blackmoon | 1924b09ff1e25fe9d39bad70f094766863f366543658627fe94f435b07da6109

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2025 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chrome.msi
Size

14.6MB
MD5

1ac2f26a8d6237713f6120d9272de355
SHA1

20f8d75d976f7af644bf8479ab1e611fe5bea55f
SHA256

1924b09ff1e25fe9d39bad70f094766863f366543658627fe94f435b07da6109
SHA512

150b5c3693c65d73f9bda9737dd560200abe1c0f95b1abf8e42ea43d80878fef5a39e9410b671ed4af1514e73542931aea96fcf7824067cca886c413672fa444
SSDEEP

393216:LBfMDSDSK12jqHzADE/FxGAl81nKJJ3g7xM9a6uAAARWMgyeG/z:5Mg2jUziiFxGAS1UJQNM9aE3RW1yemz

Score

10^/10

blackmoon fatalrat banker discovery infostealer persistence privilege_escalation rat spyware stealer trojan vmprotect

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/4508-118-0x0000000000400000-0x0000000000BA0000-memory.dmp	family_blackmoon

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
stealer trojan fatalrat
Fatalrat family
fatalrat

Fatal Rat payload 4 IoCs

rat infostealer

resource	yara_rule
behavioral2/memory/2416-365-0x0000000010000000-0x000000001002D000-memory.dmp	fatalrat
behavioral2/memory/4608-381-0x0000000002A00000-0x0000000002C00000-memory.dmp	fatalrat
behavioral2/memory/920-373-0x0000000010000000-0x000000001002D000-memory.dmp	fatalrat
behavioral2/memory/4608-382-0x0000000002A00000-0x0000000002C00000-memory.dmp	fatalrat

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0004000000022a06-66.dat	vmprotect
behavioral2/memory/2748-69-0x00007FF6D5140000-0x00007FF6D56F9000-memory.dmp	vmprotect
behavioral2/files/0x000c000000023c13-112.dat	vmprotect
behavioral2/memory/3464-114-0x00007FF6D5140000-0x00007FF6D56F9000-memory.dmp	vmprotect
behavioral2/memory/4508-118-0x0000000000400000-0x0000000000BA0000-memory.dmp	vmprotect

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\133.0.6943.127\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	GoogleUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	chrome.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TjNkNpAilaYvt.exe.log	TjNkNpAilaYvt.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\lt.pak	setup.exe
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\PrivacySandboxAttestationsPreloaded\manifest.json	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_it.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_tr.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_vi.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_zh-CN.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdateBroker.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_fa.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_fa.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_sv.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\ar.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_pt-BR.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_pt-PT.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_lv.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe	133.0.6943.127_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\fa.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_th.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_te.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\psuser_64.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\fr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\VisualElements\SmallLogo.png	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_en-GB.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_fr.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_hi.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\133.0.6943.127_chrome_installer.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdateOnDemand.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_iw.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_am.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\mr.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_gu.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\he.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\hi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\ur.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\psmachine.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_de.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_nl.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\bn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\v8_context_snapshot.bin	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_nl.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\optimization_guide_internal.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\zh-TW.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\vulkan-1.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_ms.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_hu.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\elevated_tracing_service.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_sr.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\chrome_proxy.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\chrome_pwa_launcher.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\chrome.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe	133.0.6943.127_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\Locales\sw.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2752_1635311174\Chrome-bin\133.0.6943.127\resources.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleCrashHandler64.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_en.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_id.dll	setup.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57c89f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICBF0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC2F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DBB56E52-B2C8-4BD0-96DC-EE1D75DE3BAC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD3A.tmp	msiexec.exe
File created	C:\Windows\Installer\e57c89f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC8FD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA08.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA76.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB04.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB91.tmp	msiexec.exe

Executes dropped EXE 49 IoCs

pid	Process
3396	aa.exe
2748	scrok.exe
4024	TjNkNpAilaYvt.exe
1864	TjNkNpAilaYvt.exe
4008	TjNkNpAilaYvt.exe
4316	TjNkNpAilaYvt.exe
3464	scrok.exe
4508	setup.exe
4388	setup.exe
4048	GoogleUpdate.exe
812	GoogleUpdate.exe
1816	GoogleUpdate.exe
920	svchost.exe
2416	svchost.exe
4608	svchost.exe
4988	GoogleUpdateComRegisterShell64.exe
400	GoogleUpdateComRegisterShell64.exe
3600	GoogleUpdateComRegisterShell64.exe
3440	GoogleUpdate.exe
3880	GoogleUpdate.exe
3984	GoogleUpdate.exe
2844	133.0.6943.127_chrome_installer.exe
2752	setup.exe
3176	setup.exe
368	setup.exe
2312	setup.exe
3812	GoogleCrashHandler64.exe
3416	GoogleCrashHandler.exe
812	GoogleUpdate.exe
1336	GoogleUpdateOnDemand.exe
4972	GoogleUpdate.exe
5104	chrome.exe
4212	chrome.exe
3492	chrome.exe
4596	chrome.exe
4052	chrome.exe
1824	chrome.exe
8	chrome.exe
2368	chrome.exe
3264	elevation_service.exe
4340	chrome.exe
1040	chrome.exe
4784	chrome.exe
3664	chrome.exe
1628	chrome.exe
3352	chrome.exe
5844	chrome.exe
5852	chrome.exe
5860	chrome.exe

