gh0strat | 4c784bcb4e8eb70763414c3c3748aa300fcba7b215b648a42ccf0dc8ee2b603f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2024 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

chrome win10-11_130.0.6723.59_17292.msi
Size

7.1MB
MD5

20715b6531d214951d6f69d1af3f1bb7
SHA1

74bf2f89b4c2d3e04b4b0bd670e4dc5f3d469797
SHA256

42d7eb85643aa96fa9e3ef0754a5efa02a85b9bbd001fb35c1628b8b1e5bf68f
SHA512

214842d61c6a987af9ae080d226c518b3ce25fd6c74e24506a64e109d74faf78e81bed33f1ba6ad4cfbffa5fc9dceaec9555b261b3399adaa28285bb3d4892dd
SSDEEP

196608:Dgtlisd20g9l31nJaTmbcRk2HAgXXe6Vt7alk:Dg6r7lnMTmb7gXeSt7l

Score

10^/10

gh0strat purplefox discovery evasion execution persistence privilege_escalation rat rootkit spyware stealer trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 2 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/4112-190-0x000000002C010000-0x000000002C1CB000-memory.dmp	purplefox_rootkit
behavioral2/memory/4112-193-0x000000002C010000-0x000000002C1CB000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4112-190-0x000000002C010000-0x000000002C1CB000-memory.dmp	family_gh0strat
behavioral2/memory/4112-193-0x000000002C010000-0x000000002C1CB000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
2340	powershell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

setup.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\130.0.6723.59\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exeCAzqDxoFMxlZ.exe

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\W:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\T:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\H:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\N:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\Y:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\R:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\X:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\M:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\S:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\U:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\L:	CAzqDxoFMxlZ.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in System32 directory 12 IoCs

Processes:

updater.exesetup.exektVKycpUOhHa.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ktVKycpUOhHa.exe.log	ktVKycpUOhHa.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in Program Files directory 64 IoCs

Processes:

setup.exeupdater.exeupdater.exe130.0.6723.59_chrome_installer.exemsiexec.exektVKycpUOhHa.exeupdater.exeupdater.exeChromeSetup2.exektVKycpUOhHa.exegkuiNiWmSboS.exeupdater.exeupdater.exeupdater.exesetup.exe

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\zh-TW.pak	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\04444105-f44d-4619-9136-ec75031c7776.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\CR_3E585.tmp\CHROME.PACKED.7Z	130.0.6723.59_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\th.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\ar.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\es.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\kn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\VisualElements\SmallLogoBeta.png	setup.exe
File created	C:\Program Files\TrainCourageousExaminer\common_clang32.dll	msiexec.exe
File opened for modification	C:\Program Files\TrainCourageousExaminer\ktVKycpUOhHa.wrapper.log	ktVKycpUOhHa.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\130.0.6723.59.manifest	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\ko.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File created	C:\Program Files (x86)\Google4404_1645405924\UPDATER.PACKED.7Z	ChromeSetup2.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad\settings.dat	updater.exe
File opened for modification	C:\Program Files\TrainCourageousExaminer\ktVKycpUOhHa.wrapper.log	ktVKycpUOhHa.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\ja.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\optimization_guide_internal.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\es-419.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\fi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\fil.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\libEGL.dll	setup.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\CR_3E585.tmp\SETUP.EX_	130.0.6723.59_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\ru.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\ca.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\gu.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\ro.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\am.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\sl.pak	setup.exe
File created	C:\Program Files\TrainCourageousExaminer\CAzqDxoFMxlZ	gkuiNiWmSboS.exe
File created	C:\Program Files\TrainCourageousExaminer\ktVKycpUOhHa.exe	gkuiNiWmSboS.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\_metadata\verified_contents.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\d3dcompiler_47.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\sw.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\chrome_wer.dll	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\uninstall.cmd	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\default_apps\external_extensions.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\zh-CN.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\MEIPreload\preloaded_data.pb	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe57ec06.TMP	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\de.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\ms.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File opened for modification	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\CR_3E585.tmp\setup.exe	130.0.6723.59_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\bn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\da.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\VisualElements\SmallLogo.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\chrome_pwa_launcher.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\notification_helper.exe	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\809e3615-8365-4665-a739-222dc4954aff.tmp	updater.exe
File created	C:\Program Files (x86)\Google4404_1968733315\updater.7z	ChromeSetup2.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\130.0.6723.59_chrome_installer.exe	updater.exe
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4672_1781107970\Chrome-bin\130.0.6723.59\Locales\tr.pak	setup.exe

Drops file in Windows directory 8 IoCs

Processes:

msiexec.exe

description	ioc	Process
File created	C:\Windows\Installer\e57cd64.msi	msiexec.exe
File created	C:\Windows\Installer\e57cd62.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57cd62.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1211CB1F-585C-4B3B-8E12-2D3CC065C2D2}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE3D.tmp	msiexec.exe

Executes dropped EXE 35 IoCs

Processes:

gkuiNiWmSboS.exeCAzqDxoFMxlZ.exeChromeSetup2.exektVKycpUOhHa.exeupdater.exeupdater.exeupdater.exeupdater.exeupdater.exeupdater.exektVKycpUOhHa.exektVKycpUOhHa.exeCAzqDxoFMxlZ.exe130.0.6723.59_chrome_installer.exesetup.exesetup.exeCAzqDxoFMxlZ.exesetup.exesetup.exechrome.exechrome.exechrome.exechrome.exechrome.exeelevation_service.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeupdater.exeupdater.exe

pid	Process
2684	gkuiNiWmSboS.exe
3604	CAzqDxoFMxlZ.exe
4404	ChromeSetup2.exe
2072	ktVKycpUOhHa.exe
2616	updater.exe
4908	updater.exe
956	updater.exe
2164	updater.exe
1676	updater.exe
2852	updater.exe
3208	ktVKycpUOhHa.exe
4064	ktVKycpUOhHa.exe
3992	CAzqDxoFMxlZ.exe
2388	130.0.6723.59_chrome_installer.exe
4672	setup.exe
1972	setup.exe
4112	CAzqDxoFMxlZ.exe
1440	setup.exe
3544	setup.exe
4216	chrome.exe
3212	chrome.exe
1620	chrome.exe
5028	chrome.exe
1580	chrome.exe
3752	elevation_service.exe
5104	chrome.exe
2188	chrome.exe
5200	chrome.exe
5264	chrome.exe
5296	chrome.exe
5636	chrome.exe
5692	chrome.exe
5984	chrome.exe
5632	updater.exe
5656	updater.exe

