blackmoon | ce2075f76a21e2a535681e2ad09c4d4d646e600e0491bb4f3725f6e0634fdab7

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chromestup.msi
Size

14.5MB
MD5

d2f1ff0fca1a5d50f371b849df0ff604
SHA1

edcc7fce9a61e3ca13a87c694a50d9810f83e89b
SHA256

f71845af2465c505c857f622e78e266553c1f0a578c321cca70eca0d676e3512
SHA512

3e1a7c1eee079b0094a42e6fd00d9b896798d7d535f21fc79254c489c0f8323a7d5ecf75b66556e2a3f9d7f2fc6ec689bcb8c1a1dfb829f07afecad37175dd7a
SSDEEP

393216:6BfMD+F9vscR4cMMmYCb1HvXODuuXPfott+I5MF9:uMdcMTb1Hv+CuXPw8I5g9

Score

10^/10

blackmoon fatalrat banker discovery infostealer persistence privilege_escalation rat spyware stealer trojan vmprotect

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral1/memory/940-129-0x0000000000400000-0x0000000000B9E000-memory.dmp	family_blackmoon

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
stealer trojan fatalrat
Fatalrat family
fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
behavioral1/memory/2892-372-0x0000000010000000-0x000000001002D000-memory.dmp	fatalrat

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000c000000019506-57.dat	vmprotect
behavioral1/memory/3024-66-0x000000013F1A0000-0x000000013F74F000-memory.dmp	vmprotect
behavioral1/files/0x0005000000019d3d-104.dat	vmprotect
behavioral1/memory/1528-115-0x000000013F100000-0x000000013F6AF000-memory.dmp	vmprotect
behavioral1/memory/940-129-0x0000000000400000-0x0000000000B9E000-memory.dmp	vmprotect

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\International\Geo\Nation	chrome.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUM201F.tmp\GoogleUpdate.exe	setup.exe
File created	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\chrome.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_et.dll	setup.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping1884_211889758\manifest.fingerprint	chrome.exe
File created	C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_ja.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\Locales\vi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\chrmstp.exe	setup.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping1884_211889758\crl-set	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\Locales\es.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\Locales\sk.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_es.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_et.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ru.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\109.0.5414.120.manifest	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_mr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\Locales\ms.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUM201F.tmp\GoogleUpdateSetup.exe	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_es-419.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\icudtl.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\nacl_irt_x86_64.nexe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\VisualElements\LogoBeta.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\Locales\fi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\Locales\fil.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\WidevineCdm\LICENSE	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM201F.tmp\GoogleCrashHandler64.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\chrome.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_tr.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\Locales\da.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_fa.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_pl.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\Locales\nl.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\Locales\th.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\resources.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_is.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_en-GB.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ro.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_sw.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\Locales\ar.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\VisualElements\Logo.png	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_ml.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_zh-CN.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdate.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\VisualElements\LogoCanary.png	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_kn.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_vi.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\Locales\ml.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\chrome.exe.sig	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_am.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\chrome.7z	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\Locales\tr.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM201F.tmp\GoogleUpdateBroker.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\VisualElements\SmallLogoBeta.png	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_da.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_tr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\psuser.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\Locales\sv.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\Locales\sw.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2628_706246162\Chrome-bin\109.0.5414.120\chrome_pwa_launcher.exe	setup.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF41F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF49D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF5E6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF683.tmp	msiexec.exe
File created	C:\Windows\Installer\f76f3b5.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76f3b5.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIF51A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF730.tmp	msiexec.exe
File created	C:\Windows\Installer\f76f3b2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76f3b2.msi	msiexec.exe

Executes dropped EXE 54 IoCs

pid	Process
2912	aa.exe
3024	scrok.exe
1664	TjNkNpAilaYvt.exe
1588	TjNkNpAilaYvt.exe
1316	TjNkNpAilaYvt.exe
1728	TjNkNpAilaYvt.exe
1528	scrok.exe
940	setup.exe
1536	setup.exe
2868	GoogleUpdate.exe
2892	svchost.exe
1204	GoogleUpdate.exe
2308	svchost.exe
972	svchost.exe
1948	GoogleUpdate.exe
2036	GoogleUpdateComRegisterShell64.exe
2240	GoogleUpdateComRegisterShell64.exe
2408	GoogleUpdateComRegisterShell64.exe
2268	GoogleUpdate.exe
1656	GoogleUpdate.exe
2060	GoogleUpdate.exe
1196	109.0.5414.120_chrome_installer.exe
2628	setup.exe
1688	setup.exe
2852	setup.exe
848	setup.exe
1588	GoogleCrashHandler.exe
1204	GoogleCrashHandler64.exe
908	GoogleUpdate.exe
1988	GoogleUpdateOnDemand.exe
1648	GoogleUpdate.exe
1884	chrome.exe
3012	chrome.exe
2268	chrome.exe
1552	chrome.exe
1816	chrome.exe
2796	chrome.exe
1508	chrome.exe
2144	chrome.exe
588	elevation_service.exe
972	chrome.exe
2372	chrome.exe
2636	chrome.exe
2080	chrome.exe
2244	chrome.exe
972	chrome.exe
2548	chrome.exe
2848	chrome.exe
812	chrome.exe
1960	chrome.exe
2392	chrome.exe
3660	chrome.exe
3864	chrome.exe
4016	chrome.exe