Loads dropped DLL 62 IoCs

pid	Process
640	MsiExec.exe
640	MsiExec.exe
640	MsiExec.exe
640	MsiExec.exe
640	MsiExec.exe
640	MsiExec.exe
640	MsiExec.exe
4048	GoogleUpdate.exe
812	GoogleUpdate.exe
1816	GoogleUpdate.exe
4988	GoogleUpdateComRegisterShell64.exe
1816	GoogleUpdate.exe
400	GoogleUpdateComRegisterShell64.exe
1816	GoogleUpdate.exe
3600	GoogleUpdateComRegisterShell64.exe
1816	GoogleUpdate.exe
3440	GoogleUpdate.exe
3880	GoogleUpdate.exe
3984	GoogleUpdate.exe
3984	GoogleUpdate.exe
3880	GoogleUpdate.exe
812	GoogleUpdate.exe
4972	GoogleUpdate.exe
4972	GoogleUpdate.exe
5104	chrome.exe
4212	chrome.exe
5104	chrome.exe
3492	chrome.exe
4596	chrome.exe
3492	chrome.exe
4596	chrome.exe
1824	chrome.exe
4052	chrome.exe
1824	chrome.exe
8	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
8	chrome.exe
2368	chrome.exe
2368	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
4340	chrome.exe
4340	chrome.exe
1040	chrome.exe
1040	chrome.exe
4784	chrome.exe
4784	chrome.exe
3664	chrome.exe
3664	chrome.exe
1628	chrome.exe
1628	chrome.exe
3352	chrome.exe
3352	chrome.exe
5844	chrome.exe
5852	chrome.exe
5844	chrome.exe
5852	chrome.exe
5860	chrome.exe
5860	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1120	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdateOnDemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleCrashHandler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3440	GoogleUpdate.exe
812	GoogleUpdate.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000924b2722e829c64b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000924b27220000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900924b2722000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d924b2722000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000924b272200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
968	timeout.exe
3840	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133846518492531805"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Group = "Fatal"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\InstallTime = "2025-02-21 22:49"	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods\ = "9"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\133.0.6943.127\\notification_helper.exe\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ = "IJobObserver2"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ = "IGoogleUpdateCore"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\Elevation\IconReference = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\goopdate.dll,-1004"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ = "IAppCommand"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ = "IBrowserHttpRequest2"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods\ = "24"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\VersionIndependentProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\CurVer\ = "GoogleUpdate.Update3COMClassService.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\PROGID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ = "IJobObserver2"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML\Application\ApplicationName = "Google Chrome"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.webp\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachine\CurVer\ = "GoogleUpdate.OnDemandCOMClassMachine.1.0"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
5020	msiexec.exe
5020	msiexec.exe
2748	scrok.exe
2748	scrok.exe
2748	scrok.exe
2748	scrok.exe
4316	TjNkNpAilaYvt.exe
4316	TjNkNpAilaYvt.exe
3464	scrok.exe
3464	scrok.exe
3464	scrok.exe
3464	scrok.exe
4508	setup.exe
4508	setup.exe
4048	GoogleUpdate.exe
4048	GoogleUpdate.exe
4048	GoogleUpdate.exe
4048	GoogleUpdate.exe
4048	GoogleUpdate.exe
4048	GoogleUpdate.exe
3880	GoogleUpdate.exe
3880	GoogleUpdate.exe
812	GoogleUpdate.exe
812	GoogleUpdate.exe
4048	GoogleUpdate.exe
4048	GoogleUpdate.exe
4048	GoogleUpdate.exe
4048	GoogleUpdate.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1120	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1120	msiexec.exe
Token: SeSecurityPrivilege	5020	msiexec.exe
Token: SeCreateTokenPrivilege	1120	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1120	msiexec.exe
Token: SeLockMemoryPrivilege	1120	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1120	msiexec.exe
Token: SeMachineAccountPrivilege	1120	msiexec.exe
Token: SeTcbPrivilege	1120	msiexec.exe
Token: SeSecurityPrivilege	1120	msiexec.exe
Token: SeTakeOwnershipPrivilege	1120	msiexec.exe
Token: SeLoadDriverPrivilege	1120	msiexec.exe
Token: SeSystemProfilePrivilege	1120	msiexec.exe
Token: SeSystemtimePrivilege	1120	msiexec.exe
Token: SeProfSingleProcessPrivilege	1120	msiexec.exe
Token: SeIncBasePriorityPrivilege	1120	msiexec.exe
Token: SeCreatePagefilePrivilege	1120	msiexec.exe
Token: SeCreatePermanentPrivilege	1120	msiexec.exe
Token: SeBackupPrivilege	1120	msiexec.exe
Token: SeRestorePrivilege	1120	msiexec.exe
Token: SeShutdownPrivilege	1120	msiexec.exe
Token: SeDebugPrivilege	1120	msiexec.exe
Token: SeAuditPrivilege	1120	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1120	msiexec.exe
Token: SeChangeNotifyPrivilege	1120	msiexec.exe
Token: SeRemoteShutdownPrivilege	1120	msiexec.exe
Token: SeUndockPrivilege	1120	msiexec.exe
Token: SeSyncAgentPrivilege	1120	msiexec.exe
Token: SeEnableDelegationPrivilege	1120	msiexec.exe
Token: SeManageVolumePrivilege	1120	msiexec.exe
Token: SeImpersonatePrivilege	1120	msiexec.exe
Token: SeCreateGlobalPrivilege	1120	msiexec.exe
Token: SeBackupPrivilege	3280	vssvc.exe
Token: SeRestorePrivilege	3280	vssvc.exe
Token: SeAuditPrivilege	3280	vssvc.exe
Token: SeBackupPrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeTakeOwnershipPrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeTakeOwnershipPrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeTakeOwnershipPrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeTakeOwnershipPrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeTakeOwnershipPrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeTakeOwnershipPrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeTakeOwnershipPrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeTakeOwnershipPrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeTakeOwnershipPrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeTakeOwnershipPrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeTakeOwnershipPrivilege	5020	msiexec.exe
Token: SeDebugPrivilege	2748	scrok.exe
Token: SeDebugPrivilege	4024	TjNkNpAilaYvt.exe
Token: SeDebugPrivilege	1864	TjNkNpAilaYvt.exe
Token: SeBackupPrivilege	1952	srtasks.exe
Token: SeRestorePrivilege	1952	srtasks.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
1120	msiexec.exe
1120	msiexec.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4508	setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1952	5020	msiexec.exe	91
PID 5020 wrote to memory of 1952	5020	msiexec.exe	91
PID 5020 wrote to memory of 640	5020	msiexec.exe	93
PID 5020 wrote to memory of 640	5020	msiexec.exe	93
PID 5020 wrote to memory of 640	5020	msiexec.exe	93
PID 640 wrote to memory of 3604	640	MsiExec.exe	94
PID 640 wrote to memory of 3604	640	MsiExec.exe	94
PID 640 wrote to memory of 3604	640	MsiExec.exe	94
PID 3604 wrote to memory of 968	3604	cmd.exe	96
PID 3604 wrote to memory of 968	3604	cmd.exe	96
PID 3604 wrote to memory of 968	3604	cmd.exe	96
PID 3604 wrote to memory of 3396	3604	cmd.exe	97
PID 3604 wrote to memory of 3396	3604	cmd.exe	97
PID 3604 wrote to memory of 3396	3604	cmd.exe	97
PID 3604 wrote to memory of 2748	3604	cmd.exe	98
PID 3604 wrote to memory of 2748	3604	cmd.exe	98
PID 2748 wrote to memory of 776	2748	scrok.exe	8
PID 2748 wrote to memory of 776	2748	scrok.exe	8
PID 2748 wrote to memory of 776	2748	scrok.exe	8
PID 3604 wrote to memory of 4024	3604	cmd.exe	99
PID 3604 wrote to memory of 4024	3604	cmd.exe	99
PID 3604 wrote to memory of 1864	3604	cmd.exe	100
PID 3604 wrote to memory of 1864	3604	cmd.exe	100
PID 3604 wrote to memory of 3840	3604	cmd.exe	101
PID 3604 wrote to memory of 3840	3604	cmd.exe	101
PID 3604 wrote to memory of 3840	3604	cmd.exe	101
PID 3604 wrote to memory of 4008	3604	cmd.exe	102
PID 3604 wrote to memory of 4008	3604	cmd.exe	102
PID 3604 wrote to memory of 3464	3604	cmd.exe	104
PID 3604 wrote to memory of 3464	3604	cmd.exe	104
PID 4316 wrote to memory of 4508	4316	TjNkNpAilaYvt.exe	105
PID 4316 wrote to memory of 4508	4316	TjNkNpAilaYvt.exe	105
PID 4316 wrote to memory of 4508	4316	TjNkNpAilaYvt.exe	105
PID 3464 wrote to memory of 776	3464	scrok.exe	8
PID 3464 wrote to memory of 776	3464	scrok.exe	8
PID 3464 wrote to memory of 776	3464	scrok.exe	8
PID 3604 wrote to memory of 4388	3604	cmd.exe	106
PID 3604 wrote to memory of 4388	3604	cmd.exe	106
PID 3604 wrote to memory of 4388	3604	cmd.exe	106
PID 4388 wrote to memory of 4048	4388	setup.exe	107
PID 4388 wrote to memory of 4048	4388	setup.exe	107
PID 4388 wrote to memory of 4048	4388	setup.exe	107
PID 4048 wrote to memory of 812	4048	GoogleUpdate.exe	109
PID 4048 wrote to memory of 812	4048	GoogleUpdate.exe	109
PID 4048 wrote to memory of 812	4048	GoogleUpdate.exe	109
PID 4048 wrote to memory of 1816	4048	GoogleUpdate.exe	110
PID 4048 wrote to memory of 1816	4048	GoogleUpdate.exe	110
PID 4048 wrote to memory of 1816	4048	GoogleUpdate.exe	110
PID 4508 wrote to memory of 920	4508	setup.exe	108
PID 4508 wrote to memory of 920	4508	setup.exe	108
PID 4508 wrote to memory of 920	4508	setup.exe	108
PID 4508 wrote to memory of 2416	4508	setup.exe	111
PID 4508 wrote to memory of 2416	4508	setup.exe	111
PID 4508 wrote to memory of 2416	4508	setup.exe	111
PID 4508 wrote to memory of 4608	4508	setup.exe	112
PID 4508 wrote to memory of 4608	4508	setup.exe	112
PID 4508 wrote to memory of 4608	4508	setup.exe	112
PID 1816 wrote to memory of 4988	1816	GoogleUpdate.exe	113
PID 1816 wrote to memory of 4988	1816	GoogleUpdate.exe	113
PID 1816 wrote to memory of 400	1816	GoogleUpdate.exe	114
PID 1816 wrote to memory of 400	1816	GoogleUpdate.exe	114
PID 1816 wrote to memory of 3600	1816	GoogleUpdate.exe	115
PID 1816 wrote to memory of 3600	1816	GoogleUpdate.exe	115
PID 4048 wrote to memory of 3440	4048	GoogleUpdate.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:776
- C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe" -Embedding
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1336
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
      4⤵
      Checks computer location settings
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5104
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.127 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff1642fff8,0x7fff16430004,0x7fff16430010
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4212
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1968,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1956 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3492
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2212,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2244 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4596
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2360,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2660 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1824
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2956,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3144 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4052
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2968,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3172 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:8
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3732,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3748 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4340
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3772,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3796 /prefetch:2
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2368
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4592,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4648 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4796,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4840 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4784
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5572,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5524 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3664
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5628,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5644 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1628
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5636,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5700 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3352
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=208,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4764 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5844
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3800,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4032 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5852
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4080,i,11238899794822011220,10748614913755572400,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5788 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5860

