gh0strat | 39243396378dc3cb8518cc7066078542a78a41d9c364dcf13a6dd31755aff025

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2025, 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-02_b8011778039c766a9c0b06c4f9e90212_frostygoop_gcleaner_poet-rat_sliver_snatch.exe
Size

30.4MB
MD5

b8011778039c766a9c0b06c4f9e90212
SHA1

f223edc9b2006f69673768e1d7e0a429f9c91b8d
SHA256

39243396378dc3cb8518cc7066078542a78a41d9c364dcf13a6dd31755aff025
SHA512

0294aca91e79df8da569d887c426a17d17ebe6a785d1d2f0daf6aede9cf74c3a5905ff03b6a03f320a0e7902d0a67c4787a4528c7fcf1c9681d121ac2bfd2bf2
SSDEEP

393216:cj6Fuy2Eko3SfP7ewAArcVbiYZN/NzTNIOvh1UR8ChT4JSb6y43wjYPz95vO:cmD3UDAL5Rh1at+yUDP3m

Score

10^/10

gh0strat purplefox defense_evasion discovery execution persistence privilege_escalation rat rootkit spyware stealer trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 3 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral1/memory/2172-290-0x000000002C5F0000-0x000000002C7AE000-memory.dmp	purplefox_rootkit
behavioral1/memory/2172-295-0x000000002C5F0000-0x000000002C7AE000-memory.dmp	purplefox_rootkit
behavioral1/memory/2172-296-0x000000002C5F0000-0x000000002C7AE000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/2172-290-0x000000002C5F0000-0x000000002C7AE000-memory.dmp	family_gh0strat
behavioral1/memory/2172-295-0x000000002C5F0000-0x000000002C7AE000-memory.dmp	family_gh0strat
behavioral1/memory/2172-296-0x000000002C5F0000-0x000000002C7AE000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\134.0.6998.178\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5372	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 50 IoCs

pid	Process
2392	MHHqcyuFBAXhiZh.exe
5384	MHHqcyuFBAXhiZh.exe
4944	DetailUnderline.exe
5912	DeploymentFind.exe
4880	CJXeaoXxYmBNXbEL.exe
456	updater.exe
380	updater.exe
2404	updater.exe
4444	updater.exe
2296	updater.exe
1600	updater.exe
4852	DeploymentFind.exe
4512	DeploymentFind.exe
1252	IntegrityRadiant.exe
1516	IdentifyDiscover.exe
600	IdentifyDiscover.exe
3364	DeploymentFind.exe
5568	DeploymentFind.exe
5772	ServiceDetect.exe
4948	ServiceDetect.exe
6056	134.0.6998.178_chrome_installer.exe
2268	setup.exe
4856	setup.exe
5908	setup.exe
1848	setup.exe
5788	IdentifyDiscover.exe
4548	DetailUnderline.exe
2172	DetailUnderline.exe
4576	chrome.exe
4892	chrome.exe
4852	chrome.exe
2860	chrome.exe
5460	chrome.exe
5932	elevation_service.exe
5256	chrome.exe
5480	chrome.exe
5264	chrome.exe
5572	chrome.exe
372	chrome.exe
540	chrome.exe
5912	chrome.exe
2200	chrome.exe
3844	chrome.exe
4816	updater.exe
1456	updater.exe
4376	chrome.exe
2116	chrome.exe
4436	chrome.exe
5244	chrome.exe
3564	chrome.exe

Loads dropped DLL 41 IoCs

pid	Process
4576	chrome.exe
4892	chrome.exe
4576	chrome.exe
2860	chrome.exe
5460	chrome.exe
2860	chrome.exe
5460	chrome.exe
4852	chrome.exe
4852	chrome.exe
2860	chrome.exe
2860	chrome.exe
2860	chrome.exe
2860	chrome.exe
2860	chrome.exe
2860	chrome.exe
5264	chrome.exe
5264	chrome.exe
5480	chrome.exe
5480	chrome.exe
5572	chrome.exe
5572	chrome.exe
372	chrome.exe
372	chrome.exe
540	chrome.exe
540	chrome.exe
5912	chrome.exe
5912	chrome.exe
2200	chrome.exe
2200	chrome.exe
3844	chrome.exe
3844	chrome.exe
4376	chrome.exe
2116	chrome.exe
4376	chrome.exe
4436	chrome.exe
2116	chrome.exe
4436	chrome.exe
5244	chrome.exe
5244	chrome.exe
3564	chrome.exe
3564	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Enumerates connected drives 3 TTPs 45 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	DetailUnderline.exe
File opened (read-only)	\??\Q:	DetailUnderline.exe
File opened (read-only)	\??\V:	DetailUnderline.exe
File opened (read-only)	\??\W:	DetailUnderline.exe
File opened (read-only)	\??\X:	DetailUnderline.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	DetailUnderline.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	DetailUnderline.exe
File opened (read-only)	\??\M:	DetailUnderline.exe
File opened (read-only)	\??\B:	DetailUnderline.exe
File opened (read-only)	\??\J:	DetailUnderline.exe
File opened (read-only)	\??\O:	DetailUnderline.exe
File opened (read-only)	\??\T:	DetailUnderline.exe
File opened (read-only)	\??\Z:	DetailUnderline.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	DetailUnderline.exe
File opened (read-only)	\??\K:	DetailUnderline.exe
File opened (read-only)	\??\N:	DetailUnderline.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	DetailUnderline.exe
File opened (read-only)	\??\R:	DetailUnderline.exe
File opened (read-only)	\??\S:	DetailUnderline.exe
File opened (read-only)	\??\U:	DetailUnderline.exe
File opened (read-only)	\??\Y:	DetailUnderline.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	DetailUnderline.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_83F29ED1D5F129EB605BF640EBE52C8C	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DeploymentFind.exe.log	DeploymentFind.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_83F29ED1D5F129EB605BF640EBE52C8C	updater.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\IdentifyDiscover.exe.log	IdentifyDiscover.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ServiceDetect.exe.log	ServiceDetect.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	updater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	updater.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WatchLocate\2_DetailUnderline.exe	MHHqcyuFBAXhiZh.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\lo\messages.json	chrome.exe