Loads dropped DLL 64 IoCs

pid	Process
1688	MsiExec.exe
1688	MsiExec.exe
1688	MsiExec.exe
1688	MsiExec.exe
1688	MsiExec.exe
320	cmd.exe
320	cmd.exe
320	cmd.exe
320	cmd.exe
940	setup.exe
940	setup.exe
940	setup.exe
320	cmd.exe
1536	setup.exe
2868	GoogleUpdate.exe
2868	GoogleUpdate.exe
2868	GoogleUpdate.exe
940	setup.exe
2868	GoogleUpdate.exe
940	setup.exe
940	setup.exe
940	setup.exe
940	setup.exe
940	setup.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2308	svchost.exe
2308	svchost.exe
2308	svchost.exe
972	svchost.exe
972	svchost.exe
972	svchost.exe
1204	GoogleUpdate.exe
1204	GoogleUpdate.exe
1204	GoogleUpdate.exe
2868	GoogleUpdate.exe
1948	GoogleUpdate.exe
1948	GoogleUpdate.exe
1948	GoogleUpdate.exe
2036	GoogleUpdateComRegisterShell64.exe
1948	GoogleUpdate.exe
1948	GoogleUpdate.exe
2240	GoogleUpdateComRegisterShell64.exe
1948	GoogleUpdate.exe
1948	GoogleUpdate.exe
2408	GoogleUpdateComRegisterShell64.exe
1948	GoogleUpdate.exe
2868	GoogleUpdate.exe
2868	GoogleUpdate.exe
2868	GoogleUpdate.exe
2268	GoogleUpdate.exe
2868	GoogleUpdate.exe
2868	GoogleUpdate.exe
1656	GoogleUpdate.exe
1656	GoogleUpdate.exe
1656	GoogleUpdate.exe
2060	GoogleUpdate.exe
2060	GoogleUpdate.exe
2060	GoogleUpdate.exe
2060	GoogleUpdate.exe
1656	GoogleUpdate.exe
2060	GoogleUpdate.exe
1196	109.0.5414.120_chrome_installer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2324	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdateOnDemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleCrashHandler.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2268	GoogleUpdate.exe
908	GoogleUpdate.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2908	timeout.exe
1592	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Group = "Fatal"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\InstallTime = "2025-03-28 09:17"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods\ = "9"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\GoogleUpdateBroker.exe\""	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachineFallback.1.0\CLSID\ = "{598FE0E5-E02D-465D-9A9D-37974A28FD42}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\ProgID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\LocalServer32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pdf	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\PROGID	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\LOCALSERVER32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachineFallback\CurVer\ = "GoogleUpdate.PolicyStatusMachineFallback.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine\CurVer\ = "GoogleUpdate.Update3WebMachine.1.0"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\GoogleUpdateOnDemand.exe\""	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\notification_helper.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib\ = "{463ABECF-410D-407F-8AF5-0DF35A005CC8}"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.shtml	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ = "ICoCreateAsync"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\ProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoCreateAsync.1.0\ = "CoCreateAsync"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\AppID = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ = "IProcessLauncher"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\VersionIndependentProgID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe\AppID = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ = "IPolicyStatus2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods\ = "17"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.svg	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods\ = "41"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ = "IAppCommandWeb"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ProxyStubClsid32	setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2452	msiexec.exe
2452	msiexec.exe
3024	scrok.exe
3024	scrok.exe
1528	scrok.exe
1528	scrok.exe
1728	TjNkNpAilaYvt.exe
940	setup.exe
2868	GoogleUpdate.exe
2868	GoogleUpdate.exe
2868	GoogleUpdate.exe
2868	GoogleUpdate.exe
2868	GoogleUpdate.exe
2868	GoogleUpdate.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2324	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2324	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeSecurityPrivilege	2452	msiexec.exe
Token: SeCreateTokenPrivilege	2324	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2324	msiexec.exe
Token: SeLockMemoryPrivilege	2324	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2324	msiexec.exe
Token: SeMachineAccountPrivilege	2324	msiexec.exe
Token: SeTcbPrivilege	2324	msiexec.exe
Token: SeSecurityPrivilege	2324	msiexec.exe
Token: SeTakeOwnershipPrivilege	2324	msiexec.exe
Token: SeLoadDriverPrivilege	2324	msiexec.exe
Token: SeSystemProfilePrivilege	2324	msiexec.exe
Token: SeSystemtimePrivilege	2324	msiexec.exe
Token: SeProfSingleProcessPrivilege	2324	msiexec.exe