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Chrome.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1120

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1952
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0B4DCD91304AD65485ED86173044F268
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /c timeout /nobreak /t 7 & C:\ProgramData\setup\aa.exe x C:\ProgramData\setup\ddd. -key 000000 -f -to C:\ProgramData & C:\ProgramData\Packas\scrok.exe & C:\ProgramData\Smart\TjNkNpAilaYvt.exe install & C:\ProgramData\Smart\TjNkNpAilaYvt.exe install & timeout /nobreak /t 2 & C:\ProgramData\Smart\TjNkNpAilaYvt.exe start & C:\ProgramData\Packas\scrok.exe & del C:\ProgramData\Packas\scrok.exe & C:\ProgramData\setup\setup.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /nobreak /t 7
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:968
  - - C:\ProgramData\setup\aa.exe
      C:\ProgramData\setup\aa.exe x C:\ProgramData\setup\ddd. -key 000000 -f -to C:\ProgramData
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3396
  - - C:\ProgramData\Packas\scrok.exe
      C:\ProgramData\Packas\scrok.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2748
  - - C:\ProgramData\Smart\TjNkNpAilaYvt.exe
      C:\ProgramData\Smart\TjNkNpAilaYvt.exe install
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4024
  - - C:\ProgramData\Smart\TjNkNpAilaYvt.exe
      C:\ProgramData\Smart\TjNkNpAilaYvt.exe install
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1864
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /nobreak /t 2
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3840
  - - C:\ProgramData\Smart\TjNkNpAilaYvt.exe
      C:\ProgramData\Smart\TjNkNpAilaYvt.exe start
      4⤵
      Executes dropped EXE
      PID:4008
  - - C:\ProgramData\Packas\scrok.exe
      C:\ProgramData\Packas\scrok.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3464
  - - C:\ProgramData\setup\setup.exe
      C:\ProgramData\setup\setup.exe
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4388
    - - C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9F0C1F44-1C50-396A-483A-08DA4896FF0B}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4048
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:812
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4988
        