File created	C:\Program Files (x86)\Google4880_16689276\bin\updater.exe	CJXeaoXxYmBNXbEL.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\134.0.6998.178\Locales\sw.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\zh_HK\messages.json	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\chrome_url_fetcher_2296_38793237\-8a69d345-d564-463c-aff1-a69d9e530f96-_134.0.6998.178_all_jokgxrnp5esicq6ypegro2gjq4.crx3	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\_metadata\verified_contents.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\134.0.6998.178\dxcompiler.dll	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\ka\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\pa\messages.json	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\ja\messages.json	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\30ddf8b1-728d-4cae-93b5-bb44a0f7de59.tmp	updater.exe
File opened for modification	C:\Program Files\WatchLocate\IdentifyDiscover.exe	MHHqcyuFBAXhiZh.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\134.0.6998.178\vk_swiftshader.dll	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\no\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\hi\messages.json	chrome.exe
File created	C:\Program Files (x86)\WatchLocate\bdeuiMMreplece.dll	msiexec.exe
File opened for modification	C:\Program Files\chrome_installer.log	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\si\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\ru\messages.json	chrome.exe
File opened for modification	C:\Program Files\WatchLocate\DeploymentFind.xml	MHHqcyuFBAXhiZh.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\403520f4-77b8-4d97-92b6-8d7e4a6a5132.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\134.0.6998.178\VisualElements\Logo.png	setup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\da\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\manifest.fingerprint	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\134.0.6998.178\d3dcompiler_47.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\134.0.6998.178\VisualElements\LogoBeta.png	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\pt_BR\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\mn\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\vi\messages.json	chrome.exe
File opened for modification	C:\Program Files\WatchLocate\ServiceDetect.exe	MHHqcyuFBAXhiZh.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\CR_069C1.tmp\CHROME.PACKED.7Z	134.0.6998.178_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\134.0.6998.178\Locales\te.pak	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\134.0.6998.178\default_apps\external_extensions.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\134.0.6998.178\Locales\el.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\134.0.6998.178\MEIPreload\preloaded_data.pb	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\az\messages.json	chrome.exe
File created	C:\Program Files\WatchLocate\UpdateOutline.exe	MsiExec.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe57b2b6.TMP	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\134.0.6998.178\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\134.0.6998.178\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\chrome_proxy.exe	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\fil\messages.json	chrome.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\manifest.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\134.0.6998.178\Locales\lv.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\service_worker_bin_prod.js	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\th\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4576_2105305667\_locales\en\messages.json	chrome.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe58e078.TMP	updater.exe
File created	C:\Program Files\WatchLocate\bdeuiMMreplece.dll	MsiExec.exe
File opened for modification	C:\Program Files\TechnicianClarify\DeploymentFind.wrapper.log	DeploymentFind.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\3e7d80fe-f4af-411b-8359-e9f55bc20a1b.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source2268_727490652\Chrome-bin\134.0.6998.178\Locales\fi.pak	setup.exe
File opened for modification	C:\Program Files\TechnicianClarify\DeploymentFind.wrapper.log	DeploymentFind.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5752D351-0979-4E07-BBF1-911F1957AE27}	msiexec.exe
File created	C:\Windows\Installer\e5763de.msi	msiexec.exe
File created	C:\Windows\Installer\e5763da.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5763da.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI64F4.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IntegrityRadiant.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DetailUnderline.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DetailUnderline.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DetailUnderline.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MHHqcyuFBAXhiZh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CJXeaoXxYmBNXbEL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-02_b8011778039c766a9c0b06c4f9e90212_frostygoop_gcleaner_poet-rat_sliver_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6056	134.0.6998.178_chrome_installer.exe
2268	setup.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DetailUnderline.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DetailUnderline.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	9	Go-http-client/1.1

