gh0strat | 94200b3b4792c019ebe7bcfd16573fdedf385369e41309d82958568078e90c43

Resubmissions

29-10-2024 18:03

241029-wnd2aaxgmq 10

06-10-2024 12:18

241006-pgxrgstckn 10

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2024 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94200b3b4792c019ebe7bcfd16573fdedf385369e41309d82958568078e90c43.msi
Size

28.7MB
MD5

bffddb889b7089cc6af3b9d9efb3c89d
SHA1

977fc679569271849068e704a53c57b09009f414
SHA256

94200b3b4792c019ebe7bcfd16573fdedf385369e41309d82958568078e90c43
SHA512

0c3d0db3b8d0c5a071cc3a140695d8ea1b1600c36add6a4c36e24effd9d4dc579ce6953386cc624406c8fb9d6ba436b7082a5e675799d3f860fd0df6a5946e93
SSDEEP

786432:tQ05JQsMXv0z+OEoBvTT1A7IXA5hPP4WhYw70FDDV:e0Tif06OXrT1AGw70FD5

Score

10^/10

gh0strat purplefox discovery evasion persistence privilege_escalation rat rootkit spyware stealer trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 3 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/4064-153-0x000000002B9B0000-0x000000002BB6B000-memory.dmp	purplefox_rootkit
behavioral2/memory/4064-155-0x000000002B9B0000-0x000000002BB6B000-memory.dmp	purplefox_rootkit
behavioral2/memory/4064-156-0x000000002B9B0000-0x000000002BB6B000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/4064-153-0x000000002B9B0000-0x000000002BB6B000-memory.dmp	family_gh0strat
behavioral2/memory/4064-155-0x000000002B9B0000-0x000000002BB6B000-memory.dmp	family_gh0strat
behavioral2/memory/4064-156-0x000000002B9B0000-0x000000002BB6B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\130.0.6723.70\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	ojZEoSUznz17.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	ojZEoSUznz17.exe
File opened (read-only)	\??\X:	ojZEoSUznz17.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	ojZEoSUznz17.exe
File opened (read-only)	\??\N:	ojZEoSUznz17.exe
File opened (read-only)	\??\V:	ojZEoSUznz17.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	ojZEoSUznz17.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	ojZEoSUznz17.exe
File opened (read-only)	\??\G:	ojZEoSUznz17.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	ojZEoSUznz17.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	ojZEoSUznz17.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	ojZEoSUznz17.exe
File opened (read-only)	\??\H:	ojZEoSUznz17.exe
File opened (read-only)	\??\J:	ojZEoSUznz17.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	ojZEoSUznz17.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	ojZEoSUznz17.exe
File opened (read-only)	\??\P:	ojZEoSUznz17.exe
File opened (read-only)	\??\T:	ojZEoSUznz17.exe
File opened (read-only)	\??\U:	ojZEoSUznz17.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	ojZEoSUznz17.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	ojZEoSUznz17.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_CD08734C3F770C014F2620E6CA4CE9C7	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\lTRNmTKwQzfm.exe.log	lTRNmTKwQzfm.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_CD08734C3F770C014F2620E6CA4CE9C7	updater.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\zh-CN.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Application\130.0.6723.70\Installer\setup.exe	setup.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\130.0.6723.70_chrome_installer.exe	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\manifest.fingerprint	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\es-419.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\vulkan-1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\fr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\MEIPreload\manifest.json	setup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File created	C:\Program Files (x86)\Google3956_1694002597\updater.7z	ChromeSetup(1).exe
File opened for modification	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\chrome.7z	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\ar.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\VisualElements\SmallLogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\ecaec725-c78a-475d-9270-d1ae52075712.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\130.0.6723.70.manifest	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\am.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\da.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\et.pak	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\0981f323-5740-49da-9a96-9d4b13d5fc07.tmp	updater.exe
File created	C:\Program Files\ImproveDefenderResilient\lTRNmTKwQzfm.xml	OoRjJglzLJCL.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files\ImproveDefenderResilient\lTRNmTKwQzfm.wrapper.log	lTRNmTKwQzfm.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\fi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\lv.pak	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\e17ff354-6030-4cc3-8961-80888b59efcd.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\en-US.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\hu.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\mr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\notification_helper.exe	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\34815992-e237-49e0-82c3-0228ff14f4b4.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\0981f323-5740-49da-9a96-9d4b13d5fc07.tmp	updater.exe
File created	C:\Program Files\ImproveDefenderResilient\OoRjJglzLJCL.exe	msiexec.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\4c5c1193-faf7-4690-b3f1-36ae8ac282ff.tmp	updater.exe
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\elevation_service.exe	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\uninstall.cmd	updater.exe
File created	C:\Program Files (x86)\chrome_url_fetcher_2876_181403836\-8a69d345-d564-463c-aff1-a69d9e530f96-_130.0.6723.70_all_ed6oo53x4c2arhzohmtucb4sze.crx3	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\nb.pak	setup.exe
File opened for modification	C:\Program Files\chrome_installer.log	setup.exe
File created	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe5843f9.TMP	updater.exe
File opened for modification	C:\Program Files\chrome_installer.log	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\fa.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\ml.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\chrome.exe.sig	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\Locales\gu.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\VisualElements\SmallLogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3180_471176940\Chrome-bin\130.0.6723.70\libGLESv2.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Application\130.0.6723.70\Installer\chrmstp.exe	setup.exe
File opened for modification	C:\Program Files\ImproveDefenderResilient	ojZEoSUznz17.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5801b3.msi	msiexec.exe
File created	C:\Windows\Installer\e5801b1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5801b1.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D2129BB0-0088-4785-95E7-8B3E656E5BD9}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI347.tmp	msiexec.exe