Token: SeIncBasePriorityPrivilege	2324	msiexec.exe
Token: SeCreatePagefilePrivilege	2324	msiexec.exe
Token: SeCreatePermanentPrivilege	2324	msiexec.exe
Token: SeBackupPrivilege	2324	msiexec.exe
Token: SeRestorePrivilege	2324	msiexec.exe
Token: SeShutdownPrivilege	2324	msiexec.exe
Token: SeDebugPrivilege	2324	msiexec.exe
Token: SeAuditPrivilege	2324	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2324	msiexec.exe
Token: SeChangeNotifyPrivilege	2324	msiexec.exe
Token: SeRemoteShutdownPrivilege	2324	msiexec.exe
Token: SeUndockPrivilege	2324	msiexec.exe
Token: SeSyncAgentPrivilege	2324	msiexec.exe
Token: SeEnableDelegationPrivilege	2324	msiexec.exe
Token: SeManageVolumePrivilege	2324	msiexec.exe
Token: SeImpersonatePrivilege	2324	msiexec.exe
Token: SeCreateGlobalPrivilege	2324	msiexec.exe
Token: SeBackupPrivilege	2352	vssvc.exe
Token: SeRestorePrivilege	2352	vssvc.exe
Token: SeAuditPrivilege	2352	vssvc.exe
Token: SeBackupPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2252	DrvInst.exe
Token: SeRestorePrivilege	2252	DrvInst.exe
Token: SeRestorePrivilege	2252	DrvInst.exe
Token: SeRestorePrivilege	2252	DrvInst.exe
Token: SeRestorePrivilege	2252	DrvInst.exe
Token: SeRestorePrivilege	2252	DrvInst.exe
Token: SeRestorePrivilege	2252	DrvInst.exe
Token: SeLoadDriverPrivilege	2252	DrvInst.exe
Token: SeLoadDriverPrivilege	2252	DrvInst.exe
Token: SeLoadDriverPrivilege	2252	DrvInst.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe
Token: SeTakeOwnershipPrivilege	2452	msiexec.exe
Token: SeRestorePrivilege	2452	msiexec.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2324	msiexec.exe
2324	msiexec.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
940	setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 1688	2452	msiexec.exe	35
PID 2452 wrote to memory of 1688	2452	msiexec.exe	35
PID 2452 wrote to memory of 1688	2452	msiexec.exe	35
PID 2452 wrote to memory of 1688	2452	msiexec.exe	35
PID 2452 wrote to memory of 1688	2452	msiexec.exe	35
PID 2452 wrote to memory of 1688	2452	msiexec.exe	35
PID 2452 wrote to memory of 1688	2452	msiexec.exe	35
PID 1688 wrote to memory of 320	1688	MsiExec.exe	36
PID 1688 wrote to memory of 320	1688	MsiExec.exe	36
PID 1688 wrote to memory of 320	1688	MsiExec.exe	36
PID 1688 wrote to memory of 320	1688	MsiExec.exe	36
PID 320 wrote to memory of 2908	320	cmd.exe	38
PID 320 wrote to memory of 2908	320	cmd.exe	38
PID 320 wrote to memory of 2908	320	cmd.exe	38
PID 320 wrote to memory of 2908	320	cmd.exe	38
PID 320 wrote to memory of 2912	320	cmd.exe	39
PID 320 wrote to memory of 2912	320	cmd.exe	39
PID 320 wrote to memory of 2912	320	cmd.exe	39
PID 320 wrote to memory of 2912	320	cmd.exe	39
PID 320 wrote to memory of 3024	320	cmd.exe	40
PID 320 wrote to memory of 3024	320	cmd.exe	40
PID 320 wrote to memory of 3024	320	cmd.exe	40
PID 320 wrote to memory of 3024	320	cmd.exe	40
PID 3024 wrote to memory of 612	3024	scrok.exe	9
PID 320 wrote to memory of 1664	320	cmd.exe	41
PID 320 wrote to memory of 1664	320	cmd.exe	41
PID 320 wrote to memory of 1664	320	cmd.exe	41
PID 320 wrote to memory of 1664	320	cmd.exe	41
PID 320 wrote to memory of 1588	320	cmd.exe	42
PID 320 wrote to memory of 1588	320	cmd.exe	42
PID 320 wrote to memory of 1588	320	cmd.exe	42
PID 320 wrote to memory of 1588	320	cmd.exe	42
PID 320 wrote to memory of 1592	320	cmd.exe	43
PID 320 wrote to memory of 1592	320	cmd.exe	43
PID 320 wrote to memory of 1592	320	cmd.exe	43
PID 320 wrote to memory of 1592	320	cmd.exe	43
PID 320 wrote to memory of 1316	320	cmd.exe	44
PID 320 wrote to memory of 1316	320	cmd.exe	44
PID 320 wrote to memory of 1316	320	cmd.exe	44
PID 320 wrote to memory of 1316	320	cmd.exe	44
PID 320 wrote to memory of 1528	320	cmd.exe	46
PID 320 wrote to memory of 1528	320	cmd.exe	46
PID 320 wrote to memory of 1528	320	cmd.exe	46
PID 320 wrote to memory of 1528	320	cmd.exe	46
PID 1728 wrote to memory of 940	1728	TjNkNpAilaYvt.exe	47
PID 1728 wrote to memory of 940	1728	TjNkNpAilaYvt.exe	47
PID 1728 wrote to memory of 940	1728	TjNkNpAilaYvt.exe	47
PID 1728 wrote to memory of 940	1728	TjNkNpAilaYvt.exe	47
PID 1728 wrote to memory of 940	1728	TjNkNpAilaYvt.exe	47
PID 1728 wrote to memory of 940	1728	TjNkNpAilaYvt.exe	47
PID 1728 wrote to memory of 940	1728	TjNkNpAilaYvt.exe	47
PID 1528 wrote to memory of 612	1528	scrok.exe	9
PID 320 wrote to memory of 1536	320	cmd.exe	48
PID 320 wrote to memory of 1536	320	cmd.exe	48
PID 320 wrote to memory of 1536	320	cmd.exe	48
PID 320 wrote to memory of 1536	320	cmd.exe	48
PID 320 wrote to memory of 1536	320	cmd.exe	48
PID 320 wrote to memory of 1536	320	cmd.exe	48
PID 320 wrote to memory of 1536	320	cmd.exe	48
PID 1536 wrote to memory of 2868	1536	setup.exe	49
PID 1536 wrote to memory of 2868	1536	setup.exe	49
PID 1536 wrote to memory of 2868	1536	setup.exe	49
PID 1536 wrote to memory of 2868	1536	setup.exe	49
PID 1536 wrote to memory of 2868	1536	setup.exe	49