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-3051 = "Qyzylorda Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-2321 = "Sakhalin Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	DetailUnderline.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	DetailUnderline.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_username = "2654E719A63DEACD3D4FEAFBB6852D8744C35C82CABEA44A7931F048090E3274"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time"	DetailUnderline.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	updater.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	DetailUnderline.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Update	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time"	DetailUnderline.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\pinned_tabs = "EC213DBAF561ECCB17C11339FDF9F64033BB25E68A170D2FB04E293EE8BE8025"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings\neajdppkdcdipfabeoofebfddakdcjhd = "D1A8056282EAC6D8A16B147E99E9709A63FA5113B22CE31F7041D40E3F2E99D6"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time"	DetailUnderline.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon\state = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time"	DetailUnderline.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\dr = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	DetailUnderline.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	DetailUnderline.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ = "IProcessLauncher"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\1.0	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\1.0\ = "GoogleUpdater TypeLib for IProcessLauncherSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AECA2F4A-724E-5D94-B8BB-2467150628F8}\TypeLib\ = "{AECA2F4A-724E-5D94-B8BB-2467150628F8}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{8A2F4279-5AFC-549D-B352-F32E6DBAC9DF}\LocalService = "GoogleUpdaterInternalService132.0.6833.0"	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\ = "IUpdaterAppStateSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\TypeLib\ = "{0CD01D1E-4A1C-489D-93B9-9B6672877C57}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AECA2F4A-724E-5D94-B8BB-2467150628F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\TypeLib\ = "{F258BE54-7C5F-44A0-AAE0-730620A31D23}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AECA2F4A-724E-5D94-B8BB-2467150628F8}\TypeLib\ = "{AECA2F4A-724E-5D94-B8BB-2467150628F8}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\ = "IGoogleUpdate3WebSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\132.0.6833.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\TypeLib\ = "{6430040A-5EBD-4E63-A56F-C71D5990F827}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ = "IAppCommandWeb"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D624A353-7B91-5E8B-B5AC-AA415F46F083}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D624A353-7B91-5E8B-B5AC-AA415F46F083}\TypeLib\ = "{D624A353-7B91-5E8B-B5AC-AA415F46F083}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\ = "IGoogleUpdate3WebSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{5F793925-C903-4E92-9AE3-77CA5EAB1716}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\TypeLib\ = "{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D624A353-7B91-5E8B-B5AC-AA415F46F083}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\GoogleUpdate.Update3WebMachine	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1588C1A8-27D9-563E-9641-8D20767FB258}\1.0\ = "GoogleUpdater TypeLib for IUpdateStateSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\1.0	updater.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5968	msiexec.exe
5968	msiexec.exe
5372	powershell.exe
5372	powershell.exe
5372	powershell.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe
4944	DetailUnderline.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4800	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4800	msiexec.exe
Token: SeSecurityPrivilege	5968	msiexec.exe
Token: SeCreateTokenPrivilege	4800	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4800	msiexec.exe
Token: SeLockMemoryPrivilege	4800	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4800	msiexec.exe
Token: SeMachineAccountPrivilege	4800	msiexec.exe
Token: SeTcbPrivilege	4800	msiexec.exe
Token: SeSecurityPrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeLoadDriverPrivilege	4800	msiexec.exe
Token: SeSystemProfilePrivilege	4800	msiexec.exe
Token: SeSystemtimePrivilege	4800	msiexec.exe
Token: SeProfSingleProcessPrivilege	4800	msiexec.exe
Token: SeIncBasePriorityPrivilege	4800	msiexec.exe
Token: SeCreatePagefilePrivilege	4800	msiexec.exe
Token: SeCreatePermanentPrivilege	4800	msiexec.exe
Token: SeBackupPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeShutdownPrivilege	4800	msiexec.exe
Token: SeDebugPrivilege	4800	msiexec.exe
Token: SeAuditPrivilege	4800	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4800	msiexec.exe
Token: SeChangeNotifyPrivilege	4800	msiexec.exe
Token: SeRemoteShutdownPrivilege	4800	msiexec.exe
Token: SeUndockPrivilege	4800	msiexec.exe
Token: SeSyncAgentPrivilege	4800	msiexec.exe
Token: SeEnableDelegationPrivilege	4800	msiexec.exe
Token: SeManageVolumePrivilege	4800	msiexec.exe
Token: SeImpersonatePrivilege	4800	msiexec.exe
Token: SeCreateGlobalPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeDebugPrivilege	5372	powershell.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe
Token: SeTakeOwnershipPrivilege	5968	msiexec.exe
Token: SeRestorePrivilege	5968	msiexec.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5260 wrote to memory of 4800	5260	2025-04-02_b8011778039c766a9c0b06c4f9e90212_frostygoop_gcleaner_poet-rat_sliver_snatch.exe	91
PID 5260 wrote to memory of 4800	5260	2025-04-02_b8011778039c766a9c0b06c4f9e90212_frostygoop_gcleaner_poet-rat_sliver_snatch.exe	91
PID 5260 wrote to memory of 4800	5260	2025-04-02_b8011778039c766a9c0b06c4f9e90212_frostygoop_gcleaner_poet-rat_sliver_snatch.exe	91
PID 5968 wrote to memory of 5552	5968	msiexec.exe	96
PID 5968 wrote to memory of 5552	5968	msiexec.exe	96
PID 5552 wrote to memory of 5372	5552	MsiExec.exe	97
PID 5552 wrote to memory of 5372	5552	MsiExec.exe	97
PID 5552 wrote to memory of 5824	5552	MsiExec.exe	100
PID 5552 wrote to memory of 5824	5552	MsiExec.exe	100
PID 5824 wrote to memory of 2392	5824	cmd.exe	102
PID 5824 wrote to memory of 2392	5824	cmd.exe	102
PID 5824 wrote to memory of 2392	5824	cmd.exe	102
PID 5552 wrote to memory of 5320	5552	MsiExec.exe	103
PID 5552 wrote to memory of 5320	5552	MsiExec.exe	103
PID 5320 wrote to memory of 5384	5320	cmd.exe	105
PID 5320 wrote to memory of 5384	5320	cmd.exe	105
PID 5320 wrote to memory of 5384	5320	cmd.exe	105
PID 5552 wrote to memory of 4944	5552	MsiExec.exe	106
PID 5552 wrote to memory of 4944	5552	MsiExec.exe	106
PID 5552 wrote to memory of 4944	5552	MsiExec.exe	106
PID 4944 wrote to memory of 4880	4944	DetailUnderline.exe	112
PID 4944 wrote to memory of 4880	4944	DetailUnderline.exe	112
PID 4944 wrote to memory of 4880	4944	DetailUnderline.exe	112
PID 4880 wrote to memory of 456	4880	CJXeaoXxYmBNXbEL.exe	113
PID 4880 wrote to memory of 456	4880	CJXeaoXxYmBNXbEL.exe	113
PID 4880 wrote to memory of 456	4880	CJXeaoXxYmBNXbEL.exe	113
PID 456 wrote to memory of 380	456	updater.exe	114
PID 456 wrote to memory of 380	456	updater.exe	114
PID 456 wrote to memory of 380	456	updater.exe	114
PID 2404 wrote to memory of 4444	2404	updater.exe	116
PID 2404 wrote to memory of 4444	2404	updater.exe	116
PID 2404 wrote to memory of 4444	2404	updater.exe	116
PID 2296 wrote to memory of 1600	2296	updater.exe	118
PID 2296 wrote to memory of 1600	2296	updater.exe	118
PID 2296 wrote to memory of 1600	2296	updater.exe	118
PID 4512 wrote to memory of 1252	4512	DeploymentFind.exe	122
PID 4512 wrote to memory of 1252	4512	DeploymentFind.exe	122
PID 4512 wrote to memory of 1252	4512	DeploymentFind.exe	122
PID 2296 wrote to memory of 6056	2296	updater.exe	140
PID 2296 wrote to memory of 6056	2296	updater.exe	140
PID 6056 wrote to memory of 2268	6056	134.0.6998.178_chrome_installer.exe	141
PID 6056 wrote to memory of 2268	6056	134.0.6998.178_chrome_installer.exe	141
PID 2268 wrote to memory of 4856	2268	setup.exe	142
PID 2268 wrote to memory of 4856	2268	setup.exe	142
PID 2268 wrote to memory of 5908	2268	setup.exe	143
PID 2268 wrote to memory of 5908	2268	setup.exe	143
PID 5908 wrote to memory of 1848	5908	setup.exe	144
PID 5908 wrote to memory of 1848	5908	setup.exe	144
PID 5788 wrote to memory of 4548	5788	IdentifyDiscover.exe	147
PID 5788 wrote to memory of 4548	5788	IdentifyDiscover.exe	147
PID 5788 wrote to memory of 4548	5788	IdentifyDiscover.exe	147
PID 4548 wrote to memory of 2172	4548	DetailUnderline.exe	155
PID 4548 wrote to memory of 2172	4548	DetailUnderline.exe	155
PID 4548 wrote to memory of 2172	4548	DetailUnderline.exe	155
PID 456 wrote to memory of 4576	456	updater.exe	157
PID 456 wrote to memory of 4576	456	updater.exe	157
PID 4576 wrote to memory of 4892	4576	chrome.exe	158
PID 4576 wrote to memory of 4892	4576	chrome.exe	158
PID 4576 wrote to memory of 4852	4576	chrome.exe	159
PID 4576 wrote to memory of 4852	4576	chrome.exe	159
PID 4576 wrote to memory of 2860	4576	chrome.exe	160
PID 4576 wrote to memory of 2860	4576	chrome.exe	160
PID 4576 wrote to memory of 2860	4576	chrome.exe	160
PID 4576 wrote to memory of 2860	4576	chrome.exe	160

