blackmoon | ce2075f76a21e2a535681e2ad09c4d4d646e600e0491bb4f3725f6e0634fdab7

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chromestup.msi
Size

14.5MB
MD5

d2f1ff0fca1a5d50f371b849df0ff604
SHA1

edcc7fce9a61e3ca13a87c694a50d9810f83e89b
SHA256

f71845af2465c505c857f622e78e266553c1f0a578c321cca70eca0d676e3512
SHA512

3e1a7c1eee079b0094a42e6fd00d9b896798d7d535f21fc79254c489c0f8323a7d5ecf75b66556e2a3f9d7f2fc6ec689bcb8c1a1dfb829f07afecad37175dd7a
SSDEEP

393216:6BfMD+F9vscR4cMMmYCb1HvXODuuXPfott+I5MF9:uMdcMTb1Hv+CuXPw8I5g9

Score

10^/10

blackmoon fatalrat banker discovery infostealer persistence privilege_escalation rat spyware stealer trojan vmprotect

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral1/memory/1280-131-0x0000000000400000-0x0000000000B9E000-memory.dmp	family_blackmoon

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
stealer trojan fatalrat
Fatalrat family
fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
behavioral1/memory/1568-376-0x0000000010000000-0x000000001002D000-memory.dmp	fatalrat

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000a000000018baf-58.dat	vmprotect
behavioral1/memory/2164-68-0x000000013FAF0000-0x000000014009F000-memory.dmp	vmprotect
behavioral1/files/0x0005000000019d6d-107.dat	vmprotect
behavioral1/memory/880-120-0x000000013FBD0000-0x000000014017F000-memory.dmp	vmprotect
behavioral1/memory/1280-131-0x0000000000400000-0x0000000000B9E000-memory.dmp	vmprotect

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\International\Geo\Nation	chrome.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ca.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_nl.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\Locales\am.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\Locales\ca.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\Locales\sr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\Locales\af.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\libGLESv2.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_sw.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\Locales\el.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\Locales\et.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_es-419.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\CR_ACAD4.tmp\SETUP.EX_	109.0.5414.120_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\Locales\fi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\CR_ACAD4.tmp\setup.exe	109.0.5414.120_chrome_installer.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\GoogleUpdateComRegisterShell64.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_te.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_da.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_am.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_ca.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_hu.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_is.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\WidevineCdm\LICENSE	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_sv.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_fr.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\nacl_irt_x86_64.nexe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_de.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_ml.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\Locales\ro.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\MEIPreload\preloaded_data.pb	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\Locales\ms.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ar.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_ta.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_bg.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_et.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ta.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\guiDE40.tmp	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\VisualElements\SmallLogoDev.png	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_sl.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\109.0.5414.120\109.0.5414.120_chrome_installer.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_ro.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_id.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_sw.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_hr.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_lv.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\Locales\fr.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_lv.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_pt-PT.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\CR_ACAD4.tmp\CHROME.PACKED.7Z	109.0.5414.120_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\Locales\zh-CN.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\WidevineCdm\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\chrome_proxy.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\chrome.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_kn.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_no.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_uk.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_cs.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_fil.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ms.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\Locales\da.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1768_1721255995\Chrome-bin\109.0.5414.120\Locales\ja.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_cs.dll	setup.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI1056.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI13A2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1548.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1662.tmp	msiexec.exe
File created	C:\Windows\Installer\f780f01.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f780efe.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f780efe.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI124A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1940.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f780f01.ipi	msiexec.exe

Executes dropped EXE 51 IoCs

pid	Process
284	aa.exe
2164	scrok.exe
2404	TjNkNpAilaYvt.exe
2068	TjNkNpAilaYvt.exe
1348	TjNkNpAilaYvt.exe
2064	TjNkNpAilaYvt.exe
880	scrok.exe
1280	setup.exe
668	setup.exe
816	svchost.exe
2604	svchost.exe
1568	svchost.exe
2948	GoogleUpdate.exe
1704	GoogleUpdate.exe
1812	GoogleUpdate.exe
2560	GoogleUpdateComRegisterShell64.exe
1756	GoogleUpdateComRegisterShell64.exe
1372	GoogleUpdateComRegisterShell64.exe
2292	GoogleUpdate.exe
2784	GoogleUpdate.exe
2844	GoogleUpdate.exe
2112	109.0.5414.120_chrome_installer.exe
1768	setup.exe
368	setup.exe
1520	setup.exe
2052	setup.exe
2640	GoogleCrashHandler.exe
1052	GoogleCrashHandler64.exe
1580	GoogleUpdate.exe
2716	GoogleUpdateOnDemand.exe
2388	GoogleUpdate.exe
1676	chrome.exe
1300	chrome.exe
1468	chrome.exe
3040	chrome.exe
2868	chrome.exe
1984	chrome.exe
1872	chrome.exe
2152	chrome.exe
2896	elevation_service.exe
1680	chrome.exe
1656	chrome.exe
2212	chrome.exe
2380	chrome.exe
2180	chrome.exe
580	chrome.exe
2472	chrome.exe
1720	chrome.exe
1592	chrome.exe
880	chrome.exe
3676	chrome.exe