        C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:400
        
        C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3600
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUQxMzBGQTktNkE2Qi00OEIyLTg0RjktRjdCQ0I4NzJGQ0MxfSIgdXNlcmlkPSJ7MzdENkVEQ0YtRUUyOC00MUVBLUI4QjctMzkwQjg0ODY2MTk5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0Q0NURERDlGLUVFM0UtNEUxQS05NUYzLTBENjg3MzQxNDNFN30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjM3MSIgbmV4dHZlcnNpb249IjEuMy4zNi4zMTIiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7OUYwQzFGNDQtMUM1MC0zOTZBLTQ4M0EtMDhEQTQ4OTZGRjBCfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMTA5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3440
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9F0C1F44-1C50-396A-483A-08DA4896FF0B}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{5D130FA9-6A6B-48B2-84F9-F7BCB872FCC1}"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3280

C:\ProgramData\Smart\TjNkNpAilaYvt.exe
"C:\ProgramData\Smart\TjNkNpAilaYvt.exe"
1⤵
- Drops file in System32 directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4316
- C:\ProgramData\Smart\setup.exe
  "C:\ProgramData\Smart\setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\ProgramData\NVIDIARV\svchost.exe
    "C:\ProgramData\NVIDIARV\svchost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:920
- - C:\ProgramData\NVIDIARV\svchost.exe
    "C:\ProgramData\NVIDIARV\svchost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:2416
- - C:\ProgramData\NVIDIARV\svchost.exe
    "C:\ProgramData\NVIDIARV\svchost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4608

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3984
- C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\133.0.6943.127_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\133.0.6943.127_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\gui660A.tmp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:2844
- - C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\gui660A.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Modifies registry class
    PID:2752
  - - C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.127 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff71983bed8,0x7ff71983bee4,0x7ff71983bef0
      4⤵
      Executes dropped EXE
      PID:3176
  - - C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      PID:368
    - - C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{B96AFA23-DAFC-4D44-BBC0-02971325B14F}\CR_B6CBF.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.127 --initial-client-data=0x268,0x26c,0x270,0x248,0x274,0x7ff71983bed8,0x7ff71983bee4,0x7ff71983bef0
        5⤵
        Drops file in Program Files directory
        Executes dropped EXE
        
        PID:2312
- C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3416
- C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUQxMzBGQTktNkE2Qi00OEIyLTg0RjktRjdCQ0I4NzJGQ0MxfSIgdXNlcmlkPSJ7MzdENkVEQ0YtRUUyOC00MUVBLUI4QjctMzkwQjg0ODY2MTk5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezE1OENEQjdGLUQzOUItNDQ0Mi1BQ0VBLUJEQzIxMUEwOTc4Qn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMzLjAuNjk0My4xMjciIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNCIgaWlkPSJ7OUYwQzFGNDQtMUM1MC0zOTZBLTQ4M0EtMDhEQTQ4OTZGRjBCfSIgY29ob3J0PSIxOmd1L2kxOToiIGNvaG9ydG5hbWU9IlN0YWJsZSBJbnN0YWxscyAmYW1wOyBWZXJzaW9uIFBpbnMiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi9jaHJvbWUvYXUybjMyaDNobmNuYzVrY241Mnd4YXh6eGFfMTMzLjAuNjk0My4xMjcvMTMzLjAuNjk0My4xMjdfY2hyb21lX2luc3RhbGxlci5leGUiIGRvd25sb2FkZWQ9IjExODkyOTI2NCIgdG90YWw9IjExODkyOTI2NCIgZG93bmxvYWRfdGltZV9tcz0iMTgyMzQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjUwMCIgZG93bmxvYWRfdGltZV9tcz0iMTkyNTAiIGRvd25sb2FkZWQ9IjExODkyOTI2NCIgdG90YWw9IjExODkyOTI2NCIgaW5zdGFsbF90aW1lX21zPSIyOTk1MyIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:812

C:\Program Files\Google\Chrome\Application\133.0.6943.127\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.127\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57c8a2.rbs

Filesize
1KB

MD5
74af9654d8a16004d4fc58a528d91022

SHA1
e18554b9dfd67d1fe76b275eb6fed69d74d516b1

SHA256
20a4221cb2cc7aced510669513b9b8d2b752e6ccd38d705196a925149ce82153

SHA512
8a77d7eaeae4259c83b2ae1d23fb5399883392403988278b1b368a60de4954300da17f6a64400c37c8585f75c293e763c9cf6f1826153553fa550b4a21584995

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleCrashHandler.exe

Filesize
294KB

MD5
a11ce10ac47f5f83b9bc980567331a1b

SHA1
63ee42e347b0328f8d71a3aa4dde4c6dc46da726

SHA256
101dbf984c4b3876defe2699d6160acbf1bb3f213e02a32f08fdcdc06821c542

SHA512
ff2f86c4061188ead1bfeebd36de7dbc312adcc95267537697f2bfcbb0c53e7c4ab0cd268cef22f0182391796c4612c97cbdc1266d9ee1960cdd2610d8c2bcb3

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleCrashHandler64.exe

Filesize
392KB

MD5
b659663611a4c2216dff5ab1b60dd089

SHA1
9a14392a5bdb9ea6b8c3e60224b7ff37091d48b5

SHA256
cad4aa1cf58f6b2e2aceb789d53b18418e67066ec406b2fac786cb845ef89d2b

SHA512
1065f9072cd6f1f4364f1354108f2647ee1d89f87e908a22fcd63bd3149c864c457e62268067a439d0486d8d4aa150aa984ad8ac8b51cae49014b67b80496040

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdate.exe

Filesize
158KB

MD5
cdf152e23a8cbf68dbe3f419701244fc

SHA1
cb850d3675da418131d90ab01320e4e8842228d7

SHA256
84eaf43f33d95da9ab310fc36dc3cfe53823d2220946f021f18cf3f729b8d64e

SHA512
863e1da5bc779fa02cf08587c4de5f04c56e02902c5c4f92a06f2e631380ecabcc98e35d52609f764727e41b965c0786d24ea23fc4b9776d24d9f13e0d8ae0c2

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdateComRegisterShell64.exe

Filesize
181KB

MD5
be535d8b68dd064442f73211466e5987

SHA1
aa49313d9513fd9c2d2b25da09ea24d09cc03435

SHA256
c109bcb63391ac3ea93fb97fbdf3f6ed71316cacb592ef46efaea0024bc9ed59

SHA512
eb50eebeaf83be10aea8088e35a807f9001d07d17d2bc1655c3bc0cb254d0f54303348988514ba5590ebd9d3bde3f1149c3f700f62fbce63c0199ea3cfb1f638