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:612
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B0" "000000000000053C"
  2⤵
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe" -Embedding
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1988
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
      4⤵
      Checks computer location settings
      Checks system information in the registry
      Drops file in Program Files directory
      Executes dropped EXE
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1884
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67f6b58,0x7fef67f6b68,0x7fef67f6b78
        5⤵
        Executes dropped EXE
        
        PID:3012
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:2268
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1344 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:1552
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1600 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:1816
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2112 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2124 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1508
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2496 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2144
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2632 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:972
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1576 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:2372
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1284 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2636
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3588 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2080
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3704 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2244
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3844 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:972
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3900 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2548
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2848
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4032 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:812
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4052 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:1960
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4128 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2392
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=640 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:3660
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=992 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:3864
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1776 --field-trial-handle=1432,i,2365955827320207549,17489311217012365234,131072 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:4016

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Chromestup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2324

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A3DFDB5FE9BAB64EC417540EC771C0B2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /c timeout /nobreak /t 7 & C:\ProgramData\setup\aa.exe x C:\ProgramData\setup\ddd. -key 000000 -f -to C:\ProgramData & C:\ProgramData\Packas\scrok.exe & C:\ProgramData\Smart\TjNkNpAilaYvt.exe install & C:\ProgramData\Smart\TjNkNpAilaYvt.exe install & timeout /nobreak /t 2 & C:\ProgramData\Smart\TjNkNpAilaYvt.exe start & C:\ProgramData\Packas\scrok.exe & del C:\ProgramData\Packas\scrok.exe & C:\ProgramData\setup\setup.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:320
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /nobreak /t 7
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2908
  - - C:\ProgramData\setup\aa.exe
      C:\ProgramData\setup\aa.exe x C:\ProgramData\setup\ddd. -key 000000 -f -to C:\ProgramData
      4⤵
      Executes dropped EXE
      PID:2912
  - - C:\ProgramData\Packas\scrok.exe
      C:\ProgramData\Packas\scrok.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3024
  - - C:\ProgramData\Smart\TjNkNpAilaYvt.exe
      C:\ProgramData\Smart\TjNkNpAilaYvt.exe install
      4⤵
      Executes dropped EXE
      PID:1664
  - - C:\ProgramData\Smart\TjNkNpAilaYvt.exe
      C:\ProgramData\Smart\TjNkNpAilaYvt.exe install
      4⤵
      Executes dropped EXE
      PID:1588
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /nobreak /t 2
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1592
  - - C:\ProgramData\Smart\TjNkNpAilaYvt.exe
      C:\ProgramData\Smart\TjNkNpAilaYvt.exe start
      4⤵
      Executes dropped EXE
      PID:1316
  - - C:\ProgramData\Packas\scrok.exe
      C:\ProgramData\Packas\scrok.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1528
  - - C:\ProgramData\setup\setup.exe
      C:\ProgramData\setup\setup.exe
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1536
    - - C:\Program Files (x86)\Google\Temp\GUM201F.tmp\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Temp\GUM201F.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9F0C1F44-1C50-396A-483A-08DA4896FF0B}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2868
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1204
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1948
        
        C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2036
        
        C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2240
        
        C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2408
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDFBQUIwMTctN0FCMC00OTg2LTgzRUYtOThBMkU2QkFEQzgxfSIgdXNlcmlkPSJ7NDgzQjUzNzgtRUU3Qy00QkM5LTlDM0MtQkQyODQ2ODQ4RjYxfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezk2NkJGODc3LTREQzYtNEJCNi05NTQxLUQ3OTRGQzI0QTI2MH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjE1MSIgbmV4dHZlcnNpb249IjEuMy4zNi4zMTIiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7OUYwQzFGNDQtMUM1MC0zOTZBLTQ4M0EtMDhEQTQ4OTZGRjBCfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI5MjAiLz48L2FwcD48L3JlcXVlc3Q-
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2268
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9F0C1F44-1C50-396A-483A-08DA4896FF0B}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{D1AAB017-7AB0-4986-83EF-98A2E6BADC81}"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\ProgramData\Smart\TjNkNpAilaYvt.exe
"C:\ProgramData\Smart\TjNkNpAilaYvt.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728
- C:\ProgramData\Smart\setup.exe
  "C:\ProgramData\Smart\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:940
- - C:\ProgramData\NVIDIARV\svchost.exe
    "C:\ProgramData\NVIDIARV\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2892
- - C:\ProgramData\NVIDIARV\svchost.exe
    "C:\ProgramData\NVIDIARV\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:972
- - C:\ProgramData\NVIDIARV\svchost.exe
    "C:\ProgramData\NVIDIARV\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2308

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2060
- C:\Program Files (x86)\Google\Update\Install\{73ADD814-832E-4C3D-B9C2-D5DD001D2877}\109.0.5414.120_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{73ADD814-832E-4C3D-B9C2-D5DD001D2877}\109.0.5414.120_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{73ADD814-832E-4C3D-B9C2-D5DD001D2877}\gui649F.tmp"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1196
- - C:\Program Files (x86)\Google\Update\Install\{73ADD814-832E-4C3D-B9C2-D5DD001D2877}\CR_A0461.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{73ADD814-832E-4C3D-B9C2-D5DD001D2877}\CR_A0461.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{73ADD814-832E-4C3D-B9C2-D5DD001D2877}\CR_A0461.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{73ADD814-832E-4C3D-B9C2-D5DD001D2877}\gui649F.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Modifies registry class
    PID:2628
  - - C:\Program Files (x86)\Google\Update\Install\{73ADD814-832E-4C3D-B9C2-D5DD001D2877}\CR_A0461.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{73ADD814-832E-4C3D-B9C2-D5DD001D2877}\CR_A0461.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f841148,0x13f841158,0x13f841168
      4⤵
      Executes dropped EXE
      PID:1688
  - - C:\Program Files (x86)\Google\Update\Install\{73ADD814-832E-4C3D-B9C2-D5DD001D2877}\CR_A0461.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{73ADD814-832E-4C3D-B9C2-D5DD001D2877}\CR_A0461.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      PID:2852
    - - C:\Program Files (x86)\Google\Update\Install\{73ADD814-832E-4C3D-B9C2-D5DD001D2877}\CR_A0461.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{73ADD814-832E-4C3D-B9C2-D5DD001D2877}\CR_A0461.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f841148,0x13f841158,0x13f841168
        5⤵
        Executes dropped EXE
        
        PID:848
- C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1588
- C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDFBQUIwMTctN0FCMC00OTg2LTgzRUYtOThBMkU2QkFEQzgxfSIgdXNlcmlkPSJ7NDgzQjUzNzgtRUU3Qy00QkM5LTlDM0MtQkQyODQ2ODQ4RjYxfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0YxMzgxM0MyLTE0MEYtNEE0NS1BQ0IzLTdFODk2NURFOTlERn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTA5LjAuNTQxNC4xMjAiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMjA2IiBpaWQ9Ins5RjBDMUY0NC0xQzUwLTM5NkEtNDgzQS0wOERBNDg5NkZGMEJ9IiBjb2hvcnQ9IjE6MWc4eDoiIGNvaG9ydG5hbWU9IldpbmRvd3MgNyI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9lZGdlZGwubWUuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL2Nocm9tZS9jemFvMmhydnBrNXdncXJrejRra3M1cjczNF8xMDkuMC41NDE0LjEyMC8xMDkuMC41NDE0LjEyMF9jaHJvbWVfaW5zdGFsbGVyLmV4ZSIgZG93bmxvYWRlZD0iOTMxMjI2MDAiIHRvdGFsPSI5MzEyMjYwMCIgZG93bmxvYWRfdGltZV9tcz0iMTA3NzkiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjMzNTQiIGRvd25sb2FkX3RpbWVfbXM9IjExNDk3IiBkb3dubG9hZGVkPSI5MzEyMjYwMCIgdG90YWw9IjkzMTIyNjAwIiBpbnN0YWxsX3RpbWVfbXM9IjI2ODQ4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:908