Loads dropped DLL 64 IoCs

pid	Process
1044	MsiExec.exe
1044	MsiExec.exe
1044	MsiExec.exe
1044	MsiExec.exe
1044	MsiExec.exe
2960	cmd.exe
2960	cmd.exe
2960	cmd.exe
2960	cmd.exe
1280	setup.exe
1280	setup.exe
1280	setup.exe
2960	cmd.exe
1280	setup.exe
1280	setup.exe
1280	setup.exe
1280	setup.exe
816	svchost.exe
816	svchost.exe
816	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
1280	setup.exe
1280	setup.exe
1568	svchost.exe
1568	svchost.exe
1568	svchost.exe
668	setup.exe
2948	GoogleUpdate.exe
2948	GoogleUpdate.exe
2948	GoogleUpdate.exe
2948	GoogleUpdate.exe
1704	GoogleUpdate.exe
1704	GoogleUpdate.exe
1704	GoogleUpdate.exe
2948	GoogleUpdate.exe
1812	GoogleUpdate.exe
1812	GoogleUpdate.exe
1812	GoogleUpdate.exe
2560	GoogleUpdateComRegisterShell64.exe
1812	GoogleUpdate.exe
1812	GoogleUpdate.exe
1756	GoogleUpdateComRegisterShell64.exe
1812	GoogleUpdate.exe
1812	GoogleUpdate.exe
1372	GoogleUpdateComRegisterShell64.exe
1812	GoogleUpdate.exe
2948	GoogleUpdate.exe
2948	GoogleUpdate.exe
2948	GoogleUpdate.exe
2292	GoogleUpdate.exe
2948	GoogleUpdate.exe
2948	GoogleUpdate.exe
2784	GoogleUpdate.exe
2784	GoogleUpdate.exe
2784	GoogleUpdate.exe
2844	GoogleUpdate.exe
2844	GoogleUpdate.exe
2844	GoogleUpdate.exe
2844	GoogleUpdate.exe
2784	GoogleUpdate.exe
2844	GoogleUpdate.exe
2112	109.0.5414.120_chrome_installer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2548	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdateOnDemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleCrashHandler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2292	GoogleUpdate.exe
1580	GoogleUpdate.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2112	timeout.exe
2768	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Group = "Fatal"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\InstallTime = "2025-03-28 09:14"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\VersionIndependentProgID\ = "GoogleUpdate.Update3WebSvc"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ = "IPolicyStatusValue"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\LOCALSERVER32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\goopdate.dll,-3000"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ = "IAppVersionWeb"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\goopdate.dll,-3000"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ = "Update3COMClass"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromeHTML\Application	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML\Application\ApplicationName = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\ServiceParameters = "/comsvc"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods\ = "24"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachineFallback\CLSID\ = "{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\ = "Google Update Process Launcher Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\VersionIndependentProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\GoogleUpdateOnDemand.exe\""	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ = "IAppVersion"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachineFallback.1.0\CLSID\ = "{598FE0E5-E02D-465D-9A9D-37974A28FD42}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\NumMethods\ = "10"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods\ = "11"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ = "IGoogleUpdate3WebSecurity"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\NumMethods\ = "16"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}\LocalServer32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.svg	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.svg\OpenWithProgids	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ = "IJobObserver2"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\VersionIndependentProgID\ = "GoogleUpdate.OnDemandCOMClassSvc"	GoogleUpdate.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2396	msiexec.exe