Loads dropped DLL 31 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	Process
4216	chrome.exe
3212	chrome.exe
4216	chrome.exe
1620	chrome.exe
5028	chrome.exe
5028	chrome.exe
1620	chrome.exe
1620	chrome.exe
1620	chrome.exe
1620	chrome.exe
1580	chrome.exe
1620	chrome.exe
1620	chrome.exe
1620	chrome.exe
5104	chrome.exe
1580	chrome.exe
2188	chrome.exe
5104	chrome.exe
2188	chrome.exe
5200	chrome.exe
5200	chrome.exe
5264	chrome.exe
5264	chrome.exe
5296	chrome.exe
5296	chrome.exe
5636	chrome.exe
5636	chrome.exe
5692	chrome.exe
5692	chrome.exe
5984	chrome.exe
5984	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

updater.exeupdater.exeupdater.exeupdater.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

gkuiNiWmSboS.exeupdater.exeupdater.exeupdater.exeCAzqDxoFMxlZ.exeupdater.exeCAzqDxoFMxlZ.exeChromeSetup2.exeupdater.exeupdater.exeupdater.exeCAzqDxoFMxlZ.exeupdater.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gkuiNiWmSboS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CAzqDxoFMxlZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CAzqDxoFMxlZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeSetup2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CAzqDxoFMxlZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

130.0.6723.59_chrome_installer.exesetup.exe

pid	Process
2388	130.0.6723.59_chrome_installer.exe
4672	setup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001a73a27760024bf60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001a73a2770000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001a73a277000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1a73a277000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001a73a27700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CAzqDxoFMxlZ.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CAzqDxoFMxlZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CAzqDxoFMxlZ.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exepowershell.exemsiexec.exeupdater.exeMsiExec.exechrome.exechrome.exechrome.exechrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\browser.show_home_button = "09267930499F8BC468FF1C5DE887F84E6CDECA6852D5495733570E0D4978E1CC"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\homepage_is_newtabpage = "AB3CB65FD8C8751C3EC699FE2596D6336B00979D68215E16691F8A7B596B9DC7"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\mhjfbmdgcfjbbpaeojofohoefgiehjai = "CF01325DD23C08142D046CD7D7B14511FD2A60D2474615DD06FDD6C8F0E04537"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\safebrowsing.incidents_sent = "8D5F063D5CC1BC2E4DD4D6F3EFB18B97E6D1485077792C86EFF3F5EA44059A6B"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nmmhkkegccagdldgiimedpiccmgmieda = "11D32C0183FC6582B592AD91A21416AEC45A0B2BF071FE0C2DE59862B86BE10B"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133741270374943083"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nmmhkkegccagdldgiimedpiccmgmieda = "F94DD3DB0CC92EC825B945088283735F7CDA89AC57C65D1BB2B97DA84BFD356F"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\lastrun = "13374127035028033"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\neajdppkdcdipfabeoofebfddakdcjhd = "E583ABAF43A37709718C1676047B550F3198CE8D4DEF40CDAC7754E68EE61B79"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\media.storage_id_salt = "BA00CCFC64EBC8B414DAB2AB13FB4E63D5B53233CB595D6C3D1D4048392449DC"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\default_search_provider_data.template_url_data = "D8E40C74F75CA0DD2555E72016C80515F685D9DA3756DA787FAF34380090F223"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\UsageStatsInSample = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\prefs.preference_reset_time = "1001CACD7B364EB81D475C719C17D07E5461C62B825909E25153AC6892FF99FD"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe

Modifies registry class 64 IoCs

Processes:

updater.exemsiexec.exeupdater.exesetup.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\1.0\ = "GoogleUpdater TypeLib for IGoogleUpdate3WebSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4334319-8210-469B-8262-DD03623FEB5B}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1BC1121C585B3B4E821D2C30C562C2D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{FC1132BC-C84F-5D90-9BB6-3D44C6394B28}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\GoogleUpdate.Update3WebMachine\CLSID	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4334319-8210-469B-8262-DD03623FEB5B}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{DD42475D-6D46-496A-924E-BD5630B4CBBA}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\GoogleUpdate.Update3WebMachine	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}\TypeLib\ = "{C4622B28-A747-44C7-96AF-319BE5C3B261}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ = "IProcessLauncher2"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\ = "IGoogleUpdate3WebSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\ = "IPolicyStatusSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib\ = "{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F258BE54-7C5F-44A0-AAE0-730620A31D23}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\131.0.6776.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5BB0C40-8078-5D97-80DD-2C8F4510263D}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\131.0.6776.0\\updater.exe\\5"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\ = "IPolicyStatus4System"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\ = "GoogleUpdater TypeLib for IProcessLauncher"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4DC034A8-4BFC-4D43-9250-914163356BB0}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatusValueSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatusValue"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{699F07AD-304C-5F71-A2DA-ABD765965B54}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\TypeLib\ = "{4DC034A8-4BFC-4D43-9250-914163356BB0}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.svg	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\TypeLib\ = "{247954F9-9EDC-4E68-8CC3-150C2B89EADF}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4334319-8210-469B-8262-DD03623FEB5B}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1BC1121C585B3B4E821D2C30C562C2D\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{699F07AD-304C-5F71-A2DA-ABD765965B54}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\131.0.6776.0\\updater.exe\\4"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML\Application\ApplicationName = "Google Chrome"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\TypeLib\Version = "1.0"	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\LocalServer32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\TypeLib\ = "{F63F6F8B-ACD5-413C-A44B-0409136D26CB}"	updater.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exepowershell.exeCAzqDxoFMxlZ.exeupdater.exeupdater.exeupdater.exektVKycpUOhHa.exeCAzqDxoFMxlZ.exeCAzqDxoFMxlZ.exe