C:\Users\Admin\AppData\Local\Temp\2025-04-02_b8011778039c766a9c0b06c4f9e90212_frostygoop_gcleaner_poet-rat_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-02_b8011778039c766a9c0b06c4f9e90212_frostygoop_gcleaner_poet-rat_sliver_snatch.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5260
- C:\Windows\SysWOW64\msiexec.exe
  msiexec /i C:\ProgramData\gcjMwhAdMDgEeaaZ /qn
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4800

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DAAE1827C14513343440A9CF39E42078 E Global\MSI0000
  2⤵
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WatchLocate','C:\Program Files\TechnicianClarify','C:\Program Files\ControlEmphasize'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5372
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""C:\Program Files\WatchLocate\MHHqcyuFBAXhiZh.exe" x "C:\Program Files\WatchLocate\IntegrateOrganizerTrusty." -f -to "C:\Program Files\WatchLocate" -key "@9)30AarTUjBAutomateBuilderTrusty""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5824
  - - C:\Program Files\WatchLocate\MHHqcyuFBAXhiZh.exe
      "C:\Program Files\WatchLocate\MHHqcyuFBAXhiZh.exe" x "C:\Program Files\WatchLocate\IntegrateOrganizerTrusty." -f -to "C:\Program Files\WatchLocate" -key "@9)30AarTUjBAutomateBuilderTrusty"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2392
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""C:\Program Files\WatchLocate\MHHqcyuFBAXhiZh.exe" x "C:\Program Files\WatchLocate\AchieveAdvisorDynamic." -not "1_DetailUnderline.exe" -not "sss" -not "UuovEfPLBaztjuP" -not "1_//__EDRFILENAME1__" -not "" -not "1_IntegrityRadiant.exe" -not "1_UpdateOutline.exe" -not "sa" -f -to "C:\Program Files\WatchLocate" -key "@;128vJAukaaSustainBuilderNimble""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5320
  - - C:\Program Files\WatchLocate\MHHqcyuFBAXhiZh.exe
      "C:\Program Files\WatchLocate\MHHqcyuFBAXhiZh.exe" x "C:\Program Files\WatchLocate\AchieveAdvisorDynamic." -not "1_DetailUnderline.exe" -not "sss" -not "UuovEfPLBaztjuP" -not "1_//__EDRFILENAME1__" -not "" -not "1_IntegrityRadiant.exe" -not "1_UpdateOutline.exe" -not "sa" -f -to "C:\Program Files\WatchLocate" -key "@;128vJAukaaSustainBuilderNimble"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:5384
- - C:\Program Files\WatchLocate\DetailUnderline.exe
    "C:\Program Files\WatchLocate\DetailUnderline.exe" -WatchLocated Watch -WatchLocateS Locat -WatchLocateP 1007
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Program Files\SearchOutline\CJXeaoXxYmBNXbEL.exe
      "C:\Program Files\SearchOutline\CJXeaoXxYmBNXbEL.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\Program Files (x86)\Google4880_16689276\bin\updater.exe
        
        "C:\Program Files (x86)\Google4880_16689276\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={1B5B4C03-7369-8C4F-1A7A-4D9FACA7609D}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
        5⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:456
      - C:\Program Files (x86)\Google4880_16689276\bin\updater.exe
        
        "C:\Program Files (x86)\Google4880_16689276\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=132.0.6833.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x879488,0x879494,0x8794a0
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:380
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=134.0.6998.178 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f27c6f38,0x7ff9f27c6f44,0x7ff9f27c6f50
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4892
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2144 /prefetch:3
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4852
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2112 /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2860
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2540 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5460
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3272 /prefetch:1
        7⤵
        Executes dropped EXE
        
        PID:5256
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3280 /prefetch:1
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5480
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3760 /prefetch:1
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5572
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3784 /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5264
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4692 /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:372
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4976 /prefetch:1
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:540
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5440 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:5912
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4812 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2200
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5804 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3844
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5436 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        
        PID:4376
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4092 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4176 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4436
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4780 /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5244
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=2116,i,3829680785286290549,16819167369332951670,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3784 /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3564

C:\Program Files\TechnicianClarify\DeploymentFind.exe
"C:\Program Files\TechnicianClarify\DeploymentFind.exe" install
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
PID:5912

C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=132.0.6833.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x8f9488,0x8f9494,0x8f94a0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4444

C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=132.0.6833.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x8f9488,0x8f9494,0x8f94a0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1600
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\134.0.6998.178_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\134.0.6998.178_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\3e7d80fe-f4af-411b-8359-e9f55bc20a1b.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\CR_069C1.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\CR_069C1.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\CR_069C1.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\3e7d80fe-f4af-411b-8359-e9f55bc20a1b.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\CR_069C1.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\CR_069C1.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=134.0.6998.178 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7eb509ed8,0x7ff7eb509ee4,0x7ff7eb509ef0
      4⤵
      Executes dropped EXE
      PID:4856
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\CR_069C1.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\CR_069C1.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:5908
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\CR_069C1.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\CR_069C1.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=134.0.6998.178 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7eb509ed8,0x7ff7eb509ee4,0x7ff7eb509ef0
        5⤵
        Executes dropped EXE
        
        PID:1848

C:\Program Files\TechnicianClarify\DeploymentFind.exe
"C:\Program Files\TechnicianClarify\DeploymentFind.exe" start
1⤵
- Executes dropped EXE
PID:4852

C:\Program Files\TechnicianClarify\DeploymentFind.exe
"C:\Program Files\TechnicianClarify\DeploymentFind.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files\TechnicianClarify\IntegrityRadiant.exe
  "C:\Program Files\TechnicianClarify\IntegrityRadiant.exe" -TechnicianClarifyd Technici -TechnicianClarifyS anClarif -TechnicianClarifyP 1196
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1252

C:\Program Files\WatchLocate\IdentifyDiscover.exe
"C:\Program Files\WatchLocate\IdentifyDiscover.exe" install
1⤵
- Executes dropped EXE
PID:1516

C:\Program Files\WatchLocate\IdentifyDiscover.exe
"C:\Program Files\WatchLocate\IdentifyDiscover.exe" start
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:600

C:\Program Files\TechnicianClarify\DeploymentFind.exe
"C:\Program Files\TechnicianClarify\DeploymentFind.exe" install
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3364

C:\Program Files\TechnicianClarify\DeploymentFind.exe
"C:\Program Files\TechnicianClarify\DeploymentFind.exe" start
1⤵
- Executes dropped EXE
PID:5568

C:\Program Files\ControlEmphasize\ServiceDetect.exe
"C:\Program Files\ControlEmphasize\ServiceDetect.exe" install
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5772

C:\Program Files\ControlEmphasize\ServiceDetect.exe
"C:\Program Files\ControlEmphasize\ServiceDetect.exe" start
1⤵
- Executes dropped EXE
PID:4948

C:\Program Files\WatchLocate\IdentifyDiscover.exe
"C:\Program Files\WatchLocate\IdentifyDiscover.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Program Files\WatchLocate\DetailUnderline.exe
  "C:\Program Files\WatchLocate\DetailUnderline.exe" -WatchLocated Watch -WatchLocateS Locat -WatchLocateP 1017
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Program Files\WatchLocate\DetailUnderline.exe
    "C:\Program Files\WatchLocate\DetailUnderline.exe" -WatchLocated Watch -WatchLocateS Locat -WatchLocateP 1010
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:2172

C:\Program Files\Google\Chrome\Application\134.0.6998.178\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\134.0.6998.178\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4484

C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4816
- C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=132.0.6833.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x8f9488,0x8f9494,0x8f94a0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5763dd.rbs

Filesize
7KB

MD5
19104c6f5a5db0712f696d71bbf6c23c

SHA1
45f61b379fce31924260d33de25c790949c39fdd

SHA256
9a56369ddf37c650bd265b3a5d5b004cf734b063c8ef7b20109820216d381403

SHA512
80ded03657280f58a027c35ca6213c7504d14e8281d77b90b791635f0c2d774ad6da2c6b90783babf61241a02dbaa6a9fa18014d056de096fe488207c91d5af2

