gh0strat | 08734e0c77e055be3c43066f2cbcfd84537a819434d1e1f6d41c984ff7a4d865

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChromeSetupz.5516.25.msi
Size

20.2MB
MD5

92f66429d4ad77c68f77060cb18dcce0
SHA1

cde034910f4ad24df46f6bc7e4e6d467ac8baa31
SHA256

08734e0c77e055be3c43066f2cbcfd84537a819434d1e1f6d41c984ff7a4d865
SHA512

de04850632071600f6d1b9efaa3d4272ef4176e474ab8feb0caf029c300fb4c0d5a0d9f28a037c4b61a9ddaa9ca2fc89d82f09c414bffc9580935b05f1b59cc7
SSDEEP

393216:0Q0Frf5krXSujs/7rYMB6z4GGFTfuN0+O6r7a7n25K5Q0quXbenFJldPYjzhEiA8:0Q05JQs/gZzdGFyHre7n250PbenFtPQl

Score

10^/10

gh0strat purplefox discovery evasion execution persistence privilege_escalation rat rootkit spyware stealer trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 3 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/1700-159-0x000000002C130000-0x000000002C2ED000-memory.dmp	purplefox_rootkit
behavioral2/memory/1700-163-0x000000002C130000-0x000000002C2ED000-memory.dmp	purplefox_rootkit
behavioral2/memory/1700-164-0x000000002C130000-0x000000002C2ED000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/1700-159-0x000000002C130000-0x000000002C2ED000-memory.dmp	family_gh0strat
behavioral2/memory/1700-163-0x000000002C130000-0x000000002C2ED000-memory.dmp	family_gh0strat
behavioral2/memory/1700-164-0x000000002C130000-0x000000002C2ED000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3560	powershell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\130.0.6723.117\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	yrjwPObnoqyg.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	yrjwPObnoqyg.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	yrjwPObnoqyg.exe
File opened (read-only)	\??\O:	yrjwPObnoqyg.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	yrjwPObnoqyg.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	yrjwPObnoqyg.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	yrjwPObnoqyg.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	yrjwPObnoqyg.exe
File opened (read-only)	\??\V:	yrjwPObnoqyg.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	yrjwPObnoqyg.exe
File opened (read-only)	\??\L:	yrjwPObnoqyg.exe
File opened (read-only)	\??\X:	yrjwPObnoqyg.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	yrjwPObnoqyg.exe
File opened (read-only)	\??\K:	yrjwPObnoqyg.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	yrjwPObnoqyg.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	yrjwPObnoqyg.exe
File opened (read-only)	\??\S:	yrjwPObnoqyg.exe
File opened (read-only)	\??\W:	yrjwPObnoqyg.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	yrjwPObnoqyg.exe
File opened (read-only)	\??\R:	yrjwPObnoqyg.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_841DF67C840691A847835C0F760B4DC0	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_841DF67C840691A847835C0F760B4DC0	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PpMCUaskmPAB.exe.log	PpMCUaskmPAB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\sk\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\hu\messages.json	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\_metadata\verified_contents.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\Locales\et.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\Locales\fil.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\PrivacySandboxAttestationsPreloaded\manifest.json	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\DriveHumbleTechnician\yrjwPObnoqyg	qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\zu\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\zh_CN\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\manifest.fingerprint	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\Locales\bg.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\Locales\uk.pak	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe58e932.TMP	updater.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\pa\messages.json	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	C1h2r3a6ais7up.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\f66e3c9a-e629-43a2-9c88-be81f7fbbe16.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\resources.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\offscreendocument.html	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\dxil.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\Locales\bn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\VisualElements\SmallLogoBeta.png	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\fr_CA\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\eu\messages.json	chrome.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\769035ab-fd69-4a33-bedf-99680dc5e6e1.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\Locales\af.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\hi\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\ka\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\de\messages.json	chrome.exe
File created	C:\Program Files\DriveHumbleTechnician\eaKqUwGXuXSKSERTyFiFfxKGAgTAir	qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\en\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\ca\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\iw\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\dasherSettingSchema.json	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\chrome_elf.dll	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\fa\messages.json	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\Locales\ko.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Application\130.0.6723.117\Installer\setup.exe	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\hr\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\lv\messages.json	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\Locales\vi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\Locales\hr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\Locales\pl.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\v8_context_snapshot.bin	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\VisualElements\SmallLogoDev.png	setup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\Locales\ro.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\en_GB\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\gu\messages.json	chrome.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\CR_991E3.tmp\CHROME.PACKED.7Z	130.0.6723.117_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\Locales\ml.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\VisualElements\SmallLogo.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\chrome_wer.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4168_1857885555\Chrome-bin\130.0.6723.117\libEGL.dll	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\th\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\fr\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\cs\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1544_1638013986\_locales\nl\messages.json	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\130.0.6723.117_chrome_installer.exe	updater.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E3535876-7CDF-474D-9B78-FC4A9ADEFD7C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF6D3.tmp	msiexec.exe
File created	C:\Windows\Installer\e57f59d.msi	msiexec.exe
File created	C:\Windows\Installer\e57f59b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57f59b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Executes dropped EXE 37 IoCs

pid	Process
1928	qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
4012	qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
1904	yrjwPObnoqyg.exe
1312	C1h2r3a6ais7up.exe
2208	updater.exe
3176	updater.exe
3840	updater.exe
1964	updater.exe
3408	PpMCUaskmPAB.exe
3480	updater.exe
1628	updater.exe
3132	PpMCUaskmPAB.exe
3172	PpMCUaskmPAB.exe
608	yrjwPObnoqyg.exe
1700	yrjwPObnoqyg.exe
3952	130.0.6723.117_chrome_installer.exe
4168	setup.exe
1972	setup.exe
2368	setup.exe
3336	setup.exe
1544	chrome.exe
4460	chrome.exe
2460	chrome.exe
4404	chrome.exe
2380	chrome.exe
3168	chrome.exe
3712	chrome.exe
2864	elevation_service.exe
4596	chrome.exe
4828	chrome.exe
2864	chrome.exe
5452	chrome.exe
5628	chrome.exe
6040	chrome.exe
6088	chrome.exe
5872	updater.exe
5928	updater.exe

