gh0strat | a7a6306644c25e96d94c470f5dd1b1666df2b89f83693c5f40a9beb302e5c447

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChromeSetup.msi
Size

29.3MB
MD5

751eb88d77d640cc9b497aafb5679821
SHA1

2dc4ee60244acd2e135e7f9493bc047da5291cbd
SHA256

a7a6306644c25e96d94c470f5dd1b1666df2b89f83693c5f40a9beb302e5c447
SHA512

75898716b8e5642e20f44c843d0c4e2c3d7ff3f45096fb88ec988caa99f00a949c42bd82a783966acee031f7c150d3bf77f9ae2908236f68c846bd9279ca8d39
SSDEEP

786432:kQ05JQsO+H3nM6mU0/nKginprtaTFVn1AESToSDNGpiKv2+iW:V0TZOUSPin617SBJGpiKv2DW

Score

10^/10

gh0strat purplefox discovery evasion persistence privilege_escalation rat rootkit spyware stealer trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 2 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/708-123-0x000000002B940000-0x000000002BAFB000-memory.dmp	purplefox_rootkit
behavioral2/memory/708-154-0x000000002B940000-0x000000002BAFB000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/708-123-0x000000002B940000-0x000000002BAFB000-memory.dmp	family_gh0strat
behavioral2/memory/708-154-0x000000002B940000-0x000000002BAFB000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\129.0.6668.72\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	rOzLXIpgkU16.exe
File opened (read-only)	\??\W:	rOzLXIpgkU16.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	rOzLXIpgkU16.exe
File opened (read-only)	\??\V:	rOzLXIpgkU16.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	rOzLXIpgkU16.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	rOzLXIpgkU16.exe
File opened (read-only)	\??\R:	rOzLXIpgkU16.exe
File opened (read-only)	\??\S:	rOzLXIpgkU16.exe
File opened (read-only)	\??\X:	rOzLXIpgkU16.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	rOzLXIpgkU16.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	rOzLXIpgkU16.exe
File opened (read-only)	\??\Z:	rOzLXIpgkU16.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	rOzLXIpgkU16.exe
File opened (read-only)	\??\O:	rOzLXIpgkU16.exe
File opened (read-only)	\??\P:	rOzLXIpgkU16.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	rOzLXIpgkU16.exe
File opened (read-only)	\??\T:	rOzLXIpgkU16.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	rOzLXIpgkU16.exe
File opened (read-only)	\??\Y:	rOzLXIpgkU16.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	rOzLXIpgkU16.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_058F778FC8346DE378B15A5652BAADD9	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_058F778FC8346DE378B15A5652BAADD9	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\FacilitateEngineerVigorous\DUosLfESJGRt.exe	kfQsuzzYiimC.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\nb.pak	setup.exe
File opened for modification	C:\Program Files\chrome_installer.log	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\he.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\lt.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\vi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\chrome_elf.dll	setup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\CR_C553B.tmp\CHROME.PACKED.7Z	129.0.6668.72_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\chrome.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\chrome_100_percent.pak	setup.exe
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File created	C:\Program Files (x86)\Google4464_1617921552\bin\uninstall.cmd	ChromeSetup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\29628a00-30fa-4c05-a518-745ee78d1f3b.tmp	updater.exe
File opened for modification	C:\Program Files\FacilitateEngineerVigorous	rOzLXIpgkU16.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe57da04.TMP	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\VisualElements\Logo.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\WidevineCdm\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\fr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\hr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\29628a00-30fa-4c05-a518-745ee78d1f3b.tmp	updater.exe
File opened for modification	C:\Program Files\FacilitateEngineerVigorous\DUosLfESJGRt.wrapper.log	DUosLfESJGRt.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\_metadata\verified_contents.json	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\manifest.fingerprint	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\chrome.7z	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\af.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\VisualElements\LogoBeta.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Application\129.0.6668.72\Installer\chrmstp.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File created	C:\Program Files (x86)\Google4464_1617921552\bin\updater.exe	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\en-GB.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\gu.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\VisualElements\LogoCanary.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\libGLESv2.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\fi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\ur.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\chrome.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\os_update_handler.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\FacilitateEngineerVigorous\rOzLXIpgkU16.exe	kfQsuzzYiimC.exe
File created	C:\Program Files (x86)\Google4464_298894792\UPDATER.PACKED.7Z	ChromeSetup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\el.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\ko.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\libEGL.dll	setup.exe
File created	C:\Program Files\FacilitateEngineerVigorous\qcxmbULseosLkruVhPHs	msiexec.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	ChromeSetup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe5851f3.TMP	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\92dd669a-333a-4a8f-a762-c8e44fc5bc27.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File created	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\c42b1f0e-e802-42cd-b874-07cf0461f153.tmp	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\10a46b7a-ed68-4540-a638-16e1be4e4958.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\bg.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1432_1143579272\Chrome-bin\129.0.6668.72\Locales\es-419.pak	setup.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57a018.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{45F61091-6153-4541-B740-A66DE9373B02}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA141.tmp	msiexec.exe
File created	C:\Windows\Installer\e57a01a.msi	msiexec.exe
File created	C:\Windows\Installer\e57a018.msi	msiexec.exe

Executes dropped EXE 34 IoCs

pid	Process
2752	kfQsuzzYiimC.exe
4548	rOzLXIpgkU16.exe
4464	ChromeSetup.exe
4024	DUosLfESJGRt.exe
2332	updater.exe
2940	updater.exe
2408	updater.exe
4848	updater.exe
4072	updater.exe
2816	updater.exe
4672	DUosLfESJGRt.exe
3836	DUosLfESJGRt.exe
4716	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
232	129.0.6668.72_chrome_installer.exe
1432	setup.exe
3104	setup.exe
2752	setup.exe
4576	setup.exe
1424	chrome.exe
3468	chrome.exe
520	chrome.exe
3400	chrome.exe
2652	chrome.exe
3248	chrome.exe
4360	chrome.exe
1144	elevation_service.exe
2972	chrome.exe
5200	chrome.exe
5448	chrome.exe
5544	chrome.exe
5712	chrome.exe
6020	updater.exe
6036	updater.exe

