chrome.exe	123
PID 888 wrote to memory of 5032	888	chrome.exe	123
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124
PID 888 wrote to memory of 692	888	chrome.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ChromeSetup_2.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4820

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:64
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 35D7472158AB350B2929087219A5A74B E Global\MSI0000
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Program Files\PlanAdvocateClever\lqxQEcVCcklQ.exe
    "C:\Program Files\PlanAdvocateClever\lqxQEcVCcklQ.exe" x "C:\Program Files\PlanAdvocateClever\EcBLXJNedSQEOiEUagbC" -o"C:\Program Files\PlanAdvocateClever\" -pIMjRYIJMzCylrwsUsHNz -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3996
- - C:\Program Files\PlanAdvocateClever\LyHdRfaUXB12.exe
    "C:\Program Files\PlanAdvocateClever\LyHdRfaUXB12.exe" -number 254 -file file3 -mode mode3 -flag flag3
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3352
- - C:\Program Files\PlanAdvocateClever\ChromeSetup.exe
    "C:\Program Files\PlanAdvocateClever\ChromeSetup.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Program Files (x86)\Google2104_1569459742\bin\updater.exe
      "C:\Program Files (x86)\Google2104_1569459742\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={FD39FE3E-F972-AC55-37EA-CE3FED473068}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\Program Files (x86)\Google2104_1569459742\bin\updater.exe
        
        "C:\Program Files (x86)\Google2104_1569459742\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xfec694,0xfec6a0,0xfec6ac
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4428
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        5⤵
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:888
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=129.0.6668.89 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba15d7bf8,0x7ffba15d7c04,0x7ffba15d7c10
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5032
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1976,i,11404377849818001395,10883167022918327280,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:692
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=2200,i,11404377849818001395,10883167022918327280,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:3
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:3256
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2348,i,11404377849818001395,10883167022918327280,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4504
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,11404377849818001395,10883167022918327280,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4696
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,11404377849818001395,10883167022918327280,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4552
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4164,i,11404377849818001395,10883167022918327280,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:1148
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4420,i,11404377849818001395,10883167022918327280,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:1856
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4808,i,11404377849818001395,10883167022918327280,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5144
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4896,i,11404377849818001395,10883167022918327280,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5188
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4140,i,11404377849818001395,10883167022918327280,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5248
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5044,i,11404377849818001395,10883167022918327280,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5316
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5068,i,11404377849818001395,10883167022918327280,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5540

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Program Files\PlanAdvocateClever\xPVvDzTmMXBf.exe
"C:\Program Files\PlanAdvocateClever\xPVvDzTmMXBf.exe" install
1⤵
- Drops file in System32 directory
- Executes dropped EXE
PID:3288

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xd0c694,0xd0c6a0,0xd0c6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:764

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xd0c694,0xd0c6a0,0xd0c6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4420
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\129.0.6668.89_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\129.0.6668.89_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\2ea1e441-ba26-40d9-a5d3-32fd8f91bcfd.tmp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\CR_61746.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\CR_61746.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\CR_61746.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\2ea1e441-ba26-40d9-a5d3-32fd8f91bcfd.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:312
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\CR_61746.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\CR_61746.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=129.0.6668.89 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff6e11c9628,0x7ff6e11c9634,0x7ff6e11c9640
      4⤵
      Executes dropped EXE
      PID:3200
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\CR_61746.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\CR_61746.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:4576
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\CR_61746.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\CR_61746.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=129.0.6668.89 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff6e11c9628,0x7ff6e11c9634,0x7ff6e11c9640
        5⤵
        Executes dropped EXE
        
        PID:3432

C:\Program Files\PlanAdvocateClever\xPVvDzTmMXBf.exe
"C:\Program Files\PlanAdvocateClever\xPVvDzTmMXBf.exe" start
1⤵
- Executes dropped EXE
PID:4728