Loads dropped DLL 33 IoCs

pid	Process
1544	chrome.exe
4460	chrome.exe
1544	chrome.exe
2460	chrome.exe
2460	chrome.exe
4404	chrome.exe
4404	chrome.exe
2460	chrome.exe
2460	chrome.exe
2460	chrome.exe
2380	chrome.exe
3168	chrome.exe
3712	chrome.exe
3168	chrome.exe
3712	chrome.exe
2380	chrome.exe
2460	chrome.exe
2460	chrome.exe
2460	chrome.exe
4596	chrome.exe
4596	chrome.exe
4828	chrome.exe
4828	chrome.exe
2864	chrome.exe
2864	chrome.exe
5452	chrome.exe
5452	chrome.exe
5628	chrome.exe
5628	chrome.exe
6040	chrome.exe
6040	chrome.exe
6088	chrome.exe
6088	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4048	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C1h2r3a6ais7up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yrjwPObnoqyg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yrjwPObnoqyg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yrjwPObnoqyg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1320	PING.EXE
3952	130.0.6723.117_chrome_installer.exe
4168	setup.exe
2428	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a47b29fbd6f9c3720000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a47b29fb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a47b29fb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da47b29fb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a47b29fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	yrjwPObnoqyg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	yrjwPObnoqyg.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\neajdppkdcdipfabeoofebfddakdcjhd = "0AB8235BCF6CD735C78C38B85B74BEFD18914286EE2CB6C8038950115A0C23E6"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\state = "1"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\safebrowsing.incidents_sent = "11D90B4FA6AC8561C53193FDB47118B189FF07225839B8C273C101158536E52A"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\dr = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nmmhkkegccagdldgiimedpiccmgmieda = "15661F2A5350E33D1EC92EADAAB18D5963EE677331978A519CFDD7F840F1427B"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\homepage = "25EE4AF1A4E3E8B7C52843EE34DA8A06CFE7153CE3D50E41FADD45EFD8A82748"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	updater.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\nkeimhogjdpnpccoofpliimaahmaaome = "2620DD8285D5404531C8A1B8468B85D0CDBC44620B60251D4E1DDF3505DB9341"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\StabilityMetrics	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\UsageStatsInSample = "0"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133763974488585191"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi = "258222BC21D8A8510EEFE793694EBBE376F3DA1D571ED72447E2E852F32792E9"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\lastrun = "13376397445619412"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.account_id = "C9C65E4D3304587A839579821F12334783B12665EA41DD2C34F3D92FECCA9D86"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\session.startup_urls = "135559D901D1DD01CD7AECDCA2C80A955C7C514E1738F456157E182DF41FDEA9"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\prefs.preference_reset_time = "6C056523881962FA60C39DC586EC88672E3DBD75C7CEEB8D31E9A1D9E0BF85EE"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.webp\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\LocalService = "GoogleUpdaterService128.0.6597.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\ = "GoogleUpdater TypeLib for IProcessLauncher"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\TypeLib\ = "{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CCA9FC90-B200-5641-99C0-7907756A93CF}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\TypeLib\ = "{6430040A-5EBD-4E63-A56F-C71D5990F827}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{699F07AD-304C-5F71-A2DA-ABD765965B54}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B685B009-DBC4-4F24-9542-A162C3793E77}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0\ = "GoogleUpdater TypeLib for IProcessLauncher2System"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4B5D74-8832-5170-AB03-2415833EC703}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\5"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34527502-D3DB-4205-A69B-789B27EE0414}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromePDF	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8A4B5D74-8832-5170-AB03-2415833EC703}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\GoogleUpdate.Update3WebMachine	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6785353EFDC7D474B987CFA4A9EDDFC7\ProductName = "DriveHumbleTechnician"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4DC034A8-4BFC-4D43-9250-914163356BB0}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1588C1A8-27D9-563E-9641-8D20767FB258}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\LocalService = "GoogleUpdaterService128.0.6597.0"	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ProgID	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ = "IAppVersionWeb"	updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6785353EFDC7D474B987CFA4A9EDDFC7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\1.0\ = "GoogleUpdater TypeLib for IGoogleUpdate3Web"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\TypeLib\ = "{34527502-D3DB-4205-A69B-789B27EE0414}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\1.0\ = "GoogleUpdater TypeLib for ICompleteStatusSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\ = "IAppWebSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6597.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{4DC034A8-4BFC-4D43-9250-914163356BB0}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromeHTML\shell	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{CCA9FC90-B200-5641-99C0-7907756A93CF}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32	updater.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6785353EFDC7D474B987CFA4A9EDDFC7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\OpenWithProgIds\ChromeHTML	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{34527502-D3DB-4205-A69B-789B27EE0414}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromeHTML\Application	setup.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1320	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3436	msiexec.exe
3436	msiexec.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
2208	updater.exe
2208	updater.exe
2208	updater.exe
2208	updater.exe
2208	updater.exe
2208	updater.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe
1904	yrjwPObnoqyg.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4048	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4048	msiexec.exe
