gh0strat | 46334ecbb566c047a2fd9fa81ca12789e9eb299f2dcc18b0c78255f8edae616a

Analysis

max time kernel
300s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chrmroe-intraller.msi
Size

43.5MB
MD5

113a2eab7ccf51501146194bbaadb175
SHA1

de00c7a8ff5b49adec8bc44eba7f6332446f0e8f
SHA256

4cab134dbaf1059613f44da615292af5713a0aa3a0185abda0cf1ebf8a7dc9a4
SHA512

ce681034d9c3cad7367fa2a541401036651ce79385524b10f8ea0287c6c6e1bd307c82d339056d6f2e2fd48cbdd05e80650c1b5acb62b55772b4157d3ef9c13e
SSDEEP

786432:KPmAYqjq7J2mESTU1A2SBaUCAkEPstiz7Ngv9iJ67P3+OBrIU7:d4m5U1A2SMUxstiz7NGYJ673z9

Score

10^/10

gh0strat purplefox discovery evasion execution persistence privilege_escalation rat rootkit spyware stealer trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 5 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral1/memory/1244-172-0x000000002B4D0000-0x000000002B68C000-memory.dmp	purplefox_rootkit
behavioral1/memory/1244-174-0x000000002B4D0000-0x000000002B68C000-memory.dmp	purplefox_rootkit
behavioral1/memory/1244-175-0x000000002B4D0000-0x000000002B68C000-memory.dmp	purplefox_rootkit
behavioral1/memory/1244-176-0x000000002B4D0000-0x000000002B68C000-memory.dmp	purplefox_rootkit
behavioral1/memory/1244-177-0x000000002B4D0000-0x000000002B68C000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1244-172-0x000000002B4D0000-0x000000002B68C000-memory.dmp	family_gh0strat
behavioral1/memory/1244-174-0x000000002B4D0000-0x000000002B68C000-memory.dmp	family_gh0strat
behavioral1/memory/1244-175-0x000000002B4D0000-0x000000002B68C000-memory.dmp	family_gh0strat
behavioral1/memory/1244-176-0x000000002B4D0000-0x000000002B68C000-memory.dmp	family_gh0strat
behavioral1/memory/1244-177-0x000000002B4D0000-0x000000002B68C000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
1908	powershell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

setup.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\129.0.6668.103\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exeqMdeNKsXYpNq.exe

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\U:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\X:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\L:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\S:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\T:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\Y:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\V:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\Z:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\K:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\M:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\N:	qMdeNKsXYpNq.exe
File opened (read-only)	\??\R:	qMdeNKsXYpNq.exe

Drops file in System32 directory 12 IoCs

Processes:

updater.exevKtMPwVbdMUU.exesetup.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD	updater.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\vKtMPwVbdMUU.exe.log	vKtMPwVbdMUU.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	updater.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe

Drops file in Program Files directory 64 IoCs

Processes:

updater.exeupdater.exesetup.exeChromeSetup.exeupdater.exeupdater.exevKtMPwVbdMUU.exechrome.exeJkRyrlfVyEOH.exeupdater.exeupdater.exeupdater.exe129.0.6668.103_chrome_installer.exemsiexec.exesetup.exevKtMPwVbdMUU.exe

description	ioc	Process
File created	C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\uninstall.cmd	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe5824d9.TMP	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\default_apps\external_extensions.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\dxil.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\nl.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\chrome_elf.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\notification_helper.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\tr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	ChromeSetup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe584c94.TMP	updater.exe
File opened for modification	C:\Program Files\UtilizeDynamicWorker\vKtMPwVbdMUU.wrapper.log	vKtMPwVbdMUU.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\af.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\en-US.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\dxcompiler.dll	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4056_2046841351\_metadata\verified_contents.json	chrome.exe
File created	C:\Program Files\UtilizeDynamicWorker\qMdeNKsXYpNq.exe	JkRyrlfVyEOH.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad\settings.dat	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\it.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\VisualElements\LogoBeta.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\VisualElements\LogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\da.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File created	C:\Program Files\UtilizeDynamicWorker\ChromeSetup.exe	JkRyrlfVyEOH.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\uninstall.cmd	updater.exe
File opened for modification	C:\Program Files\chrome_installer.log	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\icudtl.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\el.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\sv.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\th.pak	setup.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\CR_224A3.tmp\setup.exe	129.0.6668.103_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\d3dcompiler_47.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\hu.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\kn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\nb.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\sl.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\sw.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\libGLESv2.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\vk_swiftshader.dll	setup.exe
File created	C:\Program Files\UtilizeDynamicWorker\UE4PrereqSetup_x64.exe	msiexec.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe	updater.exe
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\de.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4056_567464446\manifest.fingerprint	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4056_2046841351\LICENSE.txt	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\te.pak	setup.exe
File created	C:\Program Files (x86)\Google4780_1438284957\updater.7z	ChromeSetup.exe
File opened for modification	C:\Program Files\UtilizeDynamicWorker\vKtMPwVbdMUU.wrapper.log	vKtMPwVbdMUU.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\129.0.6668.103_chrome_installer.exe	updater.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\ko.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\Locales\vi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5056_86072594\Chrome-bin\129.0.6668.103\resources.pak	setup.exe

Drops file in Windows directory 8 IoCs

Processes:

msiexec.exe

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57f656.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E4586484-5C27-4883-9D5F-77C1C7E5F0BA}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF78F.tmp	msiexec.exe
File created	C:\Windows\Installer\e57f658.msi	msiexec.exe
File created	C:\Windows\Installer\e57f656.msi	msiexec.exe

Executes dropped EXE 37 IoCs

Processes:

JkRyrlfVyEOH.exeqMdeNKsXYpNq.exeChromeSetup.exevKtMPwVbdMUU.exeupdater.exeupdater.exeupdater.exeupdater.exeupdater.exeupdater.exevKtMPwVbdMUU.exevKtMPwVbdMUU.exeqMdeNKsXYpNq.exeqMdeNKsXYpNq.exe129.0.6668.103_chrome_installer.exesetup.exesetup.exesetup.exesetup.exechrome.exechrome.exechrome.exechrome.exechrome.exeelevation_service.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeupdater.exeupdater.exechrome.exechrome.exechrome.exe

pid	Process
3300	JkRyrlfVyEOH.exe
2140	qMdeNKsXYpNq.exe
4780	ChromeSetup.exe
5020	vKtMPwVbdMUU.exe
1752	updater.exe
3420	updater.exe
2192	updater.exe
4392	updater.exe
3872	updater.exe
1804	updater.exe
3712	vKtMPwVbdMUU.exe
3844	vKtMPwVbdMUU.exe
2644	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
708	129.0.6668.103_chrome_installer.exe
5056	setup.exe
3260	setup.exe
4400	setup.exe
3672	setup.exe
4056	chrome.exe
2392	chrome.exe
4532	chrome.exe
1680	chrome.exe
4412	chrome.exe
4764	elevation_service.exe
3712	chrome.exe
1516	chrome.exe
2424	chrome.exe
5164	chrome.exe
5396	chrome.exe
5404	chrome.exe
5928	chrome.exe
4764	updater.exe
5252	updater.exe
5836	chrome.exe
1912	chrome.exe
5400	chrome.exe