pid	Process
2992	msiexec.exe
2992	msiexec.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
3604	CAzqDxoFMxlZ.exe
3604	CAzqDxoFMxlZ.exe
2616	updater.exe
2616	updater.exe
2616	updater.exe
2616	updater.exe
2616	updater.exe
2616	updater.exe
956	updater.exe
956	updater.exe
956	updater.exe
956	updater.exe
956	updater.exe
956	updater.exe
1676	updater.exe
1676	updater.exe
1676	updater.exe
1676	updater.exe
1676	updater.exe
1676	updater.exe
4064	ktVKycpUOhHa.exe
4064	ktVKycpUOhHa.exe
3992	CAzqDxoFMxlZ.exe
3992	CAzqDxoFMxlZ.exe
3992	CAzqDxoFMxlZ.exe
3992	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe
4112	CAzqDxoFMxlZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid	Process
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exepowershell.exegkuiNiWmSboS.exe

description	pid	Process
Token: SeShutdownPrivilege	2076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2076	msiexec.exe
Token: SeSecurityPrivilege	2992	msiexec.exe
Token: SeCreateTokenPrivilege	2076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2076	msiexec.exe
Token: SeLockMemoryPrivilege	2076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2076	msiexec.exe
Token: SeMachineAccountPrivilege	2076	msiexec.exe
Token: SeTcbPrivilege	2076	msiexec.exe
Token: SeSecurityPrivilege	2076	msiexec.exe
Token: SeTakeOwnershipPrivilege	2076	msiexec.exe
Token: SeLoadDriverPrivilege	2076	msiexec.exe
Token: SeSystemProfilePrivilege	2076	msiexec.exe
Token: SeSystemtimePrivilege	2076	msiexec.exe
Token: SeProfSingleProcessPrivilege	2076	msiexec.exe
Token: SeIncBasePriorityPrivilege	2076	msiexec.exe
Token: SeCreatePagefilePrivilege	2076	msiexec.exe
Token: SeCreatePermanentPrivilege	2076	msiexec.exe
Token: SeBackupPrivilege	2076	msiexec.exe
Token: SeRestorePrivilege	2076	msiexec.exe
Token: SeShutdownPrivilege	2076	msiexec.exe
Token: SeDebugPrivilege	2076	msiexec.exe
Token: SeAuditPrivilege	2076	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2076	msiexec.exe
Token: SeChangeNotifyPrivilege	2076	msiexec.exe
Token: SeRemoteShutdownPrivilege	2076	msiexec.exe
Token: SeUndockPrivilege	2076	msiexec.exe
Token: SeSyncAgentPrivilege	2076	msiexec.exe
Token: SeEnableDelegationPrivilege	2076	msiexec.exe
Token: SeManageVolumePrivilege	2076	msiexec.exe
Token: SeImpersonatePrivilege	2076	msiexec.exe
Token: SeCreateGlobalPrivilege	2076	msiexec.exe
Token: SeBackupPrivilege	1140	vssvc.exe
Token: SeRestorePrivilege	1140	vssvc.exe
Token: SeAuditPrivilege	1140	vssvc.exe
Token: SeBackupPrivilege	2992	msiexec.exe
Token: SeRestorePrivilege	2992	msiexec.exe
Token: SeRestorePrivilege	2992	msiexec.exe
Token: SeTakeOwnershipPrivilege	2992	msiexec.exe
Token: SeRestorePrivilege	2992	msiexec.exe
Token: SeTakeOwnershipPrivilege	2992	msiexec.exe
Token: SeBackupPrivilege	4880	srtasks.exe
Token: SeRestorePrivilege	4880	srtasks.exe
Token: SeSecurityPrivilege	4880	srtasks.exe
Token: SeTakeOwnershipPrivilege	4880	srtasks.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeBackupPrivilege	4880	srtasks.exe
Token: SeRestorePrivilege	4880	srtasks.exe
Token: SeSecurityPrivilege	4880	srtasks.exe
Token: SeTakeOwnershipPrivilege	4880	srtasks.exe
Token: SeRestorePrivilege	2684	gkuiNiWmSboS.exe
Token: 35	2684	gkuiNiWmSboS.exe
Token: SeSecurityPrivilege	2684	gkuiNiWmSboS.exe
Token: SeSecurityPrivilege	2684	gkuiNiWmSboS.exe
Token: SeRestorePrivilege	2992	msiexec.exe
Token: SeTakeOwnershipPrivilege	2992	msiexec.exe
Token: SeRestorePrivilege	2992	msiexec.exe
Token: SeTakeOwnershipPrivilege	2992	msiexec.exe
Token: SeRestorePrivilege	2992	msiexec.exe
Token: SeTakeOwnershipPrivilege	2992	msiexec.exe
Token: SeRestorePrivilege	2992	msiexec.exe
Token: SeTakeOwnershipPrivilege	2992	msiexec.exe
Token: SeRestorePrivilege	2992	msiexec.exe
Token: SeTakeOwnershipPrivilege	2992	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

msiexec.exechrome.exe

pid	Process
2076	msiexec.exe
2076	msiexec.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	Process
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe
4216	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMsiExec.exeChromeSetup2.exeupdater.exeupdater.exeupdater.exektVKycpUOhHa.exe130.0.6723.59_chrome_installer.exesetup.exeCAzqDxoFMxlZ.exesetup.exechrome.exe