Token: SeSecurityPrivilege	3436	msiexec.exe
Token: SeCreateTokenPrivilege	4048	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4048	msiexec.exe
Token: SeLockMemoryPrivilege	4048	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4048	msiexec.exe
Token: SeMachineAccountPrivilege	4048	msiexec.exe
Token: SeTcbPrivilege	4048	msiexec.exe
Token: SeSecurityPrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeLoadDriverPrivilege	4048	msiexec.exe
Token: SeSystemProfilePrivilege	4048	msiexec.exe
Token: SeSystemtimePrivilege	4048	msiexec.exe
Token: SeProfSingleProcessPrivilege	4048	msiexec.exe
Token: SeIncBasePriorityPrivilege	4048	msiexec.exe
Token: SeCreatePagefilePrivilege	4048	msiexec.exe
Token: SeCreatePermanentPrivilege	4048	msiexec.exe
Token: SeBackupPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeShutdownPrivilege	4048	msiexec.exe
Token: SeDebugPrivilege	4048	msiexec.exe
Token: SeAuditPrivilege	4048	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4048	msiexec.exe
Token: SeChangeNotifyPrivilege	4048	msiexec.exe
Token: SeRemoteShutdownPrivilege	4048	msiexec.exe
Token: SeUndockPrivilege	4048	msiexec.exe
Token: SeSyncAgentPrivilege	4048	msiexec.exe
Token: SeEnableDelegationPrivilege	4048	msiexec.exe
Token: SeManageVolumePrivilege	4048	msiexec.exe
Token: SeImpersonatePrivilege	4048	msiexec.exe
Token: SeCreateGlobalPrivilege	4048	msiexec.exe
Token: SeBackupPrivilege	2472	vssvc.exe
Token: SeRestorePrivilege	2472	vssvc.exe
Token: SeAuditPrivilege	2472	vssvc.exe
Token: SeBackupPrivilege	3436	msiexec.exe
Token: SeRestorePrivilege	3436	msiexec.exe
Token: SeRestorePrivilege	3436	msiexec.exe
Token: SeTakeOwnershipPrivilege	3436	msiexec.exe
Token: SeRestorePrivilege	3436	msiexec.exe
Token: SeTakeOwnershipPrivilege	3436	msiexec.exe
Token: SeBackupPrivilege	756	srtasks.exe
Token: SeRestorePrivilege	756	srtasks.exe
Token: SeSecurityPrivilege	756	srtasks.exe
Token: SeTakeOwnershipPrivilege	756	srtasks.exe
Token: SeBackupPrivilege	756	srtasks.exe
Token: SeRestorePrivilege	756	srtasks.exe
Token: SeSecurityPrivilege	756	srtasks.exe
Token: SeTakeOwnershipPrivilege	756	srtasks.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeRestorePrivilege	1928	qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
Token: 35	1928	qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
Token: SeSecurityPrivilege	1928	qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
Token: SeSecurityPrivilege	1928	qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
Token: SeRestorePrivilege	4012	qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
Token: 35	4012	qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
Token: SeSecurityPrivilege	4012	qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
Token: SeSecurityPrivilege	4012	qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
Token: SeRestorePrivilege	3436	msiexec.exe
Token: SeTakeOwnershipPrivilege	3436	msiexec.exe
Token: SeRestorePrivilege	3436	msiexec.exe
Token: SeTakeOwnershipPrivilege	3436	msiexec.exe
Token: SeRestorePrivilege	3436	msiexec.exe
Token: SeTakeOwnershipPrivilege	3436	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4048	msiexec.exe
4048	msiexec.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 756	3436	msiexec.exe	104
PID 3436 wrote to memory of 756	3436	msiexec.exe	104
PID 3436 wrote to memory of 4524	3436	msiexec.exe	106
PID 3436 wrote to memory of 4524	3436	msiexec.exe	106
PID 4524 wrote to memory of 3560	4524	MsiExec.exe	107
PID 4524 wrote to memory of 3560	4524	MsiExec.exe	107
PID 4524 wrote to memory of 2428	4524	MsiExec.exe	109
PID 4524 wrote to memory of 2428	4524	MsiExec.exe	109
PID 2428 wrote to memory of 1928	2428	cmd.exe	111
PID 2428 wrote to memory of 1928	2428	cmd.exe	111
PID 2428 wrote to memory of 1928	2428	cmd.exe	111
PID 2428 wrote to memory of 1320	2428	cmd.exe	112
PID 2428 wrote to memory of 1320	2428	cmd.exe	112
PID 2428 wrote to memory of 4012	2428	cmd.exe	114
PID 2428 wrote to memory of 4012	2428	cmd.exe	114
PID 2428 wrote to memory of 4012	2428	cmd.exe	114
PID 4524 wrote to memory of 1904	4524	MsiExec.exe	116
PID 4524 wrote to memory of 1904	4524	MsiExec.exe	116
PID 4524 wrote to memory of 1904	4524	MsiExec.exe	116
PID 4524 wrote to memory of 1312	4524	MsiExec.exe	118
PID 4524 wrote to memory of 1312	4524	MsiExec.exe	118
PID 4524 wrote to memory of 1312	4524	MsiExec.exe	118
PID 1312 wrote to memory of 2208	1312	C1h2r3a6ais7up.exe	119
PID 1312 wrote to memory of 2208	1312	C1h2r3a6ais7up.exe	119
PID 1312 wrote to memory of 2208	1312	C1h2r3a6ais7up.exe	119
PID 2208 wrote to memory of 3176	2208	updater.exe	121
PID 2208 wrote to memory of 3176	2208	updater.exe	121
PID 2208 wrote to memory of 3176	2208	updater.exe	121
PID 3840 wrote to memory of 1964	3840	updater.exe	123
PID 3840 wrote to memory of 1964	3840	updater.exe	123
PID 3840 wrote to memory of 1964	3840	updater.exe	123
PID 3480 wrote to memory of 1628	3480	updater.exe	128
PID 3480 wrote to memory of 1628	3480	updater.exe	128
PID 3480 wrote to memory of 1628	3480	updater.exe	128
PID 3172 wrote to memory of 608	3172	PpMCUaskmPAB.exe	135
PID 3172 wrote to memory of 608	3172	PpMCUaskmPAB.exe	135
PID 3172 wrote to memory of 608	3172	PpMCUaskmPAB.exe	135
PID 608 wrote to memory of 1700	608	yrjwPObnoqyg.exe	138
PID 608 wrote to memory of 1700	608	yrjwPObnoqyg.exe	138
PID 608 wrote to memory of 1700	608	yrjwPObnoqyg.exe	138
PID 3480 wrote to memory of 3952	3480	updater.exe	140
PID 3480 wrote to memory of 3952	3480	updater.exe	140
PID 3952 wrote to memory of 4168	3952	130.0.6723.117_chrome_installer.exe	141
PID 3952 wrote to memory of 4168	3952	130.0.6723.117_chrome_installer.exe	141
PID 4168 wrote to memory of 1972	4168	setup.exe	142
PID 4168 wrote to memory of 1972	4168	setup.exe	142
PID 4168 wrote to memory of 2368	4168	setup.exe	143
PID 4168 wrote to memory of 2368	4168	setup.exe	143
PID 2368 wrote to memory of 3336	2368	setup.exe	144
PID 2368 wrote to memory of 3336	2368	setup.exe	144
PID 2208 wrote to memory of 1544	2208	updater.exe	146
PID 2208 wrote to memory of 1544	2208	updater.exe	146
PID 1544 wrote to memory of 4460	1544	chrome.exe	147
PID 1544 wrote to memory of 4460	1544	chrome.exe	147
PID 1544 wrote to memory of 2460	1544	chrome.exe	148
PID 1544 wrote to memory of 2460	1544	chrome.exe	148
PID 1544 wrote to memory of 2460	1544	chrome.exe	148
PID 1544 wrote to memory of 2460	1544	chrome.exe	148
PID 1544 wrote to memory of 2460	1544	chrome.exe	148
PID 1544 wrote to memory of 2460	1544	chrome.exe	148
PID 1544 wrote to memory of 2460	1544	chrome.exe	148
PID 1544 wrote to memory of 2460	1544	chrome.exe	148
PID 1544 wrote to memory of 2460	1544	chrome.exe	148
PID 1544 wrote to memory of 2460	1544	chrome.exe	148