Loads dropped DLL 29 IoCs

pid	Process
1424	chrome.exe
3468	chrome.exe
1424	chrome.exe
520	chrome.exe
3400	chrome.exe
520	chrome.exe
3400	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
2652	chrome.exe
2652	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
3248	chrome.exe
4360	chrome.exe
3248	chrome.exe
4360	chrome.exe
2972	chrome.exe
2972	chrome.exe
5200	chrome.exe
5200	chrome.exe
5448	chrome.exe
5448	chrome.exe
5544	chrome.exe
5544	chrome.exe
5712	chrome.exe
5712	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4260	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rOzLXIpgkU16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rOzLXIpgkU16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rOzLXIpgkU16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfQsuzzYiimC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
232	129.0.6668.72_chrome_installer.exe
1432	setup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e7a671f193ce7b7c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e7a671f10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e7a671f1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de7a671f1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e7a671f100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rOzLXIpgkU16.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rOzLXIpgkU16.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\StabilityMetrics\user_experience_metrics.stability.exited_cleanly = "0"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\version = "129.0.6668.72"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\browser.show_home_button = "A4971B29031728F6237593A28F804FB71471DE2A59CB643EACF6BE2C8E27FD9B"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_signed_in_username = "14842538D6267C02FD829CCD0453382C36E910A3F49B405D7FFC3B304B3052C2"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\failed_count = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi = "174453AA900F205D30DFE4D9BB482F5234D9A8ABE2754ABD5A82CDF94BCEB768"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ahfgeienlihckogmohjhadlkjgocpleb = "59097B4CFF94FA2F5C1EC85C7E4F46E69DD0305CD814401C3FE7FD954C6845E7"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\UsageStatsInSample = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\pinned_tabs = "ACC9C8B8C9B7F8885625581B78FA3D7B1E441C62795F1B64D61BC0D2B3D6F5B1"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\neajdppkdcdipfabeoofebfddakdcjhd = "C2A9468F6A2E80EA52F5FE1F505EDF0626E03BC691556EEB3F0F17C66524E905"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\session.restore_on_startup = "89056A2C39AF19790F647D3F8A9677B600D3BCD8347151F7D83AA114335643AD"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\safebrowsing.incidents_sent = "EF950C3355CEC16E4C748C016CCE708E63EBE1E2BB76595355DFE5A8AB32B7C8"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	updater.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\InstallerPinned = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi = "FA1A8CF4A87A07E0B39B86FC9023125DDC0C211B9ABD97DA5805FE9D8778C925"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\homepage_is_newtabpage = "304B17EC5071D2BEB83270F409E7E4D36EBF59F4BB7481FFF92F444A24700B35"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nkeimhogjdpnpccoofpliimaahmaaome = "944DD7D113B780FC4E27C59A44C1F9349322B8A807F117A8A3DA7D108A02E515"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\enterprise_signin.policy_recovery_token = "289F4574150AC610020B9845809C9D0ED7EE0E186757AAA833367F4815AFF182"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\lastrun = "13372409492883877"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\Extensions	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\session.startup_urls = "3FC99AC8CFAB25B2183AD42CFE1D68D212D8C3FE12C562D15EABB8037769D3C1"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	updater.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1588C1A8-27D9-563E-9641-8D20767FB258}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib\ = "{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{699F07AD-304C-5F71-A2DA-ABD765965B54}\1.0\ = "GoogleUpdater TypeLib for IUpdaterAppStatesCallbackSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{CCA9FC90-B200-5641-99C0-7907756A93CF}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B685B009-DBC4-4F24-9542-A162C3793E77}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\TypeLib\ = "{494B20CF-282E-4BDD-9F5D-B70CB09D351E}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4334319-8210-469B-8262-DD03623FEB5B}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatus3System"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\1.0\ = "GoogleUpdater TypeLib for IAppWebSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B685B009-DBC4-4F24-9542-A162C3793E77}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\TypeLib\ = "{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ = "Interface {463ABECF-410D-407F-8AF5-0DF35A005CC8}"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8A4B5D74-8832-5170-AB03-2415833EC703}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0\win32	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0\ = "GoogleUpdater TypeLib for IUpdaterSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\TypeLib\ = "{ACAB122B-29C0-56A9-8145-AFA2F82A547C}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{699F07AD-304C-5F71-A2DA-ABD765965B54}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib\ = "{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4334319-8210-469B-8262-DD03623FEB5B}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\TypeLib\ = "{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{27634814-8E41-4C35-8577-980134A96544}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\1.0	updater.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