C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\109.0.5414.120\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76f3b6.rbs

Filesize
1KB

MD5
ac7befc21fc9e4f420a88d63d2615446

SHA1
8f81cf56e55400bf9a7e3806fc3a777d03a00338

SHA256
b47baec1c0ee0c7fc5242eee75e07b370cd37783973bc28c824a0639c97f1b1d

SHA512
6c4a2e07fa07168a441a1d87b346d5abc88ed7ae596ee7969d5c62a0399bbb95cbd92cbb804eaf219896d45d75a65ed26592d5be1eb4edc01f9461d822424855

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\GoogleCrashHandler.exe

Filesize
294KB

MD5
a11ce10ac47f5f83b9bc980567331a1b

SHA1
63ee42e347b0328f8d71a3aa4dde4c6dc46da726

SHA256
101dbf984c4b3876defe2699d6160acbf1bb3f213e02a32f08fdcdc06821c542

SHA512
ff2f86c4061188ead1bfeebd36de7dbc312adcc95267537697f2bfcbb0c53e7c4ab0cd268cef22f0182391796c4612c97cbdc1266d9ee1960cdd2610d8c2bcb3

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\GoogleCrashHandler64.exe

Filesize
392KB

MD5
b659663611a4c2216dff5ab1b60dd089

SHA1
9a14392a5bdb9ea6b8c3e60224b7ff37091d48b5

SHA256
cad4aa1cf58f6b2e2aceb789d53b18418e67066ec406b2fac786cb845ef89d2b

SHA512
1065f9072cd6f1f4364f1354108f2647ee1d89f87e908a22fcd63bd3149c864c457e62268067a439d0486d8d4aa150aa984ad8ac8b51cae49014b67b80496040

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\GoogleUpdateComRegisterShell64.exe

Filesize
181KB

MD5
be535d8b68dd064442f73211466e5987

SHA1
aa49313d9513fd9c2d2b25da09ea24d09cc03435

SHA256
c109bcb63391ac3ea93fb97fbdf3f6ed71316cacb592ef46efaea0024bc9ed59

SHA512
eb50eebeaf83be10aea8088e35a807f9001d07d17d2bc1655c3bc0cb254d0f54303348988514ba5590ebd9d3bde3f1149c3f700f62fbce63c0199ea3cfb1f638

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\GoogleUpdateCore.exe

Filesize
217KB

MD5
af51ea4d9828e21f72e935b0deae50f2

SHA1
c7fe57c2a16c9f5a5ebdd3cc0910427cba5308bd

SHA256
3575011873d0f6d49c783095dae06e6619f8f5463da578fbe284ca5d1d449619

SHA512
ec9828d0bade39754748fb53cfc7efdc5e57955198bac3c248ea9b5a9a607182bb1477819f220549a8e9eadbe6bf69a12da6c8af3761980d2dd9078eaeaa932f

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdate.dll

Filesize
1.9MB

MD5
dae72b4b8bcf62780d63b9cbb5b36b35

SHA1
1d9b764661cfe4ee0f0388ff75fd0f6866a9cd89

SHA256
b0ca6700e7a4ea667d91bcf3338699f28649c2e0a3c0d8b4f2d146ab7c843ab6

SHA512
402c00cab6dac8981e200b6b8b4263038d76afe47c473d5f2abf0406222b32fff727b495c6b754d207af2778288203ce0774a6200b3e580e90299d08ce0c098f

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_am.dll

Filesize
42KB

MD5
849bc7e364e30f8ee4c157f50d5b695e

SHA1
b52b8efa1f3a2c84f436f328decd2912efeb1b18

SHA256
f1384a25a6f40e861455c62190d794415f3e9bfca6317c214847e9535dfc3fb9

SHA512
6fd7f542a7073b3bbf1b0c200bb306b30f1b35a64a1fb013f25c7df76f63ef377d9bd736e8da2e9372f1c994785eaeedb6b60e3a0d4a4e8734c266ad61782d3b

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_ar.dll

Filesize
41KB

MD5
163695df53cea0728f9f58a46a08e102

SHA1
71b39eec83260e2ccc299fac165414acb46958bd

SHA256
f89dddda3e887385b42ea88118ba8fb1cc68fde0c07d44b851164564eb7c1ec8

SHA512
6dfb70a175097f3c96ae815a563c185136cb5a35f361288cc81570facfa1f1d28f49eaa61172d1da4982ebb76bd3e32c4de77cf97dedfb79f18113d7594d0989

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_bg.dll

Filesize
44KB

MD5
c523ec13643d74b187b26b410d39569b

SHA1
46aff0297036c60f22ad30d4e58f429890d9e09d

SHA256
80505863866bcd93a7e617dd8160531401d6d05f48d595348cd321cf7d97aeac

SHA512
ecf98e29a3481b05ab23c3ff89fa3caf054b874ed15462a5e33022aacf561d8fea4a0de35cc5f7450f62110ca4ace613e0c67f543ad22eb417e79eb3ebf24ed7

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_bn.dll

Filesize
44KB

MD5
dafa45a82ce30cf2fd621e0a0b8c031f

SHA1
e39ed5213f9bb02d9da2c889425fab8ca6978db7

SHA256
d58e5f0fa894123de1d9b687a5b84826e095eca128ee5df8870f2db74f4233a2

SHA512
2b772ebc128eb59d636eec36583329962ead8e0a399fd56394b1244486bf815f4e033ceef74a62a9930ab2bf6ec1ba5e2d3c942183f7cb2355a716a3e2c6c7a1