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ChromeSetupz.5516.25.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4048

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 66E8F5AE06D39077EDE38968856D3E64 E Global\MSI0000
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DriveHumbleTechnician'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3560
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /min "" "C:\Program Files\DriveHumbleTechnician\qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe" x "C:\Program Files\DriveHumbleTechnician\XSMdjOpzlHEtnonzAHdFfqjsKAHetr" -o"C:\Program Files\DriveHumbleTechnician\" -p"373357|xZmCie].{GTlD" -y & ping 127.0.0.1 -n 2 & start /min "" "C:\Program Files\DriveHumbleTechnician\qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe" x "C:\Program Files\DriveHumbleTechnician\eaKqUwGXuXSKSERTyFiFfxKGAgTAir" -x!1_yrjwPObnoqyg.exe -o"C:\Program Files\DriveHumbleTechnician\" -p"91844v.Gsd9S^{PzzOfj" -y
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Program Files\DriveHumbleTechnician\qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
      "C:\Program Files\DriveHumbleTechnician\qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe" x "C:\Program Files\DriveHumbleTechnician\XSMdjOpzlHEtnonzAHdFfqjsKAHetr" -o"C:\Program Files\DriveHumbleTechnician\" -p"373357|xZmCie].{GTlD" -y
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1928
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1320
  - - C:\Program Files\DriveHumbleTechnician\qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe
      "C:\Program Files\DriveHumbleTechnician\qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe" x "C:\Program Files\DriveHumbleTechnician\eaKqUwGXuXSKSERTyFiFfxKGAgTAir" -x!1_yrjwPObnoqyg.exe -o"C:\Program Files\DriveHumbleTechnician\" -p"91844v.Gsd9S^{PzzOfj" -y
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4012
- - C:\Program Files\DriveHumbleTechnician\yrjwPObnoqyg.exe
    "C:\Program Files\DriveHumbleTechnician\yrjwPObnoqyg.exe" -number 121 -file file3 -mode mode3
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1904
- - C:\Program Files\DriveHumbleTechnician\C1h2r3a6ais7up.exe
    "C:\Program Files\DriveHumbleTechnician\C1h2r3a6ais7up.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Program Files (x86)\Google1312_2134763654\bin\updater.exe
      "C:\Program Files (x86)\Google1312_2134763654\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={FD39FE3E-F972-AC55-37EA-CE3FED473068}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Program Files (x86)\Google1312_2134763654\bin\updater.exe
        
        "C:\Program Files (x86)\Google1312_2134763654\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x52c694,0x52c6a0,0x52c6ac
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3176
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        5⤵
        Checks system information in the registry
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1544
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=130.0.6723.117 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc1db7c38,0x7fffc1db7c44,0x7fffc1db7c50
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4460
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1964,i,7102083657735907835,9023696900099390168,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:2460
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=2092,i,7102083657735907835,9023696900099390168,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4404
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2352,i,7102083657735907835,9023696900099390168,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:2380
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2920,i,7102083657735907835,9023696900099390168,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3168
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2932,i,7102083657735907835,9023696900099390168,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3712
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3860,i,7102083657735907835,9023696900099390168,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4596
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4612,i,7102083657735907835,9023696900099390168,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4828
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4700,i,7102083657735907835,9023696900099390168,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2864
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5416,i,7102083657735907835,9023696900099390168,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5452
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5432,i,7102083657735907835,9023696900099390168,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5628
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5600,i,7102083657735907835,9023696900099390168,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6040
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5696,i,7102083657735907835,9023696900099390168,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6088

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x81c694,0x81c6a0,0x81c6ac
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1964

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Program Files\DriveHumbleTechnician\yrjwPObnoqyg.vbs"
1⤵
- Modifies data under HKEY_USERS
PID:664

C:\Program Files\DriveHumbleTechnician\PpMCUaskmPAB.exe
"C:\Program Files\DriveHumbleTechnician\PpMCUaskmPAB.exe" install
1⤵
- Drops file in System32 directory
- Executes dropped EXE
PID:3408

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x81c694,0x81c6a0,0x81c6ac
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1628
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\130.0.6723.117_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\130.0.6723.117_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\27c53165-5483-48e1-8169-09d4bb877bd0.tmp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\CR_991E3.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\CR_991E3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\CR_991E3.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\27c53165-5483-48e1-8169-09d4bb877bd0.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\CR_991E3.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\CR_991E3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=130.0.6723.117 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff60a6fec28,0x7ff60a6fec34,0x7ff60a6fec40
      4⤵
      Executes dropped EXE
      PID:1972
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\CR_991E3.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\CR_991E3.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2368
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\CR_991E3.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\CR_991E3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=130.0.6723.117 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff60a6fec28,0x7ff60a6fec34,0x7ff60a6fec40
        5⤵
        Executes dropped EXE
        