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\GoogleUpdateCore.exe

Filesize
217KB

MD5
af51ea4d9828e21f72e935b0deae50f2

SHA1
c7fe57c2a16c9f5a5ebdd3cc0910427cba5308bd

SHA256
3575011873d0f6d49c783095dae06e6619f8f5463da578fbe284ca5d1d449619

SHA512
ec9828d0bade39754748fb53cfc7efdc5e57955198bac3c248ea9b5a9a607182bb1477819f220549a8e9eadbe6bf69a12da6c8af3761980d2dd9078eaeaa932f

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdate.dll

Filesize
1.9MB

MD5
dae72b4b8bcf62780d63b9cbb5b36b35

SHA1
1d9b764661cfe4ee0f0388ff75fd0f6866a9cd89

SHA256
b0ca6700e7a4ea667d91bcf3338699f28649c2e0a3c0d8b4f2d146ab7c843ab6

SHA512
402c00cab6dac8981e200b6b8b4263038d76afe47c473d5f2abf0406222b32fff727b495c6b754d207af2778288203ce0774a6200b3e580e90299d08ce0c098f

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_am.dll

Filesize
42KB

MD5
849bc7e364e30f8ee4c157f50d5b695e

SHA1
b52b8efa1f3a2c84f436f328decd2912efeb1b18

SHA256
f1384a25a6f40e861455c62190d794415f3e9bfca6317c214847e9535dfc3fb9

SHA512
6fd7f542a7073b3bbf1b0c200bb306b30f1b35a64a1fb013f25c7df76f63ef377d9bd736e8da2e9372f1c994785eaeedb6b60e3a0d4a4e8734c266ad61782d3b

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_ar.dll

Filesize
41KB

MD5
163695df53cea0728f9f58a46a08e102

SHA1
71b39eec83260e2ccc299fac165414acb46958bd

SHA256
f89dddda3e887385b42ea88118ba8fb1cc68fde0c07d44b851164564eb7c1ec8

SHA512
6dfb70a175097f3c96ae815a563c185136cb5a35f361288cc81570facfa1f1d28f49eaa61172d1da4982ebb76bd3e32c4de77cf97dedfb79f18113d7594d0989

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_bg.dll

Filesize
44KB

MD5
c523ec13643d74b187b26b410d39569b

SHA1
46aff0297036c60f22ad30d4e58f429890d9e09d

SHA256
80505863866bcd93a7e617dd8160531401d6d05f48d595348cd321cf7d97aeac

SHA512
ecf98e29a3481b05ab23c3ff89fa3caf054b874ed15462a5e33022aacf561d8fea4a0de35cc5f7450f62110ca4ace613e0c67f543ad22eb417e79eb3ebf24ed7

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_bn.dll

Filesize
44KB

MD5
dafa45a82ce30cf2fd621e0a0b8c031f

SHA1
e39ed5213f9bb02d9da2c889425fab8ca6978db7

SHA256
d58e5f0fa894123de1d9b687a5b84826e095eca128ee5df8870f2db74f4233a2

SHA512
2b772ebc128eb59d636eec36583329962ead8e0a399fd56394b1244486bf815f4e033ceef74a62a9930ab2bf6ec1ba5e2d3c942183f7cb2355a716a3e2c6c7a1

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_ca.dll

Filesize
44KB

MD5
39e25ba8d69f493e6f18c4ef0cf96de8

SHA1
5584a94a85d83514a46030c4165e8f7a942e63e2

SHA256
1f66ebdcaae482a201a6e0fab9c1f4501c23a0d4ad819ccd555fdca9cc7edb94

SHA512
773c995b449d64e36eb8cab174db29e29e29985bcfd714799d6b05b01bb7d4a0fc2aefaf2e27ff02b0e105fbe0d34d7efe29b193a1bc3365ec47e1f1003bed26

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_cs.dll

Filesize
43KB

MD5
b9033db8d0e5bf254979b0f47d10e93d

SHA1
2859de0d851b5f4fd3056e8f9015cece2436c307

SHA256
12c41c2f472b6a05fd6392e9d4f8aeb9a40840c2cbefd68b39d20f9d1d4d77ed

SHA512
52075df4ae5c86ebb0bac20604ea072a163761ae058c1473211bf4bb0eeed043cfc5a92386f876b53484cdf4e3f8a7b75d8f4bf9894c24f8c22ec23a50b70b7c

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_da.dll

Filesize
43KB

MD5
9f2e018a4f9a1d278983d0b677b91218

SHA1
c58ee1fc0d8ef9d99f85426b48c7f28f381a2c17

SHA256
d0dcdc68236eecd6b5f0b437eb92b8935741dabf1fa276a552399815af22edec

SHA512
20b74b6a9f81527d4a5fe30671d2559261fb682576f4ab04da7856280fbbaeb6af83894009c9d7cb83deeae988d0ac5ec7ec32b277b7eb45829faec2857d7014

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_de.dll

Filesize
45KB

MD5
96d92500b9a763f4b862c511c17e0a47

SHA1
2fd441eb8685d15e14fa6405e82359adea3e7148

SHA256
58829d135ff41e574ed5fc5e0421e4aa204267b02ca3ffaf08d8efb0a70fdd4c

SHA512
a1014584f1f278160d579848fa188f627676aee819e9395517490b00e273db6f583d7ddd31af6e35c9d251021df7fb26c88512aaa1c865c2ee3ba60c0a2db49a

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_el.dll

Filesize
44KB

MD5
ecdd26049573614b6f41d8a102ffcf21

SHA1
5140c6cff5d596267a64df1559ac36c4e8f49e42

SHA256
a3377520f2a95b8cc06bd30e493962c07f97eebf4661a69d03efb36b2ca515c5

SHA512
933c181d7575f20480c8deadac3f3e9190081456169122216c72e7b9a04aa75612140fc37697098c7c20b77001a67966fa1661cdc9110c40634c944f833a65b1

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_en-GB.dll

Filesize
42KB

MD5
f82ccf890c3ae14bfd7a263d07276e60

SHA1
6a915d6eb8c99d065e36a721d721d556b74bb377

SHA256
6b07a4fd3039541e30c68a8c31c371cda2cea480787f95e0ddbca3cc2fbff0cc

SHA512
4cbf9e6728e08de8d61f34b17bb20d92b6a699969edb9afa013fe962c8fd39238288adcd826134c9bca459904d8574a804c519daac6b301e0d38f68722c0359e

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_en.dll

Filesize
42KB

MD5
741211652c66a8a6790396e1875eefa9

SHA1
2ccd5653b5fc78bcc19f86b493cef11844ba7a0c

SHA256
e0945deacdb6b75ff2587dea975774b9b800747e2ee3f3917e5b40ddb87eda10

SHA512
b70f847d8ca8828c89bbb67b543950fbd514c733cf62b52ad7fc0dab7b2168fe56d1f21bef3210f5c7f563f72831455d870a5f9aa6c557f1e3543ef7329c42f9