784	msiexec.exe
784	msiexec.exe
4548	rOzLXIpgkU16.exe
4548	rOzLXIpgkU16.exe
2332	updater.exe
2332	updater.exe
2332	updater.exe
2332	updater.exe
2332	updater.exe
2332	updater.exe
2408	updater.exe
2408	updater.exe
2408	updater.exe
2408	updater.exe
2408	updater.exe
2408	updater.exe
4072	updater.exe
4072	updater.exe
4072	updater.exe
4072	updater.exe
4072	updater.exe
4072	updater.exe
4072	updater.exe
4072	updater.exe
3836	DUosLfESJGRt.exe
3836	DUosLfESJGRt.exe
4716	rOzLXIpgkU16.exe
4716	rOzLXIpgkU16.exe
4716	rOzLXIpgkU16.exe
4716	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe
708	rOzLXIpgkU16.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4260	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4260	msiexec.exe
Token: SeSecurityPrivilege	784	msiexec.exe
Token: SeCreateTokenPrivilege	4260	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4260	msiexec.exe
Token: SeLockMemoryPrivilege	4260	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4260	msiexec.exe
Token: SeMachineAccountPrivilege	4260	msiexec.exe
Token: SeTcbPrivilege	4260	msiexec.exe
Token: SeSecurityPrivilege	4260	msiexec.exe
Token: SeTakeOwnershipPrivilege	4260	msiexec.exe
Token: SeLoadDriverPrivilege	4260	msiexec.exe
Token: SeSystemProfilePrivilege	4260	msiexec.exe
Token: SeSystemtimePrivilege	4260	msiexec.exe
Token: SeProfSingleProcessPrivilege	4260	msiexec.exe
Token: SeIncBasePriorityPrivilege	4260	msiexec.exe
Token: SeCreatePagefilePrivilege	4260	msiexec.exe
Token: SeCreatePermanentPrivilege	4260	msiexec.exe
Token: SeBackupPrivilege	4260	msiexec.exe
Token: SeRestorePrivilege	4260	msiexec.exe
Token: SeShutdownPrivilege	4260	msiexec.exe
Token: SeDebugPrivilege	4260	msiexec.exe
Token: SeAuditPrivilege	4260	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4260	msiexec.exe
Token: SeChangeNotifyPrivilege	4260	msiexec.exe
Token: SeRemoteShutdownPrivilege	4260	msiexec.exe
Token: SeUndockPrivilege	4260	msiexec.exe
Token: SeSyncAgentPrivilege	4260	msiexec.exe
Token: SeEnableDelegationPrivilege	4260	msiexec.exe
Token: SeManageVolumePrivilege	4260	msiexec.exe
Token: SeImpersonatePrivilege	4260	msiexec.exe
Token: SeCreateGlobalPrivilege	4260	msiexec.exe
Token: SeBackupPrivilege	2608	vssvc.exe
Token: SeRestorePrivilege	2608	vssvc.exe
Token: SeAuditPrivilege	2608	vssvc.exe
Token: SeBackupPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4260	msiexec.exe
4260	msiexec.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 636	784	msiexec.exe	91
PID 784 wrote to memory of 636	784	msiexec.exe	91
PID 784 wrote to memory of 3632	784	msiexec.exe	93
PID 784 wrote to memory of 3632	784	msiexec.exe	93
PID 784 wrote to memory of 3632	784	msiexec.exe	93
PID 3632 wrote to memory of 2752	3632	MsiExec.exe	95
PID 3632 wrote to memory of 2752	3632	MsiExec.exe	95
PID 3632 wrote to memory of 2752	3632	MsiExec.exe	95
PID 3632 wrote to memory of 4548	3632	MsiExec.exe	97
PID 3632 wrote to memory of 4548	3632	MsiExec.exe	97
PID 3632 wrote to memory of 4548	3632	MsiExec.exe	97
PID 3632 wrote to memory of 4464	3632	MsiExec.exe	98
PID 3632 wrote to memory of 4464	3632	MsiExec.exe	98
PID 3632 wrote to memory of 4464	3632	MsiExec.exe	98
PID 4464 wrote to memory of 2332	4464	ChromeSetup.exe	99
PID 4464 wrote to memory of 2332	4464	ChromeSetup.exe	99
PID 4464 wrote to memory of 2332	4464	ChromeSetup.exe	99
PID 2332 wrote to memory of 2940	2332	updater.exe	102
PID 2332 wrote to memory of 2940	2332	updater.exe	102
PID 2332 wrote to memory of 2940	2332	updater.exe	102
PID 2408 wrote to memory of 4848	2408	updater.exe	104
PID 2408 wrote to memory of 4848	2408	updater.exe	104
PID 2408 wrote to memory of 4848	2408	updater.exe	104
PID 4072 wrote to memory of 2816	4072	updater.exe	108
PID 4072 wrote to memory of 2816	4072	updater.exe	108
PID 4072 wrote to memory of 2816	4072	updater.exe	108
PID 3836 wrote to memory of 4716	3836	DUosLfESJGRt.exe	112
PID 3836 wrote to memory of 4716	3836	DUosLfESJGRt.exe	112
PID 3836 wrote to memory of 4716	3836	DUosLfESJGRt.exe	112
PID 4716 wrote to memory of 708	4716	rOzLXIpgkU16.exe	113
PID 4716 wrote to memory of 708	4716	rOzLXIpgkU16.exe	113
PID 4716 wrote to memory of 708	4716	rOzLXIpgkU16.exe	113
PID 4072 wrote to memory of 232	4072	updater.exe	114
PID 4072 wrote to memory of 232	4072	updater.exe	114
PID 232 wrote to memory of 1432	232	129.0.6668.72_chrome_installer.exe	115
PID 232 wrote to memory of 1432	232	129.0.6668.72_chrome_installer.exe	115
PID 1432 wrote to memory of 3104	1432	setup.exe	116
PID 1432 wrote to memory of 3104	1432	setup.exe	116
PID 1432 wrote to memory of 2752	1432	setup.exe	119
PID 1432 wrote to memory of 2752	1432	setup.exe	119
PID 2752 wrote to memory of 4576	2752	setup.exe	120
PID 2752 wrote to memory of 4576	2752	setup.exe	120
PID 2332 wrote to memory of 1424	2332	updater.exe	122
PID 2332 wrote to memory of 1424	2332	updater.exe	122
PID 1424 wrote to memory of 3468	1424	chrome.exe	123
PID 1424 wrote to memory of 3468	1424	chrome.exe	123
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124
PID 1424 wrote to memory of 520	1424	chrome.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ChromeSetup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4260