Loads dropped DLL 38 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	Process
4056	chrome.exe
2392	chrome.exe
4056	chrome.exe
1680	chrome.exe
1680	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4412	chrome.exe
3712	chrome.exe
4412	chrome.exe
3712	chrome.exe
1516	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
1516	chrome.exe
2424	chrome.exe
2424	chrome.exe
5164	chrome.exe
5164	chrome.exe
5396	chrome.exe
5396	chrome.exe
5404	chrome.exe
5404	chrome.exe
5928	chrome.exe
5928	chrome.exe
5836	chrome.exe
5836	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
5400	chrome.exe
5400	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

updater.exeupdater.exeupdater.exeupdater.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

Processes:

msiexec.exe

pid	Process
3816	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

qMdeNKsXYpNq.exeupdater.exeJkRyrlfVyEOH.exeupdater.exeupdater.exeqMdeNKsXYpNq.exeupdater.exeupdater.exeupdater.exeqMdeNKsXYpNq.exeChromeSetup.exeupdater.exeupdater.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qMdeNKsXYpNq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JkRyrlfVyEOH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qMdeNKsXYpNq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qMdeNKsXYpNq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

129.0.6668.103_chrome_installer.exesetup.exe

pid	Process
708	129.0.6668.103_chrome_installer.exe
5056	setup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009fc5eef0dbaffe7c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009fc5eef00000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809009fc5eef0000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9fc5eef0000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009fc5eef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

qMdeNKsXYpNq.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	qMdeNKsXYpNq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	qMdeNKsXYpNq.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

updater.exechrome.exepowershell.exemsiexec.exechrome.exechrome.exechrome.exechrome.exesetup.exechrome.exechrome.exechrome.exesetup.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\prefs.preference_reset_time = "73ADC59CB32A0CB8A482F44DD0295C297759DB77E886FEE02B47326F586F2E59"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\browser.show_home_button = "3F867C5C3E0FDBD656D0C525A48A884B88F58BB5D03DFCD704536F264C14F69E"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133740550558139858"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\session.restore_on_startup = "5DA43A1C39BBCD3C004D47C887DD19D6367136E5887322210D862749B49FC4CB"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi = "0EE9C9DEF144C218C6D3FE385B1379283661A3AA94E414B0E9056B1AD667642E"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_signed_in_username = "0B0F89A66BE40FCC6FFF3E77C6269399222A2B1A67B1619BAFEE830E653FB8E7"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi = "90CE4F1DFDCACEDBE5F9FE6B7DE479C59890ECDFD16613AB19F6AF9516D0198D"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\safebrowsing.incidents_sent = "9B9AF56D8340E63FA2D43CA2B7462A02038E9F8A16E53F539E9DEA0982E7E71C"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ahfgeienlihckogmohjhadlkjgocpleb = "CD7C25654B711CD4C5256606AB49A037C598772BAB000FB1226D76CC0AD64BD7"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\mhjfbmdgcfjbbpaeojofohoefgiehjai = "08FF327119E2268EB33892520B87FA7F9EAD941D17D67CEA5220B01184006A4B"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\search_provider_overrides = "B0D75778C1A6E1B2B513CD2C6FA4D61893562504DBEE49839A3616EAC725908B"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\UsageStatsInSample = "0"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.account_id = "103D17C00EF68B76001AF2D37E20147487D21E84A6C07EC02BA1B362B56C400E"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\default_search_provider_data.template_url_data = "26F152FE0CB876121B8B34DDBC5D07CAF8E65950698E7B8725652EE2F66D00C1"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\session.startup_urls = "470D5995E528CFC0D8C3527CC4B54B502509C18C639E3E72EEFEAC5D3FF2F2D3"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\lastrun = "13374055051793376"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\neajdppkdcdipfabeoofebfddakdcjhd = "45B8F33FAAD4E77FA4761166148B647A09A26BB6863756E0D5BB10DEFA101A39"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\homepage_is_newtabpage = "E765F56A3D1F898C2EB8DE745FC4CEEC55F50C3EAE70B80122537487028C2FB1"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\dr = "1"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\media.cdm.origin_data = "CFF026CF02E86D8609D55A7DC3AB7AFB3E1EA7B44D40669055C474ED545FBD27"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\state = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\failed_count = "0"	chrome.exe

Modifies registry class 64 IoCs

Processes:

updater.exeupdater.exesetup.exemsiexec.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5BB0C40-8078-5D97-80DD-2C8F4510263D}\1.0\ = "GoogleUpdater TypeLib for IUpdaterInternalCallbackSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ = "IAppBundleWeb"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ = "IPolicyStatus"	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\LocalServer32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\131.0.6776.0\\updater.exe\\4"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib\ = "{F4334319-8210-469B-8262-DD03623FEB5B}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ = "IPolicyStatus"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\ = "IGoogleUpdate3WebSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\TypeLib\ = "{6430040A-5EBD-4E63-A56F-C71D5990F827}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\131.0.6776.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\TypeLib\ = "{247954F9-9EDC-4E68-8CC3-150C2B89EADF}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\129.0.6668.103\\notification_helper.exe\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\TypeLib\ = "{DD42475D-6D46-496A-924E-BD5630B4CBBA}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34527502-D3DB-4205-A69B-789B27EE0414}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\131.0.6776.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ = "ICurrentState"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\TypeLib\ = "{B685B009-DBC4-4F24-9542-A162C3793E77}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34527502-D3DB-4205-A69B-789B27EE0414}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\131.0.6776.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC1132BC-C84F-5D90-9BB6-3D44C6394B28}\TypeLib\ = "{FC1132BC-C84F-5D90-9BB6-3D44C6394B28}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4846854E72C53884D9F5771C7C5E0FAB\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0\ = "GoogleUpdater TypeLib for IProcessLauncher2System"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\TypeLib\ = "{F63F6F8B-ACD5-413C-A44B-0409136D26CB}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FAAA8C4338A21E940BBDADEAF349A873\4846854E72C53884D9F5771C7C5E0FAB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\TypeLib\ = "{1588C1A8-27D9-563E-9641-8D20767FB258}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\131.0.6776.0\\updater.exe\\6"	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\ProgID	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\131.0.6776.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\TypeLib\ = "{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ServiceParameters = "--com-service"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ = "IAppCommandWeb"	updater.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exepowershell.exeqMdeNKsXYpNq.exeupdater.exeupdater.exeupdater.exevKtMPwVbdMUU.exeqMdeNKsXYpNq.exeqMdeNKsXYpNq.exe