        PID:3336

C:\Program Files\DriveHumbleTechnician\PpMCUaskmPAB.exe
"C:\Program Files\DriveHumbleTechnician\PpMCUaskmPAB.exe" start
1⤵
- Executes dropped EXE
PID:3132

C:\Program Files\DriveHumbleTechnician\PpMCUaskmPAB.exe
"C:\Program Files\DriveHumbleTechnician\PpMCUaskmPAB.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Program Files\DriveHumbleTechnician\yrjwPObnoqyg.exe
  "C:\Program Files\DriveHumbleTechnician\yrjwPObnoqyg.exe" -number 166 -file file3 -mode mode3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:608
- - C:\Program Files\DriveHumbleTechnician\yrjwPObnoqyg.exe
    "C:\Program Files\DriveHumbleTechnician\yrjwPObnoqyg.exe" -number 62 -file file3 -mode mode3
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:1700

C:\Program Files\Google\Chrome\Application\130.0.6723.117\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\130.0.6723.117\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5512

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --system --windows-service --service=update
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:5872
- C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x81c694,0x81c6a0,0x81c6ac
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57f59c.rbs

Filesize
7KB

MD5
f222da4bcae4ee8b00d0ef1a8a2265da

SHA1
e936b2d6b7bb58febc0b2252725c5f643baeab24

SHA256
540e9969895f4eba9d1d92e5f5f437669a24b8604651bf08a62368feea8772c1

SHA512
951f15f0b660c34fabef0cc0bba6d31f8265cac64a9e083a403b635d8a0a4e74feec7eadfd4d3eba50884a818babb31e8243f0f5956af6365819a729d368bce6

Download Submit
C:\Program Files (x86)\Google1312_2134763654\bin\updater.exe

Filesize
4.7MB

MD5
823816b4a601c69c89435ee17ef7b9e0

SHA1
2fc4c446243be4a18a6a0d142a68d5da7d2a6954

SHA256
c2a7c0fa80f228c2ce599e4427280997ea9e1a3f85ed32e5d5e4219dfb05ddb2

SHA512
f3b38807ed1eb96c932e850b9b37551554408a628bedf12aa32bde08c442ff3663bf584335e7eab193ce2cf7552bce456737c96a2ba9faa953150e6304068fc6

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad\settings.dat

Filesize
40B

MD5
685866bcd503dab75a8597b53ceca203

SHA1
da15edab3302a0e2067e3de9491609dc1b6e3f7b

SHA256
a6e9cdfe84db54eaecd8339e465bb67e519200e938eb07b0b7c1d685e55696c2

SHA512
d29052d73a041b466323c24afe7c783619c4641f582eaaed97fafb1803be2f68a1500ab1a69bd3a3859f6523d7cd73419e4bd11dbc1e3788e6392c0786a28021

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
354B

MD5
d4927578fc92dc543365aa4e43b202ba

SHA1
5e1aeb950ac6ac3f071fa02f90a4fbc0c8e5304c

SHA256
4ac029c04a6e82f4c588237f57a798b4285c818bdbb4250c20f11a5b95d4ecd1

SHA512
4c6cbf4bfb4279edc6d6bd816ca4d1d4dbc8b7f06d875493ffeea3a8782568f49911db28aae743a41962bbe4fe34afc531e119be58888a2acf0623e99df38e95

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
500B

MD5
14924a59cdf75ea7faa4402a28c6bc2b

SHA1
ef45376d09250b2fb8d55c4529b81427669b7f1b

SHA256
68f2936bee8a8934076882132b22a3c89aa7c5bcbe318b841dd283d25df56555

SHA512
cdb54a4116db824524aa3f6498347553c085cb8bb132b1ab885f023660adadd631a40dce37b31e84f79b76a3e4341bff348ef2fc107179c1730bc842ed2d1424

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
49B

MD5
7b693a82168c33ec9e8cf276859ddf7f

SHA1
d396dbbe299fe7754a6244d01e97cc4edd0693eb

SHA256
84a9a7f43db56cd6e9a408f88244e8ba5efbe48a5b5168d321f112b8c8fd8e3f

SHA512
4064c158d753d19a72e1be1c8bd5fe7f22e2032d67d1dd7ea1d85ce652d63c69b85a4292c4403b0f7729b05607f3d1ccfaf4d27d04ad09ffcec70082450320ab

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
600B

MD5
8ce8a911cdcefa67b4eddd5107efb00d

SHA1
184ad5d37b27b6714f7e1792849a41055c1fe934

SHA256
3fd71834d682389eb8fde56fa2dc8c11d03c1753c1e291d333b1b9457b0e0d4c

SHA512
3ece52569aee6b9e2fbb145de8def1d381f1887ea9a5c7b787737cc1c94993d141952862c2206cb1ff7b868548785ac5186cf4842f5e82b10d5d0a33130e2b62

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
11KB

MD5
59efaf7c2a377de4244d020b3e4ecd6b

SHA1
44dbe442dbf1194cef039a90b91d31ad0482d1ee

SHA256
4b3ad9f8e5aa70274cec30e7cefcaff0a863ce8203488e9af3b42bf7f89b37e5

SHA512
5902cf201515d0ef37b866636a072d4424bdd400540dbfc83f62a7f1a0cac88f51261a2ce4158ecc58192d67409d896a1c2bc7711e5da9296edda6145a07609b

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
e076b4970fb9727450c3ccd2a50bbd81

SHA1
e16ee763a5ba24d6c5fc1461a15851f1ce5d826b

SHA256
6034b36de58c5c9c8947ea2b7d17c4c983ebfaadecaff74e03985db62fca0292

SHA512
5050029f9a2bf861624560175444f092421b6bb50cc16e5e4eb9d24f4373c1cc0566e1a5d2c02d454cac4ff99ac49faf37ce16eb33c7c3fbe9f447e927561181