2396	msiexec.exe
2164	scrok.exe
2164	scrok.exe
2064	TjNkNpAilaYvt.exe
880	scrok.exe
880	scrok.exe
1280	setup.exe
2948	GoogleUpdate.exe
2948	GoogleUpdate.exe
2948	GoogleUpdate.exe
2948	GoogleUpdate.exe
2948	GoogleUpdate.exe
2948	GoogleUpdate.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe
2604	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2548	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2548	msiexec.exe
Token: SeRestorePrivilege	2396	msiexec.exe
Token: SeTakeOwnershipPrivilege	2396	msiexec.exe
Token: SeSecurityPrivilege	2396	msiexec.exe
Token: SeCreateTokenPrivilege	2548	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2548	msiexec.exe
Token: SeLockMemoryPrivilege	2548	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2548	msiexec.exe
Token: SeMachineAccountPrivilege	2548	msiexec.exe
Token: SeTcbPrivilege	2548	msiexec.exe
Token: SeSecurityPrivilege	2548	msiexec.exe
Token: SeTakeOwnershipPrivilege	2548	msiexec.exe
Token: SeLoadDriverPrivilege	2548	msiexec.exe
Token: SeSystemProfilePrivilege	2548	msiexec.exe
Token: SeSystemtimePrivilege	2548	msiexec.exe
Token: SeProfSingleProcessPrivilege	2548	msiexec.exe
Token: SeIncBasePriorityPrivilege	2548	msiexec.exe
Token: SeCreatePagefilePrivilege	2548	msiexec.exe
Token: SeCreatePermanentPrivilege	2548	msiexec.exe
Token: SeBackupPrivilege	2548	msiexec.exe
Token: SeRestorePrivilege	2548	msiexec.exe
Token: SeShutdownPrivilege	2548	msiexec.exe
Token: SeDebugPrivilege	2548	msiexec.exe
Token: SeAuditPrivilege	2548	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2548	msiexec.exe
Token: SeChangeNotifyPrivilege	2548	msiexec.exe
Token: SeRemoteShutdownPrivilege	2548	msiexec.exe
Token: SeUndockPrivilege	2548	msiexec.exe
Token: SeSyncAgentPrivilege	2548	msiexec.exe
Token: SeEnableDelegationPrivilege	2548	msiexec.exe
Token: SeManageVolumePrivilege	2548	msiexec.exe
Token: SeImpersonatePrivilege	2548	msiexec.exe
Token: SeCreateGlobalPrivilege	2548	msiexec.exe
Token: SeBackupPrivilege	2976	vssvc.exe
Token: SeRestorePrivilege	2976	vssvc.exe
Token: SeAuditPrivilege	2976	vssvc.exe
Token: SeBackupPrivilege	2396	msiexec.exe
Token: SeRestorePrivilege	2396	msiexec.exe
Token: SeRestorePrivilege	2844	DrvInst.exe
Token: SeRestorePrivilege	2844	DrvInst.exe
Token: SeRestorePrivilege	2844	DrvInst.exe
Token: SeRestorePrivilege	2844	DrvInst.exe
Token: SeRestorePrivilege	2844	DrvInst.exe
Token: SeRestorePrivilege	2844	DrvInst.exe
Token: SeRestorePrivilege	2844	DrvInst.exe
Token: SeLoadDriverPrivilege	2844	DrvInst.exe
Token: SeLoadDriverPrivilege	2844	DrvInst.exe
Token: SeLoadDriverPrivilege	2844	DrvInst.exe
Token: SeRestorePrivilege	2396	msiexec.exe
Token: SeTakeOwnershipPrivilege	2396	msiexec.exe
Token: SeRestorePrivilege	2396	msiexec.exe
Token: SeTakeOwnershipPrivilege	2396	msiexec.exe
Token: SeRestorePrivilege	2396	msiexec.exe
Token: SeTakeOwnershipPrivilege	2396	msiexec.exe
Token: SeRestorePrivilege	2396	msiexec.exe
Token: SeTakeOwnershipPrivilege	2396	msiexec.exe
Token: SeRestorePrivilege	2396	msiexec.exe
Token: SeTakeOwnershipPrivilege	2396	msiexec.exe
Token: SeRestorePrivilege	2396	msiexec.exe
Token: SeTakeOwnershipPrivilege	2396	msiexec.exe
