blackmoon | ce2075f76a21e2a535681e2ad09c4d4d646e600e0491bb4f3725f6e0634fdab7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chromestup.msi
Size

14.5MB
MD5

d2f1ff0fca1a5d50f371b849df0ff604
SHA1

edcc7fce9a61e3ca13a87c694a50d9810f83e89b
SHA256

f71845af2465c505c857f622e78e266553c1f0a578c321cca70eca0d676e3512
SHA512

3e1a7c1eee079b0094a42e6fd00d9b896798d7d535f21fc79254c489c0f8323a7d5ecf75b66556e2a3f9d7f2fc6ec689bcb8c1a1dfb829f07afecad37175dd7a
SSDEEP

393216:6BfMD+F9vscR4cMMmYCb1HvXODuuXPfott+I5MF9:uMdcMTb1Hv+CuXPw8I5g9

Score

10^/10

blackmoon fatalrat banker discovery infostealer persistence privilege_escalation rat spyware stealer trojan vmprotect

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/3248-118-0x0000000000400000-0x0000000000B9E000-memory.dmp	family_blackmoon

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
stealer trojan fatalrat
Fatalrat family
fatalrat

Fatal Rat payload 2 IoCs

rat infostealer

resource	yara_rule
behavioral2/memory/5996-207-0x0000000010000000-0x000000001002D000-memory.dmp	fatalrat
behavioral2/memory/1104-377-0x0000000010000000-0x000000001002D000-memory.dmp	fatalrat

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x00080000000242af-68.dat	vmprotect
behavioral2/memory/504-71-0x00007FF760760000-0x00007FF760D0F000-memory.dmp	vmprotect
behavioral2/files/0x00090000000242ba-112.dat	vmprotect
behavioral2/memory/3120-114-0x00007FF760760000-0x00007FF760D0F000-memory.dmp	vmprotect
behavioral2/memory/3248-118-0x0000000000400000-0x0000000000B9E000-memory.dmp	vmprotect

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\134.0.6998.178\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	GoogleUpdate.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TjNkNpAilaYvt.exe.log	TjNkNpAilaYvt.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\Locales\af.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\VisualElements\LogoBeta.png	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\_locales\sw\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\_locales\sl\messages.json	chrome.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_fil.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_iw.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\Locales\he.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\resources.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\chrome_elf.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\chrome_wer.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\vulkan-1.dll	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\_locales\mr\messages.json	chrome.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\psuser.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_fr.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_hu.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_sw.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\Locales\sw.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\chrome.exe.sig	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\_locales\km\messages.json	chrome.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_gu.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_is.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_pt-BR.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\Locales\bn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\Locales\es-419.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\Locales\es.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\Locales\lt.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\_locales\af\messages.json	chrome.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_ar.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_kn.dll	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\_locales\de\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\_locales\ko\messages.json	chrome.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_sv.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\134.0.6998.178_chrome_installer.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\Locales\it.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\Locales\mr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_fi.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_pl.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files\chrome_installer.log	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\_locales\is\messages.json	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\Locales\ms.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_en.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_te.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\CR_FD1D5.tmp\setup.exe	134.0.6998.178_chrome_installer.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\_locales\ka\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\_locales\et\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\_locales\gl\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\_locales\ne\messages.json	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\Locales\de.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\134.0.6998.178\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source532_1451456554\Chrome-bin\chrome_proxy.exe	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\manifest.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\_locales\my\messages.json	chrome.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\GoogleUpdateOnDemand.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_it.dll	setup.exe
File created	C:\Program Files\chrome_url_fetcher_4336_2015640597\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4336_478076035\_locales\kn\messages.json	chrome.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_ja.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_ms.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_pt-PT.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_ta.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ca.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_de.dll	GoogleUpdate.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIABF4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC05.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DBB56E52-B2C8-4BD0-96DC-EE1D75DE3BAC}	msiexec.exe
File created	C:\Windows\Installer\e57a827.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57a827.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA3C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAABA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB28.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACB2.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA875.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9AE.tmp	msiexec.exe

Executes dropped EXE 50 IoCs

pid	Process
704	aa.exe
504	scrok.exe
5024	TjNkNpAilaYvt.exe
2488	TjNkNpAilaYvt.exe
1960	TjNkNpAilaYvt.exe
632	TjNkNpAilaYvt.exe
3120	scrok.exe
3248	setup.exe
5128	setup.exe
5996	svchost.exe
3060	svchost.exe
1104	svchost.exe
5916	GoogleUpdate.exe
5752	GoogleUpdate.exe
1332	GoogleUpdate.exe
3856	GoogleUpdateComRegisterShell64.exe
2744	GoogleUpdateComRegisterShell64.exe
2600	GoogleUpdateComRegisterShell64.exe
2784	GoogleUpdate.exe
5644	GoogleUpdate.exe
4908	GoogleUpdate.exe
2748	134.0.6998.178_chrome_installer.exe
532	setup.exe
3776	setup.exe
644	setup.exe
5628	setup.exe
216	GoogleCrashHandler.exe
1348	GoogleCrashHandler64.exe
4292	GoogleUpdate.exe
1264	GoogleUpdateOnDemand.exe
5396	GoogleUpdate.exe
4336	chrome.exe
1628	chrome.exe
4296	chrome.exe
6016	chrome.exe
4016	chrome.exe
1284	chrome.exe
6004	chrome.exe
440	elevation_service.exe
3572	chrome.exe
3104	chrome.exe
612	chrome.exe
1300	chrome.exe
408	chrome.exe
2632	chrome.exe
4332	chrome.exe
4892	chrome.exe
988	chrome.exe
5924	chrome.exe
2764	chrome.exe