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
2KB

MD5
3db997778801e5b9f3e47927b242a9ca

SHA1
eb5c969cb7440b485d99a469dfd41c31ab2a2531

SHA256
88ea12777b34754003e48319e8e1544ca8644c51c180e339b1b75c0e916a5eff

SHA512
b05b2b242dc4d6e5a758a2654961641a3a601a05a6b2ce1109844be2dbdffde55c13d3425144382c731161eb692592514d19bda97dfb7d0216d984f085b20682

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
6KB

MD5
c7dac9faa3c73514b6ca20f34ab0826b

SHA1
6e6cbc07f8d41ec7d55769f05ed6ddd440c5cc73

SHA256
057a9deaf7c07b188c5a79a3986423aefb03ad12e8c40a4fe374c49364b994b8

SHA512
9267a64420cb098919c48803b8914c1138fcc660223f68402130240724b20f5f449b7a6755c20af5015ee94d93d7132f56d5b341c9a0d3a6b7210322bb1c2c5d

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\27c53165-5483-48e1-8169-09d4bb877bd0.tmp

Filesize
689KB

MD5
27bc119fcea3442fe4185f1f4c177150

SHA1
38fee6e86672b614f898cd2ee0f103da57e60c97

SHA256
7b07912320e458509b172ae06711faa0e02515b40441b664b467c24bbd17b7f3

SHA512
54eb58d46c8c7a0e19b350456bbb8ca2cf95cc8207d8f6198a738528168c28a69d0d3a03fc4b49efccb236ec187282d4874203a62ec75532698c77243078e04c

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3480_1980429023\CR_991E3.tmp\setup.exe

Filesize
5.7MB

MD5
975f2eaa38bb31796f08bdf7ada59b5d

SHA1
3d8bbb8cc560a5be2d73d394caf19a914140432d

SHA256
fdd374c979fdd584e6361d41a238c81436018d96d9f5be0cc1e05e7f997c1873

SHA512
a110ddf5b7df6d871c0bfe0f1821df8e127e3e5e6d1c6955f844cce4725afa06ca258c34b9488681588da0fe0594660f080525a101a2f05ef6b5c63811332051

Download Submit
C:\Program Files\Crashpad\settings.dat

Filesize
40B

MD5
376b885c59ecc6159c03f179619cd4c3

SHA1
b5b33280b5c5b33498b8e9560b96df6ef0e780bc

SHA256
6fb20a594f3d10486acd3e3b43d677f1912d1dba8ee8eea2cfcb5a19fb768998

SHA512
f1882748bd5cdf622d9afe1ec2dde1698a8eaca1a6bbd315d423b72fc1f406f96e52bf54f1049979b84143458ad36b116524dc3a3da70cee9cfafedf44378904

Download Submit
C:\Program Files\DriveHumbleTechnician\2_yrjwPObnoqyg.exe

Filesize
2.1MB

MD5
d9a41a6ce1809032f7e409a79766fbe6

SHA1
c011b1122fb750ce3b393fc35df623d7fb21ebaa

SHA256
0099f9e565c7bb368d24fa3e497fb6cad33463ef13a02017f8d072bfb7185520

SHA512
23d324a40aca1ecc022a42646826632d43c67496722004fe155df7d76e1175a02a3a69595606d452834ad61cbc119fa4fe8c98b7a39845b4fefaece34d4a92e1

Download Submit
C:\Program Files\DriveHumbleTechnician\C1h2r3a6ais7up.exe

Filesize
8.5MB

MD5
5adff4313fbd074df44b4eb5b7893c5e

SHA1
d27388ef6cf34d40e0e7666f6381fcc5bbafa0f7

SHA256
d0c7a4390bdd6b442b96fc76f8a38f7b756ba2c16752ea259844420161865cae

SHA512
f5d639922b91878cf83d97563288a3aa4cba94db3ad5e8ac11d24ef7c44b019383a4414aeba6171b4c7bfa83ea1eafc1231cc9233e3b82b5ca7dc0b3ffacbf60

Download Submit
C:\Program Files\DriveHumbleTechnician\PpMCUaskmPAB.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\DriveHumbleTechnician\PpMCUaskmPAB.wrapper.log

Filesize
467B

MD5
e7e6a0025c34a11db85f4e16485e63e4

SHA1
2f38f893753a3592816302f3bcc064cd82caf23a

SHA256
5f3f2ea69e6959a135d429b7881a986e9e7f3694f4835f0c8231bc39b35a5a2d

SHA512
d4983337cc43c133b20ca282a619759779caddca57b98411cfcc505ca2c02ecc6a0f796f7ef00be8b6c6e0e2eda5aa9d966598fb61839558aca7ace15dd511a7

Download Submit
C:\Program Files\DriveHumbleTechnician\PpMCUaskmPAB.wrapper.log

Filesize
531B

MD5
21e77163387c5ed0094458bbec4ca683

SHA1
c1b8bf86f1dc5f3985eb37c62cd6d5e37fdab3d5

SHA256
3532d5d0c6964e181be07146f85fa3b542086a07e22dfad24d7636f28c7031a2

SHA512
f815d08b82429511050087f3ecd8d6ead5d5da8da994811e1ca807d40459dd590194b23ecd5d71dfe9a4f8102763891229af1978704b26888974aaffd226ae49

Download Submit
C:\Program Files\DriveHumbleTechnician\PpMCUaskmPAB.wrapper.log

Filesize
968B

MD5
ec86737144a9b3e19fa6994364885b5a

SHA1
e68c186d93747892c4e01d26297e167b4caa20d1

SHA256
1c5a5c04c476831f7eda59a9ed3faa3f4b6167e4e99a41352aa19a20908547fb

SHA512
10e13a9f831d5dfeed41b02ba4ec0ef048e18e47cf949cf6fd87e08c07d5ee7e1d464fc56a0602fb64ff09390e5c88d80ef9ec922578662282fe359915ea54f0

Download Submit
C:\Program Files\DriveHumbleTechnician\PpMCUaskmPAB.xml

Filesize
441B

MD5
0e7e51ebbd06799db13c46051bdf549d

SHA1
137d1e117b7873423fd42d410b2ee966e5f7fac2

SHA256
808cdc415e0fe34df3bc808178815cf10d27cf6aadffa73fffae4dc4d46eb114

SHA512
d7c9e3d5fbf08127a5ab25be4a79b1f0d914cf8f78f9f1d5ac0e5249a58aa809bff03bcaaecda1b752b07f47ecadab04b64f604edf887e2e74004454b75bba9a