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_ca.dll

Filesize
44KB

MD5
39e25ba8d69f493e6f18c4ef0cf96de8

SHA1
5584a94a85d83514a46030c4165e8f7a942e63e2

SHA256
1f66ebdcaae482a201a6e0fab9c1f4501c23a0d4ad819ccd555fdca9cc7edb94

SHA512
773c995b449d64e36eb8cab174db29e29e29985bcfd714799d6b05b01bb7d4a0fc2aefaf2e27ff02b0e105fbe0d34d7efe29b193a1bc3365ec47e1f1003bed26

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_cs.dll

Filesize
43KB

MD5
b9033db8d0e5bf254979b0f47d10e93d

SHA1
2859de0d851b5f4fd3056e8f9015cece2436c307

SHA256
12c41c2f472b6a05fd6392e9d4f8aeb9a40840c2cbefd68b39d20f9d1d4d77ed

SHA512
52075df4ae5c86ebb0bac20604ea072a163761ae058c1473211bf4bb0eeed043cfc5a92386f876b53484cdf4e3f8a7b75d8f4bf9894c24f8c22ec23a50b70b7c

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_da.dll

Filesize
43KB

MD5
9f2e018a4f9a1d278983d0b677b91218

SHA1
c58ee1fc0d8ef9d99f85426b48c7f28f381a2c17

SHA256
d0dcdc68236eecd6b5f0b437eb92b8935741dabf1fa276a552399815af22edec

SHA512
20b74b6a9f81527d4a5fe30671d2559261fb682576f4ab04da7856280fbbaeb6af83894009c9d7cb83deeae988d0ac5ec7ec32b277b7eb45829faec2857d7014

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_de.dll

Filesize
45KB

MD5
96d92500b9a763f4b862c511c17e0a47

SHA1
2fd441eb8685d15e14fa6405e82359adea3e7148

SHA256
58829d135ff41e574ed5fc5e0421e4aa204267b02ca3ffaf08d8efb0a70fdd4c

SHA512
a1014584f1f278160d579848fa188f627676aee819e9395517490b00e273db6f583d7ddd31af6e35c9d251021df7fb26c88512aaa1c865c2ee3ba60c0a2db49a

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_el.dll

Filesize
44KB

MD5
ecdd26049573614b6f41d8a102ffcf21

SHA1
5140c6cff5d596267a64df1559ac36c4e8f49e42

SHA256
a3377520f2a95b8cc06bd30e493962c07f97eebf4661a69d03efb36b2ca515c5

SHA512
933c181d7575f20480c8deadac3f3e9190081456169122216c72e7b9a04aa75612140fc37697098c7c20b77001a67966fa1661cdc9110c40634c944f833a65b1

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_en-GB.dll

Filesize
42KB

MD5
f82ccf890c3ae14bfd7a263d07276e60

SHA1
6a915d6eb8c99d065e36a721d721d556b74bb377

SHA256
6b07a4fd3039541e30c68a8c31c371cda2cea480787f95e0ddbca3cc2fbff0cc

SHA512
4cbf9e6728e08de8d61f34b17bb20d92b6a699969edb9afa013fe962c8fd39238288adcd826134c9bca459904d8574a804c519daac6b301e0d38f68722c0359e

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_en.dll

Filesize
42KB

MD5
741211652c66a8a6790396e1875eefa9

SHA1
2ccd5653b5fc78bcc19f86b493cef11844ba7a0c

SHA256
e0945deacdb6b75ff2587dea975774b9b800747e2ee3f3917e5b40ddb87eda10

SHA512
b70f847d8ca8828c89bbb67b543950fbd514c733cf62b52ad7fc0dab7b2168fe56d1f21bef3210f5c7f563f72831455d870a5f9aa6c557f1e3543ef7329c42f9

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_es-419.dll

Filesize
43KB

MD5
1c0b1c3625c9ccace1b23e0c64095ee9

SHA1
3904a80d016e0a9a267c0b5feb8e6747b44b5fa1

SHA256
f030757e1911e9efde0d74a02c22694fa5ef139f73897a7f97acab9da05f7c8b

SHA512
0a988edef8d67cd83c2be65cbfa07059df311732ee92ad73fb9411d7cf7d853a2b8d2ab801733d05ab6afaccab33a2684117bbc1d80b362b677cc53ae9de42f0

Download Submit
C:\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_es.dll

Filesize
45KB

MD5
dae64d49ee97339b7327b52c9f720848

SHA1
15f159c4808f9e4fe6a2f1a4a19faa5d84ac630b

SHA256
e76400e62ae0ab31565e50b05d1001b775a91aa487a54dc90e53c0e103c717c2

SHA512
9ae72e5a658aa0e1fb261d62ccef474cd42d9bec2b4a50f71925d131ffea22b8f60fb961772587ce71cb30a32da3b7986e7483ecea960a509e0450d3983c84b0

Download Submit
C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\setup.exe

Filesize
4.7MB

MD5
b42b8ac29ee0a9c3401ac4e7e186282d

SHA1
69dfb1dd33cf845a1358d862eebc4affe7b51223

SHA256
19545e8376807bce8a430c37cab9731e85052103f769dd60a5da3d93ca68c6ec

SHA512
b5269e7392e77a0fa850049ff61e271c5aab90d546945b17a65cc2ea6420432ae56321e1e39cfd97ccdb3dfc37ddbd6ff77907f5685cc2323b8635c8cdb4a84f

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
1009B

MD5
e843f314e5cd07337af81f501690b5d1

SHA1
bf1910991713867980676e9f21e1d3bd4e1ee5a8

SHA256
9bb70017bed3e63e6cd2b26a145589671c74200135dad03776803e1b12032bfa

SHA512
55c8c68986135d05d2f7ecd0a6c3282f85e601e5fd6a6359e8f1d4c0846df31b5cecd022a23cbe42306e02419ca6ebb3dc420bfce68ae00df5cee2740c738450