description	pid	Process	procid_target
PID 2992 wrote to memory of 4880	2992	msiexec.exe	106
PID 2992 wrote to memory of 4880	2992	msiexec.exe	106
PID 2992 wrote to memory of 5000	2992	msiexec.exe	108
PID 2992 wrote to memory of 5000	2992	msiexec.exe	108
PID 5000 wrote to memory of 2340	5000	MsiExec.exe	109
PID 5000 wrote to memory of 2340	5000	MsiExec.exe	109
PID 5000 wrote to memory of 2684	5000	MsiExec.exe	111
PID 5000 wrote to memory of 2684	5000	MsiExec.exe	111
PID 5000 wrote to memory of 2684	5000	MsiExec.exe	111
PID 5000 wrote to memory of 3604	5000	MsiExec.exe	113
PID 5000 wrote to memory of 3604	5000	MsiExec.exe	113
PID 5000 wrote to memory of 3604	5000	MsiExec.exe	113
PID 5000 wrote to memory of 4404	5000	MsiExec.exe	114
PID 5000 wrote to memory of 4404	5000	MsiExec.exe	114
PID 5000 wrote to memory of 4404	5000	MsiExec.exe	114
PID 4404 wrote to memory of 2616	4404	ChromeSetup2.exe	118
PID 4404 wrote to memory of 2616	4404	ChromeSetup2.exe	118
PID 4404 wrote to memory of 2616	4404	ChromeSetup2.exe	118
PID 2616 wrote to memory of 4908	2616	updater.exe	119
PID 2616 wrote to memory of 4908	2616	updater.exe	119
PID 2616 wrote to memory of 4908	2616	updater.exe	119
PID 956 wrote to memory of 2164	956	updater.exe	121
PID 956 wrote to memory of 2164	956	updater.exe	121
PID 956 wrote to memory of 2164	956	updater.exe	121
PID 1676 wrote to memory of 2852	1676	updater.exe	123
PID 1676 wrote to memory of 2852	1676	updater.exe	123
PID 1676 wrote to memory of 2852	1676	updater.exe	123
PID 4064 wrote to memory of 3992	4064	ktVKycpUOhHa.exe	128
PID 4064 wrote to memory of 3992	4064	ktVKycpUOhHa.exe	128
PID 4064 wrote to memory of 3992	4064	ktVKycpUOhHa.exe	128
PID 1676 wrote to memory of 2388	1676	updater.exe	134
PID 1676 wrote to memory of 2388	1676	updater.exe	134
PID 2388 wrote to memory of 4672	2388	130.0.6723.59_chrome_installer.exe	135
PID 2388 wrote to memory of 4672	2388	130.0.6723.59_chrome_installer.exe	135
PID 4672 wrote to memory of 1972	4672	setup.exe	136
PID 4672 wrote to memory of 1972	4672	setup.exe	136
PID 3992 wrote to memory of 4112	3992	CAzqDxoFMxlZ.exe	137
PID 3992 wrote to memory of 4112	3992	CAzqDxoFMxlZ.exe	137
PID 3992 wrote to memory of 4112	3992	CAzqDxoFMxlZ.exe	137
PID 4672 wrote to memory of 1440	4672	setup.exe	139
PID 4672 wrote to memory of 1440	4672	setup.exe	139
PID 1440 wrote to memory of 3544	1440	setup.exe	140
PID 1440 wrote to memory of 3544	1440	setup.exe	140
PID 2616 wrote to memory of 4216	2616	updater.exe	143
PID 2616 wrote to memory of 4216	2616	updater.exe	143
PID 4216 wrote to memory of 3212	4216	chrome.exe	144
PID 4216 wrote to memory of 3212	4216	chrome.exe	144
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145
PID 4216 wrote to memory of 1620	4216	chrome.exe	145

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\chrome win10-11_130.0.6723.59_17292.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2076

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4880
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0BB66AE76DE08CFA05AE633241CAE1A3 E Global\MSI0000
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\TrainCourageousExaminer'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- - C:\Program Files\TrainCourageousExaminer\gkuiNiWmSboS.exe
    "C:\Program Files\TrainCourageousExaminer\gkuiNiWmSboS.exe" x "C:\Program Files\TrainCourageousExaminer\EUHjpVDwBQiotUCpbKOm" -o"C:\Program Files\TrainCourageousExaminer\" -pqGpRXWYVOMAlOvsWPWqo -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- - C:\Program Files\TrainCourageousExaminer\CAzqDxoFMxlZ.exe
    "C:\Program Files\TrainCourageousExaminer\CAzqDxoFMxlZ.exe" -number 228 -file file3 -mode mode3 -flag flag3
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3604
- - C:\Program Files\TrainCourageousExaminer\ChromeSetup2.exe
    "C:\Program Files\TrainCourageousExaminer\ChromeSetup2.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Program Files (x86)\Google4404_1968733315\bin\updater.exe
      "C:\Program Files (x86)\Google4404_1968733315\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={0831CB51-605E-C38D-DE8B-88614C43BE12}&lang=zh-CN&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Program Files (x86)\Google4404_1968733315\bin\updater.exe
        
        "C:\Program Files (x86)\Google4404_1968733315\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=131.0.6776.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x1016290,0x101629c,0x10162a8
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4908
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        5⤵
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4216
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=130.0.6723.59 --initial-client-data=0xfc,0x100,0x104,0x7c,0x108,0x7ffd5f347c38,0x7ffd5f347c44,0x7ffd5f347c50
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3212
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1936,i,7165581941244872285,4002897513418434635,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1816 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:1620
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=2124,i,7165581941244872285,4002897513418434635,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2112 /prefetch:3
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5028
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2336,i,7165581941244872285,4002897513418434635,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2324 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1580
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2848,i,7165581941244872285,4002897513418434635,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3004 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2188
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2856,i,7165581941244872285,4002897513418434635,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3288 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5104
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4368,i,7165581941244872285,4002897513418434635,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4416 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5200
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4556,i,7165581941244872285,4002897513418434635,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4552 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5264
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4876,i,7165581941244872285,4002897513418434635,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5296
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4748,i,7165581941244872285,4002897513418434635,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4816 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5636
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5128,i,7165581941244872285,4002897513418434635,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5140 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5692
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5416,i,7165581941244872285,4002897513418434635,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5508 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5984

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Program Files\TrainCourageousExaminer\ktVKycpUOhHa.exe
"C:\Program Files\TrainCourageousExaminer\ktVKycpUOhHa.exe" install
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
PID:2072

C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:956
- C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=131.0.6776.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x936290,0x93629c,0x9362a8
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2164

C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=131.0.6776.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x936290,0x93629c,0x9362a8
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2852
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\130.0.6723.59_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\130.0.6723.59_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\cb6d19b3-1757-4073-8737-955ecbaa99b5.tmp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\CR_3E585.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\CR_3E585.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\CR_3E585.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\cb6d19b3-1757-4073-8737-955ecbaa99b5.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\CR_3E585.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\CR_3E585.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=130.0.6723.59 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7d891dc28,0x7ff7d891dc34,0x7ff7d891dc40
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:1972
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\CR_3E585.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\CR_3E585.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1440
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\CR_3E585.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\CR_3E585.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=130.0.6723.59 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7d891dc28,0x7ff7d891dc34,0x7ff7d891dc40
        5⤵
        Executes dropped EXE
        