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_es-419.dll

Filesize
43KB

MD5
1c0b1c3625c9ccace1b23e0c64095ee9

SHA1
3904a80d016e0a9a267c0b5feb8e6747b44b5fa1

SHA256
f030757e1911e9efde0d74a02c22694fa5ef139f73897a7f97acab9da05f7c8b

SHA512
0a988edef8d67cd83c2be65cbfa07059df311732ee92ad73fb9411d7cf7d853a2b8d2ab801733d05ab6afaccab33a2684117bbc1d80b362b677cc53ae9de42f0

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_es.dll

Filesize
45KB

MD5
dae64d49ee97339b7327b52c9f720848

SHA1
15f159c4808f9e4fe6a2f1a4a19faa5d84ac630b

SHA256
e76400e62ae0ab31565e50b05d1001b775a91aa487a54dc90e53c0e103c717c2

SHA512
9ae72e5a658aa0e1fb261d62ccef474cd42d9bec2b4a50f71925d131ffea22b8f60fb961772587ce71cb30a32da3b7986e7483ecea960a509e0450d3983c84b0

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_et.dll

Filesize
42KB

MD5
dfa1d51ca956e3aaa1008503aaeb3dd8

SHA1
94511faf996c1ce9b2397c7fc3f78f32fbf8f966

SHA256
3781d18bab1524cff8104167caaccb7eee6614394068dbb7b7c412c7c9b5aae9

SHA512
b25f9a14053acab26f1d353e9d908cbe769a640d0e8d66c30209c2a5d76c503b8e7fb04651f37ff482f7c4df4ffed33013d37b1f7bb6650e25447006f447b85d

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_fa.dll

Filesize
42KB

MD5
90d38d6669931e76faa1e69aee2ab3e2

SHA1
e0de420b422c7ad4e73ace2c84db45f6db2b1d6e

SHA256
1fe4bc690efc72cb8737d4b451c2c843d2987d71bf60723471bf66cf53fcc714

SHA512
1cc66e166b4dc3b6c1f96340489652bd313d8d6de31a3165bac9da8fd42146843f840ee7a5f163512163fc8f90b865a06cc29a147c44389f40eb1edafd6d3743

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_fi.dll

Filesize
43KB

MD5
5c530468d61708123c8919a8480e5967

SHA1
2d85a2335bc688d2c2045299c1e36b39b179603e

SHA256
21aa3b8d540c7b2ea33c4a11fb35fdd721b69f04a660edb2ac2031d98f38e239

SHA512
bfe4ce4762ef5de853635a2341249012da27b7a02e3f4722841792345527d7951fb20661d1b7c8a58293c4ac5ee0b34cea0e190fa5f74efd12aeacba3c74a2aa

Download Submit
C:\Program Files (x86)\Google\Temp\GUMF7FD.tmp\goopdateres_zh-CN.dll

Filesize
37KB

MD5
ca52cc49599bb6bda28c38aea1f9ec4e

SHA1
494f166b530444f39bca27e2b9e10f27e34fc98a

SHA256
f9f144aa2dc0de21b24c93f498a9b4a946b7da42819a776b3283a0bcae18544b

SHA512
05e2d5711eef8f57737b2512de2e73744f17e0a34de0bfd2a06c9cc60a08ebadbafe38e30b66a2ede7fa61d5b9571adddcfbd7e1cafcee1ab2168a563d2d3f0d

Download Submit
C:\Program Files\Google\Chrome\Application\133.0.6943.127\Installer\setup.exe

Filesize
6.0MB

MD5
3eda07f3f5bd229c5a02ca9487dd152d

SHA1
b6b845c42e2316b63a61a058eb1a9714211a54ec

SHA256
cba6ac1785a616fbffb09afb29cc8b5d9a82a019d9b547338aa09b6a06905e11

SHA512
e8a0d0308f955f923753380033ebf12a795d9e3dd57e155e46ff6d709c9a4a71a24227b79a129773e6209eb1039202928a9515294833b36c218f44d787349aa6

Download Submit
C:\ProgramData\NVIDIARV\svchost.exe

Filesize
3.3MB

MD5
4ce1a842d3d770f6fa4b4167542408b2

SHA1
43b0c03b176318ce2551d3dfc2c18e18f53c2240

SHA256
ba51980ef9681d849c9331e891cc411c1687d3c011f0acc01da9f4ef640764b6

SHA512
a28f0659af75da93f479359212dc4ffb9440f171cf89b19de929b7a8015b5e087ea53ab979dd6815597865538c79b1e3354e987940da88da4dfcf16bdf1f4337

Download Submit
C:\ProgramData\Packas\scrok.exe

Filesize
2.7MB

MD5
a03b2eaa4d517fd935bb0032d444f22d

SHA1
014864aac638b7c04b4d50e6c39d7266eafda773

SHA256
6fd145b1de7d0a143fd25274544d5e3c4ecee06cf3e31631d51cae8ca3e25f01

SHA512
68a253fcdb3cd1a086fe93fa7c8a7500d6b5414bdfc0dad555973697d4fb552e09088b849573f705ca91b1652ddd4572842b82d40f5821761b3ac299e465be51

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
1009B

MD5
40cc031c9061e9041d1843b87f302cb5

SHA1
36fdd8cbb906e59cd471d0c0ec5fbfe7b8f38055

SHA256
797a10343910757d8147c6bc0cac792cb2aaf2cecf9394f211462d29acc840f5

SHA512
d6b037d1e1eae172439cd8e9b417fdef9c2b848f2ae56d4c4aa0aa31357bc79c508fac75296bd105238f3318993b208aa95f1a7a79d66f5d3d8385df4a0b1df9

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
330B

MD5
7e6568cc889287fcbfc5db663c304c27

SHA1
bf9a37ce3c55b0aca022ae1982ac8428e23749f6

SHA256
f720bcbb4f214796518dbb0e5184b108a8788288fbfe83ee65f7ff0c512c88b9

SHA512
3cb42eae1bbd19c064e0767b20eb39032ac52e6320da3570de22d6dbeae41cadbc83c388f891d1c8a1b7fd8fb77963d64797f87ad002ea468dd28577fcfd74e1