pid	Process
3560	msiexec.exe
3560	msiexec.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
2140	qMdeNKsXYpNq.exe
2140	qMdeNKsXYpNq.exe
1752	updater.exe
1752	updater.exe
1752	updater.exe
1752	updater.exe
1752	updater.exe
1752	updater.exe
2192	updater.exe
2192	updater.exe
2192	updater.exe
2192	updater.exe
2192	updater.exe
2192	updater.exe
3872	updater.exe
3872	updater.exe
3872	updater.exe
3872	updater.exe
3872	updater.exe
3872	updater.exe
3844	vKtMPwVbdMUU.exe
3844	vKtMPwVbdMUU.exe
2644	qMdeNKsXYpNq.exe
2644	qMdeNKsXYpNq.exe
2644	qMdeNKsXYpNq.exe
2644	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe
1244	qMdeNKsXYpNq.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid	Process
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exepowershell.exesrtasks.exeJkRyrlfVyEOH.exe

description	pid	Process
Token: SeShutdownPrivilege	3816	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3816	msiexec.exe
Token: SeSecurityPrivilege	3560	msiexec.exe
Token: SeCreateTokenPrivilege	3816	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3816	msiexec.exe
Token: SeLockMemoryPrivilege	3816	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3816	msiexec.exe
Token: SeMachineAccountPrivilege	3816	msiexec.exe
Token: SeTcbPrivilege	3816	msiexec.exe
Token: SeSecurityPrivilege	3816	msiexec.exe
Token: SeTakeOwnershipPrivilege	3816	msiexec.exe
Token: SeLoadDriverPrivilege	3816	msiexec.exe
Token: SeSystemProfilePrivilege	3816	msiexec.exe
Token: SeSystemtimePrivilege	3816	msiexec.exe
Token: SeProfSingleProcessPrivilege	3816	msiexec.exe
Token: SeIncBasePriorityPrivilege	3816	msiexec.exe
Token: SeCreatePagefilePrivilege	3816	msiexec.exe
Token: SeCreatePermanentPrivilege	3816	msiexec.exe
Token: SeBackupPrivilege	3816	msiexec.exe
Token: SeRestorePrivilege	3816	msiexec.exe
Token: SeShutdownPrivilege	3816	msiexec.exe
Token: SeDebugPrivilege	3816	msiexec.exe
Token: SeAuditPrivilege	3816	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3816	msiexec.exe
Token: SeChangeNotifyPrivilege	3816	msiexec.exe
Token: SeRemoteShutdownPrivilege	3816	msiexec.exe
Token: SeUndockPrivilege	3816	msiexec.exe
Token: SeSyncAgentPrivilege	3816	msiexec.exe
Token: SeEnableDelegationPrivilege	3816	msiexec.exe
Token: SeManageVolumePrivilege	3816	msiexec.exe
Token: SeImpersonatePrivilege	3816	msiexec.exe
Token: SeCreateGlobalPrivilege	3816	msiexec.exe
Token: SeBackupPrivilege	3980	vssvc.exe
Token: SeRestorePrivilege	3980	vssvc.exe
Token: SeAuditPrivilege	3980	vssvc.exe
Token: SeBackupPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeBackupPrivilege	4076	srtasks.exe
Token: SeRestorePrivilege	4076	srtasks.exe
Token: SeSecurityPrivilege	4076	srtasks.exe
Token: SeTakeOwnershipPrivilege	4076	srtasks.exe
Token: SeBackupPrivilege	4076	srtasks.exe
Token: SeRestorePrivilege	4076	srtasks.exe
Token: SeSecurityPrivilege	4076	srtasks.exe
Token: SeTakeOwnershipPrivilege	4076	srtasks.exe
Token: SeRestorePrivilege	3300	JkRyrlfVyEOH.exe
Token: 35	3300	JkRyrlfVyEOH.exe
Token: SeSecurityPrivilege	3300	JkRyrlfVyEOH.exe
Token: SeSecurityPrivilege	3300	JkRyrlfVyEOH.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

msiexec.exechrome.exe

pid	Process
3816	msiexec.exe
3816	msiexec.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	Process
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMsiExec.exeChromeSetup.exeupdater.exeupdater.exeupdater.exevKtMPwVbdMUU.exeqMdeNKsXYpNq.exe129.0.6668.103_chrome_installer.exesetup.exesetup.exechrome.exe

description	pid	Process	procid_target
PID 3560 wrote to memory of 4076	3560	msiexec.exe	100
PID 3560 wrote to memory of 4076	3560	msiexec.exe	100
PID 3560 wrote to memory of 448	3560	msiexec.exe	102
PID 3560 wrote to memory of 448	3560	msiexec.exe	102
PID 448 wrote to memory of 1908	448	MsiExec.exe	103
PID 448 wrote to memory of 1908	448	MsiExec.exe	103
PID 448 wrote to memory of 3300	448	MsiExec.exe	105
PID 448 wrote to memory of 3300	448	MsiExec.exe	105
PID 448 wrote to memory of 3300	448	MsiExec.exe	105
PID 448 wrote to memory of 2140	448	MsiExec.exe	107
PID 448 wrote to memory of 2140	448	MsiExec.exe	107
PID 448 wrote to memory of 2140	448	MsiExec.exe	107
PID 448 wrote to memory of 4780	448	MsiExec.exe	108
PID 448 wrote to memory of 4780	448	MsiExec.exe	108
PID 448 wrote to memory of 4780	448	MsiExec.exe	108
PID 4780 wrote to memory of 1752	4780	ChromeSetup.exe	111
PID 4780 wrote to memory of 1752	4780	ChromeSetup.exe	111
PID 4780 wrote to memory of 1752	4780	ChromeSetup.exe	111
PID 1752 wrote to memory of 3420	1752	updater.exe	112
PID 1752 wrote to memory of 3420	1752	updater.exe	112
PID 1752 wrote to memory of 3420	1752	updater.exe	112
PID 2192 wrote to memory of 4392	2192	updater.exe	114
PID 2192 wrote to memory of 4392	2192	updater.exe	114
PID 2192 wrote to memory of 4392	2192	updater.exe	114
PID 3872 wrote to memory of 1804	3872	updater.exe	116
PID 3872 wrote to memory of 1804	3872	updater.exe	116
PID 3872 wrote to memory of 1804	3872	updater.exe	116
PID 3844 wrote to memory of 2644	3844	vKtMPwVbdMUU.exe	122
PID 3844 wrote to memory of 2644	3844	vKtMPwVbdMUU.exe	122
PID 3844 wrote to memory of 2644	3844	vKtMPwVbdMUU.exe	122
PID 2644 wrote to memory of 1244	2644	qMdeNKsXYpNq.exe	123
PID 2644 wrote to memory of 1244	2644	qMdeNKsXYpNq.exe	123
PID 2644 wrote to memory of 1244	2644	qMdeNKsXYpNq.exe	123
PID 3872 wrote to memory of 708	3872	updater.exe	124
PID 3872 wrote to memory of 708	3872	updater.exe	124
PID 708 wrote to memory of 5056	708	129.0.6668.103_chrome_installer.exe	126
PID 708 wrote to memory of 5056	708	129.0.6668.103_chrome_installer.exe	126
PID 5056 wrote to memory of 3260	5056	setup.exe	127
PID 5056 wrote to memory of 3260	5056	setup.exe	127
PID 5056 wrote to memory of 4400	5056	setup.exe	128
PID 5056 wrote to memory of 4400	5056	setup.exe	128
PID 4400 wrote to memory of 3672	4400	setup.exe	129
PID 4400 wrote to memory of 3672	4400	setup.exe	129
PID 1752 wrote to memory of 4056	1752	updater.exe	131
PID 1752 wrote to memory of 4056	1752	updater.exe	131
PID 4056 wrote to memory of 2392	4056	chrome.exe	132
PID 4056 wrote to memory of 2392	4056	chrome.exe	132
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133
PID 4056 wrote to memory of 4532	4056	chrome.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Chrmroe-intraller.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3816