Loads dropped DLL 64 IoCs

pid	Process
2004	MsiExec.exe
2004	MsiExec.exe
2004	MsiExec.exe
2004	MsiExec.exe
2004	MsiExec.exe
2004	MsiExec.exe
2004	MsiExec.exe
5916	GoogleUpdate.exe
5752	GoogleUpdate.exe
1332	GoogleUpdate.exe
3856	GoogleUpdateComRegisterShell64.exe
1332	GoogleUpdate.exe
2744	GoogleUpdateComRegisterShell64.exe
1332	GoogleUpdate.exe
2600	GoogleUpdateComRegisterShell64.exe
1332	GoogleUpdate.exe
2784	GoogleUpdate.exe
5644	GoogleUpdate.exe
4908	GoogleUpdate.exe
4908	GoogleUpdate.exe
5644	GoogleUpdate.exe
4292	GoogleUpdate.exe
5396	GoogleUpdate.exe
5396	GoogleUpdate.exe
4336	chrome.exe
1628	chrome.exe
4336	chrome.exe
4296	chrome.exe
4296	chrome.exe
6016	chrome.exe
6016	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4016	chrome.exe
4016	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
1284	chrome.exe
6004	chrome.exe
6004	chrome.exe
3572	chrome.exe
3572	chrome.exe
3104	chrome.exe
3104	chrome.exe
1300	chrome.exe
1300	chrome.exe
612	chrome.exe
612	chrome.exe
408	chrome.exe
408	chrome.exe
2632	chrome.exe
2632	chrome.exe
4332	chrome.exe
4332	chrome.exe
4892	chrome.exe
988	chrome.exe
4892	chrome.exe
988	chrome.exe
5924	chrome.exe
5924	chrome.exe
2764	chrome.exe
2764	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5992	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleCrashHandler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdateOnDemand.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2784	GoogleUpdate.exe
4292	GoogleUpdate.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005c00d8281e7515450000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005c00d8280000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809005c00d828000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5c00d828000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005c00d82800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2928	timeout.exe
2724	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Group = "Fatal"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876271284112973"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\InstallTime = "2025-03-28 09:17"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\GoogleUpdateBroker.exe\""	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\GoogleUpdateOnDemand.exe\""	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods\ = "41"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ = "ICoCreateAsync"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\NumMethods\ = "16"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachine\CurVer\ = "GoogleUpdate.PolicyStatusMachine.1.0"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusSvc.1.0\CLSID\ = "{1C4CDEFF-756A-4804-9E77-3E8EB9361016}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ = "IJobObserver"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ = "IJobObserver"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ = "IAppCommand"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.shtml\OpenWithProgids\ChromeHTML	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ServiceParameters = "/comsvc"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.webp\OpenWithProgids\ChromeHTML	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService.1.0\CLSID\ = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ = "IAppVersionWeb"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.ProcessLauncher\CurVer\ = "GoogleUpdate.ProcessLauncher.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E}\InprocHandler32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML\Application\ApplicationName = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusSvc\CurVer\ = "GoogleUpdate.PolicyStatusSvc.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\CLSID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc.1.0\ = "Google Update Legacy On Demand"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\ = "CoCreateAsync"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ = "IGoogleUpdate3Web"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachineFallback	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachineFallback\CLSID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ = "IGoogleUpdate3"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods	GoogleUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4916	msiexec.exe
4916	msiexec.exe
504	scrok.exe
504	scrok.exe
504	scrok.exe
504	scrok.exe
632	TjNkNpAilaYvt.exe
632	TjNkNpAilaYvt.exe
3120	scrok.exe
3120	scrok.exe
3120	scrok.exe
3120	scrok.exe
3248	setup.exe
3248	setup.exe
5916	GoogleUpdate.exe
5916	GoogleUpdate.exe
5916	GoogleUpdate.exe
5916	GoogleUpdate.exe
5916	GoogleUpdate.exe
5916	GoogleUpdate.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe
5996	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5992	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5992	msiexec.exe
Token: SeSecurityPrivilege	4916	msiexec.exe
Token: SeCreateTokenPrivilege	5992	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5992	msiexec.exe
Token: SeLockMemoryPrivilege	5992	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5992	msiexec.exe
Token: SeMachineAccountPrivilege	5992	msiexec.exe
Token: SeTcbPrivilege	5992	msiexec.exe
Token: SeSecurityPrivilege	5992	msiexec.exe
Token: SeTakeOwnershipPrivilege	5992	msiexec.exe
Token: SeLoadDriverPrivilege	5992	msiexec.exe
Token: SeSystemProfilePrivilege	5992	msiexec.exe
Token: SeSystemtimePrivilege	5992	msiexec.exe
Token: SeProfSingleProcessPrivilege	5992	msiexec.exe
Token: SeIncBasePriorityPrivilege	5992	msiexec.exe
Token: SeCreatePagefilePrivilege	5992	msiexec.exe
Token: SeCreatePermanentPrivilege	5992	msiexec.exe
Token: SeBackupPrivilege	5992	msiexec.exe
Token: SeRestorePrivilege	5992	msiexec.exe
Token: SeShutdownPrivilege	5992	msiexec.exe
Token: SeDebugPrivilege	5992	msiexec.exe
Token: SeAuditPrivilege	5992	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5992	msiexec.exe
Token: SeChangeNotifyPrivilege	5992	msiexec.exe
Token: SeRemoteShutdownPrivilege	5992	msiexec.exe
Token: SeUndockPrivilege	5992	msiexec.exe
Token: SeSyncAgentPrivilege	5992	msiexec.exe
Token: SeEnableDelegationPrivilege	5992	msiexec.exe
Token: SeManageVolumePrivilege	5992	msiexec.exe
Token: SeImpersonatePrivilege	5992	msiexec.exe
Token: SeCreateGlobalPrivilege	5992	msiexec.exe
Token: SeBackupPrivilege	60	vssvc.exe
Token: SeRestorePrivilege	60	vssvc.exe
Token: SeAuditPrivilege	60	vssvc.exe
Token: SeBackupPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeBackupPrivilege	6032	srtasks.exe
Token: SeRestorePrivilege	6032	srtasks.exe
Token: SeSecurityPrivilege	6032	srtasks.exe
Token: SeTakeOwnershipPrivilege	6032	srtasks.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeBackupPrivilege	6032	srtasks.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
5992	msiexec.exe
5992	msiexec.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3248	setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 6032	4916	msiexec.exe	100
PID 4916 wrote to memory of 6032	4916	msiexec.exe	100
PID 4916 wrote to memory of 2004	4916	msiexec.exe	102
PID 4916 wrote to memory of 2004	4916	msiexec.exe	102
PID 4916 wrote to memory of 2004	4916	msiexec.exe	102
PID 2004 wrote to memory of 3368	2004	MsiExec.exe	103
PID 2004 wrote to memory of 3368	2004	MsiExec.exe	103
PID 2004 wrote to memory of 3368	2004	MsiExec.exe	103
PID 3368 wrote to memory of 2928	3368	cmd.exe	105
PID 3368 wrote to memory of 2928	3368	cmd.exe	105
PID 3368 wrote to memory of 2928	3368	cmd.exe	105
PID 3368 wrote to memory of 704	3368	cmd.exe	106
PID 3368 wrote to memory of 704	3368	cmd.exe	106
PID 3368 wrote to memory of 704	3368	cmd.exe	106
PID 3368 wrote to memory of 504	3368	cmd.exe	107
PID 3368 wrote to memory of 504	3368	cmd.exe	107
PID 504 wrote to memory of 764	504	scrok.exe	8
PID 504 wrote to memory of 764	504	scrok.exe	8
PID 504 wrote to memory of 764	504	scrok.exe	8
PID 3368 wrote to memory of 5024	3368	cmd.exe	108
PID 3368 wrote to memory of 5024	3368	cmd.exe	108
PID 3368 wrote to memory of 2488	3368	cmd.exe	109
PID 3368 wrote to memory of 2488	3368	cmd.exe	109
PID 3368 wrote to memory of 2724	3368	cmd.exe	110
PID 3368 wrote to memory of 2724	3368	cmd.exe	110
PID 3368 wrote to memory of 2724	3368	cmd.exe	110
PID 3368 wrote to memory of 1960	3368	cmd.exe	111
PID 3368 wrote to memory of 1960	3368	cmd.exe	111
PID 3368 wrote to memory of 3120	3368	cmd.exe	113
PID 3368 wrote to memory of 3120	3368	cmd.exe	113
PID 632 wrote to memory of 3248	632	TjNkNpAilaYvt.exe	114
PID 632 wrote to memory of 3248	632	TjNkNpAilaYvt.exe	114
PID 632 wrote to memory of 3248	632	TjNkNpAilaYvt.exe	114
PID 3120 wrote to memory of 764	3120	scrok.exe	8
PID 3120 wrote to memory of 764	3120	scrok.exe	8
PID 3120 wrote to memory of 764	3120	scrok.exe	8
PID 3368 wrote to memory of 5128	3368	cmd.exe	115
PID 3368 wrote to memory of 5128	3368	cmd.exe	115
PID 3368 wrote to memory of 5128	3368	cmd.exe	115
PID 3248 wrote to memory of 1104	3248	setup.exe	116
PID 3248 wrote to memory of 1104	3248	setup.exe	116
PID 3248 wrote to memory of 1104	3248	setup.exe	116
PID 3248 wrote to memory of 5996	3248	setup.exe	117
PID 3248 wrote to memory of 5996	3248	setup.exe	117
PID 3248 wrote to memory of 5996	3248	setup.exe	117
PID 3248 wrote to memory of 3060	3248	setup.exe	118
PID 3248 wrote to memory of 3060	3248	setup.exe	118
PID 3248 wrote to memory of 3060	3248	setup.exe	118
PID 5128 wrote to memory of 5916	5128	setup.exe	119
PID 5128 wrote to memory of 5916	5128	setup.exe	119
PID 5128 wrote to memory of 5916	5128	setup.exe	119
PID 5916 wrote to memory of 5752	5916	GoogleUpdate.exe	120
PID 5916 wrote to memory of 5752	5916	GoogleUpdate.exe	120
PID 5916 wrote to memory of 5752	5916	GoogleUpdate.exe	120
PID 5916 wrote to memory of 1332	5916	GoogleUpdate.exe	121
PID 5916 wrote to memory of 1332	5916	GoogleUpdate.exe	121
PID 5916 wrote to memory of 1332	5916	GoogleUpdate.exe	121
PID 1332 wrote to memory of 3856	1332	GoogleUpdate.exe	122
PID 1332 wrote to memory of 3856	1332	GoogleUpdate.exe	122
PID 1332 wrote to memory of 2744	1332	GoogleUpdate.exe	123
PID 1332 wrote to memory of 2744	1332	GoogleUpdate.exe	123
PID 1332 wrote to memory of 2600	1332	GoogleUpdate.exe	124
PID 1332 wrote to memory of 2600	1332	GoogleUpdate.exe	124
PID 5916 wrote to memory of 2784	5916	GoogleUpdate.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:764
- C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe" -Embedding
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1264
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
      4⤵
      Checks computer location settings
      Checks system information in the registry
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4336
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=134.0.6998.178 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffae85f6f38,0x7ffae85f6f44,0x7ffae85f6f50
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1628
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1988 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4296
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2220 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6016
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2344 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4016
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3204 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1284
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6004
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3848 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3104
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3892 /prefetch:2
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3572
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4380 /prefetch:2
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:612
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1300
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5440 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:408
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5776 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2632
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5760 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4332
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3904 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4892
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6012 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:988
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4164 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1992,i,8390681455360756133,13044292139096823030,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4452 /prefetch:2
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2764