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
613B

MD5
722512e290ef31ab363d6ca2210c49d8

SHA1
34468206a2df1c83fbd65975132392bcc536ca65

SHA256
17e2a77b3f01b1ca8c47fe207d2104ce9154be465c9770c452bdd2ae2941e707

SHA512
b636f6c8747885f8661444d147825987f1fbb825f0dd561351ac893a47ad13515c1903bc4d186062517e72ce0c0c85a1652897bb189b766d412b58a0a71e316e

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
769B

MD5
7a4eb1aec85cb4ad2bf635ab00c834fe

SHA1
89a7ce9fd4839910da4e216cb047a01daeae9347

SHA256
346a1ce864233f7eb35d1b8c21420f6aa8a92c14055104b069b80c0293528151

SHA512
c94b6e825b4b72488f6a544c97ead9a1b530361629b58409c7df8be5b0ba63c4f8722a26eb567deb210a53f7a1002968e1bab26e033dc9e90e3efcc22b75be8b

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.xml

Filesize
298B

MD5
2c706293a3cfff8cc184a8e9a3b3da08

SHA1
873d7c9f51aa6cebd4ad3ae5930d1de84bb4437d

SHA256
ed28baf8be3a588d50ed246c2cd741bbd498aee74ea0675d57e0b33236e22067

SHA512
4aba3e25507ba5c29219ff51553f3616d07aeeb30f7465f9e921eea94cdcb411d1f48d1eefed647c22405df275e7f9d7506aac52202aae137391c6831463b043

Download Submit
C:\ProgramData\Smart\setup.exe

Filesize
4.7MB

MD5
118a9a9f6280e177fdac16989b8aa1a5

SHA1
fc37316439372be17a982d02cd0d294f7aaca751

SHA256
b995e6a0299f2465fd5881157aab1c6c9753c8e459efd661b9cd1e83be7e53f6

SHA512
14c731e7f7e9736f39d6c79a98bf1a3264da9dc76bab4faca82ec64f276f3d39c9bc4638991e30a06f52bf6204619f5da8c3168d11afe058e0c1d21a89d42878

Download Submit
C:\ProgramData\setup\aa.exe

Filesize
1.0MB

MD5
09c448be7e7d84e6e544cc03afbb05d8

SHA1
ddc13e71a72bc49c60f89b98cbb79c2449cfa07e

SHA256
a0f127a70943b0262060498c1723c795a8e2980f1acf0c42ee8c1dae72ae54b5

SHA512
e5f7a988a999e7e34d0aa2d2a5b2fbb22689588d3def4bed4518ceed38710e3714c5614bab192b0ce6bcac5172a87ebf3b3b923e495eb7344c70bd11f4bf1c12

Download Submit
C:\ProgramData\setup\ddd

Filesize
10.8MB

MD5
9bd359e3956d119811c3a6abef58e644

SHA1
9f221781f406ebcb15fc2c02d5d259116155c734

SHA256
ead38673817c84de77a4d2fe6118e6a96f863e3db38f73518007caa2af676146

SHA512
7f817794728e532da07424c621eeef161501644d137068895391505d7110f1f8ee9dc76944946e3960f84e462c66fd82ee61b619ca91a07166aed5d3434f618b

Download Submit
C:\ProgramData\setup\setup.exe

Filesize
1.3MB

MD5
4a94844260d6a08828d781d488cef61d

SHA1
de8169fdb5ab8a120df577d92eb25a2767431738

SHA256
46d7a8abe3bb9d7302529246cd8ee6e7d0360d1045fe92662cc7580e72ef5132

SHA512
82549c1e525a90003fb0174ebba2bc3b4f58706ef9fd5e6ee07d489ab536ef286e408db6c15a52b039d3f59c09bd55e35d045def79007da5d414d5d589d34f4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
414B

MD5
a7cf1376df03c07d924c4dc706c97555

SHA1
08059f43bd5f86cb7328062fedd3934c3b9c6a21

SHA256
93d942eee75391df3f3b704bcb7616fead0464c17ab589b56c42d92dea3bc97d

SHA512
504ac58f9c91e9448395e9606772540dc0a481b04c0152af7219da397c261476697dd820560c265d128b5b21d58db71b7ce34757cdc70a978f388667f49bdee1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
23d57336233e87a1e91ad506cdc3c4b2

SHA1
ad00fd760b23fd6497e5d2df527b19c7a1ba8630

SHA256
660d918e1e7052020dc17119c1a0e75a9c37cd5d85fa1501286023b509d072a3

SHA512
d67bf4ed3837d2428045280223b13ef30b3bdd552f5de8c2878e0ac6689058bd1ebbe0dcfde7a17aff5e8c341f9724469bc3e0d2ef1442e8582c306920d408d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
3a7702a699b3bff043b3c88dbaf5e162

SHA1
a1fc7be0bebe076b2007b7c094e2d3c0297a3152

SHA256
c65293a66b8687a8cd510a619fa72e9947bc1a513de25fbe17725da488731dbf

SHA512
340d8c44387f72dfb926b9052ef9a734289ef819cf6e72c6e949bc0ffa29d85bcba28ebe5e691f513c68089697c659c714f4427c9d9aeb79bbcf41e59dd31745

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
cc02ccd9ec41abda529c62753969a454

SHA1
7233188b3268979b9bd5a91b94ec8aae22dea1a8

SHA256
8cba8636522b2a5d91a6be26e552d57a1d76254146507b058f249615898de5e8

SHA512
717674497d570a12834aeb7bf1bad84a3c8c2341ef5e56340e4cf4752ba93a951b08ae4f5b68995427b217dabb8caf91c987e9307cc0661a86ca766997abf662

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\32.png

Filesize
1KB

MD5
a3a00ef924278ba60be0fffeec04995e

SHA1
69ab25402bb5ef6d99538ec8044c6edb128be0d3

SHA256
a5670fe56dbae316511d6f8c7349477c69c53dc59fe5615984eed5c8cf55a717

SHA512
fd53f2c0e8f493817f5ff5c2f9b87ffb82a11bc2b56a9798072efdf22677d2760bc489a2c8d76fdee6f65a0f4509d4bc257851811b4f720120780e796c6bc4b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\48.png

Filesize
1KB

MD5
5bfbb6b6a7e313f5d67a1219f7866c4a

SHA1
c49ec46ca5fb945b582c99b47a2b7c09da8f766e

SHA256
6dc4e5c4c1722173cb9d40e7edd2947c12677b12fd2fdd6e2544bda6bb456ab1

SHA512
55928faf39965083855cf6e1a8bc477560b41f3d8d8f678de7271960c6b59b7f2a256ae4e03428f86c1fc0e431370512e9c69a5631cad9e103e8978faa10ac13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\64.png