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 26D2B515D011B7D88D0CC1E400149435 E Global\MSI0000
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\UtilizeDynamicWorker'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1908
- - C:\Program Files\UtilizeDynamicWorker\JkRyrlfVyEOH.exe
    "C:\Program Files\UtilizeDynamicWorker\JkRyrlfVyEOH.exe" x "C:\Program Files\UtilizeDynamicWorker\ZcOUMgAKFaEfsJXTUJeF" -o"C:\Program Files\UtilizeDynamicWorker\" -psiCMjwFfLqezcQPgBfEe -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3300
- - C:\Program Files\UtilizeDynamicWorker\qMdeNKsXYpNq.exe
    "C:\Program Files\UtilizeDynamicWorker\qMdeNKsXYpNq.exe" -number 276 -file file3 -mode mode3 -flag flag3
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2140
- - C:\Program Files\UtilizeDynamicWorker\ChromeSetup.exe
    "C:\Program Files\UtilizeDynamicWorker\ChromeSetup.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Program Files (x86)\Google4780_1438284957\bin\updater.exe
      "C:\Program Files (x86)\Google4780_1438284957\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={0831CB51-605E-C38D-DE8B-88614C43BE12}&lang=zh-CN&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\Program Files (x86)\Google4780_1438284957\bin\updater.exe
        
        "C:\Program Files (x86)\Google4780_1438284957\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=131.0.6776.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x1386290,0x138629c,0x13862a8
        5⤵
        Drops file in Program Files directory
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3420
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        5⤵
        Checks system information in the registry
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4056
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=129.0.6668.103 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffccbe7bf8,0x7fffccbe7c04,0x7fffccbe7c10
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2392
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1944,i,17412517828461445635,6520295115232082182,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1936 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4532
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=2104,i,17412517828461445635,6520295115232082182,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2168 /prefetch:3
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:1680
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2332,i,17412517828461445635,6520295115232082182,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2680 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4412
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3036,i,17412517828461445635,6520295115232082182,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3080 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3712
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3056,i,17412517828461445635,6520295115232082182,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1516
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4384,i,17412517828461445635,6520295115232082182,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4128 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2424
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4700,i,17412517828461445635,6520295115232082182,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4760 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5164
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4824,i,17412517828461445635,6520295115232082182,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4680 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5396
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4816,i,17412517828461445635,6520295115232082182,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4976 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5404
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4356,i,17412517828461445635,6520295115232082182,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5344 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5928
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=212,i,17412517828461445635,6520295115232082182,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4724 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5836
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5636,i,17412517828461445635,6520295115232082182,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5412 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:1912
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=1160,i,17412517828461445635,6520295115232082182,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5412 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3980

C:\Program Files\UtilizeDynamicWorker\vKtMPwVbdMUU.exe
"C:\Program Files\UtilizeDynamicWorker\vKtMPwVbdMUU.exe" install
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
PID:5020

C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=131.0.6776.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x4b6290,0x4b629c,0x4b62a8
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4392

C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=131.0.6776.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x4b6290,0x4b629c,0x4b62a8
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1804
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\129.0.6668.103_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\129.0.6668.103_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\fef71f96-2af1-495d-b2a8-a17b90267d23.tmp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\CR_224A3.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\CR_224A3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\CR_224A3.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\fef71f96-2af1-495d-b2a8-a17b90267d23.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\CR_224A3.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\CR_224A3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=129.0.6668.103 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff77827c628,0x7ff77827c634,0x7ff77827c640
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:3260
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\CR_224A3.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\CR_224A3.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:4400
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\CR_224A3.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\CR_224A3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=129.0.6668.103 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff77827c628,0x7ff77827c634,0x7ff77827c640
        5⤵
        Executes dropped EXE
        
        PID:3672

C:\Program Files\UtilizeDynamicWorker\vKtMPwVbdMUU.exe
"C:\Program Files\UtilizeDynamicWorker\vKtMPwVbdMUU.exe" start
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:3712

C:\Program Files\UtilizeDynamicWorker\vKtMPwVbdMUU.exe
"C:\Program Files\UtilizeDynamicWorker\vKtMPwVbdMUU.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Program Files\UtilizeDynamicWorker\qMdeNKsXYpNq.exe
  "C:\Program Files\UtilizeDynamicWorker\qMdeNKsXYpNq.exe" -number 236 -file file3 -mode mode3 -flag flag3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Program Files\UtilizeDynamicWorker\qMdeNKsXYpNq.exe
    "C:\Program Files\UtilizeDynamicWorker\qMdeNKsXYpNq.exe" -number 362 -file file3 -mode mode3 -flag flag3
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1244

C:\Program Files\Google\Chrome\Application\129.0.6668.103\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\129.0.6668.103\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6000

C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:4764
- C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=131.0.6776.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x4b6290,0x4b629c,0x4b62a8
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57f657.rbs

Filesize
7KB

MD5
1ad202b8e486a27f1dee19c097695d8c

SHA1
4296c958ff8c34eef43c7f65e3b57fe0356d3155

SHA256
9619c3a2921b8259973daa03391ad2bdbfbef05a405b7991ece24587847b84e4

SHA512
0be5ad7b43ec3f98d377b41301c85843e89c0d01547c044f7dfac25caa15bb939e93d4469390268bf06d23a31a5a9c205ed6426e0c5aec8cee6c5465d7f2ed11

Download Submit
C:\Program Files (x86)\Google4780_1438284957\bin\updater.exe

Filesize
5.3MB

MD5
e2937e33c2554eecc37c804a7f99f8b7

SHA1
2c33d4573e21c7d18de1d3f337bacd7c4e58fe87

SHA256
5dde29f028e75ee72f50902d20c41b699ef8fc5c294f04a321deac6909ffe409

SHA512
cf50e630cd75483f5887153490ab5c55e21a711541d0a4aa0e29d055f42076f7d58edf743bff26e145b56a69b6be9f6704e9c2b071be0aa5a7f6cc1f6be3406f