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:636
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2A6E276FCE3E51682D037F3308F8C686 E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Program Files\FacilitateEngineerVigorous\kfQsuzzYiimC.exe
    "C:\Program Files\FacilitateEngineerVigorous\kfQsuzzYiimC.exe" x "C:\Program Files\FacilitateEngineerVigorous\qcxmbULseosLkruVhPHs" -o"C:\Program Files\FacilitateEngineerVigorous\" -pmnvoloPBJgRXdEHqjKyr -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2752
- - C:\Program Files\FacilitateEngineerVigorous\rOzLXIpgkU16.exe
    "C:\Program Files\FacilitateEngineerVigorous\rOzLXIpgkU16.exe" -number 218 -file file3 -mode mode3 -flag flag3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4548
- - C:\Program Files\FacilitateEngineerVigorous\ChromeSetup.exe
    "C:\Program Files\FacilitateEngineerVigorous\ChromeSetup.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Program Files (x86)\Google4464_1617921552\bin\updater.exe
      "C:\Program Files (x86)\Google4464_1617921552\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={FD39FE3E-F972-AC55-37EA-CE3FED473068}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2332
    - - C:\Program Files (x86)\Google4464_1617921552\bin\updater.exe
        
        "C:\Program Files (x86)\Google4464_1617921552\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x260,0x284,0x133c694,0x133c6a0,0x133c6ac
        5⤵
        Drops file in Program Files directory
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2940
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        5⤵
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1424
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=129.0.6668.72 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff90607bf8,0x7fff90607c04,0x7fff90607c10
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3468
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2004,i,18339186355906809726,16339818561334906151,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:520
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1988,i,18339186355906809726,16339818561334906151,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:3400
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2296,i,18339186355906809726,16339818561334906151,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:2652
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3300,i,18339186355906809726,16339818561334906151,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:3248
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3308,i,18339186355906809726,16339818561334906151,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4360
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4440,i,18339186355906809726,16339818561334906151,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:2972
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4780,i,18339186355906809726,16339818561334906151,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5200
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4776,i,18339186355906809726,16339818561334906151,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5448
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4920,i,18339186355906809726,16339818561334906151,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5544
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5284,i,18339186355906809726,16339818561334906151,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5712

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Program Files\FacilitateEngineerVigorous\DUosLfESJGRt.exe
"C:\Program Files\FacilitateEngineerVigorous\DUosLfESJGRt.exe" install
1⤵
- Executes dropped EXE
PID:4024

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xbdc694,0xbdc6a0,0xbdc6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4848

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xbdc694,0xbdc6a0,0xbdc6ac
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2816
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\129.0.6668.72_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\129.0.6668.72_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\e952eaf8-443f-41aa-8521-00f35437a700.tmp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\CR_C553B.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\CR_C553B.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\CR_C553B.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\e952eaf8-443f-41aa-8521-00f35437a700.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\CR_C553B.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\CR_C553B.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=129.0.6668.72 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff674679628,0x7ff674679634,0x7ff674679640
      4⤵
      Executes dropped EXE
      PID:3104
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\CR_C553B.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\CR_C553B.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\CR_C553B.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\CR_C553B.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=129.0.6668.72 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff674679628,0x7ff674679634,0x7ff674679640
        5⤵
        Drops file in Program Files directory
        Executes dropped EXE
        
        PID:4576

C:\Program Files\FacilitateEngineerVigorous\DUosLfESJGRt.exe
"C:\Program Files\FacilitateEngineerVigorous\DUosLfESJGRt.exe" start
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:4672

C:\Program Files\FacilitateEngineerVigorous\DUosLfESJGRt.exe
"C:\Program Files\FacilitateEngineerVigorous\DUosLfESJGRt.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Program Files\FacilitateEngineerVigorous\rOzLXIpgkU16.exe
  "C:\Program Files\FacilitateEngineerVigorous\rOzLXIpgkU16.exe" -number 192 -file file3 -mode mode3 -flag flag3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Program Files\FacilitateEngineerVigorous\rOzLXIpgkU16.exe
    "C:\Program Files\FacilitateEngineerVigorous\rOzLXIpgkU16.exe" -number 362 -file file3 -mode mode3 -flag flag3
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:708

C:\Program Files\Google\Chrome\Application\129.0.6668.72\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\129.0.6668.72\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5792

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:6020
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xbdc694,0xbdc6a0,0xbdc6ac
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57a019.rbs

Filesize
7KB

MD5
d25c990bd0b2caf564dc644eb563d005

SHA1
47d2925c1b72959a01dcfd066c45a91b14e8b555

SHA256
d7458a6d82e9e5377a27e03cabdce4b09517284f0471ccc9dfd3dfed2d6c4224

SHA512
3e1fcc5229a02d9c28f754907aadaebb5d0137e02152a4c00c454b3a1df397c5d8b432bf8850c0a1a19177b79f021dd0018972e4818cbc5d3b4783d6242f2c2d

Download Submit
C:\Program Files (x86)\Google4464_1617921552\bin\updater.exe

Filesize
4.7MB

MD5
823816b4a601c69c89435ee17ef7b9e0

SHA1
2fc4c446243be4a18a6a0d142a68d5da7d2a6954

SHA256
c2a7c0fa80f228c2ce599e4427280997ea9e1a3f85ed32e5d5e4219dfb05ddb2

SHA512
f3b38807ed1eb96c932e850b9b37551554408a628bedf12aa32bde08c442ff3663bf584335e7eab193ce2cf7552bce456737c96a2ba9faa953150e6304068fc6