Executes dropped EXE 35 IoCs

pid	Process
1884	OoRjJglzLJCL.exe
4748	ojZEoSUznz17.exe
3956	ChromeSetup(1).exe
3868	updater.exe
2980	updater.exe
1152	lTRNmTKwQzfm.exe
4928	updater.exe
3472	updater.exe
2876	updater.exe
4968	updater.exe
2152	lTRNmTKwQzfm.exe
4836	lTRNmTKwQzfm.exe
2660	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
5112	130.0.6723.70_chrome_installer.exe
3180	setup.exe
2304	setup.exe
5060	setup.exe
4844	setup.exe
516	chrome.exe
3940	chrome.exe
3816	chrome.exe
3468	chrome.exe
1384	chrome.exe
1836	elevation_service.exe
3524	chrome.exe
3104	chrome.exe
5236	chrome.exe
5276	chrome.exe
5360	chrome.exe
5608	chrome.exe
5624	chrome.exe
5912	chrome.exe
5136	updater.exe
5228	updater.exe

Loads dropped DLL 31 IoCs

pid	Process
516	chrome.exe
3940	chrome.exe
516	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3468	chrome.exe
1384	chrome.exe
3468	chrome.exe
1384	chrome.exe
3816	chrome.exe
3816	chrome.exe
3816	chrome.exe
3524	chrome.exe
3524	chrome.exe
3104	chrome.exe
3104	chrome.exe
5236	chrome.exe
5236	chrome.exe
5276	chrome.exe
5276	chrome.exe
5360	chrome.exe
5360	chrome.exe
5608	chrome.exe
5624	chrome.exe
5624	chrome.exe
5608	chrome.exe
5912	chrome.exe
5912	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
516	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojZEoSUznz17.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojZEoSUznz17.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OoRjJglzLJCL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojZEoSUznz17.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromeSetup(1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5112	130.0.6723.70_chrome_installer.exe
3180	setup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000041ba55ff39bb976e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000041ba55ff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090041ba55ff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d41ba55ff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000041ba55ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ojZEoSUznz17.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ojZEoSUznz17.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\neajdppkdcdipfabeoofebfddakdcjhd = "E4BC013AE060AF96F649E9C166360D63ED8598E304FB280486E79AD078B9C026"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\neajdppkdcdipfabeoofebfddakdcjhd = "02E38628C143A88C6CDE4DA703DF4542062648A2C120A54212050349B5C4FAEF"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\homepage_is_newtabpage = "30830804EC755C10A30CE7C337F425E06808923D3FBEA9DB528BD5591C0467EC"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\UsageStatsInSample = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\media.cdm.origin_data = "662E7C1FB3D548FDF197288EAC65761911CCA7ECD3D41A9EE21F1E46FCB847FC"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_username = "52F4FD8987B903F5579F63E088C2390AC187E299606880D599A23D9AB7FD4C34"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\pinned_tabs = "CAB254D359A9F685B1A4AAD8451599363FC1F7D95C14C50823D52EDF59B4B274"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\version = "130.0.6723.70"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\homepage = "081489AFA3182FEA7912CA5FE9C34A6F51F05562AC06C7FB4C3E0F59FA4B0780"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_signed_in_username = "49A0C8ECCE926EFB4D0D553488A5AF0ACB6239C06CAB76573208754E1467C12E"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nkeimhogjdpnpccoofpliimaahmaaome = "371F497EEBE42927C31B17B9E0B0C6BDAF5B709A2449B2A88893B88AD2150BB9"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nmmhkkegccagdldgiimedpiccmgmieda = "B807C237CFA3E70FE65D552C8A91EE7346A8A4AA70AD5FEC0A4F4456E01316C7"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\search_provider_overrides = "80EA156677BFD237E45A12F2A331CC05616E204B873BBC66EE01744459EFFD14"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi = "67DE3B8CF1E2AF63325BFB117230FB8EE1EA33DE8971439E8D7F6A9B1934FE5B"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nmmhkkegccagdldgiimedpiccmgmieda = "4D3DB3463B80616CCF7D2FFF9117ED82F5FE1C0B21B773C6894BC58CC0AEEF65"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\lastrun = "13374698707800790"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\media.storage_id_salt = "C0B716BDB45251755482C89A0AC761CF320884BD1302B17D1A45577E32A5F521"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\safebrowsing.incidents_sent = "7346411FC47A460AAD1997993C3C04BC13D3825E473F32F5407398DB022E7954"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nkeimhogjdpnpccoofpliimaahmaaome = "ADD5B0D058B4A874C91137F9578714A2651EC1E916E39DAD53EE418928D7C03A"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\session.restore_on_startup = "468715957E3BEB0B14A4CB2B774B17B9DBE9D401335592FAD795DA5EA91D7B8E"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ahfgeienlihckogmohjhadlkjgocpleb = "C5FEF1BF1A5676556E3D0A5A306C3F8638E48F690FF4A1C1577FCEB12092740D"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133746987111538889"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\4"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4334319-8210-469B-8262-DD03623FEB5B}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0\win32\ = "C:\\Program Files\\Google\\Chrome\\Application\\130.0.6723.70\\elevation_service.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromeHTML\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\ = "ICompleteStatusSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ = "IAppVersionWeb"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML\Application\ApplicationIcon = "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe,0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\ = "IUpdaterAppStateSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML\Application\ApplicationDescription = "Access the Internet"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xhtml	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4B5D74-8832-5170-AB03-2415833EC703}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\5"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\ = "IPolicyStatusSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{44B969D4-48B7-5A30-9CD6-CAC179D81F9C}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ = "IUpdaterSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\ = "IAppCommandWebSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\TypeLib\ = "{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4334319-8210-469B-8262-DD03623FEB5B}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatus3System"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib\ = "{463ABECF-410D-407F-8AF5-0DF35A005CC8}"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{4DC034A8-4BFC-4D43-9250-914163356BB0}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\TypeLib\ = "{247954F9-9EDC-4E68-8CC3-150C2B89EADF}"	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\Elevation	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\1.0\ = "GoogleUpdater TypeLib for ICurrentStateSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromePDF\Application\ApplicationIcon = "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe,0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CCA9FC90-B200-5641-99C0-7907756A93CF}\TypeLib\ = "{CCA9FC90-B200-5641-99C0-7907756A93CF}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\ = "IUpdateStateSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4334319-8210-469B-8262-DD03623FEB5B}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C0DD9AE90BF0CD54C863668A4519833D\0BB9212D88005874597EB8E356E6B59D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\ = "IAppVersionWebSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\TypeLib\ = "{F966A529-43C6-4710-8FF4-0B456324C8F4}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\TypeLib\ = "{699F07AD-304C-5F71-A2DA-ABD765965B54}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromePDF\Application\ApplicationDescription = "Access the Internet"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BB9212D88005874597EB8E356E6B59D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0\0	updater.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1632	msiexec.exe
1632	msiexec.exe
4748	ojZEoSUznz17.exe
4748	ojZEoSUznz17.exe
3868	updater.exe
3868	updater.exe
3868	updater.exe
3868	updater.exe
3868	updater.exe
3868	updater.exe
4928	updater.exe
4928	updater.exe
4928	updater.exe
4928	updater.exe
4928	updater.exe
4928	updater.exe
2876	updater.exe
2876	updater.exe
2876	updater.exe
2876	updater.exe
2876	updater.exe
2876	updater.exe
2876	updater.exe
2876	updater.exe
4836	lTRNmTKwQzfm.exe
4836	lTRNmTKwQzfm.exe
2660	ojZEoSUznz17.exe
2660	ojZEoSUznz17.exe
2660	ojZEoSUznz17.exe
2660	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe
4064	ojZEoSUznz17.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	516	msiexec.exe
Token: SeIncreaseQuotaPrivilege	516	msiexec.exe
Token: SeSecurityPrivilege	1632	msiexec.exe
Token: SeCreateTokenPrivilege	516	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	516	msiexec.exe
Token: SeLockMemoryPrivilege	516	msiexec.exe
Token: SeIncreaseQuotaPrivilege	516	msiexec.exe
Token: SeMachineAccountPrivilege	516	msiexec.exe
Token: SeTcbPrivilege	516	msiexec.exe
Token: SeSecurityPrivilege	516	msiexec.exe
Token: SeTakeOwnershipPrivilege	516	msiexec.exe
Token: SeLoadDriverPrivilege	516	msiexec.exe
Token: SeSystemProfilePrivilege	516	msiexec.exe
Token: SeSystemtimePrivilege	516	msiexec.exe
Token: SeProfSingleProcessPrivilege	516	msiexec.exe
Token: SeIncBasePriorityPrivilege	516	msiexec.exe
Token: SeCreatePagefilePrivilege	516	msiexec.exe
Token: SeCreatePermanentPrivilege	516	msiexec.exe
Token: SeBackupPrivilege	516	msiexec.exe
Token: SeRestorePrivilege	516	msiexec.exe
Token: SeShutdownPrivilege	516	msiexec.exe
Token: SeDebugPrivilege	516	msiexec.exe
Token: SeAuditPrivilege	516	msiexec.exe
Token: SeSystemEnvironmentPrivilege	516	msiexec.exe
Token: SeChangeNotifyPrivilege	516	msiexec.exe
Token: SeRemoteShutdownPrivilege	516	msiexec.exe
Token: SeUndockPrivilege	516	msiexec.exe
Token: SeSyncAgentPrivilege	516	msiexec.exe
Token: SeEnableDelegationPrivilege	516	msiexec.exe
Token: SeManageVolumePrivilege	516	msiexec.exe
Token: SeImpersonatePrivilege	516	msiexec.exe
Token: SeCreateGlobalPrivilege	516	msiexec.exe
Token: SeBackupPrivilege	1372	vssvc.exe
Token: SeRestorePrivilege	1372	vssvc.exe
Token: SeAuditPrivilege	1372	vssvc.exe
Token: SeBackupPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeBackupPrivilege	1216	srtasks.exe
Token: SeRestorePrivilege	1216	srtasks.exe
Token: SeSecurityPrivilege	1216	srtasks.exe
Token: SeTakeOwnershipPrivilege	1216	srtasks.exe
Token: SeBackupPrivilege	1216	srtasks.exe
Token: SeRestorePrivilege	1216	srtasks.exe
Token: SeSecurityPrivilege	1216	srtasks.exe
Token: SeTakeOwnershipPrivilege	1216	srtasks.exe
Token: SeRestorePrivilege	1884	OoRjJglzLJCL.exe
Token: 35	1884	OoRjJglzLJCL.exe
Token: SeSecurityPrivilege	1884	OoRjJglzLJCL.exe
Token: SeSecurityPrivilege	1884	OoRjJglzLJCL.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
516	msiexec.exe
516	msiexec.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe
516	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1216	1632	msiexec.exe	102
PID 1632 wrote to memory of 1216	1632	msiexec.exe	102
PID 1632 wrote to memory of 3952	1632	msiexec.exe	104
PID 1632 wrote to memory of 3952	1632	msiexec.exe	104
PID 3952 wrote to memory of 1884	3952	MsiExec.exe	105
PID 3952 wrote to memory of 1884	3952	MsiExec.exe	105
PID 3952 wrote to memory of 1884	3952	MsiExec.exe	105
PID 3952 wrote to memory of 4748	3952	MsiExec.exe	107
PID 3952 wrote to memory of 4748	3952	MsiExec.exe	107
PID 3952 wrote to memory of 4748	3952	MsiExec.exe	107
PID 3952 wrote to memory of 3956	3952	MsiExec.exe	109
PID 3952 wrote to memory of 3956	3952	MsiExec.exe	109
PID 3952 wrote to memory of 3956	3952	MsiExec.exe	109
PID 3956 wrote to memory of 3868	3956	ChromeSetup(1).exe	110
PID 3956 wrote to memory of 3868	3956	ChromeSetup(1).exe	110
PID 3956 wrote to memory of 3868	3956	ChromeSetup(1).exe	110
PID 3868 wrote to memory of 2980	3868	updater.exe	111
PID 3868 wrote to memory of 2980	3868	updater.exe	111
PID 3868 wrote to memory of 2980	3868	updater.exe	111
PID 4928 wrote to memory of 3472	4928	updater.exe	115
PID 4928 wrote to memory of 3472	4928	updater.exe	115
PID 4928 wrote to memory of 3472	4928	updater.exe	115
PID 2876 wrote to memory of 4968	2876	updater.exe	117
PID 2876 wrote to memory of 4968	2876	updater.exe	117
PID 2876 wrote to memory of 4968	2876	updater.exe	117
PID 4836 wrote to memory of 2660	4836	lTRNmTKwQzfm.exe	121
PID 4836 wrote to memory of 2660	4836	lTRNmTKwQzfm.exe	121
PID 4836 wrote to memory of 2660	4836	lTRNmTKwQzfm.exe	121
PID 2660 wrote to memory of 4064	2660	ojZEoSUznz17.exe	123
PID 2660 wrote to memory of 4064	2660	ojZEoSUznz17.exe	123
PID 2660 wrote to memory of 4064	2660	ojZEoSUznz17.exe	123
PID 2876 wrote to memory of 5112	2876	updater.exe	127
PID 2876 wrote to memory of 5112	2876	updater.exe	127
PID 5112 wrote to memory of 3180	5112	130.0.6723.70_chrome_installer.exe	129
PID 5112 wrote to memory of 3180	5112	130.0.6723.70_chrome_installer.exe	129
PID 3180 wrote to memory of 2304	3180	setup.exe	130
PID 3180 wrote to memory of 2304	3180	setup.exe	130
PID 3180 wrote to memory of 5060	3180	setup.exe	131
PID 3180 wrote to memory of 5060	3180	setup.exe	131
PID 5060 wrote to memory of 4844	5060	setup.exe	132
PID 5060 wrote to memory of 4844	5060	setup.exe	132
PID 3868 wrote to memory of 516	3868	updater.exe	135
PID 3868 wrote to memory of 516	3868	updater.exe	135
PID 516 wrote to memory of 3940	516	chrome.exe	136
PID 516 wrote to memory of 3940	516	chrome.exe	136
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137
PID 516 wrote to memory of 3816	516	chrome.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\94200b3b4792c019ebe7bcfd16573fdedf385369e41309d82958568078e90c43.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:516