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad\settings.dat

Filesize
40B

MD5
523327372f4189119f828563eca31b3c

SHA1
69c6e543445918fc112d0ded8af48cb1a854590f

SHA256
18f2bb4b090e5cfd2b6006e4d1b81652c12af4780c492dc4fcb250e684d2f685

SHA512
f4aac00de9e3cb3e57c86feefaedc6149535d4f4959f0ade961e3e29f9a797e047a2e98e8351375a227c1172b796513827759c077172d445adcb0f9ab2fb0d4e

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
503B

MD5
2a14921477a7bc707dda3026839b1928

SHA1
1cce3b1510e7b921db293c70314e10deb3d40722

SHA256
4fbdcf95121f305691a2e01dd805bddfd97d13a528a3309f771ea24105197a9c

SHA512
5471da4c974a341dcd385efb96dd5458bd031e1b8474275347f3d80d25f1689bd7680dccda988718930fe760568a5c2e9e43c10c5e2ac50e2ed0c450a464913a

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
354B

MD5
61e150bfd9fe9c9fe354b74b4c535215

SHA1
6702e4d555315b91f7df284caa7c819d87cb5466

SHA256
b403d8e714539402c473a85d2b51069bf3dac127ec139c97a0bbeeb1b6409f37

SHA512
3400d796aefa86784395b92300a4125c2faf6bb01bf87c3827e44340a92d44ed65637e844770a30cddc337c2f4bdce154f554e4bf4ab50f2b3ce2fc36909d969

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
603B

MD5
6ac709d189c64b64f38bc73ba0777fbb

SHA1
d68c4ac12634d877d6a5fbecbc114512a1e9dc18

SHA256
7f4c6343eda3d88e488efc60c3514fcd94d20e862fe35facfd5a6c07f5a0b31a

SHA512
856e1f5a59f41d7d418132b34087153cc47d1aaae4c109b0b3ef438b3d401cbc618f04755bb20e4ec27547f47bc017db85ca7bf502b6931542d056f68e3239d1

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
603B

MD5
44f59efc96788146d3a5c0578b3d287f

SHA1
33e389a052d978e04648ffb56b2e9fc81caa71ab

SHA256
671061b5a5702a1190fc0b28d7ce386a5b8037f56e0fbfa19c2fa745a41e2121

SHA512
8ec03a73351b06917e64a5b40f13e9fb19e6e8b3c328e46bbd5fe688649cdea1f24822e4b37451455462da18142f9e2ed34f518588e2d79457d7de7a3cebe7ef

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
49B

MD5
4a2784f1ca879e8fbbd97e39d0de3cc9

SHA1
a0eb8b63b4b19b134b46fea8e66f819105f004e8

SHA256
2bcd0a4051b1fa5b0444cee9fd9f7341fafe1eae36659511926ebefba648dee9

SHA512
95e64a2afbdba5943410f912eba5bc626cbe775c14dd8a3ac8fb6c8c0301762190c15844f2776f894088cf937450e383464592bee8e24308c6f90029d5a57f57

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
9KB

MD5
426d7121dd2ceae4aefe8c85ef20bd18

SHA1
4e1ec2b070d5e11fc09241257823985d2126e46b

SHA256
b1557a8c701b73dd0e6a391403f25efd0b816289c158cb182fb63ca7afb50304

SHA512
3fa12749d29a7ec48a005c00b9c7f75775684e389882779f8edd68f2ef9e2b6d9a2272ae211772675ac882644b6e51f089d548ce305b8c391a2c2d0d2ffa7b40

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
10KB

MD5
a18e5b433a575dcc946bec048462d231

SHA1
6dfd750799efa42a0b82ee968477bbd5784219a7

SHA256
6e3f8ddf754a88cf9b47b57a70377fc3768343e3d7f369233e78c149b57d5c52

SHA512
3cb559140d55641459da7a94f5a115c6a6bbd9b9aabc88faf7590c3d44e577c74de45778e8d0ad8a21df76fd40feb11888ff18b6ba7eb40f2f73b425a81f79c8

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
ae39915b81ae4652ddfda99d96a36270

SHA1
992bff6955e52c21b893abeb434b576ff6b7d65e

SHA256
5d3ee33c8c737119a5e994e8ade5ea00c0de44140057065ffa6a983a5424e66e

SHA512
528d68f4a952e6ca1f091266002f0c0a16aab82bb56f21e33efa97ac2d941901a59c1cbc7a41cddc01580d4ca4e1a3b209e654757a8c67d72f8a0c401ee4ae98

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
18152b906b0ee7de5a05f15b79e18e4a

SHA1
78f93518a5f53f91f17bef9d73b3b46c42c26efb

SHA256
171e78868d45dcc08e1ec2bdfee89695e9f630eede5325412a0f451f9b747a6a

SHA512
f9e92338e6d643e00b98dce6d9a08024ce944440c348bef0142efcac9f1b34bbc530bd8bbed519b8443a8f48c476d17f92e62237b919145e100361d1ef353477

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
4KB

MD5
a11a547859a77b85714e6fcf681ccd2e

SHA1
ac01a23f514dc7653501ddd98d556c9c18e0657c

SHA256
bb6acadcb4117c44f8ea9df5cd82b2a9b273b71f0491a830f3befd25ff796069

SHA512
150d8aa29a3ae08752ab46e7a1d0d5d729a2a1d15f764f1469a027b20c4a3e9d74955363411c34eb63e7c346dcf328851af38f26bee792afb0eca5876eaad7e7

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
6KB

MD5
987297eb1d87575743898681652d3cf1

SHA1
cb75d96b560184186c3f05dd903e31c65d027b17

SHA256
8681f282436776bab84b0a5017624e206dc0273d32d9802076e9257cb062b866

SHA512
faf62c358d0045ac7fab4fff56f2f22b7da878cbcab18c7796955c02e6ff70aaf18ef7b8319ebd44c3dd8c3c946bf92e22fd2d394ed50963dc915403424aab3f

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\CR_224A3.tmp\setup.exe

Filesize
5.8MB

MD5
6a3cc882889792cb84332a0decd2924d

SHA1
6b0f364951a6fdb00a69db247b5dc43d7e8e833e

SHA256
406be6fd6a06a972c49c635d80b7dcb719c7f807ba4c2891e0622eed17b8f5e2

SHA512
cf1e944914a7273450554f2209d3eedeb0b1a71ad9926d17833ad1bec38ae060418609d463797483466a4ac43d075c9daf28b66774ea99d67e90a10cf1ed34db

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3872_1980349256\fef71f96-2af1-495d-b2a8-a17b90267d23.tmp