Download Submit
C:\Program Files\DriveHumbleTechnician\XSMdjOpzlHEtnonzAHdFfqjsKAHetr

Filesize
1.5MB

MD5
4f8c76acd4909457be94c24638d582ad

SHA1
aa8c712b920ccf8c50de26f32fc1e4cc471bc8eb

SHA256
69dfc5f0598bee73b850e4b8958ad345188b99767f674f1f54dc1a68a270595f

SHA512
c7a7ca2a882446191b1a961011b59deca8849ca8ae71cde19cdced727a3a9883efe7b5c1f5a247bb39c3b19f08d7da28db102d76da1627d69613c3d6dd7dc6cf

Download Submit
C:\Program Files\DriveHumbleTechnician\eaKqUwGXuXSKSERTyFiFfxKGAgTAir

Filesize
1.5MB

MD5
277d195bb1d050281da36e259c851e0c

SHA1
e5281f027d44e6da9eb041acfaaf0404db6ba1d8

SHA256
2b189cd2b037480fc4eada82dc53d2339327372c9979dba7fa7b66c8b7e11652

SHA512
d499fd7fbf37421736deb1d96011707a3709b8c59294b37afd5e50fd2664fccdc2e75258816e3c9526f45e1716a18b9ad72e94dfa555d1f44a3baadb9cbbb77b

Download Submit
C:\Program Files\DriveHumbleTechnician\qQYSSihgyoxprPyXJXzhAKmSpDJpse.exe

Filesize
577KB

MD5
c31c4b04558396c6fabab64dcf366534

SHA1
fa836d92edc577d6a17ded47641ba1938589b09a

SHA256
9d182f421381429fd77598feb609fefb54dcaef722ddbf5aa611b68a706c10d3

SHA512
814dcbc1d43bc037dadc2f3f67856dd790b15fc1b0c50fa74a169c8cc02cdc79d44f1f10e200ef662eee20cd6b5ca646ec4e77673e3fe3cb7dfb7649243f6e99

Download Submit
C:\Program Files\DriveHumbleTechnician\yrjwPObnoqyg.vbs

Filesize
2KB

MD5
520a9fbf61757e655381fe3638d5123e

SHA1
31e1912d044d5f1ba205823809d175a6ad1b52e6

SHA256
ee4b4f26b8d36ba2ec844f526c18715841236aaa7fed06b9018ba9aa34a5a413

SHA512
3888d4407f796984a95dae37aca58c4c855540244d33a69563bd55d36ab43d59440f94c7097e0661d016eb0c9f96d1ca0e7cc43a04e4cb6026135812170caca8

Download Submit
C:\Program Files\Google\Chrome\Application\130.0.6723.117\chrome_elf.dll

Filesize
1.3MB

MD5
a763044aa392bbaa224283f77a46a5bd

SHA1
fbd97bd6a4bf0f6cc6c6e3f3581f8ef76699ea0c

SHA256
5b78f93a7a160f064246e61fbd4d1f0040a46e7f9dd059f9abe36f36b4b5cb46

SHA512
e35441de5b23c3b1473276b38082782f4b771eaac2873a77483fcd551809292f2524f46579451eee240b7f7a1f950033fa142f251b010007d34b1237378f0502

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.7MB

MD5
de65cbedaa19e03141fd979a5e406eb0

SHA1
5e9944d20b9bd5f6c7f62a1f77d6a91feb18292f

SHA256
5c52becfd379e90bb4446cd2b60cbfead727d2884f9b3fbd63888d41ad8b5207

SHA512
b0681dc70771946ecdb03ef01d75bace0e8dbda721a723f6759c27ddc70bc1e655f27316a15c9ea3be5a602fa4af3c189bc9b88660293a6e9f6645c41fb1f76e

Download Submit
C:\Program Files\chrome_installer.log

Filesize
21KB

MD5
3bb9c9cd4a398b292ae9d71d63a2e952

SHA1
c14c019b260b0af7494b91101c91b21c27843e75

SHA256
c264f3aef1476e90d72ed4d8b08535c7cb604cc8cbe587e3aeba126438039977

SHA512
4e1e8a68a62b8ea5d4ad0be1a7b1afa49e21e4a1c80d7a1eddab466ac888f1067c9444965161efc557b5d2dba869faafaa72b096f3d3e95cb818166630a2b02f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
414B

MD5
c4ca32f1c0e6a413c95a0e6da7eef4fe

SHA1
3599c851df2f51eee76b940b58a6c4cb62e6b878

SHA256
d70a897bb19a51c0be291119b80f691ed03276f0b7f21cf78981a3772d9cff17

SHA512
6a6a5ea96deb5555e30b7ab85256ee4492ab8d7ce8ecb4427add1a86ac080eecd927e8c784d51f62cf986abb02ff9456b838c47f658526ef15462ad1049870eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
3b4af8a38e583cbb854560543231fa5d

SHA1
a2aeb465a00df87c80ea4a1dca059e546992441a

SHA256
2acdcb8c158901d7bb5904b1da72094b9e8f64c22c023a4c332be1db59cb7508

SHA512
d2074ac7afcde2ca60acfcfcbe76edfa7f277957fe2711f8e0b080ea6ad19f4797c78c18cec1f4bf4304ec7721d7bfbebd1ebf704b8e1c119434bbbfe4c12f69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
6a4c25b1c4e32024d3df4d6103b9a6e7

SHA1
0f4a73631af93fafe85d1fd7e78639e50907121a

SHA256
7cae3339a23126c90ba5a03e54d7ecc9fe1f5e1d2ff89186f0422739703a90d9

SHA512
c6b7b62916de8985683a786b2399c4a909d6dabcd10f785b30951fdffc6cc5719e611cc8ed48f817c4aa94e5fe7be1a4665c8ab0c4396bb9e11c88872a262811

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
f1953a3922c274057594ea5ad3ac6e51