Token: SeRestorePrivilege	2396	msiexec.exe
Token: SeTakeOwnershipPrivilege	2396	msiexec.exe
Token: SeRestorePrivilege	2396	msiexec.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2548	msiexec.exe
2548	msiexec.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1280	setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1044	2396	msiexec.exe	34
PID 2396 wrote to memory of 1044	2396	msiexec.exe	34
PID 2396 wrote to memory of 1044	2396	msiexec.exe	34
PID 2396 wrote to memory of 1044	2396	msiexec.exe	34
PID 2396 wrote to memory of 1044	2396	msiexec.exe	34
PID 2396 wrote to memory of 1044	2396	msiexec.exe	34
PID 2396 wrote to memory of 1044	2396	msiexec.exe	34
PID 1044 wrote to memory of 2960	1044	MsiExec.exe	35
PID 1044 wrote to memory of 2960	1044	MsiExec.exe	35
PID 1044 wrote to memory of 2960	1044	MsiExec.exe	35
PID 1044 wrote to memory of 2960	1044	MsiExec.exe	35
PID 2960 wrote to memory of 2112	2960	cmd.exe	37
PID 2960 wrote to memory of 2112	2960	cmd.exe	37
PID 2960 wrote to memory of 2112	2960	cmd.exe	37
PID 2960 wrote to memory of 2112	2960	cmd.exe	37
PID 2960 wrote to memory of 284	2960	cmd.exe	38
PID 2960 wrote to memory of 284	2960	cmd.exe	38
PID 2960 wrote to memory of 284	2960	cmd.exe	38
PID 2960 wrote to memory of 284	2960	cmd.exe	38
PID 2960 wrote to memory of 2164	2960	cmd.exe	39
PID 2960 wrote to memory of 2164	2960	cmd.exe	39
PID 2960 wrote to memory of 2164	2960	cmd.exe	39
PID 2960 wrote to memory of 2164	2960	cmd.exe	39
PID 2164 wrote to memory of 608	2164	scrok.exe	9
PID 2960 wrote to memory of 2404	2960	cmd.exe	40
PID 2960 wrote to memory of 2404	2960	cmd.exe	40
PID 2960 wrote to memory of 2404	2960	cmd.exe	40
PID 2960 wrote to memory of 2404	2960	cmd.exe	40
PID 2960 wrote to memory of 2068	2960	cmd.exe	41
PID 2960 wrote to memory of 2068	2960	cmd.exe	41
PID 2960 wrote to memory of 2068	2960	cmd.exe	41
PID 2960 wrote to memory of 2068	2960	cmd.exe	41
PID 2960 wrote to memory of 2768	2960	cmd.exe	42
PID 2960 wrote to memory of 2768	2960	cmd.exe	42
PID 2960 wrote to memory of 2768	2960	cmd.exe	42
PID 2960 wrote to memory of 2768	2960	cmd.exe	42
PID 2960 wrote to memory of 1348	2960	cmd.exe	43
PID 2960 wrote to memory of 1348	2960	cmd.exe	43
PID 2960 wrote to memory of 1348	2960	cmd.exe	43
PID 2960 wrote to memory of 1348	2960	cmd.exe	43
PID 2960 wrote to memory of 880	2960	cmd.exe	45
PID 2960 wrote to memory of 880	2960	cmd.exe	45
PID 2960 wrote to memory of 880	2960	cmd.exe	45
PID 2960 wrote to memory of 880	2960	cmd.exe	45
PID 2064 wrote to memory of 1280	2064	TjNkNpAilaYvt.exe	46
PID 2064 wrote to memory of 1280	2064	TjNkNpAilaYvt.exe	46
PID 2064 wrote to memory of 1280	2064	TjNkNpAilaYvt.exe	46
PID 2064 wrote to memory of 1280	2064	TjNkNpAilaYvt.exe	46
PID 2064 wrote to memory of 1280	2064	TjNkNpAilaYvt.exe	46
PID 2064 wrote to memory of 1280	2064	TjNkNpAilaYvt.exe	46
PID 2064 wrote to memory of 1280	2064	TjNkNpAilaYvt.exe	46
PID 880 wrote to memory of 608	880	scrok.exe	9
PID 2960 wrote to memory of 668	2960	cmd.exe	47
PID 2960 wrote to memory of 668	2960	cmd.exe	47
PID 2960 wrote to memory of 668	2960	cmd.exe	47
PID 2960 wrote to memory of 668	2960	cmd.exe	47
PID 2960 wrote to memory of 668	2960	cmd.exe	47
PID 2960 wrote to memory of 668	2960	cmd.exe	47
PID 2960 wrote to memory of 668	2960	cmd.exe	47
PID 1280 wrote to memory of 816	1280	setup.exe	48
PID 1280 wrote to memory of 816	1280	setup.exe	48
PID 1280 wrote to memory of 816	1280	setup.exe	48
PID 1280 wrote to memory of 816	1280	setup.exe	48
PID 1280 wrote to memory of 816	1280	setup.exe	48