C:\Program Files\PlanAdvocateClever\xPVvDzTmMXBf.exe
"C:\Program Files\PlanAdvocateClever\xPVvDzTmMXBf.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files\PlanAdvocateClever\LyHdRfaUXB12.exe
  "C:\Program Files\PlanAdvocateClever\LyHdRfaUXB12.exe" -number 295 -file file3 -mode mode3 -flag flag3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Program Files\PlanAdvocateClever\LyHdRfaUXB12.exe
    "C:\Program Files\PlanAdvocateClever\LyHdRfaUXB12.exe" -number 362 -file file3 -mode mode3 -flag flag3
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4508

C:\Program Files\Google\Chrome\Application\129.0.6668.89\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\129.0.6668.89\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5660

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:5968
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xd0c694,0xd0c6a0,0xd0c6ac
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57a4bd.rbs

Filesize
7KB

MD5
f2e574c73e0a8951b4fc60eccb07378a

SHA1
33352c21e7cfc8c9d8b4802a0ba5f1b10c9ca773

SHA256
bb2e6c6cf95d9febf414fded5bb0cd23d38ce8ad5f6a155d846787987f5a5834

SHA512
c3acc5da6fc03e777807c97a385a43f4b74d35af28c56985a509b776f7e301f88f73dc736c075a4a7c1ff62236c61861bdb4207d6f53d5268dd096df9854aa0b

Download Submit
C:\Program Files (x86)\Google2104_1569459742\bin\updater.exe

Filesize
4.7MB

MD5
823816b4a601c69c89435ee17ef7b9e0

SHA1
2fc4c446243be4a18a6a0d142a68d5da7d2a6954

SHA256
c2a7c0fa80f228c2ce599e4427280997ea9e1a3f85ed32e5d5e4219dfb05ddb2

SHA512
f3b38807ed1eb96c932e850b9b37551554408a628bedf12aa32bde08c442ff3663bf584335e7eab193ce2cf7552bce456737c96a2ba9faa953150e6304068fc6

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat

Filesize
40B

MD5
fdf77032c602367a0d9f686c0f8a9627

SHA1
1445d763f6c2c241f51f0702341b001441412f15

SHA256
f5241ed5cd0e191768d0e74798dd33fc151b13d8775de5295385ddb66e02d2a3

SHA512
57a28bbf9879dfbc97f7a0c55b1f33d48f4b0b0804dbf6592b7cf5f2fda44977dd4dd29c583d1f8826766eb2f3c6bd167535bf169f8b7842b8125ac1f7553e2b

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
511B

MD5
1ac086e1b672e91a1a864cbf321f147b

SHA1
c9783eebe61f09c72b9d57886a58b6e827bdaca0

SHA256
f0cb27b66176a45f2af17049dee269fa8fdf8559a0c2034b1d6f17222f70b364

SHA512
aa22e20ebd7556e6c2515bc59692053f0fdcab987a508034e923451cb373d657b2a67aeae2553057c3b6c4c8a4033474e358b15f5af035c1f626fa6c2bd5adaa

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
354B

MD5
d4927578fc92dc543365aa4e43b202ba

SHA1
5e1aeb950ac6ac3f071fa02f90a4fbc0c8e5304c

SHA256
4ac029c04a6e82f4c588237f57a798b4285c818bdbb4250c20f11a5b95d4ecd1

SHA512
4c6cbf4bfb4279edc6d6bd816ca4d1d4dbc8b7f06d875493ffeea3a8782568f49911db28aae743a41962bbe4fe34afc531e119be58888a2acf0623e99df38e95

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
610B

MD5
12a184ea793f8bc5a924f0d9e6e3dba6

SHA1
b6f0a2b7ce00e15c1420297b4ce0f70b3244d65e

SHA256
398c9ad40db4328b592bea0715d5f1d7b999d4ed788d025007f8b22bb3c98556

SHA512
26d362cf3f8cc29f3531f19caecc175cc03f1da5b55d81630732a22a33f7fd1423a30bc0756cb3e19b0f39ff282f38de375c8b92e05b525bac35004912fd371a