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 159C13D015A3041523E02A247B375A55 E Global\MSI0000
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Program Files\ImproveDefenderResilient\OoRjJglzLJCL.exe
    "C:\Program Files\ImproveDefenderResilient\OoRjJglzLJCL.exe" x "C:\Program Files\ImproveDefenderResilient\jXdmemDIXVZlyRJvLnMc" -o"C:\Program Files\ImproveDefenderResilient\" -pBWkOspNCEXRAXyVSBPgs -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- - C:\Program Files\ImproveDefenderResilient\ojZEoSUznz17.exe
    "C:\Program Files\ImproveDefenderResilient\ojZEoSUznz17.exe" -number 264 -file file3 -mode mode3 -flag flag3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4748
- - C:\Program Files\ImproveDefenderResilient\ChromeSetup(1).exe
    "C:\Program Files\ImproveDefenderResilient\ChromeSetup(1).exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Program Files (x86)\Google3956_1694002597\bin\updater.exe
      "C:\Program Files (x86)\Google3956_1694002597\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={FD39FE3E-F972-AC55-37EA-CE3FED473068}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3868
    - - C:\Program Files (x86)\Google3956_1694002597\bin\updater.exe
        
        "C:\Program Files (x86)\Google3956_1694002597\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xb5c694,0xb5c6a0,0xb5c6ac
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2980
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        5⤵
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:516
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=130.0.6723.70 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80fba8c38,0x7ff80fba8c44,0x7ff80fba8c50
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3940
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2044,i,11038654843219246011,10486916262987556365,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2040 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:3816
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=2076,i,11038654843219246011,10486916262987556365,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2088 /prefetch:3
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:3468
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2336,i,11038654843219246011,10486916262987556365,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2276 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1384
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,11038654843219246011,10486916262987556365,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3180 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3524
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,11038654843219246011,10486916262987556365,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3224 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:3104
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3996,i,11038654843219246011,10486916262987556365,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5236
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4644,i,11038654843219246011,10486916262987556365,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4660 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5276
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4828,i,11038654843219246011,10486916262987556365,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4832 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5360
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5016,i,11038654843219246011,10486916262987556365,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5004 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5608
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5020,i,11038654843219246011,10486916262987556365,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5164 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5624
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5096,i,11038654843219246011,10486916262987556365,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5320 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5912

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Program Files\ImproveDefenderResilient\lTRNmTKwQzfm.exe
"C:\Program Files\ImproveDefenderResilient\lTRNmTKwQzfm.exe" install
1⤵
- Drops file in System32 directory
- Executes dropped EXE
PID:1152

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xadc694,0xadc6a0,0xadc6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3472

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xadc694,0xadc6a0,0xadc6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4968
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\130.0.6723.70_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\130.0.6723.70_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\4c5c1193-faf7-4690-b3f1-36ae8ac282ff.tmp"
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\CR_619F9.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\CR_619F9.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\CR_619F9.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\4c5c1193-faf7-4690-b3f1-36ae8ac282ff.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3180
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\CR_619F9.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\CR_619F9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=130.0.6723.70 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff6f12d0c28,0x7ff6f12d0c34,0x7ff6f12d0c40
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:2304
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\CR_619F9.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\CR_619F9.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:5060
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\CR_619F9.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\CR_619F9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=130.0.6723.70 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff6f12d0c28,0x7ff6f12d0c34,0x7ff6f12d0c40
        5⤵
        Executes dropped EXE
        
        PID:4844

C:\Program Files\ImproveDefenderResilient\lTRNmTKwQzfm.exe
"C:\Program Files\ImproveDefenderResilient\lTRNmTKwQzfm.exe" start
1⤵
- Executes dropped EXE
PID:2152

C:\Program Files\ImproveDefenderResilient\lTRNmTKwQzfm.exe
"C:\Program Files\ImproveDefenderResilient\lTRNmTKwQzfm.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files\ImproveDefenderResilient\ojZEoSUznz17.exe
  "C:\Program Files\ImproveDefenderResilient\ojZEoSUznz17.exe" -number 162 -file file3 -mode mode3 -flag flag3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Program Files\ImproveDefenderResilient\ojZEoSUznz17.exe
    "C:\Program Files\ImproveDefenderResilient\ojZEoSUznz17.exe" -number 362 -file file3 -mode mode3 -flag flag3
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4064

C:\Program Files\Google\Chrome\Application\130.0.6723.70\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\130.0.6723.70\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5992

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:5136
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xadc694,0xadc6a0,0xadc6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5801b2.rbs