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:608
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B4" "00000000000003D4"
  2⤵
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe" -Embedding
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2716
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2388
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
      4⤵
      Checks computer location settings
      Checks system information in the registry
      Executes dropped EXE
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1676
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6826b58,0x7fef6826b68,0x7fef6826b78
        5⤵
        Executes dropped EXE
        
        PID:1300
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1072 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:1468
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1472 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2868
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1512 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:3040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2156 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2164 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1872
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3024 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2152
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3404 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:1680
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3396 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:1656
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1340 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2212
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3556 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2380
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3692 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2180
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3604 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:580
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3768 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2472
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3772 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:1720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4016 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:1592
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3760 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4256 --field-trial-handle=1360,i,13476320592471576385,12369912744001425822,131072 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3676

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Chromestup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2548

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 99C4C181C7ADD0DF5676B2D9BAD01B86
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /c timeout /nobreak /t 7 & C:\ProgramData\setup\aa.exe x C:\ProgramData\setup\ddd. -key 000000 -f -to C:\ProgramData & C:\ProgramData\Packas\scrok.exe & C:\ProgramData\Smart\TjNkNpAilaYvt.exe install & C:\ProgramData\Smart\TjNkNpAilaYvt.exe install & timeout /nobreak /t 2 & C:\ProgramData\Smart\TjNkNpAilaYvt.exe start & C:\ProgramData\Packas\scrok.exe & del C:\ProgramData\Packas\scrok.exe & C:\ProgramData\setup\setup.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /nobreak /t 7
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2112
  - - C:\ProgramData\setup\aa.exe
      C:\ProgramData\setup\aa.exe x C:\ProgramData\setup\ddd. -key 000000 -f -to C:\ProgramData
      4⤵
      Executes dropped EXE
      PID:284
  - - C:\ProgramData\Packas\scrok.exe
      C:\ProgramData\Packas\scrok.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2164
  - - C:\ProgramData\Smart\TjNkNpAilaYvt.exe
      C:\ProgramData\Smart\TjNkNpAilaYvt.exe install
      4⤵
      Executes dropped EXE
      PID:2404
  - - C:\ProgramData\Smart\TjNkNpAilaYvt.exe
      C:\ProgramData\Smart\TjNkNpAilaYvt.exe install
      4⤵
      Executes dropped EXE
      PID:2068
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /nobreak /t 2
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2768
  - - C:\ProgramData\Smart\TjNkNpAilaYvt.exe
      C:\ProgramData\Smart\TjNkNpAilaYvt.exe start
      4⤵
      Executes dropped EXE
      PID:1348
  - - C:\ProgramData\Packas\scrok.exe
      C:\ProgramData\Packas\scrok.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:880
  - - C:\ProgramData\setup\setup.exe
      C:\ProgramData\setup\setup.exe
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:668
    - - C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Temp\GUM5D3E.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9F0C1F44-1C50-396A-483A-08DA4896FF0B}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2948
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1704
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1812
        
        C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2560
        
        C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1756
        
        C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1372
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MUExOTQ4OTItOThCMi00N0U5LTlCMjctMjRCMUREQjU0QjM3fSIgdXNlcmlkPSJ7OTg4NDdBMEQtRTY0MS00RkRDLTkzQjEtRTBGNjQyNkM1Mjg3fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezZCRDA5RkMyLTJCODMtNEQwRi1CNjg4LUVEMjA0MUM1NkE2MH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjE1MSIgbmV4dHZlcnNpb249IjEuMy4zNi4zMTIiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7OUYwQzFGNDQtMUM1MC0zOTZBLTQ4M0EtMDhEQTQ4OTZGRjBCfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIzOTYzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2292
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9F0C1F44-1C50-396A-483A-08DA4896FF0B}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{1A194892-98B2-47E9-9B27-24B1DDB54B37}"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2784

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\ProgramData\Smart\TjNkNpAilaYvt.exe
"C:\ProgramData\Smart\TjNkNpAilaYvt.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2064
- C:\ProgramData\Smart\setup.exe
  "C:\ProgramData\Smart\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\ProgramData\NVIDIARV\svchost.exe
    "C:\ProgramData\NVIDIARV\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:816
- - C:\ProgramData\NVIDIARV\svchost.exe
    "C:\ProgramData\NVIDIARV\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2604
- - C:\ProgramData\NVIDIARV\svchost.exe
    "C:\ProgramData\NVIDIARV\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1568

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2844
- C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\109.0.5414.120_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\109.0.5414.120_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\guiDE40.tmp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2112
- - C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\CR_ACAD4.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\CR_ACAD4.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\CR_ACAD4.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\guiDE40.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Modifies registry class
    PID:1768
  - - C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\CR_ACAD4.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\CR_ACAD4.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f9e1148,0x13f9e1158,0x13f9e1168
      4⤵
      Executes dropped EXE
      PID:368
  - - C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\CR_ACAD4.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\CR_ACAD4.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      PID:1520
    - - C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\CR_ACAD4.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{C5A4D93A-D626-4E5D-9B45-0E995DE2A1C8}\CR_ACAD4.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f9e1148,0x13f9e1158,0x13f9e1168
        5⤵
        Executes dropped EXE
        
        PID:2052
- C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2640
- C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MUExOTQ4OTItOThCMi00N0U5LTlCMjctMjRCMUREQjU0QjM3fSIgdXNlcmlkPSJ7OTg4NDdBMEQtRTY0MS00RkRDLTkzQjEtRTBGNjQyNkM1Mjg3fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezc3N0U2MEIyLTMxODktNDQ3RC1CNTIxLTg5NTE1NkNDQzc4RX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTA5LjAuNTQxNC4xMjAiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTY5IiBpaWQ9Ins5RjBDMUY0NC0xQzUwLTM5NkEtNDgzQS0wOERBNDg5NkZGMEJ9IiBjb2hvcnQ9IjE6MWc4eDoiIGNvaG9ydG5hbWU9IldpbmRvd3MgNyI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9lZGdlZGwubWUuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL2Nocm9tZS9jemFvMmhydnBrNXdncXJrejRra3M1cjczNF8xMDkuMC41NDE0LjEyMC8xMDkuMC41NDE0LjEyMF9jaHJvbWVfaW5zdGFsbGVyLmV4ZSIgZG93bmxvYWRlZD0iOTMxMjI2MDAiIHRvdGFsPSI5MzEyMjYwMCIgZG93bmxvYWRfdGltZV9tcz0iMTkzOTEiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM1NTciIGRvd25sb2FkX3RpbWVfbXM9IjIwNzQ4IiBkb3dubG9hZGVkPSI5MzEyMjYwMCIgdG90YWw9IjkzMTIyNjAwIiBpbnN0YWxsX3RpbWVfbXM9IjM3NzY3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1580