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat

Filesize
40B

MD5
3f5f01fb15cf62b6fc95938a955fc158

SHA1
ef20c9e47845de5697724db92dafbf1bedea0bf7

SHA256
32188ce2573ee016e043d6ebe99b407cb383aa640e016ee581fd6302d62175d7

SHA512
42a18118dd647b096cbe404e895818e9befb3952fb4fa55aa6f4b7443b595837197032c4ca764e4c4eb958c83bffe693c0dfd1c19fe3f1ecef4044a123c5c067

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
503B

MD5
159e5950394872055d8a2fc749d5d9b6

SHA1
5d416971993b5ed28c650ee42c58eb00edcc2dcb

SHA256
b18982764f4763cce705b8f61de8bb255805ddfc6d50809d0d8a1dc887df91c4

SHA512
6dd4c42c3755fcc1f983cb24f905474b54b8132b7e78b128c5ff137143c248dc5d1c5f67d8bbc1c5575880ebea1e8442b9f751aa0cd52bf6532751cf2c898c61

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
354B

MD5
d4927578fc92dc543365aa4e43b202ba

SHA1
5e1aeb950ac6ac3f071fa02f90a4fbc0c8e5304c

SHA256
4ac029c04a6e82f4c588237f57a798b4285c818bdbb4250c20f11a5b95d4ecd1

SHA512
4c6cbf4bfb4279edc6d6bd816ca4d1d4dbc8b7f06d875493ffeea3a8782568f49911db28aae743a41962bbe4fe34afc531e119be58888a2acf0623e99df38e95

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
602B

MD5
914ae40ae322238d4c5ef9ad71660bd3

SHA1
eed69b8ba91c5c463009b617e8f02523c90d84c8

SHA256
5ba3714bc4823665f053c74a8f1fa441ccaf7f8ff27f5fbd210045b3bc8caf40

SHA512
f148d861e0a202cc76e2b557289c0b35f40d52c57ae1b09fb67d48e9a5a8b066a4520ef395412a45ad9a797007064311b305590e0824692e858db991b6acc5e8

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
602B

MD5
1a17a74fb2bf1a66d347b61389a597c2

SHA1
95e21597893557ecb3a2405370891c74d3aaefe3

SHA256
e602c26c4545f7d6f43c6fc4839165bba3f4024d63f7555bc0ea13c7fecf1d7e

SHA512
009112e0f7d2233dab0e7422f343244183ece307e24d6d3cc6bff9e10183caaab82d822149188c57378aec803c8504ce57bd1877dcb6cb43e6855aa67ad061f5

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
49B

MD5
7b693a82168c33ec9e8cf276859ddf7f

SHA1
d396dbbe299fe7754a6244d01e97cc4edd0693eb

SHA256
84a9a7f43db56cd6e9a408f88244e8ba5efbe48a5b5168d321f112b8c8fd8e3f

SHA512
4064c158d753d19a72e1be1c8bd5fe7f22e2032d67d1dd7ea1d85ce652d63c69b85a4292c4403b0f7729b05607f3d1ccfaf4d27d04ad09ffcec70082450320ab

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
15078a13ee00d321a2c90692813fc8ec

SHA1
f50d2511dd30caa499245f4e4d6e91373828408e

SHA256
4639ad9c891ccf8574053a39ecf52eec31d49218bc8c0763fd9fd91d2469a7e1

SHA512
ccd0272d344a5a42bfc499665ca31af06c58edc5e60db40d7cd1cf0187c753625cd0a12eb265f33f5e82689d6e0613faba4add0a3bc7e8e63b514e5583350c84

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
2KB

MD5
762dc332bc00b90003c8e975e73d702a

SHA1
1dc1c6f2e448ae469092037950fa448f6ce01b89

SHA256
e86d92ef95c0bc88c5099af9868d3744670399f336748fe899a8aecb259465e3

SHA512
d8db0d8ed5e78bd2283621fc5efab47257d4fa4268de7d6370dfd2a75f1eb8e85037c1b9dd9696efac69583c47344c2c15f89d1c6aa2db031cc7c8937c52f229

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
4KB

MD5
91dcc0a12545d7375dda6a2f71224d14

SHA1
367aa210732c8a87247ce68348b007b4e2059eb2

SHA256
70ced1cd9462698cb62cca13360591d262bbf9670425aada6005181a23a439d3

SHA512
28d02ba73125483f63e934e0f5bfc714a02721b07db4b4f66f6a70de8fb02014793ee508cff21384636544bc2124cff626852a9a7fe5fb05df03a22affedf46e

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
5KB

MD5
fb3b63076b2f7aed364cc402baa272ed

SHA1
905e4ce4f07feb1dbb1fa17f96f683d430f3ed14

SHA256
5386b77ab44b7d4fc99c63422e981e49bc8ec6028dfddd588c3ce44f90e72e65

SHA512
db24fb903e46e7b341960ec83ee42d53150a89c3d5d69b364d608e6d820a0682e0943ee6abd3c9ec9a226e0eaff4ce2e636a97a538f7250fecaff2325eaeda3d

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
9KB

MD5
46ad43a2924f177dda18f38c5da3a1d9

SHA1
bb6840240d4014336dff65e9920a64216e063111

SHA256
bee9708cc3984b8ed3be9b9e1693f92574fceea26737e1113797a5aed12779f7

SHA512
b95e6b9e61b08638931eebf1775f1794a70e8959b3c1211befc490d9f7fca35dc5ab2a5ee02ac9caf29ed087c2fdafb80924cd551e5a4c3862b17988a27a55e9