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
266B

MD5
6572ab0db2ece19fa172c89d03a7436a

SHA1
c985c1a9b4d958edefaf362e99b4e4962df567d7

SHA256
2c179e8eea79e4d3e768ae5d82ed5cf6624401e09163222990d5da4ee4c6af2a

SHA512
75f9e9d2d3007deb659fa5f59744dcda943e055694007f2c7ddcce788f1b49bf9c24a80bfa5d29004798d1dcdf568306384ffd63604c1ba69d3e23d6b3d8fedb

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
613B

MD5
b3f5aaa10894d4acb20db98bc00e6567

SHA1
02e24e5ec5ffc7bd3dbec11ffcadb005f0899eef

SHA256
627f9265f66291e4a9f520cc5a25d147194e37576880c4ecbab8b842cf706fdd

SHA512
bc747bac6a40d447d6b7cfa1d62a3f29f9ebc776d20ec56f0bf6013058b6a70cc8eff860820eff65ce9dcf9296049359f66a452c267968235a720bf1b11f4d97

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
769B

MD5
2d3da16d101b04a7a8e52cc9d3b1a883

SHA1
10c878ebe4aaa07bbce27961a6942d71c5e48b7e

SHA256
699f1da1f4c777430b78c639a37716f3e35fea9f4cfa8f84057936381df8cae8

SHA512
f58aac50fcdc2430bd64891c95dd99c008fd9a2c5a557e25a563eb7e14fb03fcbc2ecb31ac84453497eef1846dc01726b16aaf9efcb73eee922d3121d508973d

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
935B

MD5
6285a7408f3576da37689c7c85af9eb4

SHA1
1703863ae886596eaa5b8feb94ca0138b4829d57

SHA256
bd16125339b9ba6642895fad790da3877f268c92b294ee31c7d61d867892b489

SHA512
342900c19754a9d61c8dc2fa5d0b6d23919d2de1a8d27c91a0de624ca2ede21061371fba33cb1eb9de5128f170bfd0d450063f379f559463915aaafc8a8ad3a8

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.xml

Filesize
298B

MD5
2c706293a3cfff8cc184a8e9a3b3da08

SHA1
873d7c9f51aa6cebd4ad3ae5930d1de84bb4437d

SHA256
ed28baf8be3a588d50ed246c2cd741bbd498aee74ea0675d57e0b33236e22067

SHA512
4aba3e25507ba5c29219ff51553f3616d07aeeb30f7465f9e921eea94cdcb411d1f48d1eefed647c22405df275e7f9d7506aac52202aae137391c6831463b043

Download Submit
C:\ProgramData\Smart\setup.exe

Filesize
4.7MB

MD5
1fc06b4e65235d61020b7b043a493dd8

SHA1
de3c5bc49a095ed4d776f46393fc91d933e08b14

SHA256
4011ba0b6c30b4fbf007384e5535edbcf029aad8b8ac8fee792332d2520c97db

SHA512
01881b52a925888d2772c9b6d5ccaa7b411018fd35cb369a69d7fef4eb4a5f21cf89a6dea05ab946e8b0694963aaafbbb1ead21338180bbe9b4853c585909dfa

Download Submit
C:\ProgramData\setup\ddd

Filesize
10.7MB

MD5
7bd4f627460b430c303b124e51f36d77

SHA1
7962983399c083c206eef52fa185a864a6081c71

SHA256
2e4f52f7d0d858399509d3184550f72ede2a1fbb0b248dff8faaa0450a1d30ec

SHA512
c4021daacf909b7d5c96a0d1584ef187231616bcaff646bbb34572be157b3e9a91c765f88d85c17e2d320e24c2d75f2ec09e2a18a68073a4d08befb27880c3f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0c5a932e-2f79-477d-ade9-ac72c81a26a4.tmp

Filesize
12KB

MD5
f9e2f2a2d10a53c7548831299e945815

SHA1
eae501f8f60562f1cf3e0df070669d5ab0da8683

SHA256
cd0d12908afb712577365c4cf6d19638484928d6ae59d563942a36f6860cca2d

SHA512
47f1ff83f64d855fd48223b6223168a99e3718ae92615d6c2ea039f72fd4262173bf71b701c5832eee9c784983c9b9fcb406ff16dc2ac329ba80c820d936a72d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\CURRENT~RFf77eb1a.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json

Filesize
593B

MD5
91f5bc87fd478a007ec68c4e8adf11ac

SHA1
d07dd49e4ef3b36dad7d038b7e999ae850c5bef6

SHA256
92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9

SHA512
fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c1be568e2e6b3cabda0976cc53234e9a

SHA1
f4f135e48deff85eef2da88cd590aedb7fb00b52

SHA256
5a3c405fd6e82506e7b1b1d312b877b66834d19309e76cb63e4e60bd0c275922

SHA512
8c8d02046ddf1a454df11a40fcc84e3d800ea133310e00010ef6139f79c898454ba1c8671d5eab498ba596a8addc15ce2d5422f4a1e6305bcd5c6568da3aff66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b161cbc7279ce5fc6e8e49d1d50ef031

SHA1
2eb07765274856bc5681554b82d19fac1e85f623

SHA256
ee8585f0f6bbc227916cda74f029eb046f78f6cfc3ae5455e08e6cd32cc564ea

SHA512
7563d97e28acaee09824d7f4c84310f104bacc5ae3ec67cb600ce10ef916fd8c0a9d31ddf75e4c0f9842e234df70d65b08325944f490153c2fb9e3146fedc3e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
168KB

MD5
1ba19264709a9103f9c67b0aa0bf3696

SHA1
ee758a04c1c99da881b9deb0cc5cb74290909066

SHA256
8e36f20565af0c313425e31e750cfb918b646c9193268e45f24e4fbc16b6d6b9

SHA512
d9d7f769c085b3c745aa7481467357d946b7d80d1de12345b71ddf53c093d3b94e4ee4c34d7ffcdb53c78822840e09315e375f02cdd371761d85c45e6b381313