Filesize
8KB

MD5
d66451842072f287660ff2b956f66bc6

SHA1
ae32138826d1e9bb9723c2f3cb43ea50bfe5a0a9

SHA256
d117667d6912d2f3c0203e940476c6621d1767f246d71f4ae7769ab996a6ec75

SHA512
be2b7942288fd31d344237c3a183de66fbd51701b551853dcd60c361ea4c04a53e32642f9d7313b623b52dc8bc13dd2981ef5201ac6ec359a98a678759c7fb3e

Download Submit
C:\Program Files (x86)\Google3956_1694002597\bin\updater.exe

Filesize
4.7MB

MD5
823816b4a601c69c89435ee17ef7b9e0

SHA1
2fc4c446243be4a18a6a0d142a68d5da7d2a6954

SHA256
c2a7c0fa80f228c2ce599e4427280997ea9e1a3f85ed32e5d5e4219dfb05ddb2

SHA512
f3b38807ed1eb96c932e850b9b37551554408a628bedf12aa32bde08c442ff3663bf584335e7eab193ce2cf7552bce456737c96a2ba9faa953150e6304068fc6

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat

Filesize
40B

MD5
bb0390913628ed809daf12dc43682f44

SHA1
7129fcd697111c804109c8cc85833bcd7633a1a6

SHA256
94428a3af3e3c7d0003dfa4af783be4cf7eceaafeff587e1afb405821283f4eb

SHA512
9db60cea36ef7de6a327e75d17b21b6bfcdec8f0aa201299c49ef48050af6ecf0dc13a54b7c4fc7287436481e43b1766dff7498cd48cbfba2a3b8815f20371c5

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
591B

MD5
987f7552ab186069b2ec417b394601c9

SHA1
2d4292ac2dbf6e57292b5b4f4ab32f3f82f82d43

SHA256
8e7487ae145d190c11bdd773e4c1b7cd46b8c15ce57d2da444a02eff6a8f0849

SHA512
d429ca378ca6141a046db247b7240f7cc603d7fa3d2696e61d0c3f38180d68e86e37bc345fe94daaf058b517c21cd6a681d0835b40102258f0bb7380ead75389

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
354B

MD5
d4927578fc92dc543365aa4e43b202ba

SHA1
5e1aeb950ac6ac3f071fa02f90a4fbc0c8e5304c

SHA256
4ac029c04a6e82f4c588237f57a798b4285c818bdbb4250c20f11a5b95d4ecd1

SHA512
4c6cbf4bfb4279edc6d6bd816ca4d1d4dbc8b7f06d875493ffeea3a8782568f49911db28aae743a41962bbe4fe34afc531e119be58888a2acf0623e99df38e95

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
492B

MD5
78337bf7884b9f8dabf4487ead067384

SHA1
0c0d216dc5f8923b884357cbfb64548ce273606e

SHA256
df59eb328ddd7b2061ba43ec4a93eeecf1ce0cb451e7f91ff99086f3c669d686

SHA512
e2eeb1b6123db80ba4fbc86c5934365f7c4f8887082ca727e2c977166747ea90783292f0c4a53c191ee14e0ca65ab27cfdb75d8ff2d38cbdbe6dd0f6f499ecce

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
591B

MD5
12b30d5fc18cc1e14a58cebbc6412c10

SHA1
4c45b4f52312fb2bc0a0f362bf3dd1e028d1b1d7

SHA256
b5e051dc217e66ff02fbc5e2a6eca03ed797b7a15c8f4d26dcc3c26409133049

SHA512
23ebc146e5b272d07a36b0ddff3c2faca454888ccd6a9f68fe745f60c42f4768a91dfaad43f5e07f7660b06053ec92f77de3276657f5afe839337d01a172b18c

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
49B

MD5
7b693a82168c33ec9e8cf276859ddf7f

SHA1
d396dbbe299fe7754a6244d01e97cc4edd0693eb

SHA256
84a9a7f43db56cd6e9a408f88244e8ba5efbe48a5b5168d321f112b8c8fd8e3f

SHA512
4064c158d753d19a72e1be1c8bd5fe7f22e2032d67d1dd7ea1d85ce652d63c69b85a4292c4403b0f7729b05607f3d1ccfaf4d27d04ad09ffcec70082450320ab

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
ea063ab1e2fcb4751853b2093ce16f99

SHA1
3b666021c4edef6aa75c026b1ec838b60b68650e

SHA256
36d19b59dbf58e4b4064723a0864376d2d2938e7119a0d8fb8cbb5964652144f

SHA512
0c7e4fb77017cb7dc1d1b1d3e67ad41eea0b22ee161c5067e9ba7adddc559405b1fc56d715db5ec63b480ee9d474b81e2b597d58aafb448d939d675f4210b91d

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
0b8870aa415db0febc11b4635cffab4d

SHA1
fc94956db59f9ffcfb041b15d22b93c2ef984396

SHA256
97fdf60a2c87f422d2c5b3ff4fcf23cc33f63cb4c9a45467c80715fb4848d21c

SHA512
709380f7a504834f341b1e9880e7b89ff8661b1349cec85e3827d64a4db747a74f8461d02d0121504d9e681fa8014c05d8af0a57e97ac2b19a5dcc9026d2e7ae

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
4KB

MD5
4a446f2a84d610b8696dff9e41cba5f6

SHA1
8edcf74305daa278d849d94f3e7ea28459e6b6e8

SHA256
73478b8cdee3ac89d807980017f669ab4c78808a494c1ae8561afb0fbf0f806b

SHA512
ae0773652d2d412eba433053830bb75225f110255f787cb5222a1571f34fced7cf15a7ac211f2136224fddb9cefc7d682259130dd8a87f82d1c1920945a7d85d

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
5KB

MD5
108f0eeee5c0145f36a2ff532567ba0d

SHA1
7fc22ad98d3d8b0a2471cbd117d8c36b809478ce

SHA256
74b45ee5a8160da81d6f454e7acae3387276e72ee77ae4d2bf23cbacf220a5d8

SHA512
55b752aef0bf6cfae6834d1a66d3679472be7659fdbedd1e27fc0a222a5c584ab721f4bd0daea2accb85adbec25482be07de69c48fa1da7960cebc9c3bae9e8b