Filesize
1KB

MD5
0aa5ac35c79f5cb38dd5fafbabf2983c

SHA1
36658f24dbb49f5ff2a19897b22071f72e523f12

SHA256
3695587d1d40ba3171aa991cb77e6c9080b550db7c3d3b52097c1723ab060f32

SHA512
fcbc8a65c4b852c848a13fa12131fa7b17b1310ad3278e78545e8334ddf199b627110bde2fc0a5e7312fad3a5f12b0db54c665d00f1feb1cf3b7c4b18e7569e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5104_1856981287\Icons\128.png

Filesize
3KB

MD5
654cafa7846b64b91835e202c3efca65

SHA1
4e0fa549b16a47ca9e22e0a510229f528740d51b

SHA256
956bd19ad9a62b83792bed90a6e6457e0812abb36ef85763f62883d70f65241b

SHA512
65db6e4824ee4caa38fa4ec837c2ee4290e34c8d2c5099b33720e7b6ab83997608ae8a6d47961d8506be3d23606b179cf792cc040a7c6c3f251855c294b26223

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
b77fc97eecd8f7383464171a4edef544

SHA1
bbae26d2a7914a3c95dca35f1f6f820d851f6368

SHA256
93332c49fab1deb87dac6cb5d313900cb20e6e1ba928af128a1d549a44256f68

SHA512
68745413a681fdf4088bf8d6b20e843396ae2e92fbb97239dc6c764233a7e7b700a51548ff4d2ea86420b208b92a5e5420f08231637fbb5dbf7e12a377be3fc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
a490c4553fc9a2e9b73bdbc54a13394a

SHA1
1b829756d8a402674d67659e78c1a105ce39e50a

SHA256
2f579aac89d4911a9c8c3472c39dd1e9de587d155ae20fe758f0719a1a496b6e

SHA512
82bce177c8c35871dc988e77fe65dde01de723bdeb4236165f8a36d55741e13a1cc268a9df607f8f78fe0a2e267cb3337dbce897e0b1d6948a52457a16359229

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
122KB

MD5
65b44f4fbdb9acb223ba8e197d46d689

SHA1
653d555d05e2ee4e87be69a026013c3e82aca6c5

SHA256
1b70a0749dd7f2d1837982aa6bcd825a31f220027a818880bd2bef5eb7bf67ff

SHA512
29da9be389dc3751be838f47032d461a2144671c69d894bdabfbe51387e2bb00dbdb909ce9291fc9977c5228e8f0a4ffc40e89ff2a8faf18badfcdf5d79a986a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
195KB

MD5
566c63046e3c7fda9a230f2596f37609

SHA1
3ad57ea71c827c5d7d8940cf8c79d4ec43376187

SHA256
1608982013b0dfe9c31f34a36c529bd7d75939539cab0953640822673d0ea3d4

SHA512
285dcd41d40fb1e60ada492c3e1f5cdb390e685b1f7be3e999b0ce8efb16bb689ed6d276309ed4202ce8c5458444ae5dd8d15dc67f5fdfd50c82c4690f6a9a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TjNkNpAilaYvt.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
C:\Windows\Installer\MSIC8FD.tmp

Filesize
587KB

MD5
c7fbd5ee98e32a77edf1156db3fca622

SHA1
3e534fc55882e9fb940c9ae81e6f8a92a07125a0

SHA256
e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6

SHA512
8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

Download Submit
C:\Windows\Installer\MSICB91.tmp

Filesize
1.1MB

MD5
ae463676775a1dd0b7a28ddb265b4065

SHA1
dff64c17885c7628b22631a2cdc9da83e417d348

SHA256
83fbfcaff3da3eb89f9aec29e6574cf15502fd670cbb2ab0c8a84451b2598b22

SHA512
e47c2db249e7a08c5d2864671fbc235e48aebecbe0b2c2334d1a4cba1b5b3037522ff89408589f3559b3a1eaf507bd338645387d55800029bb3b941d4c7744d6

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
5139fbacba6a003598e68d6237a890ff

SHA1
a45e5b1e9ffcb977310cedce5ca05d2fc3b4b417

SHA256
ae7516bdbb3a39d33d76a2b743f03766423462e4d1b67ae6fb37f38da6a5cabd

SHA512
31c67eee0a6dec9e004cda3374d676dd2963337cd579bc9a8f2ebc9a5cf036515afd237bb3fc259c09e221b969ac7ca9f26ead1f470856a3676ae3c605a3e09c

Download Submit
\??\Volume{22274b92-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{052e279b-481a-4bce-bdd1-edf860f04a80}_OnDiskSnapshotProp

Filesize
6KB

MD5
cc10d49307a86df631b9a0fba6017095

SHA1
c56ed20f01809ec05470bbc4b6e662eaabeb290a

SHA256
432ee96c9a37e3f0e492a361e70ed6450d1ebca06b5d2ef5b6b7555c649c8a89

SHA512
905abe0b02cbdfc184ca4e5c1288187b76eb93b5db0578c2d4ece3b40d9b9a6737b5d6b87d00a8334c8b2148f2e126b74ce2a9e5cec6e96e1bb126dea6d507aa

Download Submit
memory/920-376-0x0000000002A00000-0x0000000002C00000-memory.dmp

Filesize
2.0MB

Download
memory/920-363-0x0000000000400000-0x000000000090B000-memory.dmp

Filesize
5.0MB

Download
memory/920-377-0x0000000002A00000-0x0000000002C00000-memory.dmp

Filesize
2.0MB

Download
memory/920-373-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2416-365-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2416-361-0x0000000000400000-0x000000000090B000-memory.dmp

Filesize
5.0MB

Download
memory/2748-69-0x00007FF6D5140000-0x00007FF6D56F9000-memory.dmp

Filesize
5.7MB

Download
memory/2748-68-0x00007FFF34550000-0x00007FFF34552000-memory.dmp

Filesize
8KB

Download
memory/3396-64-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/3464-114-0x00007FF6D5140000-0x00007FF6D56F9000-memory.dmp

Filesize
5.7MB

Download
memory/4024-75-0x0000000000A90000-0x0000000000B66000-memory.dmp

Filesize
856KB

Download
memory/4508-118-0x0000000000400000-0x0000000000BA0000-memory.dmp

Filesize
7.6MB

Download
memory/4508-117-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4608-381-0x0000000002A00000-0x0000000002C00000-memory.dmp

Filesize
2.0MB

Download
memory/4608-382-0x0000000002A00000-0x0000000002C00000-memory.dmp

Filesize
2.0MB

Download