C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f780f02.rbs

Filesize
1KB

MD5
128555eb871dc74093665bb9ce19c21c

SHA1
77a18e21f0c7291411336d966d6c240a386f6946

SHA256
4aac3e437d625bcd9d843e87ed591db1b63cc81234e75175e241fa088942bafa

SHA512
d90c4295192fcdd268283704e38ac2fef698dd38ed1ea7ac66cbb00802ca1ebc38760cd265e397ee67cd2fe4401b1b46c2ed68879ac9b0fb10c43ae3a3755051

Download Submit
C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\setup.exe

Filesize
4.7MB

MD5
b42b8ac29ee0a9c3401ac4e7e186282d

SHA1
69dfb1dd33cf845a1358d862eebc4affe7b51223

SHA256
19545e8376807bce8a430c37cab9731e85052103f769dd60a5da3d93ca68c6ec

SHA512
b5269e7392e77a0fa850049ff61e271c5aab90d546945b17a65cc2ea6420432ae56321e1e39cfd97ccdb3dfc37ddbd6ff77907f5685cc2323b8635c8cdb4a84f

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
935B

MD5
1be91ba315773e739264e535ec4ecced

SHA1
6ee48e18cda8b94d337f825dd48284fff3cd4abd

SHA256
4421a5be5ddf51952c99828b06e175133f788e613866f6e609c6e5f0bc8b0a67

SHA512
78f417a65d23d831382c0d685d73a804d7e213a529e8393e83a88a557b61da513fc9c95b02e67cdd18bbcb8c4b9ea706f43533020217f32dafa53dc22c286d7c

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
1009B

MD5
86844db0a7d35d1f12d580c764998453

SHA1
f9f50fc1da292bc188b03c016dbc90db188303d7

SHA256
a6ea99bbb391c9781a9799c12e9729d7d2ebbc552597e6da21766830160a3469

SHA512
072b9df6b5da02c5101ca89a65efa66338ebe6fc995b96d6bc56afb3a216d93fe3d2e40caad7a2bbb145f8898bb421310b5caa2d3e12b44eb6572a71980feacd

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
330B

MD5
0501186b7d8e37c161d2ed3f277a92fa

SHA1
55e1513e0a9def0ee4c4c830f3766a54ef979a33

SHA256
501c516b710aeb676a74955bcf4156251ada223a754c80bc97157b400f963b7f

SHA512
e3a17d726a14066f9c7a1be3287cba6cd2effed86adbd2165366b6fc96588a358a7e904cc0141d520d7eba004b4a6b5d25f94ea8f5a2ece1182ba72ecd9b904c

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
613B

MD5
4938f681a556780dbfaafc998f925267

SHA1
fca6d9ca221799b8fe34336edcba5e8820d40b10

SHA256
69f4e05d3b184847c1fadd885de567e3660c036efd6e2207b34e6f581636ab74

SHA512
f6fa28208dc9eede61cc59d4ce05acaa0b8e6221f1d0d34c6ac0a333e93c751c054bdc76ccdc0c4741684b6df3ff32713c11010706cd28d73eb7e881f0a93937

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
769B

MD5
949a6fe45ff0aac347e1b9b35b506765

SHA1
5159e2938cb1e730f41dbf7908582f44c8ab3430

SHA256
eb3246bda675fd261d02c3a3487dd667dea0583ff386263f249ff940f2af1a28

SHA512
6361b2cd9a15903aaa71c673f28cc78e6b8129ae876740033e85addff89f092d2a9383f6190c04cc27e64f5c0b6cb86d6ffe704b2275af103cb44c5cd32630da

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.xml

Filesize
298B

MD5
2c706293a3cfff8cc184a8e9a3b3da08

SHA1
873d7c9f51aa6cebd4ad3ae5930d1de84bb4437d

SHA256
ed28baf8be3a588d50ed246c2cd741bbd498aee74ea0675d57e0b33236e22067

SHA512
4aba3e25507ba5c29219ff51553f3616d07aeeb30f7465f9e921eea94cdcb411d1f48d1eefed647c22405df275e7f9d7506aac52202aae137391c6831463b043

Download Submit
C:\ProgramData\Smart\setup.exe

Filesize
4.7MB

MD5
1fc06b4e65235d61020b7b043a493dd8

SHA1
de3c5bc49a095ed4d776f46393fc91d933e08b14

SHA256
4011ba0b6c30b4fbf007384e5535edbcf029aad8b8ac8fee792332d2520c97db

SHA512
01881b52a925888d2772c9b6d5ccaa7b411018fd35cb369a69d7fef4eb4a5f21cf89a6dea05ab946e8b0694963aaafbbb1ead21338180bbe9b4853c585909dfa