Download Submit
C:\Program Files (x86)\Google4880_16689276\bin\updater.exe

Filesize
5.3MB

MD5
9db9d09b6a58e5c09773f754504ac148

SHA1
7cd31865c0858319128bbd2483c19f59b7208cea

SHA256
c294551059a85542127811249b8e725d3ab885efdd4996b201db588899769e85

SHA512
80a036cc6d42e72bf6be634c6134945750da105ab7e026c2e53e0a02362db3101acd9402b0383bcedc9dfb29b3a87cb0951191fdcf4d29a780d5380c6ad6a05f

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad\settings.dat

Filesize
40B

MD5
721f0f2962c22ee61d8caccc97b6e783

SHA1
fb6a9e6e4eb34c4664b076bc053eedbcdc4e850e

SHA256
4a7aef2ef4c55f130d45e4436a046f43328916641477a44db725ce6a197e87be

SHA512
9d256fbe1c208d0da7e8e39660e49330a51630760055e92d8765604047f6ab1327f784ea8a81e02b05533f2a37929a1cd6d5fb3c1345772622ff82d7f98505c4

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\prefs.json

Filesize
19B

MD5
aa2d0c0c72bb528cf4168ea91c1c9a56

SHA1
67be5a0c29b13b92dd86ba935f605c4ba7eea2cc

SHA256
e03e9d262ca3b7d19e37c3a69c7d8b46bd3f5542aa555a17d864071c28257b2c

SHA512
6bdb9a72b73f11f7627e6fca0ee1d417201b038cb255d445dd29e5f27de08e99a6c4729c4c893ffe97e4bc1835532879c47cceaa051f07b3cdad06ad17b2d5e7

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
415B

MD5
eed1680f7a1ce427b96cf8911c1d1123

SHA1
4664cf6272090a9446ac5087c6cbadc362244032

SHA256
5409640bc7d2d6ca30130d8e08fedc755ad8516c7fe83bd3a5cbd391fe020d5e

SHA512
f76b779a4a3fad40262fb614b9a487163118907c8e26243e038c048402759de9b9fdebcf096cab1b33c4cbe443dee3f1479536fa956c378109dd30b1aa8af67e

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
835B

MD5
51dbea49c9db1409d4ea17729f5f6f72

SHA1
04b04e0661c608b1089984f163d1cd725e1dbad3

SHA256
f86e838a46fa9012f58b3c8afaf234e4afbf152c381d5152ab62d7dc7b6af68f

SHA512
c4a3fa490833bd0a45985619b3fd1cd071e6f9a24b0788d070f9a93871758417d4475bae5d6f8925ae5a2e2a8ad3bb773b29adf9ba8939a1af4764b91dcd8bb3

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
634B

MD5
624b330fcebd2d664b30a67ee7a28d18

SHA1
79865b650af3d8f8798c87d8312cccd1570f2ed0

SHA256
ffac931134a0499d4fbb154069a30fe48b3346c8ad67ebfad3ffe2f100bfe78c

SHA512
96e359f627e4a4ba1c16d125fb98ed856a8b698aa2b235b8f2c08c572c3708360bc4d1b5e8d169542733da4431cdd03978ace7c789656918549b7f4e6992364e

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
1KB

MD5
997433b031ddda16584052a6d2f13b97

SHA1
a0a8f1c2707728602964db8db6a8000170d064e9

SHA256
aaca95f291d5728fe446a5953c4793f9471401d9ae9cb0962c435bdc8064ba0f

SHA512
1c46ec69f62328cf9716b88ccc68ba4218c75becdc0a1dbc17a4f3801ade5d1560e5c37aae01bde784a9852c78dd87ad2577ee1118dacbd52df809bdcfd93461

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
534B

MD5
d4c96165ec9560b47524ab045da942b5

SHA1
14edb41ad31046eadba8532055f5b954c1d16f25

SHA256
3dcd464e4ee77cdc410c76e62bd997ff063401bd5e2ff271666f1a44aa09a4b4

SHA512
e404bf6f4f2e5b5fb1605f7ca115e279db62038537a8dcbf772bbdab2c2c209365ab0cf038966416cae88016eb52d899e2c1c101b624cd952d04903a5f8c0454

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json

Filesize
414B

MD5
203ecc1ee2c0a7b8ff683e55c9e33f90

SHA1
b65006df55e81e38758d697fc2d993b1781b602b

SHA256
ff5dfe3b0a83b65202c4bcfd00ff6261776a05a64bddb73c85b94e2b84dfce1f

SHA512
e48a09f6f79187107f7fb0878cc144f14de39ae0a1084447c9370c2729ea0395830f2b1dd11a8aad9f339afb739d39c9f62e7d2e483b8e728e12b844b17cbb28

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
22KB

MD5
903d33c6b40aaa429127e1f38b1288cd

SHA1
1322051ca802375560727932d5f27bc22420c9cc

SHA256
b7ce79b7ac4c10d3347e4200e928f86b8668ec5ddb00267c6d1f89762920250c

SHA512
f69117bb453ff82fd63dc7413f182a5bc014c91898f7f8cd160ab127b23076f0d684843653c168763c3ea7d465af70ed47afcb5d67c07b05bc971b5346b65fa2

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
22KB

MD5
bf40f53ca3bc34f96aa39be511980bac

SHA1
ea0feac5d24668d6c17b0e89005540f70cd1eaf2

SHA256
17331ccd43c72c8c9ab64c82343b6575ad956f8e876971af375fd5eeae4eabb3

SHA512
290674f52d1e032505e5102940fb5a4de943951a650edeadb9b042b62c8e9d477711288582553f4c5733425d2864aa616d0c2a63bc03771d2ec2053555ce8df2

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
25KB

MD5
7ea7a22ac15083608a91331c83a6e9f0

SHA1
a01af27cd6df681f3811a92ab7963e7587dff6a0

SHA256
6d464482031156a9be26ee433ce4f0ab84ef67cf9d4f8c3fa1db7332adc27da9

SHA512
c160cc4bb15685751eff1ffd4deef3bc5f852ceb23fe828b9412b66dfd75a9af4674a3059a9656e6a3ca85f7a40c7fba78ee6280b4825de4d067eca28e4d516e

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
26KB

MD5
344a175a83877080eed9649bb8cd3439

SHA1
27d235dc98271f75b1b78944e05c170fba66104e

SHA256
936058a8a5c07cdc07546eb6bd3bef18c8f7cd297eb609e4cfa77b2c2c9fe896

SHA512
8b25517b819a075331317a37e061f5e28fe87210afae6ace3574c333f1a7ccf23e6c9b408e22768256ae071e967c5f33dd995a023343fc49031cc53b2fef2d45

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
29KB

MD5
c50012eeeff95e88567a4f052c1675d9

SHA1
fd24cd52e3f268e9d135bfad7b4d9625ddb27ccb

SHA256
bef5bcdf55798ea2e4147533afb5c07b0d9c34659ad770453b04cb398f2aec3a

SHA512
400a46d9c08eebb187b9b90553f9926464264b0f0cc18a719ef7f9821627818a6c24d53758efa8dfbfc0e54b9900e259cdadd2a1ad5b9b8ab3c908e9687dfced