        PID:3544

C:\Program Files\TrainCourageousExaminer\ktVKycpUOhHa.exe
"C:\Program Files\TrainCourageousExaminer\ktVKycpUOhHa.exe" start
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:3208

C:\Program Files\TrainCourageousExaminer\ktVKycpUOhHa.exe
"C:\Program Files\TrainCourageousExaminer\ktVKycpUOhHa.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Program Files\TrainCourageousExaminer\CAzqDxoFMxlZ.exe
  "C:\Program Files\TrainCourageousExaminer\CAzqDxoFMxlZ.exe" -number 171 -file file3 -mode mode3 -flag flag3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Program Files\TrainCourageousExaminer\CAzqDxoFMxlZ.exe
    "C:\Program Files\TrainCourageousExaminer\CAzqDxoFMxlZ.exe" -number 362 -file file3 -mode mode3 -flag flag3
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4112

C:\Program Files\Google\Chrome\Application\130.0.6723.59\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\130.0.6723.59\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6072

C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:5632
- C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=131.0.6776.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x936290,0x93629c,0x9362a8
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57cd63.rbs

Filesize
7KB

MD5
7b251869af46e542c670bf98dcb3ae17

SHA1
5a7f46a598878e65590436a77b2595f7424b6afc

SHA256
f90b5478fa44e6fa1e6c380c65c5d85d8c82caf012c56072a0da6d9952ee9a06

SHA512
9621ad7159707175620d49d297d304d39bd5397960296fb21bdd200addc292f1b2cf3b27765a4fc490160f3de2c6f0fa9e6d90d0c4bfa91bb431a2cac60136ef

Download Submit
C:\Program Files (x86)\Google4404_1968733315\bin\updater.exe

Filesize
5.3MB

MD5
e2937e33c2554eecc37c804a7f99f8b7

SHA1
2c33d4573e21c7d18de1d3f337bacd7c4e58fe87

SHA256
5dde29f028e75ee72f50902d20c41b699ef8fc5c294f04a321deac6909ffe409

SHA512
cf50e630cd75483f5887153490ab5c55e21a711541d0a4aa0e29d055f42076f7d58edf743bff26e145b56a69b6be9f6704e9c2b071be0aa5a7f6cc1f6be3406f

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\131.0.6776.0\Crashpad\settings.dat

Filesize
40B

MD5
7b36cd79fa8bec2295555c2926049a77

SHA1
3e6b130faaa9d3360334170e695f2d66db0a9bea

SHA256
8688f0643c73056a098857d9f308950ad331080cbdb90b1d9e96429083b927da

SHA512
fbbf891587e6bcd1d22b68ae74227aefef9211930d3635fa7fa93617835ac5db5819fd5a2b84004731123d6a65a7e906fdfe20a8fdc32355eedc3e562965ed43

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
500B

MD5
3be4a6e41f4dd9adbccfd2cc2af24184

SHA1
f5360d56f16360b8bac8188f876b65d9e6ca8f33

SHA256
84da19b24d1cf34a6d0414aa99606c49e2567e0b033ce5f1d63961067df18948

SHA512
6201544ad3f929cb6615f34bf9668c07a567cef04b164120171a7ce69b2b487ff21502c02855f7a7b78ef5c070dae8b1816ad7424b7ddcc66c388ab04a5b60a9

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
354B

MD5
61e150bfd9fe9c9fe354b74b4c535215

SHA1
6702e4d555315b91f7df284caa7c819d87cb5466

SHA256
b403d8e714539402c473a85d2b51069bf3dac127ec139c97a0bbeeb1b6409f37

SHA512
3400d796aefa86784395b92300a4125c2faf6bb01bf87c3827e44340a92d44ed65637e844770a30cddc337c2f4bdce154f554e4bf4ab50f2b3ce2fc36909d969

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
599B

MD5
3eed72659d92000ef483ab2603640128

SHA1
5a09314c56a8a293bc73e653ea4ca3d1608e930b

SHA256
77f647c061d0f91a934ea586f46598ba02a7b2428e73a66f4db1163e21b03db5

SHA512
af05be1ca76ce69bec631a193dd277553b3ebf98bc3a538e5269ea5e49ca29475992120673ecaaa15a3d62e13ccf2af6bdc8d7b589451253037f2fcf051bec3a

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
599B

MD5
9d52f4434affc002defa34632232d3cb

SHA1
031a22bcb6b37bb10a9123443a2384ffa6b237df

SHA256
f84207fb507f121da684f3a3d38d5308bf4725aec64f85c38ec69935a89ec0b2

SHA512
43f53f00169b8ce95408653fb6049ccc8c749f1120630a033351c4d97774390332ceb923c785b95376fc02a539731b7315bab81b36a4396856e780cb1eacedde

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
49B

MD5
4a2784f1ca879e8fbbd97e39d0de3cc9

SHA1
a0eb8b63b4b19b134b46fea8e66f819105f004e8

SHA256
2bcd0a4051b1fa5b0444cee9fd9f7341fafe1eae36659511926ebefba648dee9

SHA512
95e64a2afbdba5943410f912eba5bc626cbe775c14dd8a3ac8fb6c8c0301762190c15844f2776f894088cf937450e383464592bee8e24308c6f90029d5a57f57

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
b6e37cde1489340bb76e436a8f92483c

SHA1
171561ba0e5cb090beb57be1d17bdb3436cfa61c

SHA256
7ce0ccd2fe778ee2b3a49090717bf2ed67c4e35f5fded0932ae3427372bc9a1a

SHA512
7235cc916e086a80a3ad6e02adb0f222314739e75189f0afb3015e057239b8bc87dc4d8eb819e4274f94ac49c4d49b7cfcd26327426b36257ea8d6eb5ff2542c