Download Submit
C:\ProgramData\setup\ddd

Filesize
10.7MB

MD5
7bd4f627460b430c303b124e51f36d77

SHA1
7962983399c083c206eef52fa185a864a6081c71

SHA256
2e4f52f7d0d858399509d3184550f72ede2a1fbb0b248dff8faaa0450a1d30ec

SHA512
c4021daacf909b7d5c96a0d1584ef187231616bcaff646bbb34572be157b3e9a91c765f88d85c17e2d320e24c2d75f2ec09e2a18a68073a4d08befb27880c3f7

Download Submit
C:\ProgramData\setup\setup.exe

Filesize
1.3MB

MD5
4a94844260d6a08828d781d488cef61d

SHA1
de8169fdb5ab8a120df577d92eb25a2767431738

SHA256
46d7a8abe3bb9d7302529246cd8ee6e7d0360d1045fe92662cc7580e72ef5132

SHA512
82549c1e525a90003fb0174ebba2bc3b4f58706ef9fd5e6ee07d489ab536ef286e408db6c15a52b039d3f59c09bd55e35d045def79007da5d414d5d589d34f4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4c622fc8-be11-4ec0-bade-03a724c68d2d.tmp

Filesize
12KB

MD5
1fe48f780747251c247f93c8118da0c1

SHA1
a512939ea3a696bffe3027cdf6ae8d01008bdad7

SHA256
a1fcbc3663efba556989ae8876aab872c580cc35e3d61d5750d407dbf5c03c2a

SHA512
932994c47cfc0855ca3461410e836ea21a67195841ea0278b25df523043093ccf402b3d4ade0918770ab28018ec87fad3d108f957d495468692fa246970d7209

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4fa6c4b9-49bc-4e71-9943-fb3dc2c3c1b2.tmp

Filesize
4KB

MD5
470e340f9efe3702174c2bf57012a4bb

SHA1
8faa7d823d27669a96a7a46ddaf5ad4bc323486b

SHA256
2d45b995935bb57e1b415ff7e9c55174f15699f04684584dd5a0fd1801664c92

SHA512
ec3f98ee4f2cbb11e6cd187ff64ed6cd5cfbf0c7470d1aa6470102508a497c3da403c188d17def47866a5541400ec76e4d7d170b610a04d7885e4f2e5dab01b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\CURRENT~RFf79a42b.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json

Filesize
593B

MD5
91f5bc87fd478a007ec68c4e8adf11ac

SHA1
d07dd49e4ef3b36dad7d038b7e999ae850c5bef6

SHA256
92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9

SHA512
fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
176KB

MD5
2b84276ef62e39ea1535c021cd461ed2

SHA1
c6f6ffd099348ef15dfbc059e1a6cd8509405c0b

SHA256
5cbdd4e8608a2f5ec5600d70c0c3dcd6245feb24c256508251213fe0df2b5626

SHA512
e20b51553c84c1df072a99c7f3d60461bcd8dee0b12ff0d88574a5c9fbdd43adf6c05f6cdb83b5921ece4bfa3da5b5203d201356532a51806e4fb411dd0a28a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1676_1722447189\CRX_INSTALL\_locales\en\messages.json

Filesize
450B

MD5
dbedf86fa9afb3a23dbb126674f166d2

SHA1
5628affbcf6f897b9d7fd9c17deb9aa75036f1cc

SHA256
c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe

SHA512
931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1676_1722447189\fff239df-2159-4603-b099-5b6496e157f8.tmp

Filesize
242KB

MD5
541f52e24fe1ef9f8e12377a6ccae0c0

SHA1
189898bb2dcae7d5a6057bc2d98b8b450afaebb6

SHA256
81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82

SHA512
d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88

Download Submit
C:\Windows\Installer\MSI1056.tmp

Filesize
587KB

MD5
c7fbd5ee98e32a77edf1156db3fca622

SHA1
3e534fc55882e9fb940c9ae81e6f8a92a07125a0

SHA256
e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6

SHA512
8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

Download Submit
C:\Windows\Installer\MSI13A2.tmp

Filesize
1.1MB

MD5
ae463676775a1dd0b7a28ddb265b4065

SHA1
dff64c17885c7628b22631a2cdc9da83e417d348

SHA256
83fbfcaff3da3eb89f9aec29e6574cf15502fd670cbb2ab0c8a84451b2598b22

SHA512
e47c2db249e7a08c5d2864671fbc235e48aebecbe0b2c2334d1a4cba1b5b3037522ff89408589f3559b3a1eaf507bd338645387d55800029bb3b941d4c7744d6