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Filesize
31KB

MD5
f22a649bbca539cd2e852988d6775915

SHA1
481afba0838a01c622a3d69fcce0dc1e8f77b8b8

SHA256
99a8ed6852bad8ac0e98b6b02ca9c2c93e171c0936f20a0aa6b0f8afec8489f2

SHA512
5ffa28f1acce3f67097d9689972db457461d914c970624ad9e6ef89cad8b128329d13bc4a61ea55332b1083b4af5b5d7ac973be2862cace50388a5e047c1a2eb

Download Submit
C:\Program Files (x86)\WatchLocate\IntegrateOrganizerTrusty

Filesize
10.7MB

MD5
1d18bfe76c4e859ae587c5464b57381e

SHA1
fe24ff5892c579e650ac6148adc5e5dccb647703

SHA256
e3c0854475508dae9e4504b95ac1af1776beefb22525cc7b8f7fb2fe89f04100

SHA512
fb1a393378332572b929d1da110802c513ebdd8e2b41bafb36f0dc16554c81072794a09d0cbaed6f735877237d0d4071086c2555803ceb39f5183fd57a2c5ed8

Download Submit
C:\Program Files (x86)\WatchLocate\MHHqcyuFBAXhiZh.exe

Filesize
1.0MB

MD5
0c28f2ab0db226962e61a1bbf39d0c2a

SHA1
5096f4959c0f4ba1d27ddd7181a1848d21603bd9

SHA256
7e2642901ff6760edfa8204e1f1261e6acb826d4f36b2fcf017de42ccbd506d4

SHA512
7412d8e9327e111f83651bb9078bb6a72ffd750b6e1e4d8862fabb376901362b1ce507a5fafacd19d084610e2a82ab2eb72112c0f7fd467d8a9670469be5e9b3

Download Submit
C:\Program Files (x86)\WatchLocate\bdeuiMMreplece.dll

Filesize
211KB

MD5
cdc4f8d59c67e9fb34d63506f8066fc3

SHA1
49848298a4a44887e2e09eaa19f9f08bfae58b7e

SHA256
9e90ca7b5b79811b13b4c395d2d255200f9c432d1eb6dbc73430476da58cd300

SHA512
3263dd60c2fdb8773f186124b8ce39ffb7766da11a4b40efddb3b61346aa6a82b711f23023577f5eb22cc373951441e360d5b7cf82ef6b6f4402096fddf7de0c

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2296_847900551\CR_069C1.tmp\setup.exe

Filesize
6.2MB

MD5
34c2dfddff8a68e70dff4068fd425bbc

SHA1
2816c4d729e655315e283b1074b4e3f771afd32a

SHA256
f7258147da4412c75f2b665c8c0d59a0c841a19a6bf3a7f2a1e329e3db4a96c6

SHA512
ec5ea8ceae64ff86514e7d6df2e15ab5fbe828503acb297987a3d67d5db30d03fdee32f808a937bac9bf982e8422660d5201c05ee08a573b3036338a49ee4e08

Download Submit
C:\Program Files\SearchOutline\CJXeaoXxYmBNXbEL.exe

Filesize
9.9MB

MD5
75cbdf7efaac4e9dd65a713f9ef3625b

SHA1
9b3197c315841ef6ce628884dd75284e349f3555

SHA256
d94f48d876e56f0c3465b7808387023b617a6e747137271a1012e7e48b031dfb

SHA512
62e750aa0364e5e82a50e26149608c462168ea4365bc26994c2edd1a16888f342eb56ed38bf2a92e9333f82e161af657c2961b62fcdccc51922d3ae80a44cbb7

Download Submit
C:\Program Files\TechnicianClarify\DeploymentFind.wrapper.log

Filesize
208B

MD5
31a7526551ccec4589e52a02f5307b6a

SHA1
c027903b6bcfe6e1ca338b8c9560ad3be1fd4399

SHA256
2d53507eeafa10ecb691a1825b9a4948531b5fc50df28b6eb7ce921144afea71

SHA512
1c60aa9dd99482e1fb3754854207112f16b19d2359ceb4120585680c8e0f50a2caa069418d5493520c42c0971d42f6b9ac4d442387852d79cb6443fa66cfc88f

Download Submit
C:\Program Files\TechnicianClarify\DeploymentFind.wrapper.log

Filesize
423B

MD5
07f46b6d34a3c1592f53981a0229fba9

SHA1
582a77c9d04108acca7908a664e3aa6258356b21

SHA256
2e83977e57e084c5bdfc2ff5abe15e460a1e073b95c090e277877dd1b14f8006

SHA512
f5dd15776221a0d46c7961c29a923d45ae246531cf8e33ca9c2f66b356c775dd59952b69aff092c196844142aa5396bfc19d2dc08871f08376bcf28f7dab462f

Download Submit
C:\Program Files\TechnicianClarify\DeploymentFind.wrapper.log

Filesize
482B

MD5
d9d3b6ef8857c35bb14afda05b02b2c0

SHA1
e3863b3f5eeec5fdd42d67c6fc41ef3530f2405d

SHA256
17d3b5c98cd5a7f5e920106af37276f661206b3c14d389e018d725f0a743f25d

SHA512
17fed9c6e84387e0ce41fd4927c475a6eb839fcae8857fd642c0c66e9a3ae67564e1b6da70bfa4863bfbb3bc52504d878ba8d391c0a5be8db2bfe770b195a8b4

Download Submit
C:\Program Files\TechnicianClarify\DeploymentFind.wrapper.log

Filesize
663B

MD5
4d3d2fba95c2e030a8d57dca252028e2

SHA1
606d39df8ee7cf9be43459432c2cccb5bdb5c875

SHA256
87f2173c6deff9c7b157a1109b14e45000b21da6192e5c80916c57019de0de75

SHA512
441685bd30971ffa2a7e0f36de805b65b963f07d9a79cb9526299cdd4ae534a3e78c210edbd2f86ff7f99ed037a370b355eab3d18f07f8fcd79179ad35a43a2f

Download Submit
C:\Program Files\WatchLocate\2_DetailUnderline.exe

Filesize
9.1MB

MD5
51982d054827554198b0bf8758432b17

SHA1
1eb2a4efe16310dfe4d10134c2c6d593cee4b77e

SHA256
8228a1095bb453c5f6fadaddcefae6a32b46bab6ac0b2a5692789d52234612da

SHA512
c2fa91764af3bf22ed502437cac9045703db6255b19aed6e84b4c3045ee2f3c623292a75bbaa1c58910ba348d505741d303e92a7ed377a6ee7f86da77a05b803

Download Submit
C:\Program Files\WatchLocate\2_IntegrityRadiant.exe

Filesize
8.7MB

MD5
406be85342b7857344710ca1a5ea2fe6

SHA1
a4d625289a0019754aba42b4478aa779401efac4

SHA256
06efd8e371b3f38ab44682417fd073162725e75da58ade48b807cfdeaacd6fda

SHA512
ae58d8d8c106229ea27ac1fa5a311a50078b5a5d3c35bf99481631bf00b89b521ea825430a1f3ab25e7493de4ff81b61e2d06b12ca995f6e0343b764d2ec8995