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
610B

MD5
9a425cf87eb833d54d9381f90b082589

SHA1
84cd277fc1bd7bc963598a1dc0976f7b19470a1f

SHA256
d2f971278872b04a1ae8bcd937a4ab336db48e53b615c5c2ff1709754fbf85e0

SHA512
d393cba07d7022fedc3a4bf3b3b2d9bf3262c77c06dca4faa768460c734abc2f8680a46669c3dd6ea6ed4be50621698044e9c4c5cf9a0e3bcd96d1bd14014b74

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
49B

MD5
7b693a82168c33ec9e8cf276859ddf7f

SHA1
d396dbbe299fe7754a6244d01e97cc4edd0693eb

SHA256
84a9a7f43db56cd6e9a408f88244e8ba5efbe48a5b5168d321f112b8c8fd8e3f

SHA512
4064c158d753d19a72e1be1c8bd5fe7f22e2032d67d1dd7ea1d85ce652d63c69b85a4292c4403b0f7729b05607f3d1ccfaf4d27d04ad09ffcec70082450320ab

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
a2dab142eca35989bb3211ba122c273a

SHA1
e454cac77dc96d8c814c54025fca33fd05f1251d

SHA256
0b5890b3e62a42b24b3ef1a3071272e7e7c910b52050754f36688ac4a3ddcb96

SHA512
cb00db4c06cbed049e822a094d240d790c7dc5eea3648a30eaa857ae6285aac5b50e2a64f79449117841c96a6b114004d5dc03897c37bb6334ea95ac5ab715f7

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
2KB

MD5
5575b5724f93d70036d9e658adff2b08

SHA1
8c25079b668fde03346ee8519734b1e5b60c590f

SHA256
c7ba8406a79177e5c24d9d0e083b90c965a3ae00fbe68aea7b11dd91dc8a409e

SHA512
2ce8be641c27db35ad4c46555764982ba5bee80806ccc30abc7ac82cfc09a8a6301aac532a0573f4f8e3bcdcc09c128e81baafca04e6d471b63e12c8dea11fbc

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
4KB

MD5
042c7d0c4d8b3b6ce164d45cf8e9db07

SHA1
7c25f1bcf640633ba1a6e1c3bfa43aad3172628a

SHA256
fea0d97a47e3b643bdd1adc816dff7befee732c084774c6e49da57a92e4f1051

SHA512
3eb7684ff8b2b96a293c5eb859c90775087413de19bcdfb5b69fe03fa4295b92457010fca05f63ae64be492f37b20a9861221364f08d451867f4aab2295d5f2f

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
5KB

MD5
b90e92338af85d211f48712578e6f85d

SHA1
8ebea8fb385efd8b6e708315c8781fa1d165105b

SHA256
7aad48945314561bae959847f4725aeb3b7390812a5212b8d98fc7c978be2fa7

SHA512
15ca8790eaa73f2777d2a846018013616e9b4ac137ba5fc9c30920c7e9554a647c1a3afcade2da78e9e118b49c4ed0360c51de03112495f440ddb77f1c3e1f38

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
9KB

MD5
9d79653c224efd18a78d4194c68c5d77

SHA1
cec372dff537dca84c46b3878016aab33fe6abbc

SHA256
93884deb1dcf80d14d056c4068889096bb27ac03b0aa905fcd1241788cfa55be

SHA512
015bc64d0220de5e8469d0c806f4e32127eb223ff6ea891401788ed3e80108ba0bc4f286d555d2a45f8caabc80e432a32d3864ff99e18cd069908bb7c4efa10a

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
10KB

MD5
4d0daf2e0a1157ceb93c6a80f7952c27

SHA1
c4aadd84a05cb5524ea33b2c64797febda40a7d8

SHA256
6a1fb1ce3d854ea8d6d292936401b87cf57ff03a53cc31db582fa7e9b07a4261

SHA512
e060a1fb3de6523164b6ca3305eae27684c9641cc03ab1f599c48ddc4f15ba6d74eb13902219f2751833c39d04bc1c872b60eb16381db93a77ed63ca0b502e3a