Download Submit
\Program Files (x86)\Google\Temp\GUM5D3E.tmp\GoogleUpdate.exe

Filesize
158KB

MD5
cdf152e23a8cbf68dbe3f419701244fc

SHA1
cb850d3675da418131d90ab01320e4e8842228d7

SHA256
84eaf43f33d95da9ab310fc36dc3cfe53823d2220946f021f18cf3f729b8d64e

SHA512
863e1da5bc779fa02cf08587c4de5f04c56e02902c5c4f92a06f2e631380ecabcc98e35d52609f764727e41b965c0786d24ea23fc4b9776d24d9f13e0d8ae0c2

Download Submit
\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdate.dll

Filesize
1.9MB

MD5
dae72b4b8bcf62780d63b9cbb5b36b35

SHA1
1d9b764661cfe4ee0f0388ff75fd0f6866a9cd89

SHA256
b0ca6700e7a4ea667d91bcf3338699f28649c2e0a3c0d8b4f2d146ab7c843ab6

SHA512
402c00cab6dac8981e200b6b8b4263038d76afe47c473d5f2abf0406222b32fff727b495c6b754d207af2778288203ce0774a6200b3e580e90299d08ce0c098f

Download Submit
\Program Files (x86)\Google\Temp\GUM5D3E.tmp\goopdateres_zh-CN.dll

Filesize
37KB

MD5
ca52cc49599bb6bda28c38aea1f9ec4e

SHA1
494f166b530444f39bca27e2b9e10f27e34fc98a

SHA256
f9f144aa2dc0de21b24c93f498a9b4a946b7da42819a776b3283a0bcae18544b

SHA512
05e2d5711eef8f57737b2512de2e73744f17e0a34de0bfd2a06c9cc60a08ebadbafe38e30b66a2ede7fa61d5b9571adddcfbd7e1cafcee1ab2168a563d2d3f0d

Download Submit
\ProgramData\NVIDIARV\svchost.exe

Filesize
3.4MB

MD5
d6395ce9ccb9802c7fbba16139153c36

SHA1
52cf2b264a5ce1bdf18c0f17e62bd178cf92a528

SHA256
2705aa01fe0ad1deb09349e184102815726323997df433fb8da947345404422a

SHA512
a1b5b8ae410b6edb4b9ae7298779e1caa6071e3f59850e579b3cc39c3a3654dd042e77cf863dded64ae90bbacf16d377e9000cbc7a85b6a9d526f79e0ff7e6fd

Download Submit
\ProgramData\Packas\scrok.exe

Filesize
2.7MB

MD5
d07123bd407bf34ee3ce91b5fdb10db1

SHA1
d8a7c620adf407edfd03053b89051d6aabbbf6d5

SHA256
519f752759e93f2be905670b115b522cb6e770c1577082a11eaacfd397ac65fb

SHA512
74305dc3d99d2a19f5999905090beb274e97c0f1367fb109e54ad44567da774c079842e08ccd8748d5c1ecd114b87523c4778766207b231e726c3f6460690daa

Download Submit
\ProgramData\Smart\TjNkNpAilaYvt.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
\ProgramData\setup\aa.exe

Filesize
1.0MB

MD5
09c448be7e7d84e6e544cc03afbb05d8

SHA1
ddc13e71a72bc49c60f89b98cbb79c2449cfa07e

SHA256
a0f127a70943b0262060498c1723c795a8e2980f1acf0c42ee8c1dae72ae54b5

SHA512
e5f7a988a999e7e34d0aa2d2a5b2fbb22689588d3def4bed4518ceed38710e3714c5614bab192b0ce6bcac5172a87ebf3b3b923e495eb7344c70bd11f4bf1c12

Download Submit
memory/284-57-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/608-70-0x0000000000D60000-0x0000000000D89000-memory.dmp

Filesize
164KB

Download
memory/816-370-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/880-120-0x000000013FBD0000-0x000000014017F000-memory.dmp

Filesize
5.7MB

Download
memory/880-118-0x0000000077AC0000-0x0000000077AC2000-memory.dmp

Filesize
8KB

Download
memory/1280-128-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1280-126-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1280-130-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1280-131-0x0000000000400000-0x0000000000B9E000-memory.dmp

Filesize
7.6MB

Download
memory/1348-93-0x0000000000380000-0x0000000000456000-memory.dmp

Filesize
856KB

Download
memory/1568-376-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/1568-371-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/2068-84-0x00000000013A0000-0x0000000001476000-memory.dmp

Filesize
856KB

Download
memory/2164-68-0x000000013FAF0000-0x000000014009F000-memory.dmp

Filesize
5.7MB

Download
memory/2164-62-0x0000000077AC0000-0x0000000077AC2000-memory.dmp

Filesize
8KB

Download
memory/2164-66-0x0000000077AC0000-0x0000000077AC2000-memory.dmp

Filesize
8KB

Download
memory/2164-64-0x0000000077AC0000-0x0000000077AC2000-memory.dmp

Filesize
8KB

Download
memory/2404-76-0x0000000000F50000-0x0000000001026000-memory.dmp

Filesize
856KB

Download