Download Submit
C:\Program Files\WatchLocate\2_UpdateOutline.exe

Filesize
9.7MB

MD5
b999867743de2ad43fadccded5b2132b

SHA1
95063595fae52d1747c47fc7482e8abadb64d9e9

SHA256
20e401ba5ab6273e3a85482d6bfd58d24c2c0eff43dde5daf4c0801c52c8e8e5

SHA512
8b6e72443006483741faa55f165bc4e8cfc387758c538127b941ad42fb555e7d50896e15dda639ffd0abf1614717a5be6440bc59995639818ed27b1fe3fdb2fb

Download Submit
C:\Program Files\WatchLocate\AchieveAdvisorDynamic

Filesize
10.7MB

MD5
185fd3aece8285912981a7e4e04d759a

SHA1
6f4261a89d94928a47e019186a3caafd9dfa2422

SHA256
7a36043803cc95da035f8b25d78bd9947ba519de3fe81da1aff0506ab0ce6aff

SHA512
ba450e3728ac1aac3c083fb7e6b7e1d22a46d1ae14dc6e4b44c98c3e21041c1eaee79442ed3d528ec7a98c3918fc1f7c225e691835d5664b0e8a96cbe2891aaa

Download Submit
C:\Program Files\WatchLocate\DeploymentFind.xml

Filesize
484B

MD5
732201b6d1987ff6ecfc81af601514d4

SHA1
747774b1b3ded5306e1f7075347c626f8591d43e

SHA256
8bf400dba85a129eb12f4b58dece11b22bcaee7afdc2d630d4800d4eda5e6a99

SHA512
0a68a6fd3617f12707b871a276b444c5dae2c84a1b18c66e1eabc82c7aba9c3dd24991ee4cf4c16f521d2184c2028c4b5aa890f134294ce02c590e7f850f6b1a

Download Submit
C:\Program Files\WatchLocate\IdentifyDiscover.xml

Filesize
442B

MD5
7e31597fe17d4f6507aa429a6d77ee85

SHA1
08520c47e42813ba8ef1c1a1132d600fcd0260c1

SHA256
7c3efc5b9af19b759dc19934129a9c97466f13f999d4fa708014178e619583e2

SHA512
d88dccc7e3b3568b040f5704f37f3c12f2f5e8cf7254a94941e1e1cf1ffe22b2b4ff98d5c171823671d32dd9e4d2f5d87a263ef8cf83df0548473a259db22917

Download Submit
C:\Program Files\WatchLocate\IllustrateDrive.sys

Filesize
470KB

MD5
66437b33e0ea17f60cc706dab25d2677

SHA1
c26ec34ee4bc0552f0c1d4310c313a3814de262e

SHA256
8b4dc968351e1ce21a46c4fab3d769845f1508e17d0f4a2bf56652eb6437c449

SHA512
843d8a82d520007c7602a8c4fe62c2393a8abed939e705f55d3072460834fb32c5e3d29a9343539188218af60a789e9ca2bf3ab1551e246d0a74469a4dddfe7c

Download Submit
C:\Program Files\WatchLocate\ServiceDetect.exe

Filesize
606KB

MD5
4e85cc36adc996c3ddd3a9825d4b7f73

SHA1
e5aa0e5db7d9fd27e2a0484f3fd6c322fc5ee97f

SHA256
7b36e127e1fa53e0c6462312777c5d004ea83bde67e6df32fb8920b6c001d664

SHA512
2d7b7c5eb54cf68a218fca7239c0e194af0b81796e621bc039edccea64b60a202670a47af207988467a8c25584cef96a6652f52d53464ce3cf01006c680f2980

Download Submit
C:\Program Files\WatchLocate\ServiceDetect.xml

Filesize
483B

MD5
d914e1e848b2a87881f4b686c3c7040f

SHA1
37ffdf35a87de770165be57152e58a2d0be93253

SHA256
8585e3e32a2e5f48f6099361c072f3192ce073dfbee0ebed1497d151ea6f22aa

SHA512
6cc1a472bf569a7b014faf01eb48b430f5917f4fadc660ac7da0d691b31f6e52a217427491c943bee26cb992347235cbd1ad27f17444b17018d2c66964685e84

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4576_1776814548\crl-set

Filesize
686KB

MD5
1614b5cef9d105e9fe872206e28db8f8

SHA1
8f1757614f861b1805992df3113a45bb10192e47

SHA256
50d82a4bde334a88513aa9f61087a9f002ea48361c1acb2ab942a3fd3c932215

SHA512
6c97389eed8b196d05f64c13483e939a0d7ad119eb343fb9c4fd326309c77b4deaff3195875aaeeaf6f181ca4b96f3317e2544a9af35b37bee478f28bfb13a3e

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4576_1776814548\manifest.json

Filesize
94B

MD5
60473904333c6f98e05e09bf1a9a48d3

SHA1
ed103ed041d35f2e5fce8dd19a073263e5cdde19

SHA256
e15dbd1ed46ea303d121d86f1e8dac12ce74efcf507bb5edc6389ce2c4b89356

SHA512
92e2dad91bcb6544b8ceaf39100d492f91a83a8f4371b2acbcda2e759d799d3b23250f4bb3820a273808b68ee3f8e8217a074c36bfd56bfd92533adb266c9e78

Download Submit
C:\ProgramData\gcjMwhAdMDgEeaaZ

Filesize
11.2MB

MD5
10087950f7f453230bbe2ad5644b9631

SHA1
a4a5d8c4e220572a63ad6226b647aaa69823d521

SHA256
b4da9208b075ddd13b89b7d220b2b6cacd117c505bc6a8ffa295b2d4534702c6

SHA512
477e0ce1bfe35acbfc451871602fe332c96097ec4fcd35beb33544800fb27d753f27a7ca18f7a95a2ce037fe17f49d7816946a3925523160becc1e71d06ae08e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
c5630db83392a3bdb8bb82bc7f0f368c

SHA1
7807c22c2c3c2de4be1662cc77464cbac9a8aff1

SHA256
f34eb7e8ff188ae37ac39fef092c0a80324a54476acb877eec2de9e6db0a180e

SHA512
b829e0fbd1fb99cf1641efb5b2d1724ea358dfe8a94aa4ca2089e0637622f792671493a2e7c9a6cd24fc718cfe8e8c5b56b2ed6ac37066c80db29d963933d80d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
b53e14301874e13a42e622a3015908ee

SHA1
ea6885d50070b0eb0c60831e264ba0329c4f9aa2

SHA256
9de811a06af30f625ad5ba57c7d8b862fc2ca0d3afb713115ff2b4f23863b738

SHA512
84d6f12284b08bacbcb92e6b5b99957bcc86771ad8c4f90e3be6422078e781a95d946b9f1ed8846655e9319df2e5be86f56a32b9b2428f91d36d2f19c7fa7463