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\2ea1e441-ba26-40d9-a5d3-32fd8f91bcfd.tmp

Filesize
679KB

MD5
377a006e7c7726b6f2a3f057b485cdec

SHA1
b6e9b7779e660cc534ac79b02e2f12a7a2665ea4

SHA256
43743afc098fc8a26bb0348077ac0c4b6dde20ce3dfb886be530a9bc9a80fe91

SHA512
e4be802a4dfd2c60150ac4b6690634e0b5ee8729bdd13fc9641cccb01b1fcf55ad114e36cefe25b712d1e7a77a35207e6d989928b9aa1ebb15c58ba964598ddc

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4988_672562690\CR_61746.tmp\setup.exe

Filesize
5.8MB

MD5
b63e115a4f33267f7a305fe7872e97dc

SHA1
ddb5b122346a51959d12b1238cfa04fab4c8245c

SHA256
1b667499dbd68d571230bc1d064e92fd37d2326f7794da6c1418235ea723c918

SHA512
a202ada99933eb5164bc910e339ce41d8013155abd25e408dfcb37ea0a401b83c881573b571df2619d076d41e244e35d4ff6f40d5973317aa211d3549818adc0

Download Submit
C:\Program Files\Crashpad\settings.dat

Filesize
40B

MD5
1f29661577d73d34562cfa83922a8705

SHA1
8c5d38f6eb3813c1d1150017f05f8930e61c0094

SHA256
190e8f98579bece07125bca4c381358033766dc5aca06dd0b282442b814add69

SHA512
ab47ef3d1cf83ab70da597184f518480440048635a9915065f76fc98c6aeaecd75c5f27319c9dc224625a8534c230303cd0a2844a07c892ab30f331438b64f3a

Download Submit
C:\Program Files\Google\Chrome\Application\129.0.6668.89\chrome_elf.dll

Filesize
1.2MB

MD5
61bc08ad1de19460a3cee27c5fa424c9

SHA1
ca60bf1702e9a9030936224571be9bb2f2c51273

SHA256
ec27f9daf2c120ab05020d0dcb43706bb4e6e501e0d82331e533abb13555f0c4

SHA512
b045ee342a627b33bc5d30f3fc4ed25ccd90d8ed48c3ed72ba383648a72bed2a3b6218df2ea5388ad4a0b75013b23df6216a20fa0b0055e55eec09fd6264e40e

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.6MB

MD5
a09827d40b13f9de3eb0ba4b143cfaf8

SHA1
c62e1d8fea6b7e1acadddee923d7ac5d9baa5c48

SHA256
e64bde7c7360c1988651c7d54649de922f68db7601faad170eb3b75bf3b024a5

SHA512
0a782648cbf480042d8b3bad213e980bdc5aa0b16c3f12f0a4491e7ba5760250d4f8662d10ea2f961490090032b9b0800352c9730975c2d06be17d0bc6df7aea

Download Submit
C:\Program Files\PlanAdvocateClever\ChromeSetup.exe

Filesize
8.5MB

MD5
5adff4313fbd074df44b4eb5b7893c5e

SHA1
d27388ef6cf34d40e0e7666f6381fcc5bbafa0f7

SHA256
d0c7a4390bdd6b442b96fc76f8a38f7b756ba2c16752ea259844420161865cae

SHA512
f5d639922b91878cf83d97563288a3aa4cba94db3ad5e8ac11d24ef7c44b019383a4414aeba6171b4c7bfa83ea1eafc1231cc9233e3b82b5ca7dc0b3ffacbf60

Download Submit
C:\Program Files\PlanAdvocateClever\EcBLXJNedSQEOiEUagbC

Filesize
1.6MB

MD5
f18bce457864e2f216a507df7321bc13

SHA1
641e40ff6e4fae726c824aace73e315f1beeb7af

SHA256
b9495b48cb28ac87b62fc27b54302f9ffcfa9ddc38146b1f974de76133fcf65c

SHA512
99b1f6d6815f7109a5579cfaf120964b7fe6c18cc5797f280571f06a476834acc9dcd4bfe2eb01aafa85b0018a1db713f92a4cd081b337f3cc973618d676e2b4