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Chromestup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5992

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6032
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 72C9F416226FF5FDEDC73C2F1381C24C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /c timeout /nobreak /t 7 & C:\ProgramData\setup\aa.exe x C:\ProgramData\setup\ddd. -key 000000 -f -to C:\ProgramData & C:\ProgramData\Packas\scrok.exe & C:\ProgramData\Smart\TjNkNpAilaYvt.exe install & C:\ProgramData\Smart\TjNkNpAilaYvt.exe install & timeout /nobreak /t 2 & C:\ProgramData\Smart\TjNkNpAilaYvt.exe start & C:\ProgramData\Packas\scrok.exe & del C:\ProgramData\Packas\scrok.exe & C:\ProgramData\setup\setup.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /nobreak /t 7
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2928
  - - C:\ProgramData\setup\aa.exe
      C:\ProgramData\setup\aa.exe x C:\ProgramData\setup\ddd. -key 000000 -f -to C:\ProgramData
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:704
  - - C:\ProgramData\Packas\scrok.exe
      C:\ProgramData\Packas\scrok.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:504
  - - C:\ProgramData\Smart\TjNkNpAilaYvt.exe
      C:\ProgramData\Smart\TjNkNpAilaYvt.exe install
      4⤵
      Executes dropped EXE
      PID:5024
  - - C:\ProgramData\Smart\TjNkNpAilaYvt.exe
      C:\ProgramData\Smart\TjNkNpAilaYvt.exe install
      4⤵
      Executes dropped EXE
      PID:2488
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /nobreak /t 2
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2724
  - - C:\ProgramData\Smart\TjNkNpAilaYvt.exe
      C:\ProgramData\Smart\TjNkNpAilaYvt.exe start
      4⤵
      Executes dropped EXE
      PID:1960
  - - C:\ProgramData\Packas\scrok.exe
      C:\ProgramData\Packas\scrok.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3120
  - - C:\ProgramData\setup\setup.exe
      C:\ProgramData\setup\setup.exe
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5128
    - - C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9F0C1F44-1C50-396A-483A-08DA4896FF0B}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5916
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5752
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1332
        