Filesize
685KB

MD5
5c28084b121985584262517e024685c7

SHA1
e3ccdaba1aeea21479f67e991fb89329c2d78a7e

SHA256
ad9a0f1128d035014b8bee6e807360439d82f7277b0da0d6929f2deeb2b94830

SHA512
908dd1e9258f6160248bc031a47cd892e67969b6a93d8dc6a9e4c389c11a80d7bb418a062aab6ba16714a01aebe4dc2c7277f869c98b13aca660f2d89cc6a9fe

Download Submit
C:\Program Files\Crashpad\settings.dat

Filesize
40B

MD5
f01e65058c636560dd0255771ab123da

SHA1
b33200d635cf05e3820e05f7b7bb5d04772146b2

SHA256
20aac04791cdc0e6c4e8dc0f00125ff91daee53992a1ce2e71d8186e00c6a395

SHA512
adf73d69a20328e5a3c0cbe3f0a99951ecaa119c50182cc2d661a39d707e90440dce3506e8ed4e6c9ac8e569106dd400481e950dd42113d21385bcebec95d58d

Download Submit
C:\Program Files\Google\Chrome\Application\129.0.6668.103\chrome_elf.dll

Filesize
1.2MB

MD5
0f61d9246581ad731575f75a17a75740

SHA1
712affee57a59e3b2d474c20850599e8dea97ff6

SHA256
099332f8a614c06ad7b2aad95f1b7cb23acf7ec8eec71db66f4a0218d69b85a9

SHA512
4f85770cb6e36d3a8ec8b0fd54927a0611e20911c4ba3ade5a7efcf48ca033f9c632734eb4109f6a1c532c608d9ac186a567fded21b89b958edfa6c2c0a2ff75

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.6MB

MD5
288f28f03331a01efae3bdfbfadaf9e4

SHA1
34a10607a6d35b5bb9a687cf8f24b034fd437969

SHA256
b5dbfe6a43c410e23657720edcbd63bc5e9b1592dc3fa2b789b42dcadd0d9b46

SHA512
74544cdf2423de189bd6f1bff2f50e6ebd5ec28a7e19196e5cf28bc04632a5cbf1522fe363694583266208335c65751e85a68fef36de5918d9337bda7fdeaa82

Download Submit
C:\Program Files\UtilizeDynamicWorker\ChromeSetup.exe

Filesize
9.7MB

MD5
29c9848749d11cdac06f5c1ab27ae9e4

SHA1
bb6b142e7b29e8f3a523bd238697622d828a9b5a

SHA256
94b57aa9cb18f206c72031d9ac8ae1fd3dc00d9248f66cf2dc75593a156534e0

SHA512
176073947ca2be3bf05834a07a64c3db0de7ed11d77704af862164bb91aabc5f08e7d5b53a7fc7bb67fc5d8480ab322272414b81d56d9a565339ea9ead1adb18

Download Submit
C:\Program Files\UtilizeDynamicWorker\JkRyrlfVyEOH.exe

Filesize
577KB

MD5
11fa744ebf6a17d7dd3c58dc2603046d

SHA1
d99de792fd08db53bb552cd28f0080137274f897

SHA256
1b16c41ae39b679384b06f1492b587b650716430ff9c2e079dca2ad1f62c952d

SHA512
424196f2acf5b89807f4038683acc50e7604223fc630245af6bab0e0df923f8b1c49cb09ac709086568c214c3f53dcb7d6c32e8a54af222a3ff78cfab9c51670

Download Submit
C:\Program Files\UtilizeDynamicWorker\UE4PrereqSetup_x64.exe

Filesize
39.1MB

MD5
a688d249c498d4d3b89ed876c8239520

SHA1
25bdaa9b0a339099e10cf9c26e8abdcd67a9e583

SHA256
145f4e4d11e76a2612db5ffbfae8f9ab8e4385ff7660802ffd2f473c9dcb2a0d

SHA512
ca24eee29e9ae1c919b98d1f5e41b96566c86b1e40e30f3f6c7fb5c7e4049f92fb64afa4c87e8e815d3926b9cac17d0347f1f9b69d06e01303ffcb1815efecc1

Download Submit
C:\Program Files\UtilizeDynamicWorker\ZcOUMgAKFaEfsJXTUJeF

Filesize
4.3MB

MD5
b9b51255b7e495877496c1e6758e3871

SHA1
0c042a1ef84828b4e0f2d4e6046197c3a5eb8a7b

SHA256
7659a1bd1d45ee4dd54592de56ba0b669344cc205aa0894c4e98e2fb8003f268

SHA512
7c7a5399fdac2d7ed176b438f9475a3da715fb16e09a0b71f208f34a5620baf84287e8d16a91fdcd84284b7babc94f65a134fa92ec19ce698f97153b64ea7b29

Download Submit
C:\Program Files\UtilizeDynamicWorker\qMdeNKsXYpNq.exe

Filesize
3.0MB

MD5
57761e35f3375adb749fb9e14f423a21

SHA1
5deb274e82085ad21911ce9abb91d466e556fb4a

SHA256
08526d64f255bb798037b7f475bc8cad40a860e4fe68eeb52f9b9f0eb0ef0231

SHA512
e1f6fa277e7f34b961b51065ae10c190d5a453b9188f5ee5ced62706136fbbd6727db48efdbea3599fb82f4c6485313674fa458e5b7f9bde6cb7f0664de81c1e

Download Submit
C:\Program Files\UtilizeDynamicWorker\vKtMPwVbdMUU.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\UtilizeDynamicWorker\vKtMPwVbdMUU.wrapper.log

Filesize
431B

MD5
ba7a312ad5c4a696d32c9fdd9e378391

SHA1
4e936e0a67490abf860f07cb9a43584fe1ed0e7a

SHA256
818ae7d9f3641ba8590eeacba9281897d46f0c6021dedb4416a5e51782e36d61

SHA512
3ec84a39ff1c187f9c981118cc2a8af84ea545a4fbaf962c10259a6dd637d5a5a1466d03520837b21986c03086698a29ab5fb2ec5c00de9bc7670be8123cb684

Download Submit
C:\Program Files\UtilizeDynamicWorker\vKtMPwVbdMUU.wrapper.log

Filesize
495B

MD5
a209d9b7984ad79f3e71e3902592ffb1

SHA1
316c1ff9e9a9c48e204818c78ec3e32eee70c966

SHA256
b767fc990ae107dc7874126a513ea1dea18cdb60123358995e81d1c8e5132360

SHA512
b8283cecb229cf665a047d4882fe11df19da1278ef1d63cb59f4f36f4abfad335d590948acf7c9dfa10e8d7ca724f6cffe44e122e5c95fe96df7ea75dfcdd83f