Download Submit
C:\Program Files\PlanAdvocateClever\LyHdRfaUXB12.exe

Filesize
2.8MB

MD5
e274e2b9cafc75fc874aa56a40f2f20b

SHA1
be492f85fa47422e0dea88ef38e87670ca698fa4

SHA256
d464844275663ca56a44d42a9401af0193f94fc82b559e71d8333926fa304424

SHA512
11c482e066678791ba98a8ce1e016aab8ab6a15864d63137f439a445721e3a802095b42e0069677ee7b6892423a3f0bbbfe934ff177866924646053cd799463b

Download Submit
C:\Program Files\PlanAdvocateClever\lqxQEcVCcklQ.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Program Files\PlanAdvocateClever\xPVvDzTmMXBf.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\PlanAdvocateClever\xPVvDzTmMXBf.wrapper.log

Filesize
266B

MD5
6b21e4b11f9be39acc6644ecc0f91e9e

SHA1
8d38dc8df806cb4006ac51e5520eec30a6581536

SHA256
83adca57607720d040567fd24ac2e4b146beb7e5f0d588e7b67653b98874c906

SHA512
d71df300b73d9e1c5e7b4f760a78f2c39a306b8f020fd9f44bb2b214c0ad7e306ef82d1ded007671a326d460700f51b462d9eb495a8d7117405c981000388bcb

Download Submit
C:\Program Files\PlanAdvocateClever\xPVvDzTmMXBf.wrapper.log

Filesize
422B

MD5
af1702a5967aaf7134862d1dce73e778

SHA1
3ca04d04f12d2b40bb9c39348a6c1016e432749f

SHA256
23740a54245f4fe2012f14791967e00b90289d7998366f1deafb03b07148a31d

SHA512
fdcc64f1974126ce6ba5412b5f76f3b4cc69c4d5be16859991f15871d8074fc0e23600aab319d3aa3114610d6adeb53c92dcb260020ad64aab0aa16701b281f3

Download Submit
C:\Program Files\PlanAdvocateClever\xPVvDzTmMXBf.wrapper.log

Filesize
486B

MD5
0fcc63c879d34f9753626b2f9d4eee7f

SHA1
597010142a96df02c95891ceeb4a11ac27e858f8

SHA256
3f7be87dd2c7fb397cc34d0477c558fb5ac8032d6894509b28647dfedba5079f

SHA512
1e12ea045919e6a8168acd38371a5ba8f91ba034c7a44516623729b99ba29c9fa48697cb1482e67db2971819c500e6060259e4ca30805b0929899ad1c7894323

Download Submit
C:\Program Files\PlanAdvocateClever\xPVvDzTmMXBf.wrapper.log

Filesize
731B

MD5
8c1f81090a0988d0b9aa2bc8978e8268

SHA1
1ccf75d7ddd8390a2a0a98e99340639ed20304c1

SHA256
0dc7e43108614c22272ee1fd917ecff7da48ad5328a6f2bc7a96f5bdd93e6b4d

SHA512
cc6f6f7f26266f63818daddb24d9d0bfbbaae6b566e117695df725d948fef62be4ebc025da888789fcfc19215c1587b7f43f148d06d05506ba3e741099e4a059

Download Submit
C:\Program Files\PlanAdvocateClever\xPVvDzTmMXBf.xml

Filesize
436B

MD5
5bffa92db8da445437d490ae489be34e

SHA1
d2325cfb7e9096dd96873afe98f517082484fbae

SHA256
e53570f27f4958e35b731913747ef590bd68d5c2df3a86f2901db59bdf8a2cbe

SHA512
0571272d9e637ee94c5cd6a99431247a8e5227757c25941bd2fda2011b7f860597c56754159727d791b5b07833775d909954326a4a7ccb0c128a07452d622454