        C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3856
        
        C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2744
        
        C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2600
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDJFNjQxMkItOEJFMi00NjU1LTkzREItQUJFNEU1RDFCOTRCfSIgdXNlcmlkPSJ7QzNGMURCNzEtODFDQi00NUExLUEyQTctNDA1MjY0MTAyQUE0fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezU5MzMyODM3LTNENDEtNDdENi04REE5LUI3QjczNDRGMzMzQX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjEzNC4wLjY5ODUuMCIgbmV4dHZlcnNpb249IjEuMy4zNi4zMTIiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7OUYwQzFGNDQtMUM1MC0zOTZBLTQ4M0EtMDhEQTQ4OTZGRjBCfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI4NDQiLz48L2FwcD48L3JlcXVlc3Q-
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2784
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={9F0C1F44-1C50-396A-483A-08DA4896FF0B}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{D2E6412B-8BE2-4655-93DB-ABE4E5D1B94B}"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5644

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:60

C:\ProgramData\Smart\TjNkNpAilaYvt.exe
"C:\ProgramData\Smart\TjNkNpAilaYvt.exe"
1⤵
- Drops file in System32 directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:632
- C:\ProgramData\Smart\setup.exe
  "C:\ProgramData\Smart\setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\ProgramData\NVIDIARV\svchost.exe
    "C:\ProgramData\NVIDIARV\svchost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1104
- - C:\ProgramData\NVIDIARV\svchost.exe
    "C:\ProgramData\NVIDIARV\svchost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5996
- - C:\ProgramData\NVIDIARV\svchost.exe
    "C:\ProgramData\NVIDIARV\svchost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3060

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4908
- C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\134.0.6998.178_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\134.0.6998.178_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\gui298E.tmp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:2748
- - C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\CR_FD1D5.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\CR_FD1D5.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\CR_FD1D5.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\gui298E.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Modifies registry class
    PID:532
  - - C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\CR_FD1D5.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\CR_FD1D5.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=134.0.6998.178 --initial-client-data=0x268,0x26c,0x270,0x240,0x274,0x7ff7b25c9ed8,0x7ff7b25c9ee4,0x7ff7b25c9ef0
      4⤵
      Executes dropped EXE
      PID:3776
  - - C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\CR_FD1D5.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\CR_FD1D5.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:644
    - - C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\CR_FD1D5.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{8017545B-5D6A-4F8A-BEA4-591ABD5301CB}\CR_FD1D5.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=134.0.6998.178 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7b25c9ed8,0x7ff7b25c9ee4,0x7ff7b25c9ef0
        5⤵
        Executes dropped EXE
        
        PID:5628
- C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:216
- C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDJFNjQxMkItOEJFMi00NjU1LTkzREItQUJFNEU1RDFCOTRCfSIgdXNlcmlkPSJ7QzNGMURCNzEtODFDQi00NUExLUEyQTctNDA1MjY0MTAyQUE0fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezQ5RTFFNTgwLTA4NzEtNDcwNS1BQjI5LUNBNzk1M0Y2NTc4Q30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzQy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEzNC4wLjY5OTguMTc4IiBhcD0ieDY0LXN0YWJsZS1zdGF0c2RlZl8xIiBsYW5nPSJ6aC1DTiIgYnJhbmQ9IiIgY2xpZW50PSIiIGlpZD0iezlGMEMxRjQ0LTFDNTAtMzk2QS00ODNBLTA4REE0ODk2RkYwQn0iIGNvaG9ydD0iMTpndS9pMTk6IiBjb2hvcnRuYW1lPSJTdGFibGUgSW5zdGFsbHMgJmFtcDsgVmVyc2lvbiBQaW5zIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL21xd3ZtczJ3czJudTdnbXQ2amQzb2Z4cDd1XzEzNC4wLjY5OTguMTc4LzEzNC4wLjY5OTguMTc4X2Nocm9tZV9pbnN0YWxsZXIuZXhlIiBkb3dubG9hZGVkPSIxMTk5OTQ3MzYiIHRvdGFsPSIxMTk5OTQ3MzYiIGRvd25sb2FkX3RpbWVfbXM9Ijk1MTUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjEzNDQiIGRvd25sb2FkX3RpbWVfbXM9IjEwNTc4IiBkb3dubG9hZGVkPSIxMTk5OTQ3MzYiIHRvdGFsPSIxMTk5OTQ3MzYiIGluc3RhbGxfdGltZV9tcz0iMjk1NzgiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4292

C:\Program Files\Google\Chrome\Application\134.0.6998.178\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\134.0.6998.178\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57a82a.rbs

Filesize
1KB

MD5
9d6dd7622da5e14bc9239bbda6cb1f47

SHA1
01a42e9c4ac802e2a4d95b25394fa7dde8b267a4

SHA256
15ccc58b04e46cc9821cc178593d27dff68d316bcd73119e1aebdd4fd6abcc45

SHA512
8d40dd71d6cdc7c54f6ecdd63ac3cd735a49d327725a0947dd4f4535b8b33731fedaf764db5adf6444bcb79123c4875e2211828c35d63f6afb3d9f5d96cfeb61

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\GoogleCrashHandler.exe

Filesize
294KB

MD5
a11ce10ac47f5f83b9bc980567331a1b

SHA1
63ee42e347b0328f8d71a3aa4dde4c6dc46da726

SHA256
101dbf984c4b3876defe2699d6160acbf1bb3f213e02a32f08fdcdc06821c542

SHA512
ff2f86c4061188ead1bfeebd36de7dbc312adcc95267537697f2bfcbb0c53e7c4ab0cd268cef22f0182391796c4612c97cbdc1266d9ee1960cdd2610d8c2bcb3

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\GoogleCrashHandler64.exe

Filesize
392KB

MD5
b659663611a4c2216dff5ab1b60dd089

SHA1
9a14392a5bdb9ea6b8c3e60224b7ff37091d48b5

SHA256
cad4aa1cf58f6b2e2aceb789d53b18418e67066ec406b2fac786cb845ef89d2b

SHA512
1065f9072cd6f1f4364f1354108f2647ee1d89f87e908a22fcd63bd3149c864c457e62268067a439d0486d8d4aa150aa984ad8ac8b51cae49014b67b80496040