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
344KB

MD5
61116b49358015229823549bee327db4

SHA1
8319dcd77b0cd37dfc4b64c2818d640f426adc4a

SHA256
e00c53027942ddfc360730f194e69a0ec7837bf5481b8fc4d5f5008cfea77693

SHA512
4ee231bb0d8a9f49b2e7a7a18332160e187bc7cfdc30ece4a40080e6108a3456fda61337ded5c80364a05ee54ac50f12edd2d8bbdcbb6d2b624c8719837b9560

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1884_1672685382\CRX_INSTALL\_locales\en\messages.json

Filesize
450B

MD5
dbedf86fa9afb3a23dbb126674f166d2

SHA1
5628affbcf6f897b9d7fd9c17deb9aa75036f1cc

SHA256
c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe

SHA512
931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1884_1672685382\d8fb1e5b-d41e-4bc2-b420-22a61c808dec.tmp

Filesize
242KB

MD5
541f52e24fe1ef9f8e12377a6ccae0c0

SHA1
189898bb2dcae7d5a6057bc2d98b8b450afaebb6

SHA256
81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82

SHA512
d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88

Download Submit
C:\Windows\Installer\MSIF41F.tmp

Filesize
587KB

MD5
c7fbd5ee98e32a77edf1156db3fca622

SHA1
3e534fc55882e9fb940c9ae81e6f8a92a07125a0

SHA256
e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6

SHA512
8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

Download Submit
C:\Windows\Installer\MSIF51A.tmp

Filesize
1.1MB

MD5
ae463676775a1dd0b7a28ddb265b4065

SHA1
dff64c17885c7628b22631a2cdc9da83e417d348

SHA256
83fbfcaff3da3eb89f9aec29e6574cf15502fd670cbb2ab0c8a84451b2598b22

SHA512
e47c2db249e7a08c5d2864671fbc235e48aebecbe0b2c2334d1a4cba1b5b3037522ff89408589f3559b3a1eaf507bd338645387d55800029bb3b941d4c7744d6

Download Submit
\Program Files (x86)\Google\Temp\GUM201F.tmp\GoogleUpdate.exe

Filesize
158KB

MD5
cdf152e23a8cbf68dbe3f419701244fc

SHA1
cb850d3675da418131d90ab01320e4e8842228d7

SHA256
84eaf43f33d95da9ab310fc36dc3cfe53823d2220946f021f18cf3f729b8d64e

SHA512
863e1da5bc779fa02cf08587c4de5f04c56e02902c5c4f92a06f2e631380ecabcc98e35d52609f764727e41b965c0786d24ea23fc4b9776d24d9f13e0d8ae0c2

Download Submit
\Program Files (x86)\Google\Temp\GUM201F.tmp\goopdateres_zh-CN.dll

Filesize
37KB

MD5
ca52cc49599bb6bda28c38aea1f9ec4e

SHA1
494f166b530444f39bca27e2b9e10f27e34fc98a

SHA256
f9f144aa2dc0de21b24c93f498a9b4a946b7da42819a776b3283a0bcae18544b

SHA512
05e2d5711eef8f57737b2512de2e73744f17e0a34de0bfd2a06c9cc60a08ebadbafe38e30b66a2ede7fa61d5b9571adddcfbd7e1cafcee1ab2168a563d2d3f0d

Download Submit
\ProgramData\Packas\scrok.exe

Filesize
2.7MB

MD5
d07123bd407bf34ee3ce91b5fdb10db1

SHA1
d8a7c620adf407edfd03053b89051d6aabbbf6d5

SHA256
519f752759e93f2be905670b115b522cb6e770c1577082a11eaacfd397ac65fb

SHA512
74305dc3d99d2a19f5999905090beb274e97c0f1367fb109e54ad44567da774c079842e08ccd8748d5c1ecd114b87523c4778766207b231e726c3f6460690daa

Download Submit
\ProgramData\setup\aa.exe

Filesize
1.0MB

MD5
09c448be7e7d84e6e544cc03afbb05d8

SHA1
ddc13e71a72bc49c60f89b98cbb79c2449cfa07e

SHA256
a0f127a70943b0262060498c1723c795a8e2980f1acf0c42ee8c1dae72ae54b5

SHA512
e5f7a988a999e7e34d0aa2d2a5b2fbb22689588d3def4bed4518ceed38710e3714c5614bab192b0ce6bcac5172a87ebf3b3b923e495eb7344c70bd11f4bf1c12

Download Submit
\ProgramData\setup\setup.exe

Filesize
1.3MB

MD5
4a94844260d6a08828d781d488cef61d

SHA1
de8169fdb5ab8a120df577d92eb25a2767431738

SHA256
46d7a8abe3bb9d7302529246cd8ee6e7d0360d1045fe92662cc7580e72ef5132

SHA512
82549c1e525a90003fb0174ebba2bc3b4f58706ef9fd5e6ee07d489ab536ef286e408db6c15a52b039d3f59c09bd55e35d045def79007da5d414d5d589d34f4f

Download Submit
memory/612-69-0x00000000003D0000-0x00000000003F9000-memory.dmp

Filesize
164KB

Download
memory/940-126-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/940-124-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/940-129-0x0000000000400000-0x0000000000B9E000-memory.dmp

Filesize
7.6MB

Download
memory/940-128-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/972-370-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/1528-115-0x000000013F100000-0x000000013F6AF000-memory.dmp

Filesize
5.7MB

Download
memory/1528-114-0x00000000773F0000-0x00000000773F2000-memory.dmp

Filesize
8KB

Download
memory/1664-75-0x0000000000EE0000-0x0000000000FB6000-memory.dmp

Filesize
856KB

Download
memory/2308-368-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/2892-366-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/2892-372-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2912-56-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/3024-65-0x00000000773F0000-0x00000000773F2000-memory.dmp

Filesize
8KB

Download
memory/3024-66-0x000000013F1A0000-0x000000013F74F000-memory.dmp

Filesize
5.7MB

Download
memory/3024-61-0x00000000773F0000-0x00000000773F2000-memory.dmp

Filesize
8KB

Download
memory/3024-63-0x00000000773F0000-0x00000000773F2000-memory.dmp

Filesize
8KB

Download