Download Submit
C:\Program Files\chrome_installer.log

Filesize
21KB

MD5
a14906da518c9e2300bae440f9128541

SHA1
48dacabf6abdf9aa9bc835355a1b63d4d9686534

SHA256
058e9970e1557e48130ef5faa2bd82ae8e7ac25d39a301138fef797d2143a0a3

SHA512
0281d73a08d49836ffff22af588c7f509690500587a76cc1765465cd994a500b30c51683f7b0075e542b633d696a55b0a4bd3ccbe0f0327e69bc5386f1b619bc

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

Filesize
2KB

MD5
bf8740c6299292e8f19f9e7407910aaf

SHA1
ac2b4aecc0f2fdb0ff89c9424e96dbd163c54334

SHA256
0d4ed8ec90dfbbc103b60934a376691fddf221edbc252aeccfe67581d06568f0

SHA512
4a84a9c096f2ec4771bf00a818408b765263909b1bb18e07e8371032c5519da4cf4eb65dbb1a9577ce3fbbd9be5938b8a0cebeb480d5b28dfc017796a990181a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
f7ac1da44a86e6c621bfda9f4d1121e0

SHA1
18fe2e89eddedc63c1be6abae8091c24632a31d2

SHA256
ed67eccc0d5755835a67d6a4d0caa91831da80ab47eb385d7466a12a1ae4342c

SHA512
627a7d4fe3b5d060bbbdd92e6d2b52c0faa719b8fda63665b22581ddabfb674e08a9f4bc46581bdaef2f98cf5a8b5055ee296fdd13b707c1c68fd3652c7152a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
7ea07b29fcb58bf8db1f2548497e1838

SHA1
ad7c4787be9e6800747daa3bc24d8c91e529391b

SHA256
3dfc223a9976f200075c6e79ebfae4acdcc9b345b753be75f9195e00a5a96523

SHA512
cd739c1e438998b2da203deddc41c901026e636bf4e723ae03fb6558deda3544cf58d19cb53fc4d381b6b1cadcb58a159af8cdf7b4c116d375fb61693b23e173

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
b8d5aa5a899a16416c90be1db32b3a11

SHA1
6038e9a259606234042cfbc4c7487860611b69cb

SHA256
fab0cf705165530549f8e160bd403fa26cb6e26886c5ebec0803479df2d6fcb3

SHA512
f212921e335885e4a925687692663b1807727336ccda3af00dc448397e0b6c4c56e060d112643eef89531c516f3649caf918d6ba4bbff0c19bd0e090445afe4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
58f88ca59e43b73c703ff1fd509b3292

SHA1
883f3d18a2bb6d8d789f7df5b04590dae44da48a

SHA256
9bf3fedab88588ee79d4852a2e9e25b77c92334f5c1c229280b8b8d41f758a08

SHA512
7f40456a17b178d1970afb657ea97d59c0ecc2d039b1e81ece67522ffc1941ed2d57a1e80f39145b8169c01ab74b122ad2c1f38aed2c3a06594585a46c3c621a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
ba9280d97db1f5e69bd9155ab9fdd2e4

SHA1
fdd3a9f4b34f4b3a1ce2f7649cc8a661af4ef061

SHA256
4613e97e1933dfccd83e240a97fefda3e296443f903b3ddbe7bd6192ed9dea07

SHA512
fe748945b368402870d3a95c4c6ff03f0114546f0e113ddf7d1501a429c0c20ae2d25bcf2bc2b422dced0422d142903f31867fbf314105085be7cc478041582d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
183KB

MD5
53d326da438891fb25c63165595b7de1

SHA1
e12893948820a1ca0acb18b9a5676820d49d2e59

SHA256
dc21eafe258777f947ff05e9f5c34150906ed2aca44574b78bc5b7315bcdfd4a

SHA512
702adcb6b54493f308968e8e06ed80719abb427aec4511a8a5cb5bafacc08bf370f0d97d6e944c8083e9b0a7878b3f39c1204063116486db9f51c50b9c9d8d66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
183KB