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\GoogleUpdate.exe

Filesize
158KB

MD5
cdf152e23a8cbf68dbe3f419701244fc

SHA1
cb850d3675da418131d90ab01320e4e8842228d7

SHA256
84eaf43f33d95da9ab310fc36dc3cfe53823d2220946f021f18cf3f729b8d64e

SHA512
863e1da5bc779fa02cf08587c4de5f04c56e02902c5c4f92a06f2e631380ecabcc98e35d52609f764727e41b965c0786d24ea23fc4b9776d24d9f13e0d8ae0c2

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\GoogleUpdateComRegisterShell64.exe

Filesize
181KB

MD5
be535d8b68dd064442f73211466e5987

SHA1
aa49313d9513fd9c2d2b25da09ea24d09cc03435

SHA256
c109bcb63391ac3ea93fb97fbdf3f6ed71316cacb592ef46efaea0024bc9ed59

SHA512
eb50eebeaf83be10aea8088e35a807f9001d07d17d2bc1655c3bc0cb254d0f54303348988514ba5590ebd9d3bde3f1149c3f700f62fbce63c0199ea3cfb1f638

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\GoogleUpdateCore.exe

Filesize
217KB

MD5
af51ea4d9828e21f72e935b0deae50f2

SHA1
c7fe57c2a16c9f5a5ebdd3cc0910427cba5308bd

SHA256
3575011873d0f6d49c783095dae06e6619f8f5463da578fbe284ca5d1d449619

SHA512
ec9828d0bade39754748fb53cfc7efdc5e57955198bac3c248ea9b5a9a607182bb1477819f220549a8e9eadbe6bf69a12da6c8af3761980d2dd9078eaeaa932f

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdate.dll

Filesize
1.9MB

MD5
dae72b4b8bcf62780d63b9cbb5b36b35

SHA1
1d9b764661cfe4ee0f0388ff75fd0f6866a9cd89

SHA256
b0ca6700e7a4ea667d91bcf3338699f28649c2e0a3c0d8b4f2d146ab7c843ab6

SHA512
402c00cab6dac8981e200b6b8b4263038d76afe47c473d5f2abf0406222b32fff727b495c6b754d207af2778288203ce0774a6200b3e580e90299d08ce0c098f

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_am.dll

Filesize
42KB

MD5
849bc7e364e30f8ee4c157f50d5b695e

SHA1
b52b8efa1f3a2c84f436f328decd2912efeb1b18

SHA256
f1384a25a6f40e861455c62190d794415f3e9bfca6317c214847e9535dfc3fb9

SHA512
6fd7f542a7073b3bbf1b0c200bb306b30f1b35a64a1fb013f25c7df76f63ef377d9bd736e8da2e9372f1c994785eaeedb6b60e3a0d4a4e8734c266ad61782d3b

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_ar.dll

Filesize
41KB

MD5
163695df53cea0728f9f58a46a08e102

SHA1
71b39eec83260e2ccc299fac165414acb46958bd

SHA256
f89dddda3e887385b42ea88118ba8fb1cc68fde0c07d44b851164564eb7c1ec8

SHA512
6dfb70a175097f3c96ae815a563c185136cb5a35f361288cc81570facfa1f1d28f49eaa61172d1da4982ebb76bd3e32c4de77cf97dedfb79f18113d7594d0989

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_bg.dll

Filesize
44KB

MD5
c523ec13643d74b187b26b410d39569b

SHA1
46aff0297036c60f22ad30d4e58f429890d9e09d

SHA256
80505863866bcd93a7e617dd8160531401d6d05f48d595348cd321cf7d97aeac

SHA512
ecf98e29a3481b05ab23c3ff89fa3caf054b874ed15462a5e33022aacf561d8fea4a0de35cc5f7450f62110ca4ace613e0c67f543ad22eb417e79eb3ebf24ed7

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_bn.dll

Filesize
44KB

MD5
dafa45a82ce30cf2fd621e0a0b8c031f

SHA1
e39ed5213f9bb02d9da2c889425fab8ca6978db7

SHA256
d58e5f0fa894123de1d9b687a5b84826e095eca128ee5df8870f2db74f4233a2

SHA512
2b772ebc128eb59d636eec36583329962ead8e0a399fd56394b1244486bf815f4e033ceef74a62a9930ab2bf6ec1ba5e2d3c942183f7cb2355a716a3e2c6c7a1

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_ca.dll

Filesize
44KB

MD5
39e25ba8d69f493e6f18c4ef0cf96de8

SHA1
5584a94a85d83514a46030c4165e8f7a942e63e2

SHA256
1f66ebdcaae482a201a6e0fab9c1f4501c23a0d4ad819ccd555fdca9cc7edb94

SHA512
773c995b449d64e36eb8cab174db29e29e29985bcfd714799d6b05b01bb7d4a0fc2aefaf2e27ff02b0e105fbe0d34d7efe29b193a1bc3365ec47e1f1003bed26

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_cs.dll

Filesize
43KB

MD5
b9033db8d0e5bf254979b0f47d10e93d

SHA1
2859de0d851b5f4fd3056e8f9015cece2436c307

SHA256
12c41c2f472b6a05fd6392e9d4f8aeb9a40840c2cbefd68b39d20f9d1d4d77ed

SHA512
52075df4ae5c86ebb0bac20604ea072a163761ae058c1473211bf4bb0eeed043cfc5a92386f876b53484cdf4e3f8a7b75d8f4bf9894c24f8c22ec23a50b70b7c

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_da.dll

Filesize
43KB

MD5
9f2e018a4f9a1d278983d0b677b91218

SHA1
c58ee1fc0d8ef9d99f85426b48c7f28f381a2c17

SHA256
d0dcdc68236eecd6b5f0b437eb92b8935741dabf1fa276a552399815af22edec

SHA512
20b74b6a9f81527d4a5fe30671d2559261fb682576f4ab04da7856280fbbaeb6af83894009c9d7cb83deeae988d0ac5ec7ec32b277b7eb45829faec2857d7014

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_de.dll

Filesize
45KB

MD5
96d92500b9a763f4b862c511c17e0a47

SHA1
2fd441eb8685d15e14fa6405e82359adea3e7148

SHA256
58829d135ff41e574ed5fc5e0421e4aa204267b02ca3ffaf08d8efb0a70fdd4c

SHA512
a1014584f1f278160d579848fa188f627676aee819e9395517490b00e273db6f583d7ddd31af6e35c9d251021df7fb26c88512aaa1c865c2ee3ba60c0a2db49a