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
9KB

MD5
df8a568e77e640171a637fb70d832da9

SHA1
b0b0e22f87ac8324c72edecb0a6f16504fa39266

SHA256
41d8bf7d6632f90e51441ee47c377860a49b5c52b47a81695889f77a3d5de0b3

SHA512
8982ff916917715ad189222a2e4cb4a65dcfc467641d929891657cfd3baeccdbea830439f4522a7cd0eeeae941b00e10f49387b95d08af82146bed299e6c80b7

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
11KB

MD5
4fcd1083eb8152da6ca3cfe28d0c9dcd

SHA1
dc08058a522e2bdde39abd38c568859d7c25cd56

SHA256
dd67a3aa8418557f24fa2fdbe0a24f357aeea097db89bbd0ac2101441d0bbb76

SHA512
9feeb8f94d0e90fbc3e7c91a216b489e3b05c96d7bbfd0554c230505a21b3d66045a9b57418c15a7067e42414c190eee9138616535d4da578a6d907d03bfc2d6

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\4c5c1193-faf7-4690-b3f1-36ae8ac282ff.tmp

Filesize
689KB

MD5
82521e71386d0e6521050107dd96bb06

SHA1
1721eb11b76e50e02c085447625ad781143bfe1e

SHA256
0fd5b3b6d6a2aaa641620629d5f1dc328fc87d88678ac15d60d420392e5b9278

SHA512
6d794c1e6a7a0bff31bee2215c540d63ea87be11bedee54cbcfaebc0705bcedc915e34d9a281938b1de76d39705c1475fd4e02f0acd0c869d3e1163933e87a22

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2876_1164875365\CR_619F9.tmp\setup.exe

Filesize
5.7MB

MD5
6e325883a67e7d354e75dabc07ecd6bf

SHA1
381c6c8ca0461610afdd84dbfc95ce8aafc52b4c

SHA256
7a403868f3d6b1eb381646a22678b45542cf1f63105d6801a1aecb52166d4983

SHA512
06f12728127110e279d76bde41fbb270298276f731f4c2be08968b1c56449e829a1ffd4a0fee85af5540dc3e81785c8e785d44c16cff3eb12700542c4d3f61b8

Download Submit
C:\Program Files\Crashpad\settings.dat

Filesize
40B

MD5
8ba3f4824f1889dcb48a57a38db6225d

SHA1
0bd6453a1e051afedc670737780c8b403c9bce92

SHA256
73bb38d81a834c81111b78dcc9fe25fd12d1f1e7b44c5b26b6ba72aaeb4cd5b4

SHA512
1373d1d2df580c519515a0c5029c099489200d4d5fdd95daaac60e4cb012047032c84796f0aac6b0311c9bad18a80a5429ea0eb482f09362e1b61882a896359e

Download Submit
C:\Program Files\Google\Chrome\Application\130.0.6723.70\chrome_elf.dll

Filesize
1.3MB

MD5
8be34be07c1eb302d563c3e236de7f06

SHA1
714ece70a71a8c5eaee7f210343b1d62c2d69810

SHA256
d9439e1611d45f38198dc1dba805b33e9f9b689a160b99a21810b375c764b9ef

SHA512
356aeed72c1ead00f947be31900da92e3c3fac0a9ea086334491fb3b1226bfad3c807f67b6a3498ef144cc65445d6eab12b18c7bd21f3a3eb1afb75655753e45

Download Submit
C:\Program Files\Google\Chrome\Application\130.0.6723.70\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Program Files\Google\Chrome\Application\130.0.6723.70\libEGL.dll

Filesize
492KB

MD5
2c82daf82fe293355175eea7a4096d6d

SHA1
27898e657553bb89c1a2b4bb8b4c0e4740ab4bee

SHA256
98d5cee53a5bd6484db1d7b6a82a6f4dad62d03e2853a51299adc3e1cfdcb54f

SHA512
aebae801a92105fec79e9085845a96a2a29966f410d46259c021479e8761a584e223f1a5c8c113b2010cb82aa172aa9b1a71117b594eb9fcaefee8286f30246c

Download Submit
C:\Program Files\Google\Chrome\Application\130.0.6723.70\libGLESv2.dll

Filesize
7.9MB

MD5
3624625340bb0fee6081d93c333dcbf3

SHA1
d3f899bd6b8aa7e118e3ec59c5205ba73ed080ef

SHA256
6272596730531f740c09eab314af7c160cd2e7113907b882bcd1ee5b58aaa1fc

SHA512
9d3f76668b812ea39a94c0a59b460c34759ec56e3ff1f9bf2ac8fde2407b9360f171f01de2c0ec6edc780fe1c61ca0387c5fdea609baf6fb42627c4f37f194c2

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.7MB

MD5
4ccbb201f6a8be84fad84ca68e9e4858

SHA1
def9de1a7310f464ddd6b770e34de0205d650b45

SHA256
19d14030d506ea5362a5fbecd512a09314a1a57a7a28e0ed8933292a7e5a72dc

SHA512
1228cabbda54fc6c64db5a0622777d2f3c484cf0bc00bc75ec08c47e05dc5b1205371b78fc1da7304091b3de546995f6cb23612df93b457bbb2c65cc41ae23d5

Download Submit
C:\Program Files\ImproveDefenderResilient\ChromeSetup(1).exe

Filesize
8.5MB

MD5
5adff4313fbd074df44b4eb5b7893c5e

SHA1
d27388ef6cf34d40e0e7666f6381fcc5bbafa0f7

SHA256
d0c7a4390bdd6b442b96fc76f8a38f7b756ba2c16752ea259844420161865cae

SHA512
f5d639922b91878cf83d97563288a3aa4cba94db3ad5e8ac11d24ef7c44b019383a4414aeba6171b4c7bfa83ea1eafc1231cc9233e3b82b5ca7dc0b3ffacbf60