Download Submit
C:\Program Files\UtilizeDynamicWorker\vKtMPwVbdMUU.wrapper.log

Filesize
932B

MD5
05563f0d8c2e8db4d8fb3ad48e487ca4

SHA1
b1f89402dbe16bd2a20cf64274db1b401a0a09eb

SHA256
f16f14a24d331610037640e78490d7294adcb0486ea9c2e84a196c36ab71618c

SHA512
82bb2b0ead9a6247610e191ed1c2a9059c43347a7a2609f2ff9e1d33ff4de333300135b17f327026580488e9927fa7b54ce9c2866cceb44cadbf7b277093aac7

Download Submit
C:\Program Files\UtilizeDynamicWorker\vKtMPwVbdMUU.xml

Filesize
435B

MD5
37d76145bf06010c75bc5568ae02d55e

SHA1
5b43938e78fd65453c38180a7fa1b5cd8f8eed0a

SHA256
ead679c38ba5857183e7126d5d06a57c9bae54d8c2fae2d4677dd657dc2ca556

SHA512
48a87351f3bab74b734d2c1a9208fbfe72af4879b6d508ce03421a4d63d345c58c3ddc60c15ef820ddefb46041a7a9b44b9d2f1d96cbc34cc1233c3c4989bdaa

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4056_2046841351\manifest.json

Filesize
114B

MD5
3ee731d0e5bfb74cacb3d9e2dfdc7768

SHA1
ee15cb60213bb402fd90308f0f67d7b6160c9751

SHA256
5dbf79f09d999ea982d90df45eb444ebf66a0c700e51d4c9856afbe7326e9d69

SHA512
f38e3fedd392f9b273565cbe321a56051edaf48db75a0ebb539d57e8d1238d4bac41e973f037395f9c5d4a189df5e68726ed2c000134fc36bb7e7295c9a779c1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4056_567464446\crl-set

Filesize
532KB

MD5
b870d33a53ae3528aacaba90864b9cf1

SHA1
741674754c775687993f1f7f47dc816aafae4a32

SHA256
b3a9186ebef2eb013ac27479fd2a290208a8de7e1e849b90e95008c1f748b157

SHA512
14e2f15f68e51d45e9d76e89d82ceb59e04baa6686a31ea0cd5a32797128b0320cb90a0ba068754ac5408678893b0755473c28f76fd45062fb3656fd52e4c69d

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4056_567464446\manifest.json

Filesize
95B

MD5
8128e3a240c9e434d807bfa8a93be8c8

SHA1
42a7d4dc53c5bab66d425a41f8df84eb134e4ac1

SHA256
fcfaf0539abcacafdf8f4a610536d85eb608af04c09a57919e83380597047ed3

SHA512
e5c6a7bcb9536c1ffc366d6cd6b1b9ce45fc65d5adf3979c7cff77fd0885403d6f8abc0681206b95890dc5ba42f88f309f4e5c0bc66be0b8a2bee331b4ae00a9

Download Submit
C:\Program Files\chrome_installer.log

Filesize
21KB

MD5
1df4cc0e83c723a8bb267abd051f1bd8

SHA1
a590ddf2c029fcaff43feaaa90c57f783b0ed7c4

SHA256
d650b0ed50381539d18ff0453fb1eb7d6789edd2804bcc025c1a3e9d9f41eea6

SHA512
2fea8506e50182be54c5fbe84cce6d92c31d56f493db2c66444b72af1f91e878e4ffd32e475d2d2f79f9c85e63d4aa8f514f749b9d980db505a7c29972b4cfcc

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

Filesize
2KB

MD5
7e9cf341e1c7f6e7fcf6ab62b7d15932

SHA1
0a7c76ee124cf3633ea105af68a8570226dbaec3

SHA256
ffc22b8f11643ee78dffb8c01cda36d751b63d1abecb15a823f89514f6de96a3

SHA512
35d86515d814f372ed0f099299e9c644f85ffd8766adbbd9682204bee84bc9dbb33f8d120b08cad3e55b6466bf6481099eba9b30470bc0dcb76ce8ea00b367c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
f4cdd94e297d5ea54c81a156f29fbf54

SHA1
60b39b4009df62ced50442e65d747756ccac71f4

SHA256
68cc131433d72e8042839c1b565a3634b75a2d8085b3215332655ad0ad160396

SHA512
ac2638dfead9f246dd74f5e7e31733be7c82ff5eb689a36699105d1a206970ef22277595c6645aa365f35bf10a69e44b1b5580ca2c20e76d5bb4785efb3a55fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
206ced56baa5405bc055e49d686863c8

SHA1
63be5ccf6dc7ffecb470992ee5c6eb86a0447b91

SHA256
9b06a2572c9dc7a51da3edee13314acf9c1564569ce410f24d1dc86798b6758e

SHA512
83704c5035c05fa8a3c8bc3542bdee6cbf96040359a77994132eaa3a1339ebec51f5f7b3cd5771a0165d2ad7949f46c8cffc6f037772ddb1767b00b347a91551

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
49f560b6f0b19f83a0c0d61451988820

SHA1
1f40005b76dc2e3b212e71232ef8fa3849c739a6

SHA256
5cf750c36a0a300a0a522d002603224bfa694176cfe79d4471e2632913783c23

SHA512
24ee4b53f0a503abba4dbd5a593520cb8a9937e82dfbd39ba0a45020ab07c824a65457f53602b2eeccab7e93e3e9d2541871204761ba0d5562b25128d2d26d1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
d0c033a7bf5f16881a5a87d3d2427bff

SHA1
c94f621ce07909b4bca614c3710eaf304f5666d5

SHA256
20fcb6bf6e9eb9ca0a1fc2f6b0a10c1de17451ebe2fe04f75e8a6d4c76f5475b

SHA512
7c6488e0653a815338a448d6a9ccdd62d0a3417dcceb9eb923cbfc307b7e103c051e6fe8b2df6e6e60fd3df0da6adfc2ed3ffff9f47c48186503947b98e36d0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
5da22b2d386adcd8a9e3848026f37118

SHA1
d39b61f0af4bedd9c168c964de9c812e04a87742

SHA256
c1f97ef69d7b1be27a07f9063a85222e3da84b5e0e2e7ef6e11b66e585f8e45e

SHA512
b8725578fbbacc4c5226a75c29e8e84b43efd72b4c2cd4b7ae66b53d66a01365f8d63b19e7d6ad4eb507ca6f3a1b0fc59d613f9a9d148c9299edd521e506bc05

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3fd678cca59c66b49df69fcc4a2fc7f5

SHA1
f459fa3575b7f1f938916a2aa0cb3de7770264b0

SHA256
a5372c6379cac08241efcc1f47bf611b76037aa9148a296245e008237e5893b9

SHA512
953eab1dd2fc0e11a0124bf39db138a868411155ea4ed6f32e8adf4b38bc4d9d7ee060399dead91eeee6d4f9dcb962699aca2137a7bda10d61d0ee9c2c1b381e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
b873b6f31eef79ddeafa6ef385c43555