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_el.dll

Filesize
44KB

MD5
ecdd26049573614b6f41d8a102ffcf21

SHA1
5140c6cff5d596267a64df1559ac36c4e8f49e42

SHA256
a3377520f2a95b8cc06bd30e493962c07f97eebf4661a69d03efb36b2ca515c5

SHA512
933c181d7575f20480c8deadac3f3e9190081456169122216c72e7b9a04aa75612140fc37697098c7c20b77001a67966fa1661cdc9110c40634c944f833a65b1

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_en-GB.dll

Filesize
42KB

MD5
f82ccf890c3ae14bfd7a263d07276e60

SHA1
6a915d6eb8c99d065e36a721d721d556b74bb377

SHA256
6b07a4fd3039541e30c68a8c31c371cda2cea480787f95e0ddbca3cc2fbff0cc

SHA512
4cbf9e6728e08de8d61f34b17bb20d92b6a699969edb9afa013fe962c8fd39238288adcd826134c9bca459904d8574a804c519daac6b301e0d38f68722c0359e

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_en.dll

Filesize
42KB

MD5
741211652c66a8a6790396e1875eefa9

SHA1
2ccd5653b5fc78bcc19f86b493cef11844ba7a0c

SHA256
e0945deacdb6b75ff2587dea975774b9b800747e2ee3f3917e5b40ddb87eda10

SHA512
b70f847d8ca8828c89bbb67b543950fbd514c733cf62b52ad7fc0dab7b2168fe56d1f21bef3210f5c7f563f72831455d870a5f9aa6c557f1e3543ef7329c42f9

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_es-419.dll

Filesize
43KB

MD5
1c0b1c3625c9ccace1b23e0c64095ee9

SHA1
3904a80d016e0a9a267c0b5feb8e6747b44b5fa1

SHA256
f030757e1911e9efde0d74a02c22694fa5ef139f73897a7f97acab9da05f7c8b

SHA512
0a988edef8d67cd83c2be65cbfa07059df311732ee92ad73fb9411d7cf7d853a2b8d2ab801733d05ab6afaccab33a2684117bbc1d80b362b677cc53ae9de42f0

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_es.dll

Filesize
45KB

MD5
dae64d49ee97339b7327b52c9f720848

SHA1
15f159c4808f9e4fe6a2f1a4a19faa5d84ac630b

SHA256
e76400e62ae0ab31565e50b05d1001b775a91aa487a54dc90e53c0e103c717c2

SHA512
9ae72e5a658aa0e1fb261d62ccef474cd42d9bec2b4a50f71925d131ffea22b8f60fb961772587ce71cb30a32da3b7986e7483ecea960a509e0450d3983c84b0

Download Submit
C:\Program Files (x86)\Google\Temp\GUMD9C7.tmp\goopdateres_zh-CN.dll

Filesize
37KB

MD5
ca52cc49599bb6bda28c38aea1f9ec4e

SHA1
494f166b530444f39bca27e2b9e10f27e34fc98a

SHA256
f9f144aa2dc0de21b24c93f498a9b4a946b7da42819a776b3283a0bcae18544b

SHA512
05e2d5711eef8f57737b2512de2e73744f17e0a34de0bfd2a06c9cc60a08ebadbafe38e30b66a2ede7fa61d5b9571adddcfbd7e1cafcee1ab2168a563d2d3f0d

Download Submit
C:\Program Files\Google\Chrome\Application\134.0.6998.178\Installer\setup.exe

Filesize
6.2MB

MD5
34c2dfddff8a68e70dff4068fd425bbc

SHA1
2816c4d729e655315e283b1074b4e3f771afd32a

SHA256
f7258147da4412c75f2b665c8c0d59a0c841a19a6bf3a7f2a1e329e3db4a96c6

SHA512
ec5ea8ceae64ff86514e7d6df2e15ab5fbe828503acb297987a3d67d5db30d03fdee32f808a937bac9bf982e8422660d5201c05ee08a573b3036338a49ee4e08

Download Submit
C:\ProgramData\NVIDIARV\svchost.exe

Filesize
3.4MB

MD5
d6395ce9ccb9802c7fbba16139153c36

SHA1
52cf2b264a5ce1bdf18c0f17e62bd178cf92a528

SHA256
2705aa01fe0ad1deb09349e184102815726323997df433fb8da947345404422a

SHA512
a1b5b8ae410b6edb4b9ae7298779e1caa6071e3f59850e579b3cc39c3a3654dd042e77cf863dded64ae90bbacf16d377e9000cbc7a85b6a9d526f79e0ff7e6fd

Download Submit
C:\ProgramData\Packas\scrok.exe

Filesize
2.7MB

MD5
d07123bd407bf34ee3ce91b5fdb10db1

SHA1
d8a7c620adf407edfd03053b89051d6aabbbf6d5

SHA256
519f752759e93f2be905670b115b522cb6e770c1577082a11eaacfd397ac65fb

SHA512
74305dc3d99d2a19f5999905090beb274e97c0f1367fb109e54ad44567da774c079842e08ccd8748d5c1ecd114b87523c4778766207b231e726c3f6460690daa

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
1009B

MD5
be9e382f42ae6a428f6765fb76555b87

SHA1
1a9bd6b2f2e73217566f7cc3796095a0e2ea048b

SHA256
f526b12b5a23c0c5343b565018fa0f8878d604efd3ec24d912d76bf0881c474f

SHA512
85b24895f884f2b70750b75005449ebfd1522ba3f933c0d7209726b349f38e3ff758e7b4c455430176a885c66e814938210e475df5b0af0ce98842ee3c31cb0f

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
424B

MD5
7b66e67d2d13b199d7983c200d1ed254

SHA1
15c61150dda292d05182fd94c6a50e1e2b91fb17

SHA256
c310cad98d17402ebb2e7b06a00886b2b4d028332ad602a0bc41cd48791a15fa

SHA512
933190328950bfb10c90bdec81ea1a17e5e9516c0c69c03f341c035b2cd2b20ab62f1c61261b8b60f04c8bdb8d0cd58322ed9e2536b95ebbf93354a1441c8693