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
cbf1979dcdaa2fa4a80ac5ea5d47970a

SHA1
fda729806dfda8cfb293b91a2d62e93b1f68e034

SHA256
263b48a358b22087c60ffd2c4548eec841a8b03ec06e0b146f356ff05d0fb7c8

SHA512
220446802657d4546a37c798961647c8051eae3bb1057df0a1b79a5385fe51b8a4a9b462275e2d742383284d37971e3f7e2d18d5ebb4e54852270ba44ce64cde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
108ed16f0799c273fda5f9b092b80e4f

SHA1
3d9efa1d82db25a89582f86ef21fdfcc4d6982c0

SHA256
4ea2ff877da0dc6fc7c9b490c438178c27298fc6cf3af3760f52518ce74e266e

SHA512
196eff694ac0717756584256a3e6dae46bfb6327fac325d3ebffbcbe8ddb63520272633be1d3e24ddec9fd92b54eb0c521771fe5f5d7abeb66a6fceb9dc8d251

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
1045f96cae69baa346a928f0edb16791

SHA1
53173463506a3ad21a0e4e276f976b8068cc5fbf

SHA256
9923078f7c1acabd835225c230bbcf7a08aa069c61df3945ae91c5f1befb5225

SHA512
0b4d4e99183a06877884c39710db1ede492ee7ac3d2aca3f82e72ad30b59cf78ac6854a5a09e6a9f65b832bf8d3b1867d2ef76001f296194d62baf0b7457f58a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
d75e5b66dfa92e423225c4d916dcb6a6

SHA1
c23041bac7b4093439940c392871896662b1f67d

SHA256
bc00d9609024a72ec6e3a8554dddfbe48e40e7194cc0112c22189e292e88e953

SHA512
8bba8c58d1e246f3e700ac576dde63035cd5c9a55c3c57fdf86103a8f45edf2c1bf509234796f05c3ef62f58aa281114114391d452b21a6aefc8a9859ec1f577

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5b44d2ae8102d8d9a8e01901354c61f6

SHA1
ccd7b7dcd1d75d434baf5ba05b425c3b0b17c984

SHA256
c7014280a20dad4fd00240bffe9231ce8a35ef2a557c25835cb7f0b62a334668

SHA512
81a2e290db6bba96a35f2005c7130c5190e1cb4028740b86397fe16815e0b7d94015654172fd16bb03407f6d65ee3ba0863a14bc2f3d55e97eaf49cce73becc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b263.TMP

Filesize
48B

MD5
ad1058b37939a9fbb2b0074481ebee2a

SHA1
8f3795048e2d23dd1ba7657499e67fbb97024ffb

SHA256
b16a57d515466d48ef6aca7a0434faf57416c78466e5aa397f15533e53323d2b

SHA512
bf8cbfef837d98e134bbb20dd1ed62a237267b520a0d678d073b0995a9cd72eaccc14a2762da763a018744fc1668897b9b01712a0d8c07e03e6eeb3d4916529e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
b77fc97eecd8f7383464171a4edef544

SHA1
bbae26d2a7914a3c95dca35f1f6f820d851f6368

SHA256
93332c49fab1deb87dac6cb5d313900cb20e6e1ba928af128a1d549a44256f68

SHA512
68745413a681fdf4088bf8d6b20e843396ae2e92fbb97239dc6c764233a7e7b700a51548ff4d2ea86420b208b92a5e5420f08231637fbb5dbf7e12a377be3fc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
79KB

MD5
219b66cb72e1568da7c5a9eab6d0c8bb

SHA1
233ecfd15bf755ed7910893af096346668464949

SHA256
0a4f9dd0e3b1f4f531209896c2928b6b2d02f4a41ed1eb9f2985186c201411a4

SHA512
bd03bebdae7af8a1b5f1e7caac50af0dcf63ce708544b402b00a8394c3f7657db325a5806b81c8fbe769aea0ee755f3b2b383c737278a701d615415086d726f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
146KB

MD5
6a5b1205c1737f494f3140fdfe361357

SHA1
cdd8f17d63de6787c22f8e3f2ef5a2a69026b319

SHA256
8aabca262033f6b1eaa141bc4903079e09682739a83f1049122bad69a6174d63

SHA512
c50ab8add3b30beca6f3b9e64d69398c6a1ba8cee66b2c673ef1a8cdd8b8a0af36e9b6618f33240616180d9d471772ef860e611fb999886e010ce133b2a62c16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
146KB

MD5
b91a27324426b20c3f058ba7be9833e4

SHA1
ff69239a9390765d6ed9440b770565631fa44890

SHA256
bb2ccdf9fff1a5ab6740d6f40fb23c3cbfd2ea63ae00fe728ab31ef6d094f568

SHA512
9a9a713a932632ba280f5a4da6fc1373c1c504fb1d798043c23d29f122174dfb6bc77429240ef3b93f64c323f99d8af730f620be626dd3b1e31763102ff3d33b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wjmbvg3f.moj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DeploymentFind.exe.log

Filesize
1KB

MD5
2da44f7c2b3721a44a3760ab180ca05e

SHA1
ce3325e28e5911967b403fee03f6cbf6b1b303af

SHA256
7253a1555ca5787509e338a9b09e6bd99f9db0ac6102baf21ca632ca8f8380d4

SHA512
78d1cf7ea933c0d61426604c5010dde5d3111dcb1a0de2f1bb218b2bc654685de6830245e1a20efcb20b6cd16f0df862b75aa98b2ac467b3e6a66dfffe6ae1ee

Download Submit
memory/1252-194-0x000000002A550000-0x000000002A5CB000-memory.dmp

Filesize
492KB

Download
memory/1252-183-0x000000002A480000-0x000000002A4CA000-memory.dmp

Filesize
296KB

Download
memory/1252-197-0x000000002A550000-0x000000002A5CB000-memory.dmp

Filesize
492KB

Download
memory/2172-295-0x000000002C5F0000-0x000000002C7AE000-memory.dmp

Filesize
1.7MB

Download
memory/2172-290-0x000000002C5F0000-0x000000002C7AE000-memory.dmp

Filesize
1.7MB

Download
memory/2172-289-0x000000002A9C0000-0x000000002AA08000-memory.dmp

Filesize
288KB

Download
memory/2172-296-0x000000002C5F0000-0x000000002C7AE000-memory.dmp

Filesize
1.7MB

Download
memory/2392-37-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/4944-88-0x000000002A480000-0x000000002A4AC000-memory.dmp

Filesize
176KB

Download
memory/4944-100-0x000000002A500000-0x000000002A548000-memory.dmp

Filesize
288KB

Download
memory/4944-104-0x000000002A500000-0x000000002A548000-memory.dmp

Filesize
288KB

Download
memory/5372-19-0x00000137EA7C0000-0x00000137EA7E2000-memory.dmp

Filesize
136KB

Download
memory/5384-62-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/5912-106-0x0000000000210000-0x00000000002AE000-memory.dmp

Filesize
632KB

Download