SHA1
ce3ccf8c7206e02c8b6d6c8c1f62e8f5abfc4fd6

SHA256
548e55a6b59808453c1c456ba372ac325849f4343feffc05d1683965a71f4c7b

SHA512
3b6973e3aef1c9a3ebad49404ea63a3c0353d386bd3146034566a0c8c70b4ff7f11552c02994a2b1859d8f2ae2b89784ad9a949c333497335d478da20d3e195a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
b792a9740a9f771ae685f9167ae1de1c

SHA1
7851418cbfedefb4fac414638cfcadddecb47d5e

SHA256
d72aae68de35055d1662ebc68cc7f1cbfc5cbafe16f18fcace0c634d562a330e

SHA512
06cc2cbf42706f779bbae7823e5d78eebe7165069072cd404e03e2a448daedc640eefc6cdf50bf10bb8c62d3f6a5eb556100479971b0a6d1060303272a68a106

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
1f97e3303579f2ba6ab90a2c23822f84

SHA1
ed2a23ecef5ea3cccec6eb8c434bf056b5616bb3

SHA256
640b0388d31b4c82e069f4c1daf8ed2a9e16883557572f2066b1a8cc8e55b261

SHA512
473267e1a4bd1b2f53ac23c7d75ab52779abeaf6bb7433cf61b506394347ea459dde69776783d9130af937a224dc431f42b64c90fd301601c3390df5ee86b911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
202KB

MD5
3856cc4589a274233795d1c9e23ca311

SHA1
9646bb299a201292caedea852fb371f85d9f443b

SHA256
4a33a7c49317e845bbca49549b53771eb8aadda457e4772d3a2c28ca1bf6c411

SHA512
5ccb4293fe8add2fcc402591116cd2c379d1abba967cb7808b5dfeb95b450d4f1f84d84e151c859cefbb328dd8858dce7f55cd454ed2c5e0504ac76cd6fdada2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
202KB

MD5
08410bbd3cdff0d673ff97b890b05874

SHA1
1bed7c3c9c2ba04bd57defa2013dc615145a559f

SHA256
58dee8bb3e1b33cde04b60b135209e1aecf19234e6dcf4e18cc6d2747ae842d0

SHA512
ca927fdcc04796f13fc759bab3fa9ce0bc438b002384de5ec04cf984fb89c9dc3f9ef4d1b3b930f42205ec96430687f51d19d45d57f77ec4d6ccf53ba6eab2f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
bd930e3d1075903965ce591e0cecde36

SHA1
99e9cac5be3b618d91912bb3a840324ca307f197

SHA256
fac9df2ec943af4f7d49f5bbb843ffba577ccd03a5fc18cd99fee49e9fa6fe08

SHA512
5c2df5ae0c639374754493c1dc9f76d36bf23ca1505f6e91f0ba87315dce9665977a38bc41b39641f9529c911fdb232b5874460ea0b33682e6794c47f6f3d019

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
206KB

MD5
1314a87e8a68494e3cd73e84a65c8d28

SHA1
6b43cb8771b1fc0c1d442535c4ca77f03e2122b6

SHA256
af8949658e8e77e83a7dc506e3fc9ab694d7ef224777b6b9298e75960a58bcda

SHA512
82e3683e220f880e18df3d3e82eafce9a8e3f167c2318aebc07d0cd02833433c52d9863dca4381d8d653e288f3c11430797942ddbe412bd345df63cfb9359191

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.52.0\Filtering Rules

Filesize
72KB

MD5
c6af15da82a8a9172fc9cafc969de4f9

SHA1
81f477e181036d551ef6f09cb875c6b280bebe00

SHA256
782009d9765c6104a1b4d1eac553834e7e399d749a082ead42bb47abb42895b5

SHA512
f541cb1703a0bd31fcb6e293acbc6e20f73b365ff8d2270a6d44780e9d5731b8d7803aecacd49d73e0da065dd1026c9fa95f9cad2bf0776ce1e2c3c9fca052c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jpfqzve1.qnc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\e57f656.msi

Filesize
43.5MB

MD5
113a2eab7ccf51501146194bbaadb175

SHA1
de00c7a8ff5b49adec8bc44eba7f6332446f0e8f

SHA256
4cab134dbaf1059613f44da615292af5713a0aa3a0185abda0cf1ebf8a7dc9a4

SHA512
ce681034d9c3cad7367fa2a541401036651ce79385524b10f8ea0287c6c6e1bd307c82d339056d6f2e2fd48cbdd05e80650c1b5acb62b55772b4157d3ef9c13e

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\vKtMPwVbdMUU.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
5282fbd5f50fadd7620f7b079895882c

SHA1
12e3cd4b26445bbc659903662ed3dcc742ab4d37

SHA256
0de9c8728506ccfc85b928aae6d1ef64baf35f72bda479586aa590dbd9d6ee69

SHA512
0b2fbaf173f78f29abb21a351db2a68fe8ac6cf0eb86d1ea90d6471f6dd0b467c9e585c22ec4646c2b591782bbb2818fb680ba4d173b688690d1cf0e84f79680

Download Submit
\??\Volume{f0eec59f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{59b85813-e23d-4158-a6df-d5f36f920669}_OnDiskSnapshotProp

Filesize
6KB

MD5
3664be05b42bb4ceb1b40e204a6805b8

SHA1
995736b1282b119248b630b5d95970b3ac79d28b

SHA256
deaa7cc64947c2224035fb97d6e67557d526f13c62060fee814a0fbf8c8336ae

SHA512
95e40b4a6771b59c1b96ffc9dcf68364c8f26d5625d6b19dc53a3cb58d4e0ea299f3cb7ab678d87de1ebda893f9aa98e8eb2ec20aa30c3d9bb9defb70d3773b3

Download Submit
\??\pipe\crashpad_4056_BJXMNDVLVMGYMVHM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1244-148-0x0000000029890000-0x00000000298D6000-memory.dmp

Filesize
280KB

Download
memory/1244-172-0x000000002B4D0000-0x000000002B68C000-memory.dmp

Filesize
1.7MB

Download
memory/1244-177-0x000000002B4D0000-0x000000002B68C000-memory.dmp

Filesize
1.7MB

Download
memory/1244-174-0x000000002B4D0000-0x000000002B68C000-memory.dmp

Filesize
1.7MB

Download
memory/1244-175-0x000000002B4D0000-0x000000002B68C000-memory.dmp

Filesize
1.7MB

Download
memory/1244-176-0x000000002B4D0000-0x000000002B68C000-memory.dmp

Filesize
1.7MB

Download
memory/1908-22-0x0000022B525B0000-0x0000022B525D2000-memory.dmp

Filesize
136KB

Download
memory/5020-59-0x0000000000A40000-0x0000000000B16000-memory.dmp

Filesize
856KB

Download