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
613B

MD5
95827523062fd327e7482d1ec9291999

SHA1
df231abff2b29bf95cfecf4ad77b4d2ded5e0389

SHA256
e46fa29015bc58e1d4eb5532c3adecd483e75618a07c78a262a8bbb31aaeb97a

SHA512
29bac6b2876cf6987d5eb73c3a3a1c10d8f332f8fe665995500ca80c6d5aaf06b53ebc3485d8980ffe380fbfc6caa0ee36b8f6002c4c7f5e5dc82880b82d5160

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.wrapper.log

Filesize
769B

MD5
b662d7700ce6fd052409c159bc2e331c

SHA1
6480140994325c2827cf06c9bc9881600ab74a1b

SHA256
68e2c1a6e81fd64067a8fde8ae1ad4938aa83461f74922ad00ceb376ebd9c15f

SHA512
69085118cb6f3969f1b9e1eed3c677f10a20179573d2f68d31789924bd93316ff1e02baa5aed3c006cd9307e711025139828749f036e015cbf332f14df5b40f9

Download Submit
C:\ProgramData\Smart\TjNkNpAilaYvt.xml

Filesize
298B

MD5
2c706293a3cfff8cc184a8e9a3b3da08

SHA1
873d7c9f51aa6cebd4ad3ae5930d1de84bb4437d

SHA256
ed28baf8be3a588d50ed246c2cd741bbd498aee74ea0675d57e0b33236e22067

SHA512
4aba3e25507ba5c29219ff51553f3616d07aeeb30f7465f9e921eea94cdcb411d1f48d1eefed647c22405df275e7f9d7506aac52202aae137391c6831463b043

Download Submit
C:\ProgramData\Smart\setup.exe

Filesize
4.7MB

MD5
1fc06b4e65235d61020b7b043a493dd8

SHA1
de3c5bc49a095ed4d776f46393fc91d933e08b14

SHA256
4011ba0b6c30b4fbf007384e5535edbcf029aad8b8ac8fee792332d2520c97db

SHA512
01881b52a925888d2772c9b6d5ccaa7b411018fd35cb369a69d7fef4eb4a5f21cf89a6dea05ab946e8b0694963aaafbbb1ead21338180bbe9b4853c585909dfa

Download Submit
C:\ProgramData\setup\aa.exe

Filesize
1.0MB

MD5
09c448be7e7d84e6e544cc03afbb05d8

SHA1
ddc13e71a72bc49c60f89b98cbb79c2449cfa07e

SHA256
a0f127a70943b0262060498c1723c795a8e2980f1acf0c42ee8c1dae72ae54b5

SHA512
e5f7a988a999e7e34d0aa2d2a5b2fbb22689588d3def4bed4518ceed38710e3714c5614bab192b0ce6bcac5172a87ebf3b3b923e495eb7344c70bd11f4bf1c12

Download Submit
C:\ProgramData\setup\ddd

Filesize
10.7MB

MD5
7bd4f627460b430c303b124e51f36d77

SHA1
7962983399c083c206eef52fa185a864a6081c71

SHA256
2e4f52f7d0d858399509d3184550f72ede2a1fbb0b248dff8faaa0450a1d30ec

SHA512
c4021daacf909b7d5c96a0d1584ef187231616bcaff646bbb34572be157b3e9a91c765f88d85c17e2d320e24c2d75f2ec09e2a18a68073a4d08befb27880c3f7

Download Submit
C:\ProgramData\setup\setup.exe

Filesize
1.3MB

MD5
4a94844260d6a08828d781d488cef61d

SHA1
de8169fdb5ab8a120df577d92eb25a2767431738

SHA256
46d7a8abe3bb9d7302529246cd8ee6e7d0360d1045fe92662cc7580e72ef5132

SHA512
82549c1e525a90003fb0174ebba2bc3b4f58706ef9fd5e6ee07d489ab536ef286e408db6c15a52b039d3f59c09bd55e35d045def79007da5d414d5d589d34f4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
dba246108efeec31e500a9ade3dfd69d

SHA1
32cf2243f83b8ebde6b3332d497cc7af8ab91915

SHA256
c6488a9f2ef30f43d0b6649e8f396ae37563c514c66bcf14089fcc42f60e12d2

SHA512
9a1ddc8cfd0db71c8f085fd8047a44224ad1fd4d5d4dc2c1ae0edacd8f275f2a7e865e67ffcda8c4195cc31ca028f042c79a51f9c2f031d72720ff9a5a1b5306

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
4d432130e324d07b066d2f1a196eed4a

SHA1
2a55908e5a44a0694e1adc35e1bd3297db1c9624

SHA256
74f51c472f051fc555f7b840095b15190b0115f5bd9635b823809d99feba5490

SHA512
f9219af9ae694372cc625869038f5f2845958d641fcc8c4ab81f25600afadb79185a04c978c051bf2d3c37b4e31f20139b869b845a4188cc685c6a7692b0c110

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8bd7ebc6a3a6865048c2d57f6bcc9a5a

SHA1
542cf7fdb0bba3e62ec885348506d7bc8c660037

SHA256
f67e194b07a143c2985bce440b0a69b5c84181c6cae2764044033ebb9ea0630d

SHA512
8c4d440e15b00a1207220b893e950b0e588c5613332cb96598e84efb8614813ccf71b2f78fe79ac919448546d53092868f48892e55f5943d7255003b8558795c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
419d284bb91f6764c471086028e5f422

SHA1
0d2d0a83fe126a7ba0c8d59df70c8ecfe6bff5cd

SHA256
e04a26665f986440b6845b9563e630d494b2b3a938deb63906878bf8947c63e8

SHA512
fd6df9ad8ea48f6abc2a3c9919814b69721ca730a532c3fffc12d35ed53d191ab8511b77f6c1a60c2b3f2c85177797d7a8acc1fb30e95cae1ea32314acee80c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
6b0f7f4d8aad55c237625530ff45a10b

SHA1
069b266c687bf5034efb2ded5bd3eaf411395a47

SHA256
92571ea4d9d7a3b9184d6aef91c76c1e7a00c259126102172b87e240a7e2a3cf

SHA512
a07d794b8751a261287bf27c86fc4c1187c01cc5e7592353ebc08eb9b754bb7b2b59c5dff467716fe7979b471a2a14eba9ee0aca8403e1c59998617b5e9ad86d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5f55edc3aee48ea34c5565be5e767673