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
2KB

MD5
92c70be7cc518041151b8d2c1148661e

SHA1
a8b3313ce30bc7c970e1909115f543e40dae68c8

SHA256
17b748ebb3490f4004d3157f5e315de62d2d2e5603aa01cb14b2c57f6e0caefb

SHA512
654c955175e3a78b649cc798bbc1eeb401342966b23350f87ea2b196487cf2cf3e634481dca94a6f0137618d80e9735565b686b826df9bdddabbc8c6078e5fc1

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
4KB

MD5
93ffe15c4cc41c0835c049dc29d99e1b

SHA1
daac0611f869420a774aae6154b65cdaf8a124d2

SHA256
4dbb46becd03be5ffb346f01aeff1368048d9ebfee3160a85d0f51c7b2c0bc7f

SHA512
8443dc0334daaa66ed143a9f28c1061ae75caa20e68d1c083362f6a7f0006b1218edec7cb87c08566dff909f17ecffecb43db95c8076ca44167af690e7f05bc9

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
6KB

MD5
1dfe29786a7baac15718ce56cad522b9

SHA1
a0f1cf8d03dc9b9f8ec8ce79465e9f1345a7e932

SHA256
fa2233a91e9b18166859613bd90b1c9d3f00c6b87790779b2478d88e482c21d0

SHA512
b420cae4c1ec30878f70915c944a7f44475fa6ea1b47e243e375aa76e0ff3be0d67f1011072cf2869fde886cd5007a94bf21becb4bb845eb77b5f3c834c44bb0

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
9KB

MD5
744f7df1140c19302687d3ea47833e6c

SHA1
7f9c7127227aef72d2ea84f2b5c4a35c52db00f1

SHA256
7ea48f4becd84a9bf9e52e92f0ad741a0959bfde26e1a52c6218cd25b3873a6e

SHA512
1683f4d48fe049edd4af1da81517cfe05609f8d711000d1eca6999cc1216f1a4638c69347d913f0137597ccfc614eacbc597c8dab8f304415d85e77f829d021a

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
11KB

MD5
0562c2d439fb88466d9f08cc4d09cd4f

SHA1
94d11cfd596226aac32846b9158242fc44c9f674

SHA256
728736d85113c98c2e02a9dd117e13a53d4198a5edaaf48001d441b892809205

SHA512
bf8c850efbf3a6a7ca6f64e67974d4d570b48fe72d1612c493f140eaa1f4f0e34d525fc274e89e211b9c84d5810cf39c90519653310525ceb4caf18bcbbf16f5

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\CR_3E585.tmp\setup.exe

Filesize
5.6MB

MD5
f088060a8be42f8f3cddaee9b1886eef

SHA1
27bdbad90441616bc3225ed0245e3e7a92201544

SHA256
7478a46fe160c8e9832421561cbc4be619e9a9dc15ffd9905146916d4c66cf96

SHA512
0f3b7ef5c5693daef09c523bc4bcde6936d6e9e6584562a9a88941c830b7faef8c62ce0dab3939db7fc57cf25487a044e8c782b068d17e3b535207d30ced1c1a

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping1676_1634699479\cb6d19b3-1757-4073-8737-955ecbaa99b5.tmp

Filesize
685KB

MD5
5c28084b121985584262517e024685c7

SHA1
e3ccdaba1aeea21479f67e991fb89329c2d78a7e

SHA256
ad9a0f1128d035014b8bee6e807360439d82f7277b0da0d6929f2deeb2b94830

SHA512
908dd1e9258f6160248bc031a47cd892e67969b6a93d8dc6a9e4c389c11a80d7bb418a062aab6ba16714a01aebe4dc2c7277f869c98b13aca660f2d89cc6a9fe

Download Submit
C:\Program Files\Crashpad\settings.dat

Filesize
40B

MD5
45b11644d3d427bc84be0dfc360fb462

SHA1
19817273844d57de52ff6872849fb508743f468e

SHA256
94f20433b7110d704e3cbab86fd93ee60cef78a4dffc74167f0cfca9d10fbbdc

SHA512
17055e67f305b6bc79c6f0a04720ad22155a6b3a87dc47754cd00177cea315bfd4e211c34d984876450e283eef8a1bd0bb9ee56f982aaf36c5a8cab517a05971

Download Submit
C:\Program Files\Google\Chrome\Application\130.0.6723.59\chrome_elf.dll

Filesize
1.3MB

MD5
a04e95a88b22085887870d3cb8467793

SHA1
0f8a825b17ba5821536ffa23cfab28ac76b2d698

SHA256
5deb6e2267d44180943f3c98f828797d6c72bb81ce5a9d4bf6063512e74a9072

SHA512
6d67e214af1c63e7ffd6dda08117e3412082689ee4b72ee46a64d5f30ecd0437c52ef1737e93bef8ca10f0465a1fa4f331444f0af300df3b47f21865bcb4cdf6

Download Submit
C:\Program Files\Google\Chrome\Application\130.0.6723.59\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.7MB

MD5
e378be905fd7eda796bba0b09b9afca1

SHA1
8c228b132c79c87a7ca89e262336895d9327bdea

SHA256
f58c615abafc390a10d8a40ea4259c202453e770399b7bccaa8e2797fa2da9d2

SHA512
223a2ec941fa698da8ed83b4a51eb4065553c5af75b65cccba331f25759210d498eb57fba280ed81f941f003fe63c0679adc6a1b0d2f330af96a3bbd9b4e8b7b

Download Submit
C:\Program Files\TrainCourageousExaminer\CAzqDxoFMxlZ.exe

Filesize
2.9MB

MD5
389306e923d191d937a87280abaa47ed

SHA1
2e38b68b8d0cd57a137368b5fa3092ee3d875655

SHA256
dce01c2b698ad7e3e5e3efc280dd1a97bfd54a81cd18bf60851b0657ef7d2fb3

SHA512
c01e5230f4c3259141738a922d17195886ac39354af8265abc9be16bce64157e14f208ee5112176b248245c5c62780fc250192ec6bb02c53136d1e4af56c975c

Download Submit
C:\Program Files\TrainCourageousExaminer\ChromeSetup2.exe

Filesize
9.7MB

MD5
29c9848749d11cdac06f5c1ab27ae9e4

SHA1
bb6b142e7b29e8f3a523bd238697622d828a9b5a

SHA256
94b57aa9cb18f206c72031d9ac8ae1fd3dc00d9248f66cf2dc75593a156534e0

SHA512
176073947ca2be3bf05834a07a64c3db0de7ed11d77704af862164bb91aabc5f08e7d5b53a7fc7bb67fc5d8480ab322272414b81d56d9a565339ea9ead1adb18