SHA1
e1d85bdb537d5142d77cd3122d1300509128f977

SHA256
109476089d85b763ebf0d7f30680d4fb85ca94b77b0ea31a1f487c80f1078827

SHA512
4c29a0cde2b40c61f6def6bc512a27de4952944ef11c37d55db5e545db066c6b0b251e385cece487c7a0dd538d57c5ac270673512c96396d0a8c1395728819a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
4c6afcf3c80b7175e7dc1340347efdac

SHA1
172b2577180da726b13baa871769107ff76ee95d

SHA256
773875f8f0c0208ee89ed00f753d9802d64114d19f6aa228c5ea1b040b7942df

SHA512
c6db2aaef6d194338db4fb86a7656dda66620b25cb4ed50af0626ca6ae7e227a29ffb48d7bcdaab16500d2f0a5f067f267180a9bb03a0e163f7bbafaef9cc2b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
3a2d137a45248ccf07c57e7cd71a4bbd

SHA1
1f93a998ee820c21ba3f1629e4d9781a306a81da

SHA256
ff20be665254a4ee9a6ccb7c4b2e0934ac559b2deb509a395858eb671ec479ab

SHA512
be3573f0c6ec06edd3293802e3b72422a7c79c0037f953d1e4dc886368437a7a3a9c6d0d78b50e1089171468c6fe473568aeba3ed70302b3cd74a015af04d720

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
200KB

MD5
1ea18251e7e33ca3807299a3ab308428

SHA1
baa0579430cd296823435e1828ccb061639ebe45

SHA256
87d661b86edb562c345fd91a9b2d147c4c44b248d9d79b032b9091df30d0016b

SHA512
2fb720afe593b730eccaeeb0eb1ce57a459b768e44e0abb2e25f101a722ace0381fbf05c38b04bba9231a6ed7f951450261f6c72bcac4730098da29d7018b9d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
11908287068bf312927e8c2368fec41f

SHA1
ad7ac5bb721425234ce0685f14e23115b3d04da6

SHA256
ea30372ae7644378ea2d795d3bfa1a076ecf1c1ad5579514bce8493637d81f88

SHA512
06613779ec20d4785a55d3c6e953501ca9121ee1fa66183b739542e85da63ddf093eb89d5c20295df43da6ea690df358fa2e2f9e2b907714410b3d9ec4f6d4be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
1fe82a8e3e1f485106fbd2010f6e6b93

SHA1
e79a921e34b4e9e2f46cecdbd9a164a279ac999a

SHA256
9161a749d3ccbc8eead55015564735f0b67fa1fbb96e6aa4be5587922fe79254

SHA512
985fe3f39c496e04211515abfebd73503f888dd020496901f1c4fb3ceb6235429a9abed2344b1816d7b0d6d6c4a9196a1df6f8b978f512cf5d36dd301d827b41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
200KB

MD5
9db43b0ce39720098f96c3d7414ee349

SHA1
0512418adba8e0146b67ae05a528014ded81214d

SHA256
16603cb965a3f7a3525089abce77a09306258684706ddfa7c4a407f7626a3d94

SHA512
017bdef9d282e17a2e8f81f11ed328671057167e91fdef2121bc5a97b045dfad1aee9e6393eff469c8b8f0951308549447b4ccf26fa06ff0fe7efc417bbeee6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

Filesize
132KB

MD5
da75bb05d10acc967eecaac040d3d733

SHA1
95c08e067df713af8992db113f7e9aec84f17181

SHA256
33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

SHA512
56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0jdldgmm.mp4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1544_1397784407\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Windows\Installer\e57f59b.msi

Filesize
20.2MB

MD5
92f66429d4ad77c68f77060cb18dcce0

SHA1
cde034910f4ad24df46f6bc7e4e6d467ac8baa31

SHA256
08734e0c77e055be3c43066f2cbcfd84537a819434d1e1f6d41c984ff7a4d865

SHA512
de04850632071600f6d1b9efaa3d4272ef4176e474ab8feb0caf029c300fb4c0d5a0d9f28a037c4b61a9ddaa9ca2fc89d82f09c414bffc9580935b05f1b59cc7

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PpMCUaskmPAB.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
53c1e9774491367997ed934ab91baed4

SHA1
c4c4b6bcbbe2664d663b5df9857c13e1f447065d

SHA256
d31beac34e33d85514d63c67fb617cf2271a940e940fe2bc7d3a4750f5b1fb54

SHA512
8ed8ffccd5487ff9bde16fc6096a5197ab22f5bae1892f49f372880feb2948dd08b079cd49f6a116cecd21429d7c971b85a17386aa3ce7668d20743f1a888c86

Download Submit
\??\Volume{fb297ba4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6b02cfc4-23e2-42d6-810a-57a2c213095c}_OnDiskSnapshotProp

Filesize
6KB

MD5
ae241873919f7ca7a77a871323078086

SHA1
53d946642f07a3a324473facb4d13454cbc9ed45

SHA256
3a0105d0700b82e246c0a22ab59741ca11f8e85823488376840c953f60900488

SHA512
a91f425be029e869eba06c5c474c8e7575d2e32af3dd649ab54f837f0349cb711ff95a64caa4d0ba9fdfcb6b18c5e03d32056c42414a134188d2b0349cabe28f

Download Submit
memory/1700-151-0x000000002A500000-0x000000002A54D000-memory.dmp

Filesize
308KB

Download
memory/1700-164-0x000000002C130000-0x000000002C2ED000-memory.dmp

Filesize
1.7MB

Download
memory/1700-163-0x000000002C130000-0x000000002C2ED000-memory.dmp

Filesize
1.7MB

Download
memory/1700-159-0x000000002C130000-0x000000002C2ED000-memory.dmp

Filesize
1.7MB

Download
memory/1904-72-0x0000000029980000-0x00000000299AF000-memory.dmp

Filesize
188KB

Download
memory/3408-96-0x0000000000690000-0x0000000000766000-memory.dmp

Filesize
856KB

Download
memory/3560-20-0x0000022333050000-0x0000022333072000-memory.dmp

Filesize
136KB

Download