SHA1
216391afaf9273084da45b62f95bb1ce9088f26b

SHA256
28054778e18653104a2c7af5d57d594fdf0c3aae945323116ad3b3d440f86522

SHA512
87f294d060ed1cd3a36cff400ac687313b8a901fd9f2b1469c0dbe74abf3c6f22d1b103c8436eeb5a30664aea13661b199022e9fb125bfd76399f98c833022a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
711149b0204b81c2f64940d618bf206c

SHA1
43ecd321793333a1be1fdab241ef809ad57a352f

SHA256
bdb78fe10a6d7be3af5eab053f32b987a2d80119ae7159d63ded1de0f838b72b

SHA512
458cad389bc12d45178c78c1632534180f40da0e25190d9bbad5b642cfaa216734d7a7db5246ec9cf9fc88ca5dd0431e698f7ede80db4e3f092b8ad0764970c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f306.TMP

Filesize
48B

MD5
12c6b73209fe3fd50236bdb4117317a5

SHA1
c8f8392cdf0c86c7168239e63a5df97c3820e65e

SHA256
a60903c39b34e835516cfbe6caa6027e1c31e78dd511f77e054bdbfd6ae34a98

SHA512
de95cc1cfb01607a0ec38bebb1ec274502671c035b56acee72ecd67fcb2903f55eabe3755b8fa1231dc83b14147721674ad88ac00fac6d39a3fb821b8d00784b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
b77fc97eecd8f7383464171a4edef544

SHA1
bbae26d2a7914a3c95dca35f1f6f820d851f6368

SHA256
93332c49fab1deb87dac6cb5d313900cb20e6e1ba928af128a1d549a44256f68

SHA512
68745413a681fdf4088bf8d6b20e843396ae2e92fbb97239dc6c764233a7e7b700a51548ff4d2ea86420b208b92a5e5420f08231637fbb5dbf7e12a377be3fc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
81db9c75595fffa93fac07ff327b03b0

SHA1
351f08d7174ee457c6872e794f1a3782b01210eb

SHA256
01a2ebb03036540d2844be6080ab34a7f85a06f3ae222c769fc41f6b598edabe

SHA512
c804604f44c285d9bb90940942f7f06ff53830d4fd7c925c0a252acb6314ef9dcb0f4156c3856999abb80dc82a77078d45c5e7364e079b1b6989621ff2ce467c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
148KB

MD5
83fa08a4b7f5b82f05f2f629ce59a243

SHA1
af225d5cb446bb6add12d975c70e66e4e593d879

SHA256
eb0e501039445f2f4763c02ff79c3357030fbe9ac36bcc320f4845d9d21366c4

SHA512
ca7567fa7d9b3f5af1d85f6d0263a57563b2479fa11681f499f54bf49b7b8b3adc1ba1b0c0f5a25ba84e60853b5d746401af9463a836963b131cd02fbfc42e0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
148KB

MD5
b13ea645c30f33bfc4e8d9bf494e1ba6

SHA1
fbd63cddb3ed18cb591757382dbc102fdce90384

SHA256
ae40ce146f01116b7222490fc2aa2e7cb496cab27e77fa6aeb58822c5e90f0a0

SHA512
c59fd9197b5bff04f2ef03b2801c7f78dc78af6717b6e46a2fe362d1a8f08cc2596ce46c37b11b923c206019f2d151615441ea53090c477bbc92063a0bb4b116

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TjNkNpAilaYvt.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
C:\Windows\Installer\MSIA875.tmp

Filesize
587KB

MD5
c7fbd5ee98e32a77edf1156db3fca622

SHA1
3e534fc55882e9fb940c9ae81e6f8a92a07125a0

SHA256
e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6

SHA512
8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

Download Submit
C:\Windows\Installer\MSIAB28.tmp

Filesize
1.1MB

MD5
ae463676775a1dd0b7a28ddb265b4065

SHA1
dff64c17885c7628b22631a2cdc9da83e417d348

SHA256
83fbfcaff3da3eb89f9aec29e6574cf15502fd670cbb2ab0c8a84451b2598b22

SHA512
e47c2db249e7a08c5d2864671fbc235e48aebecbe0b2c2334d1a4cba1b5b3037522ff89408589f3559b3a1eaf507bd338645387d55800029bb3b941d4c7744d6

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
67c54f2afde8287f0fc755628d707a75

SHA1
f0f7f10a0750d9ef935ad4a03f8524810947d9fa

SHA256
d11e023a4d4c01adc16a70a40315fcd7bd65d1f6dea22988de721e402179b0e5

SHA512
313e17891eedcc2fac66e44ca0c3238c6bd47fc397aae58212a37ee30a5df31feb5f877893f1e3335318c3f4fe1d6bfe1fb2439f414a2da1af3d18b9a2d31ca4

Download Submit
\??\Volume{28d8005c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ba57d8e6-5a0a-4158-8275-57980c13faab}_OnDiskSnapshotProp

Filesize
6KB

MD5
3ed416e0d28b2df52e6f29b80ba48d34

SHA1
24f96708830fac900a9cca961bea8cc7c3bd4b83

SHA256
c18a5d43f525ffc21117e0165b97cdbf9e89318b17ff1d4470b92eca1dbcb213

SHA512
e6332b1601f00d089713dc92f1c272f29484e0c12019ba82c0d20235209a4ec48e5391639f0c207a3f8df3667c5edaf3e4d44499619504db056419f1bafc9e29

Download Submit
memory/504-70-0x00007FFB06AF0000-0x00007FFB06AF2000-memory.dmp

Filesize
8KB

Download
memory/504-71-0x00007FF760760000-0x00007FF760D0F000-memory.dmp

Filesize
5.7MB

Download
memory/704-66-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/1104-377-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/1104-301-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download
memory/3060-375-0x0000000002A00000-0x0000000002C00000-memory.dmp

Filesize
2.0MB

Download
memory/3060-376-0x0000000002A00000-0x0000000002C00000-memory.dmp

Filesize
2.0MB

Download
memory/3120-114-0x00007FF760760000-0x00007FF760D0F000-memory.dmp

Filesize
5.7MB

Download
memory/3248-118-0x0000000000400000-0x0000000000B9E000-memory.dmp

Filesize
7.6MB

Download
memory/3248-117-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/5024-77-0x0000000000890000-0x0000000000966000-memory.dmp

Filesize
856KB

Download
memory/5996-207-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/5996-205-0x0000000000400000-0x0000000000918000-memory.dmp

Filesize
5.1MB

Download