MD5
17586d2c5516a4093d217a328a8d25d6

SHA1
47231b002ef245fa881dc724a7574dbfd50d6f92

SHA256
54bcbc5e9f46ddc0dd11cf66d1793a8d0ba5d6b965fa0c426e6261682f027b92

SHA512
f7b584b604d356df30d65ced248ebf4507dc0d9572b74e7099cfac8a025be2554e6e19c936bf8f06a1fd247a4e0c0fd39a005ea523d66d37580ff8b79d8f9f4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
e11fcc067332bd07b212e07136d398a6

SHA1
d19609662e55443dad6a6d33e6942e206cb707a7

SHA256
a5f29d586ef9482686c03a7cb0e682de85341e09b69a1af609a1d130866a3787

SHA512
b871059fc4f851d66cf55b7e6c999a26e0e347513a768182fec40659912992390ec549094b06860d8d4b44011bdb343c6799b5d5b9f9d2a7550a3b7b7ee10b4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
93db194c1057bf32468f84d76a755a86

SHA1
7453568bb0b4d94c36d9bc472d8878e577dfe065

SHA256
ee2e1babc186bcdb1670bc75a9ec2f78f1c7a41223fcce0d3a8c004f62e8908b

SHA512
b9f641ba1c73cd346f6a48e0a797812227662f194c54b2fdd9f046fd846c1816ab2de4d8788b671687c0133be032219f6070bd487c89f6e895d2f05adcc74579

Download Submit
C:\Windows\Installer\e57a4bc.msi

Filesize
20.3MB

MD5
d2dfcd8a7f448d9f4fda391c2db85681

SHA1
c0b17f94163e1d9220f574ce3dc1221cecacc018

SHA256
536024eb83741570d957775695d977793c6eb1dfa1229ffe14342943e5be9e85

SHA512
8ab31b75814743baf84455d00d5447a1eabbfeef500bf418487716378ff5f4eba14dfe3d36ed37d6299158f4fb2833236e0ce7fc0b85b7c5c17c9ad9c4402578

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xPVvDzTmMXBf.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
96a20de2c0189e23ed7f8d6c9ffe436f

SHA1
d28ec7c544ce5e5538ed9d38bd819bbc5e8457dc

SHA256
adf53bf7a907cee4495d53fa19cc843d0c0d615c699a840d581969860014e0fd

SHA512
f68108b9b02f249211d9b23047859b9012fd76272867770a893c5e9dbd5d7c172b432ad04234092cfce7076cb61b3980b3f426c8de77757e4fcc3de1f00384b3

Download Submit
\??\Volume{fa35ad82-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{603e0b27-a506-4e3f-9c68-9da1e0aaada6}_OnDiskSnapshotProp

Filesize
6KB

MD5
7a27ca74326204637eeb91d78ee9151e

SHA1
6cdec304cfb3945a8979b67805452507f3a1b82d

SHA256
d772d9c5d679d8b96dfd6055c767c8d15afee8143466dd26b09b6e0532330040

SHA512
f456923fd1fa6813627994bbdbec603089717b452814d40c2663544a2f677df87859a82f4c2792e3fdaeea103f3d7926e35adba650eebe3747ba731b772e1eac

Download Submit
memory/3288-54-0x0000000000500000-0x00000000005D6000-memory.dmp

Filesize
856KB

Download
memory/3352-35-0x0000000000A60000-0x0000000000A87000-memory.dmp

Filesize
156KB

Download
memory/4508-132-0x000000002B6A0000-0x000000002B85B000-memory.dmp

Filesize
1.7MB

Download
memory/4508-131-0x0000000029A80000-0x0000000029ABE000-memory.dmp

Filesize
248KB

Download
memory/4508-150-0x000000002B6A0000-0x000000002B85B000-memory.dmp

Filesize
1.7MB

Download
memory/4508-134-0x000000002B6A0000-0x000000002B85B000-memory.dmp

Filesize
1.7MB

Download