Download Submit
C:\Program Files\TrainCourageousExaminer\EUHjpVDwBQiotUCpbKOm

Filesize
2.1MB

MD5
a745c99514fa8c9ce924f33186761704

SHA1
8f1b0063e835cb79bc2916ef00edd021732b78a7

SHA256
9e43af17106baaf595d59924646e98e212b365316bc28924ea4da73008de99f1

SHA512
f2d76c58e59e85547414bdc23e8488050456e6080e5cee0c3d014b83967233920dde9fb27a6276697d925e3d0c62646c7a34c21fdfa4174f464b9a7639f4dcc9

Download Submit
C:\Program Files\TrainCourageousExaminer\gkuiNiWmSboS.exe

Filesize
577KB

MD5
11fa744ebf6a17d7dd3c58dc2603046d

SHA1
d99de792fd08db53bb552cd28f0080137274f897

SHA256
1b16c41ae39b679384b06f1492b587b650716430ff9c2e079dca2ad1f62c952d

SHA512
424196f2acf5b89807f4038683acc50e7604223fc630245af6bab0e0df923f8b1c49cb09ac709086568c214c3f53dcb7d6c32e8a54af222a3ff78cfab9c51670

Download Submit
C:\Program Files\TrainCourageousExaminer\ktVKycpUOhHa.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\TrainCourageousExaminer\ktVKycpUOhHa.wrapper.log

Filesize
290B

MD5
12c0fec13b281cfa4ec8f54ee0b58ec5

SHA1
885191e8b0c3ce32498e587edb4bf7770097859c

SHA256
f1d448bc9d44f65a9b4d0f2dfdd685c561d3e13ac561e9dec915dcf5621c828b

SHA512
3f7501d1c0a2e2c0e44f4a2df6026e2015ccd3192d1694920f210d2e1af2fd5a4b0867ed0da0522636803c248f478de2f5c480b5e14d10cd48ffff1c929bc754

Download Submit
C:\Program Files\TrainCourageousExaminer\ktVKycpUOhHa.wrapper.log

Filesize
458B

MD5
4713e59f2e6dcd695e1a5fbeeaed2162

SHA1
0f181bc59085c5476098075f761e8a958380cb09

SHA256
cc9f9e98217c450293bc8385da18ab7bab9f7c2ba4034b04654f23d407719b9b

SHA512
f5ca6ee638b7c158eb7ac6fd58a1c2d7b22699e7ac780e0e0e8b594c0078d92ea112a154279123d3d3e52020eb058831103b2e1388f7431453a84bf3e06c50cb

Download Submit
C:\Program Files\TrainCourageousExaminer\ktVKycpUOhHa.wrapper.log

Filesize
636B

MD5
d58e98d1f280408e5ca68aebbca19b61

SHA1
101967298afebb5a429f85fcc3a453a598d9c829

SHA256
0843af2915a55413541e5aae5edf573f41282eeb86f7b3bd74673e52896bf5e7

SHA512
490bcf7c8adfea8dbe2d73dd66e79dc1806b2367ad4ba01c60615832618884abca1158981293f7f8b514cf9c12424c046993d6056c48ba7a107c51bd37c7aa12

Download Submit
C:\Program Files\TrainCourageousExaminer\ktVKycpUOhHa.xml

Filesize
457B

MD5
8c3a3dc8798f36f449361172f01c8e13

SHA1
24f707febb8fecd1ca13715efeda49041396e5dc

SHA256
db144bf4300d99266ed3baff93dfea6bf913fb8b971e29f0932091097a637056

SHA512
9855c8c08ddd2210e183e7b8ab21de16147a2a12fd37c29bc015fd18a291dc32a9da5e82aba029cad021f66807553c0a59a0c8f034faaa485f1584f92b7070ea

Download Submit
C:\Program Files\chrome_installer.log

Filesize
21KB

MD5
b43aa4da3e14e40354d1d566d8dd4a6f

SHA1
8afbf55ef2501b0940933f1cb3fc0b15e387ad21

SHA256
8f9d26b2cebfced0e949c6ad3e234019fea826c39fc520a5728d79bd21403ced

SHA512
e50a1ecf97ab7fee38cbdaf63621a5c5e1a094b53e714175f2f96ca248ec804d36b0c633d694c7b7f3682584abe030ade36332ce04e7373342d6aceff038279b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
01de400afa8bf21e84d11ded01bc8ece

SHA1
c6a8bfa7e5e71be9d3db2e67c7479e9b8eef45dd

SHA256
523d84930429837b5232fcdef9747f685b397ce8cffcc7b3b8c035113026f256

SHA512
f8bda6580fdc9accde83fda40c04bfd93d3c96b68ecaed0eb64695fa366eade19042c9040d369189c97c1db2c2401fa637843aafe8e6280d23aece359ad046aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
00549f430dd1643af754ca0fe0b5c533

SHA1
4d645a0083c2e87cb12b9dd58fa57635e933c50e

SHA256
53d641359a1e4d81e6052b51b319352f08d69e1e5e3d1cefb05171ec4f349248

SHA512
5b66e42dd847d72acd674f8e1b559cc3cbc4988560898acc0dd2e7185c8a8d4b19f46661744513de62138675bab3b7fdfe7f0745a90c533f49c1513bc925d4a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
423d78573ae80c700fc32ea89c95a345

SHA1
5357f05d9c18ea5627a692a8dfb781d23fd4c315

SHA256
c81253d46121017f7388a0a7e52ca7574207329d0610b7a08fc775f10b1e27c0

SHA512
90e7341454df97af0956ff79e0364fc80c3edf6987bda9c7f09eda6db16eb7f067970311f3b2b63c334637d979b20166e0c7d7f7b2063cc618e4bc1e13c091d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
2eebdd04f3496309b875ea30aafd896d