Download Submit
C:\Program Files\ImproveDefenderResilient\OoRjJglzLJCL.exe

Filesize
577KB

MD5
11fa744ebf6a17d7dd3c58dc2603046d

SHA1
d99de792fd08db53bb552cd28f0080137274f897

SHA256
1b16c41ae39b679384b06f1492b587b650716430ff9c2e079dca2ad1f62c952d

SHA512
424196f2acf5b89807f4038683acc50e7604223fc630245af6bab0e0df923f8b1c49cb09ac709086568c214c3f53dcb7d6c32e8a54af222a3ff78cfab9c51670

Download Submit
C:\Program Files\ImproveDefenderResilient\jXdmemDIXVZlyRJvLnMc

Filesize
1.1MB

MD5
04b529a6aef5e7c2a1f79a04b81be20f

SHA1
ee6a4c1f35ae62a42c0a4378362878769cd3aec1

SHA256
c7101b019dc7625c4036420b8c9f90ad4c6e7e57d847b1c60c6270cc67cf8aca

SHA512
328ed4939b78630cec8aa7ff3fc0af48ae4b1592241265d8f3d60d2945772686b1a1eb40b1ace635dad911482a12a985432793cf48ca9d637558982c53a11f81

Download Submit
C:\Program Files\ImproveDefenderResilient\lTRNmTKwQzfm.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\ImproveDefenderResilient\lTRNmTKwQzfm.wrapper.log

Filesize
431B

MD5
8f4b1c9a08b6909713b84e5efa32cabe

SHA1
6e7c288511a750b6e758f4e8987cbe7b03d1cbca

SHA256
59113d27ee65d3620117740ecc545318d24bdf8d07e89af0e5b75e49ac974b0e

SHA512
8dcff19339edee57e51731d20a47d3579e3e26dad5f76ca67be0342f454eed60a8d3048f2ad930d50f44c3a7e777eb70869c046d5908ee0704eddb7b9887dc45

Download Submit
C:\Program Files\ImproveDefenderResilient\lTRNmTKwQzfm.wrapper.log

Filesize
600B

MD5
f22c4d34354da9ab9ca275dd93e19dd0

SHA1
066be0f50d8bcd3601b48aee381a93cd83998cd9

SHA256
c2fe7c2e3f2da29350e489fad7891a1dd78687449138009bfd6ddc2ac5a4ead9

SHA512
617243add0d838e09e90d21955c1a963eb1bb64a3c75c97824fde07b17ae655ca8b35772b6366b27ebabea0ee09d030d3e70b45d760cb63f0a6a9805457a4418

Download Submit
C:\Program Files\ImproveDefenderResilient\lTRNmTKwQzfm.xml

Filesize
448B

MD5
266bfe492318ff1337c913cc4635f563

SHA1
32f7a6db72b608302368b546afaf9e2307fd1dde

SHA256
23eda6decdfaeed555d8ad9f83795a90cbedef8a3b75960d6794bb231e86fc47

SHA512
872cd6a69305aae9ac776a031a4c1b2d5ce08915477225752154e45d32dcbaafa29048d9033577caedd3eb2d862373b08d61d211e55e8673265d87ca01afd341

Download Submit
C:\Program Files\ImproveDefenderResilient\ojZEoSUznz17.exe

Filesize
2.4MB

MD5
f85f44f7f01ac7dfe2d379dad4386920

SHA1
2d1fefb3ac611e97845659085aaccf10b74815a1

SHA256
e2dde008486ee007b634bb8012ae1fc11f79ee4a2ce6e4d5337074cfb2582e73

SHA512
56d060093e92a6663b4c17a39c209009439d09b119856890ed9200cac51a3d2c7f726b681964cce83e0daf77a177db62fa5cf5ddb639fbe25c4be5c6fa5cc7a1

Download Submit
C:\Program Files\chrome_installer.log

Filesize
21KB

MD5
f18bc76b4d6b4c1625ff7d9741be6844

SHA1
6e4f752a3b1675752dc763bf5227c02a6dd477b2

SHA256
b24a0576761ae6909260cdc30d6087c118b616796cadd8d39256f0379a70f763

SHA512
3cacbde19b60063d8595009a4f94fcdeef935cbeb51ede9034a96d6f7faabc0fbee73db66014b58751ab09ec29457667f7d61b74a41ca1ea5b04c3a4da68a51a

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

Filesize
2KB

MD5
3e49f1c011d9aa73d3313593f891e17e

SHA1
28c46ec664e0d0d2e1978e3cd816a04a5f697200

SHA256
f7ea5c02592e644050a3112721aa4d79eea95f7915efc2db141649e8b693b0ba

SHA512
b8aea6bec44dc5a4231e09070a562cea44e4932b826ea8cebd38b61a9d7a273a1fe9c1bf59764624ffac7c5d50a702641cfd6743c0d1bf2fc0cebcb913e78709

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
126618c8e18b4920bda44ff1f25243ad

SHA1
dd6420b9f44c1593f2c6c81dd55aaea098ffdae0

SHA256
2f6ea1810d6699c12c17fb61c9a655330e07782a8480a8212d390375c20a93bc

SHA512
8900075ba9777308759f4e7bc8a536f123b0ad8df93010b44ad84db7ad306ca14023f64989e24ef8e21dc8faa79936d367b00a6c3458932da6f380c76872d4b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
cc6a364757645921a23207cfeffcc39e

SHA1
936a7120257b805fcf680d99af0e4b03bd92f7a6

SHA256
8ce74b1124c310498831fdc04ba4a16c5ff381c837d26b45a388429fb29dfe2f

SHA512
6b6e9780fea739f08e5467881a170ebfc742485bec982ef466a024637c6a611df861576951ff61b2839c1911d1cbcae6a1ffa882323eca2b9edb8422cfbb2db0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9420cf91a5c4f9dbb74708364704365b

SHA1
7f45b505d6e23e7597ae6351e89c4447bd80a664

SHA256
d3182c4638d420817b5efba9f2facf3c8b2933a30eb947b34570cc1679babb53

SHA512
08b2b11661ec058849982b5954a359d6227608d0e89f396b516c4b801b55be7b6195ed8e59ae7970c262d20db6606635622366e14867b23ac50bf21bff2ef629

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
d646be5e0ce5ed29ad85e1ecf11f0a37