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
11KB

MD5
b9a22eebcbc015de39db7aa2c1ad6f89

SHA1
9e6d578ccdc079c3dee3b903bce75162847d0bc3

SHA256
16fcdfc9079acff44bc08017725c1f94433e2a94b01318505ac0bf49548dee8a

SHA512
6d4f3409ab66e41d74ffd4eb1d845f10f83f3ff3cc4a1df47428a03f85a4ba417aad64b7ded97217564a72d9e3edf8393978eaa3e912323b792c755415c474ad

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\CR_C553B.tmp\setup.exe

Filesize
5.8MB

MD5
45c814cbc966211dc237c7b17c283836

SHA1
497c2d1c5583f71ec05030499de554e2c338f7df

SHA256
97a18f773f924b4ff82f0189694502c11a0b4582d624068db482b1d4de6209ab

SHA512
d0210ec856defbd0c5fb80fb58c04f88d3a6f7d05741f74600c93f4ad0b62e354e46d4cf950ba1d89e7fb159aa988279e6aaef9d86e3e68e2d4de68fc9e0e3f8

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4072_1788240282\e952eaf8-443f-41aa-8521-00f35437a700.tmp

Filesize
679KB

MD5
377a006e7c7726b6f2a3f057b485cdec

SHA1
b6e9b7779e660cc534ac79b02e2f12a7a2665ea4

SHA256
43743afc098fc8a26bb0348077ac0c4b6dde20ce3dfb886be530a9bc9a80fe91

SHA512
e4be802a4dfd2c60150ac4b6690634e0b5ee8729bdd13fc9641cccb01b1fcf55ad114e36cefe25b712d1e7a77a35207e6d989928b9aa1ebb15c58ba964598ddc

Download Submit
C:\Program Files\Crashpad\settings.dat

Filesize
40B

MD5
01a8280de895c7c3696284a5e620db55

SHA1
7902910d0348970748969b89a156d75addc0d8f8

SHA256
6ecec4e866e9c544736f113d1c614df5d969e4a3c5c4b90b02f80b21ee9d020b

SHA512
7db527a3158f5d3c2537f79b41a876efa10761d5f5e920758e2f2cb713fe7776a7ae652ff30da845e33b4194867578cfe8587ecb27e110e9a1c469d4f3e5c8fd

Download Submit
C:\Program Files\FacilitateEngineerVigorous\ChromeSetup.exe

Filesize
8.5MB

MD5
5adff4313fbd074df44b4eb5b7893c5e

SHA1
d27388ef6cf34d40e0e7666f6381fcc5bbafa0f7

SHA256
d0c7a4390bdd6b442b96fc76f8a38f7b756ba2c16752ea259844420161865cae

SHA512
f5d639922b91878cf83d97563288a3aa4cba94db3ad5e8ac11d24ef7c44b019383a4414aeba6171b4c7bfa83ea1eafc1231cc9233e3b82b5ca7dc0b3ffacbf60

Download Submit
C:\Program Files\FacilitateEngineerVigorous\DUosLfESJGRt.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\FacilitateEngineerVigorous\DUosLfESJGRt.wrapper.log

Filesize
256B

MD5
cb13f8f0b0b59d32d43e8b8241f6f4e4

SHA1
9586f5747896962a43603d5997ff5f6746eef926

SHA256
35b1b2e81888966778b78055d02a9d5646fd4ae8ae5feec75a15953a339b737d

SHA512
7f6931bc5a7a72f221f9513cb448e3cd899a0f351aabf22c5d4e29aaec263bdfd0a2e7bca03df6f183d6fdf2ad69948bb09e90a57c2b8666a1c56dc417f9bacb

Download Submit
C:\Program Files\FacilitateEngineerVigorous\DUosLfESJGRt.wrapper.log

Filesize
471B

MD5
32fc95b87d349c80b3a38cbde9f42c3b

SHA1
7ba736ad70e9f1e9f972481b47b22f5646042890

SHA256
6b4042d0825381193254e517283d2c2b6f59093e0933688467fd60529e4a5f67

SHA512
bb940424ad052809e7619fd8ead2aef54193473af436fdc94811f55f7100b153e4d5959fd03200b4cb62a582445b15ae7526f8d25dabf379c618dfde20bcfb05

Download Submit
C:\Program Files\FacilitateEngineerVigorous\DUosLfESJGRt.wrapper.log

Filesize
568B

MD5
61d3522c61041348e1b1c4974ff55e8f

SHA1
a2c815766c1159b6a5dae41bf7032660257a7412

SHA256
75a90dce0f505e7204b14fefb73d0e6dc2cc1d539d32e415d2fa6e8ba117e4d8

SHA512
a22dc9324a18a398896b82183baa5c76148c64ce4f98c3002a5bd80ceb2d477bab6cd6631be751cf67aab756944e8777cc85e4cfbf4b94ddb813bbb218ce8464

Download Submit
C:\Program Files\FacilitateEngineerVigorous\DUosLfESJGRt.wrapper.log

Filesize
719B

MD5
5b7da3944de2c6e8eb9dcc02aaafd357

SHA1
495397c359dcba8acbfba900752e12fd9dd258fb

SHA256
91cdb69fb600ff02911126ed7a45244674727d18e582d2ba8424a6aad41b1d64

SHA512
c9e4ebdca8333cb0704dc5c84c08b5c86de4d4a47041d951fac1bfc640019a7b5ef12b14b06d683edb1097e82ecd3a5ea65a28155298e1fa36619a229bd09f5c

Download Submit
C:\Program Files\FacilitateEngineerVigorous\DUosLfESJGRt.xml

Filesize
434B

MD5
8317c8370e98f6a1fa779b8ba6c00e62

SHA1
57b19983d9a3b0e94eba7a62bd8cdfd231427fb8

SHA256
94b24aac78e540602d45050b5c51c2d8306144a57cc60611a5850cb909555aaf

SHA512
5ee683436aafd2bb223d6190a689d2811975be7c767b65fca275617575def89310659ce30b098f63c59954aa15cc16e6797aa30a6256342a7974bbe568f4479e