SHA1
d0d348deda82af8a436886d491d36f4b9e47c210

SHA256
567c25c683914d2243a58af0a9b5985e23fb581bc6a2a15a50ae561303ffbfcd

SHA512
e6ff1b5831df2c55cf539ad970cb10b5c5ac113517252d0355fd24892aad079318ed162eebf540e7ef1d020b8ea0ac4e39bc94ba4635eb7c53d8295d1bab79ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
f561426c49aeedbcf22fed87784ade4b

SHA1
cd4abba3a4418dc1f6672b8154e18f975ae1be88

SHA256
1c9e8defee56c1799184970560263aaf280fe1af7f29c9b886a6cc78ec00bb5d

SHA512
0f17197d82b457bb25d7b8428a93539b6321bab6b29f379b3d842662dfa8276479d1b6770b52302d3fe0dee18600efa977cf3d6643adc24384de6700785a49a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
540e711972b796b45b6c63a333aa9755

SHA1
eb9e564a8b314638120398c966ee84c0aa0a4156

SHA256
e5dc0f78b73eb3bc37e13e1361d0ad7c599c9084f171d486a3639fa1bceaf2a5

SHA512
40133447be48652ead2ed33a08e17f1e198e29c97bbedc8f7d1c169f4e7cb7e65ee57d4b01fd788f284e536719ef54ef31160583d418eebe28398a6d5b740029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
5edcc47aacecb9de69146e41d6baac8b

SHA1
c2d0fdbafbe8f616df11604b92aad0931b42d7fe

SHA256
ebbc6ce5327df97d7e870812bd8bb45ad9fc81644e8486863bd74245114f1275

SHA512
db672c00602aa69a7e0a3c8f868b63d0ea3bb1dcede8d56dda7f6314a070e5ec3b10dbc1b830ed38dab80d9c98cbcd465ac91df1ce1f7ac73dd058e64f517c75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
25a4becf4bfba23b8b81cbc5faf962c5

SHA1
2effb19892a76b4cda6c66dde36f4d37e73ede6e

SHA256
1426fa52424e028dd4e4354fefbe55bc5b4f8df247599822f293c620d9959243

SHA512
be8cde66d6cf0917167dbfd6a054d2113dbb4399fab5e9c26006aa21d78f32755b09d79be8c26b242162ca3e84c1fdb192e4061e6774d86982bba67d44906151

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
199KB

MD5
a540adadb874e8f31530161dee50db95

SHA1
2e1c7473420e55e33de0fcd4d6a4f1a595fd0cef

SHA256
1662001cf97d957ff5bb83e54072046e19660df62690e56f6f9d4b95641dc72e

SHA512
1e6f129fe5655b7a782cbb4bcecc5fd4a38092e6d76e7377e42c40f96eb4634e4b5a8f732a8b183ba0b45a0947da831d4143a48f82cd9db7ccee1114ba93f945

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
8f270c56e1c1d5df239ae79b9837dc46

SHA1
215418af12fa57bf97ec209413a42d2cf67fbb3b

SHA256
f58bb64519419437b29a0673bcd56581306ed077f73e42f07ac3ed26669e3af2

SHA512
353dd1b420dab3e1343a641bd97537ae67490690d7565055846f30498066252517799d4f01d0efbc056fb4232d380fc139256eafdf2aa97b57fbcde080f62d9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
199KB

MD5
37fa08b936dab8e0e3eea01ca8a8e70e

SHA1
90b011897e463fc7e802916ef6d35c0098ca1cc3

SHA256
01d9bba854bca8855d22029b4194a5c8fa5859156779a1271f1ef590572ea6f7

SHA512
f5845e5674eb2f67e785f9ab7f90f358e8d76ccf03e4c81ca40d8f16d8bce1532de329e150ae0d14b5ab16e4b18f5bb115ed55e46d504f398d40580301f98437

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tctrklfq.lfq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\e57cd62.msi

Filesize
7.1MB

MD5
20715b6531d214951d6f69d1af3f1bb7

SHA1
74bf2f89b4c2d3e04b4b0bd670e4dc5f3d469797

SHA256
42d7eb85643aa96fa9e3ef0754a5efa02a85b9bbd001fb35c1628b8b1e5bf68f

SHA512
214842d61c6a987af9ae080d226c518b3ce25fd6c74e24506a64e109d74faf78e81bed33f1ba6ad4cfbffa5fc9dceaec9555b261b3399adaa28285bb3d4892dd

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ktVKycpUOhHa.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
42b73e0132991b6d7b005bf82e5df96f

SHA1
adc53ac1493e359b71dee0e9ea99481c3d4f68bb

SHA256
b72596f62f8bfe04f793a47c22781250743fc496ea334e42b50e5fbee48d324d

SHA512
693fd906ddb3ddafca5a040d5db53a46c2ce0f9571be720afcbfdc5412fcc18f61a6ca16f1c19db179de151cada4a3eca4bcd7194b5ef5b76e75c7c6b41a05e2

Download Submit
\??\Volume{77a2731a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{cb274177-ccba-4f5a-a671-89f28f59b920}_OnDiskSnapshotProp

Filesize
6KB

MD5
6bb6be6d457a8f946076d3711fb6e4e0

SHA1
08c5bb82f20fefa89a088df60db0c81e980eeb3b

SHA256
ed11cf7788b54249947e43f6a4ec18b83a1bb5dd18a78aca12ea6237bfa823ec

SHA512
8f457afc1a21ee4c4351b36dad6230d091a15ac2c603796d75d8a58882a1b5a9afb46ff547bdfd370275a2ca0eec7d2275d98b95a3cba3a090dbe9b36aa385f5

Download Submit
\??\pipe\crashpad_4216_NZGUJKJESEKMSPEB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2072-55-0x0000000000A20000-0x0000000000AF6000-memory.dmp

Filesize
856KB

Download
memory/2340-14-0x0000020728490000-0x00000207284B2000-memory.dmp

Filesize
136KB

Download
memory/4112-193-0x000000002C010000-0x000000002C1CB000-memory.dmp

Filesize
1.7MB

Download
memory/4112-190-0x000000002C010000-0x000000002C1CB000-memory.dmp

Filesize
1.7MB

Download
memory/4112-165-0x000000002BBA0000-0x000000002BBE6000-memory.dmp

Filesize
280KB

Download