SHA1
03f1ec85af2a955f0663ee8e5eeec62bf7b753dc

SHA256
d20e2f1426b14a2a6fa80ed0560c2fbbed32cb912d853452324d7a0ce0fcf4b5

SHA512
3568598841aaab34adbfecb8004e03f7d1dc36a9977d24d4b00c67fcfb54bc02354c49176274371fd3f5acef2d80387a42b163f44af9404490689952f01d7519

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
57d16d300d90b4ef21738c6763a076fd

SHA1
45e219f5e0c387cd75b58e7ff5e4a272fd39fa21

SHA256
7195b0da9b78fb1d373f51623da16cedf7304d40eda2ce79d54867864b67db44

SHA512
bf85e381d8e9c310f1c205755e78ae1b45902ad0030a07ec9f576be330f5fd63ce2d15caee2ca9f7c9d5c3df03bff0ebc021bc8ce90d8a7e78b2e9d1a484d503

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
0a4716190d4bcf34c89f9b0962e43244

SHA1
b6f7c8eddb008b19afe005402980ff6eb2c0bc7e

SHA256
80520aa86b375c5a47a4b6582baa40b86bf58f8aeb5335d9b5b6c8857db72312

SHA512
a2be1b901ba71e45ff4f085f1077a182d32daaa98fa332046cfa9494653c8ddceef83ebc0700cb1f37f7ca29f544fcb0c0e9cd84d4977da03569e7015a9fa2b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
321a77678fda371a74d99fb7771762bd

SHA1
060235f7cfe3e0e4f5112ddd1f5047b7c3fbfcd1

SHA256
ea1fe5f6c19b5ed7e2b323194f87a568c4c45d80a1affb558defa0f3e2125c07

SHA512
6d7a4c4af9c2488681605e89d4d82ebf5c558c32ddc89e610788ace70160c3905151595910596b592923f1cc139411a32df265f645602a699f4705a74235bda6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
201KB

MD5
7f64261359417a421939f0423a3e331b

SHA1
0ddc18e5089f68c3b0eed5f7e9eea58943958b0d

SHA256
51aff599bd7d17238dad61a7db7fd9685d839eaeace4cd5fbf13357807f27d0a

SHA512
c9e17f5dfb8dc5f02191461ba4072cca0733a8a9ca00334947eb0ca5674189e961b9a530154fae0ece879ec95aabce34cf6ee094e61f4b5482b23ddcd6d68947

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
69490a0ab4441b07f2171c24f9f7c6f6

SHA1
95359e7ae0799486b2ba3fa1e6e6a8904ff43cbd

SHA256
15fc1b11bdb63bb0c29f2cacf4fbe4b568218b1ec334c8d000e5beb110cdc03c

SHA512
61c55f08634e91153ee5372e2b3ceb6b78e863854a220ab5208d10ad9badd7d1c50a677abbc88d273d3102f52158632032cabf777a36b4e4ec479bcda3d8ec7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
f5fc9cc24e0d28649b22f125eb3e37c6

SHA1
8ac72d677ff83d315475a9856f0216e874bd31c3

SHA256
71dfef1562352d73f6b952e8c438c7b270642cbd10816faf3f58350fe859a636

SHA512
0848ae02186f947a1159f9bcff664d2b5a191b459c4224b19895769da383e59d683f5b023ca1c5871005542e95447a850c2df8b3f90d5e2c0ea4b299aa8c655c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
201KB

MD5
87a3f5acd74b5cdcaf4c15f5c88e103d

SHA1
dc6760c20f579b2bd27e3d24453273e9dec7a048

SHA256
cc36b7539df1688997a501734cf6efa0331f08b64e13f928f4a0164ecf5a6a80

SHA512
c0caea2b83d794ca3d96bc971f8ba7d2084d3d6105065e8095739e530ebf525c80b2217c27cd467185a206d1d2bc265e1c66004844b7a80563ff0a153010389a

Download Submit
C:\Windows\Installer\e5801b1.msi

Filesize
28.7MB

MD5
bffddb889b7089cc6af3b9d9efb3c89d

SHA1
977fc679569271849068e704a53c57b09009f414

SHA256
94200b3b4792c019ebe7bcfd16573fdedf385369e41309d82958568078e90c43

SHA512
0c3d0db3b8d0c5a071cc3a140695d8ea1b1600c36add6a4c36e24effd9d4dc579ce6953386cc624406c8fb9d6ba436b7082a5e675799d3f860fd0df6a5946e93

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\lTRNmTKwQzfm.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
5238003864eabe8a0737d8b2d4c4cc08

SHA1
3c616a4332a6c93da74810b5937f1d2ab59b14ec

SHA256
259552a1783d1aba8fd28d5c78ada6ffb41848d64ebd91990f42898c4b2ff04c

SHA512
816225e0d0b0343d2f2ca2cf774bd8a2d2484dde718d051c9cc1372f9cc6a44eeb51f28a4eeeea712223aef2c9af00473bccc6c531bda67544f8556a866ebc06

Download Submit
\??\Volume{ff55ba41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{fe992899-6042-44b1-976a-fe003d5b6e2d}_OnDiskSnapshotProp

Filesize
6KB

MD5
942195ff204a80312dda029b4d94f6bc

SHA1
0a1b45990f6711837b14f5ab8826915282543d03

SHA256
1e6243fee94e6f572b64ac2f9948fa2b448d182a98bf56b58ae507d67dc4ae99

SHA512
702b5228349f1c8153327a9bfa111e730eafa08029ba1f13e7bc30758865d18a16d132361d255897d759ffc6a5e0c938179e96e4ddf1bc8745b876b4316eff83

Download Submit
memory/1152-58-0x0000000000AC0000-0x0000000000B96000-memory.dmp

Filesize
856KB

Download
memory/4064-156-0x000000002B9B0000-0x000000002BB6B000-memory.dmp

Filesize
1.7MB

Download
memory/4064-155-0x000000002B9B0000-0x000000002BB6B000-memory.dmp

Filesize
1.7MB

Download
memory/4064-153-0x000000002B9B0000-0x000000002BB6B000-memory.dmp

Filesize
1.7MB

Download
memory/4064-152-0x0000000029D90000-0x0000000029DCE000-memory.dmp

Filesize
248KB

Download