Download Submit
C:\Program Files\FacilitateEngineerVigorous\kfQsuzzYiimC.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Program Files\FacilitateEngineerVigorous\qcxmbULseosLkruVhPHs

Filesize
1.7MB

MD5
8074a26230501ebdcd7dd941db160214

SHA1
f8edb4a6d8e2693fdda38a3339027b5ea1a38ec8

SHA256
3aae95a77e6af7a12dc4ce1939bdd56a17f1f89b117d1fe40234eea3762a17f8

SHA512
ef88fda40519d320d3b25bb9101dd08d50410626a178abc64530eb41704c361822586b8dc9b3ee6e2f18c714018c051629d731d27c8ab84084e883beaeafd694

Download Submit
C:\Program Files\FacilitateEngineerVigorous\rOzLXIpgkU16.exe

Filesize
2.9MB

MD5
62238c79f5861e8e100a7fd5e573655c

SHA1
bf8a8ed429bce0323ad67cb5948dc55e3de3ec99

SHA256
c7663c91d0975cc0fa8ce01d73aa5f3d37525ce2990aefc6fca0b6d29988b704

SHA512
412eb9b8d443317a422d024e2334dd50d9ad96227cf7fbce405bf6ba716285b4305089f6525495dcfaa2dbaf73a4798310de6a350d2c17ff6fa010252a94e153

Download Submit
C:\Program Files\Google\Chrome\Application\129.0.6668.72\chrome_elf.dll

Filesize
1.2MB

MD5
39e537846b3f01b806337100ea6801a9

SHA1
f0d4bc3aeee2125827d100892c7a91347aa39982

SHA256
88a70a9f2829c29313392e1aa9d565c6cf79bc56d02823fbe872367c39f36a07

SHA512
b97634f640570b779146257625edde2fb9c464c328f31f7f4059c0bbd364afc890c21954589a1976a012ddc3eae36c51d8d6c08db5e9e896a8279b4093b20667

Download Submit
C:\Program Files\Google\Chrome\Application\129.0.6668.72\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Program Files\Google\Chrome\Application\129.0.6668.72\libGLESv2.dll

Filesize
7.9MB

MD5
8e27db80f77c2551c6d497a01d0a58ed

SHA1
b92cb57567893ac0f11339cb092811ec87dfb388

SHA256
a3eb6b9ad140e493514a856bafe059c2d2b36b7ed0d8280f92428e467f31494b

SHA512
badd260bab9400a5e58b3b825d19cfa9fa9575da96ca862f69f7e6bb5066c5ab246148e56577898d97fe379f7f40ee53295e76f38c720f004dc4513782f59277

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.6MB

MD5
17e6c7baa71f6cb2cf1538e58a1d61d6

SHA1
bf028e1bdc490224c665f1c73122577e47e28806

SHA256
72007d5e7f2569395865ff327dda26f08d189915027a1fdc9b935a435ae1fbe9

SHA512
b114cccd4d9afe6fb7b83a2aa9535b5b3bca5309c75f03ab8fed68f25199959f06427f77e0d6674e517fbc33a85c14437c01b35b7878f775bd49301f57584a1b

Download Submit
C:\Program Files\chrome_installer.log

Filesize
21KB

MD5
2d402a25a62045fb08612e7611c8ccf3

SHA1
97796a2c4c6c5dd80f1cbb459e49df2c6e62e6e6

SHA256
69228babc7350b28d6466fb06f6bd209be1d63b14c20317a3aa7b3aa6fc4bdc7

SHA512
98d464f0faf5900d851b706573fcb9948f94a3791a62303c09548e5a23e1243c0c416799640d4fcca542f8bece407a5c3d67ba2c9c40314ac88186c0e09facf8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
b02c14b08a608aa36dcbbc2706da5016

SHA1
3f0e5603c4691031835c30239c411b7c267aa9f3

SHA256
2580436aaca2e8df4ae6fa86900d00be7ae96cf533fe7dea8f85f4102b6178b1

SHA512
5e99374d295c11a85b5b022719e463cdc3153e6147c99cdd5a80e21610f63e649ce4adf4abb9caf8fe3d18b669f80cda850abbde476b8ecd87868571047878eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
b245a0b7603412b4cdfb0f27b112e69f

SHA1
7fca50e6c7b8ffba86307367c36b492a7526d226

SHA256
572b039338da1300cccb3f6378455e0f13f0fbca5544b5b31a164c544fa09e11

SHA512
a0a216caf7cc59359071d73c990dfb99263464e60b0096cb1b6cdb31bd0e1345ffb4f40768f8a884512adcd8af47d0f03a3351a8d9781be7de1e2d3a9adb25af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
f0949b2001242eb5cccc523cef0a3dcd

SHA1
4d7274d68cdcb4cb336a7354955c64b9e8af64c9

SHA256
a9500b9629c966862ebc85069d80829d479bd0c9b7911bfde8cf1452fa76444e

SHA512
1b8a0780d146e4a594c4babb3dc00c44cc31282715e29a1dd65a3b776b0fc932c71ca807f97dc196c15143e0d537eaa4fa81b6b023e682dcd0136ef5a9442426

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
b84dbf1d28c3fdae2d675e2ca3050739

SHA1
a879e6f8cdb8582df75194d6350ca0f106e904cb

SHA256
c5922a0849f3b8117a02d764802e08dd7034088e703b8e930b9745a12a3c5eb5

SHA512
fb032b4199d67ea8fc2e9e4714afcf143c2bca65d1d8a7396b7a101ed9651e9ba50cd0a26cad77114c0c25dbea820bc00f9cdbf840b551e0315576df0fada47b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5db6151c18220a0c2fb36bbacc6769b4

SHA1
52553fb16a12561def61f8f3bef8c17d65589dca

SHA256
b6c5daf7d67834e2151681550e46495fe47bd3bb78b1a67478e584d2611dea6f

SHA512
769cd5be8c47db8a56edcab264541d8ac860ab193df655bd4594e6daf357523cd78bfa195172df30705cffc75895cee6d7a7af201f5042cc162e800caeedec4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
f864b545d2d7f12a4476beb518c3828c

SHA1
387ec3f214e8bb0021733a2bd26a4925a4809e5b

SHA256
85fc67ad69bb7c29bcb20cde19b0d3b6f15abf7f82297e59203d8bc597d16a9b

SHA512
2ab0911cbc04940d4b6a10fc06c27a51a7ede5d7c69e2ec806e05736f7abb3b883f2f7d197409b9833feeb8b5a9521df896050e2ea8cb50c2386919ba9643fe3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
77f1b8cf4bcaaa004f2b35c793771e96

SHA1
5506e9b660d94c3e84ee2f3e24aba0f3f2358a1b

SHA256
0edd3dbfa5174b87a0f73920ceb84f06c2f44d332d2563ea78f7d8a5b0c27d6c

SHA512
d528264ecddfcfab6528096ab9259d56b5403d07ab44d4a3c2830104acae138726d6ca43fcd466056b16f329fd3931f0ac62f5b45933ae1fa44c2d4ff13d6033

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
183KB

MD5
c3b54db4170619ab91b479a03b12027d

SHA1
a9e1daf698813d04c0cea81dd49967d55d939b30

SHA256
c37b30a3cbe31e5feba28bb0557017b43d8ef36bd9e5050231518637bbbf3fec

SHA512
3f97124ce80123488d0e14581f632f83f223e8cdc87ac47f7ad094d8fefd3e2354895791226e920fd3fb7381f0b3154821e009d6e79ef900b1d63ab2e4a5bfcc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
162608b691917ea07f170873c27b8b83

SHA1
dd99c6ceec1997d3ebc0965937e78b8d86e0de7c

SHA256
f354519cfdf2bf102084384e89200fa2b8aa1a3638150bde98644fa2f84ccdac

SHA512
41456f653208ed857da25323af238b2501a28f78b8a3099520faa14f10838b95bc6ec3f254ae08b13a10c3f867da58a99df92fa554c17d95af50e583d10edd29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
fb40d2abe303f111e51fed691df1c8b2

SHA1
e11bea8115f11393742afe85523194fbb148330a

SHA256
18228224294caef705abc641de1a74fa8226253bcf5aa56a9028f8429053c6a5

SHA512
22fa7dffa4489c4b4e97555532509c65a83c736d7852a9c99ed028e4d99f7f366ad52ae3ca4dc46670138a50262243c9a7ffa096788e2fcd3faacac342edf2d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
183KB

MD5
3b89d2da38f6769062f4ce3be5a2fcc5

SHA1
0e2489cad2bca898120b2f2205a18c835b430e81

SHA256
f4ef8fa24c181603ee72010eab8c580179de6be5c7e993df87b1b45d58f848a0

SHA512
d00e29de7a5b9d067724657e21943079a2410c2bd96024a7f06cb2b9e84dea586d30ffbaebe0cb54c6752a54c9f5a0ec65acdc8d7419b042527716b27dac78e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DUosLfESJGRt.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
C:\Windows\Installer\e57a018.msi

Filesize
29.3MB

MD5
751eb88d77d640cc9b497aafb5679821

SHA1
2dc4ee60244acd2e135e7f9493bc047da5291cbd

SHA256
a7a6306644c25e96d94c470f5dd1b1666df2b89f83693c5f40a9beb302e5c447

SHA512
75898716b8e5642e20f44c843d0c4e2c3d7ff3f45096fb88ec988caa99f00a949c42bd82a783966acee031f7c150d3bf77f9ae2908236f68c846bd9279ca8d39

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
49778bed573dc45b06cd82da98d3edcc

SHA1
7d2dac0226fddf3395d584feed7e02195cbe450d

SHA256
c05762dcffcfa08bf8f20b7f93991af4b1345891edcd0f88a552c4900706b13b

SHA512
044c342fb277dd5f3853d5dd147605ec87db597e243de619feb86e8d5583cae3cf4fab61900623a54680175620a4c87d81a9987975900d9d73e3b6c52ae99f4f

Download Submit
\??\Volume{f171a6e7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{50a8ac38-bbf1-4c8d-a365-e9634e6f0daa}_OnDiskSnapshotProp

Filesize
6KB

MD5
c320b966774be5a72e990406bbf2f3d0

SHA1
1bab48176abc3fca6456bbedb63ff285d3824fea

SHA256
505e9568bdeed5be979df438b952a50bf644f072b6a7fce8817daa6fc40e0060

SHA512
0ec6b8fbcaa96113f1c1661d66a60af17991fa48b3fab79f52767ab6de7e2573265a515663c4c54155fd5aa386936f4a50294587b64b0626a37d3d93763414fa

Download Submit
memory/708-154-0x000000002B940000-0x000000002BAFB000-memory.dmp

Filesize
1.7MB

Download
memory/708-123-0x000000002B940000-0x000000002BAFB000-memory.dmp

Filesize
1.7MB

Download
memory/708-122-0x0000000029D40000-0x0000000029D83000-memory.dmp

Filesize
268KB

Download
memory/4024-54-0x0000000000210000-0x00000000002E6000-memory.dmp

Filesize
856KB

Download