33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 71:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:T4f8,"Software\Policies\Google\Update\" in Source: sample.bin, "Software\Policies\Google\CloudManagement\" in Source: sample.bin, "Software\Google\Update\ClientState\" in Source: sample.bin, ":Software\Google\Update\ClientStateMedium\" in Source: sample.bin, "eSYSTEM\CurrentControlSet\Services" in Source: sample.bin, "Software\Classes\CLSID\" in Source: sample.bin, "nSOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: sample.bin, "Software\Google\" in Source: sample.bin, "Software\Google\\Chrome\Enrollment\" in Source: sample.bin, "Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER" in Source: sample.bin, "Software\Google\Update\Clients\" in Source: sample.bin, "Software\Classes\TypeLib\" in Source: sample.bin, "Software\Classes\Interface\" in Source: sample.bin, "nSoftware\Policies\Google\Chrome\" in Source: sample.bin, "Software\Google\Update\" in Source: sample.bin, "Software\Google\Enrollment\" in Source: sample.bin, "Software\Google" in Source: sample.bin, "Software\Classes\AppID\" in Source: sample.bin, "Software\Classes\" in Source: sample.bin, "SOFTWARE\Microsoft\Cryptography\" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin36:T54c,Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")37:Tf5d,Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject non-crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject process end" (Indicator: "WaitForSingleObject"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")38:T642,Found reference to API "sgnScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WebView2: CoreWebView2Environment failed when trying to LoadLibrary: hr=0x" (Indicator: "LoadLibrary"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "sgnScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")39:T4ae,Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")3a:T5d2,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")3b:T96e,"msiexec.exe" queried SystemProcessInformation at 00000000-00005868-00000C15-3422485458 [PID: 5868] "msiexec.exe" queried SystemProcessInformation at 00000000-00005868-00000C15-3422493698 [PID: 5868] "MSID6AC.tmp" queried SystemProcessInformation at 00000000-00000080-00000C15-3432853541 [PID: 80] "MSID6AC.tmp" queried SystemProcessInformation at 00000000-00000080-00000C15-3432860423 [PID: 80] "MSID6AC.tmp" queried SystemProcessInformation at 00000000-00000080-00000C15-3433049406 [PID: 80] "MSID6AC.tmp" queried SystemProcessInformation at 00000000-00000080-00000C15-3433056261 [PID: 80] "updater.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-3444131961 [PID: 1792] "updater.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-3444139138 [PID: 1792] "updater.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-3444327403 [PID: 1792] "updater.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-3444334498 [PID: 1792] "updater.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-3446590667 [PID: 1792] "updater.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-3446597928 [PID: 1792] "updater.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-3446644067 [PID: 1792] "updater.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-3446651669 [PID: 1792] "updater.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-3448016435 [PID: 1792] "updater.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-3448023351 [PID: 1792] "updater.exe" queried SystemProcessInformation at 00000000-00004696-00000C15-3445735560 [PID: 4696] "updater.exe" queried SystemProcessInformation at 00000000-00004696-00000C15-3445742569 [PID: 4696] "updater.exe" queried SystemProcessInformation at 00000000-00004696-00000C15-3445930132 [PID: 4696] "updater.exe" queried SystemProcessInformation at 00000000-00004696-00000C15-3445936914 [PID: 4696] "updater.exe" queried SystemProcessInformation at 00000000-00004696-00000C15-3449486524 [PID: 4696] "updater.exe" queried SystemProcessInformation at 00000000-00004696-00000C15-3449499559 [PID: 4696] "updater.exe" queried SystemProcessInformation at 00000000-00004696-00000C15-3449694908 [PID: 4696] "updater.exe" queried SystemProcessInformation at 00000000-00004696-00000C15-3449702040 [PID: 4696]3c:T6516,Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 54588; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 123259; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 179108; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 308004; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 309907; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 418606; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 487462; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 556169; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 663278; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 703870; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 832625; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 894975; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1037071; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1051651; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1229705; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1337463; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1343154; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1454939; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1574963; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1586755; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1594087; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1642023; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1666915; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1670281; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1748421; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1833593; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1918461; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2126597; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2204342; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2241208; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2389675; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2554192; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2560242; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2592915; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2620874; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2633519; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2715769; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2753970; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3067836; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3132813; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3160030; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3170558; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3177914; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3242163; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3262487; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3272430; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3287636; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3296435; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3313386; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3511521; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3571475; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3580161; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3595992; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3667838; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3711015; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3726517; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3730212; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3745869; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3824503; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3953702; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3963826; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4128908; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4220040; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4367178; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4432166; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4440650; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4524649; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4607519; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4628634; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4815777; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4840201; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4907632; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 5022755; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 5034527; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 5075376; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 5083229; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 5160985; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 5209672; code bytes = 30d0 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 80205; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 186924; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 346318; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 379363; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 423545; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 555415; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 672244; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 917504; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 944857; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 961832; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 980120; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1028502; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1169840; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1197570; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1304356; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1485415; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1556803; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1741952; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1865573; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2056630; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2097219; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2124102; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2322034; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2353997; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2357994; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2404486; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2472197; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2619936; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2645715; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2732125; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2792759; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2815995; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2838701; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3206661; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3246475; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3348842; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3480118; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3583736; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3700250; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3712370; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3937626; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4025223; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4046072; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4080793; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4328959; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4345966; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4353257; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4354180; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4420499; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4466761; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4491832; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4560901; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4735790; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4759514; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4776617; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4796448; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4862412; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4955488; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 5099391; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 5161069; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 5205748; code bytes = 33c1 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2028; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 18768; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 19563; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 89099; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 103947; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 132601; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 153341; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 166522; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 174726; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 219083; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 263109; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 316812; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 335204; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 413016; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 413480; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 432158; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 435490; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 735581; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 766363; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 797042; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 817860; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 983181; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 991881; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1058690; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1086722; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1270089; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1280659; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1416106; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1577366; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1619749; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1769305; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 1888309; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2005789; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2037495; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2046663; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2146653; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2162511; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2163587; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2167036; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2187890; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2234553; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2450856; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2455453; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2481004; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2508093; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2635202; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2693637; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2779003; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2798409; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2832268; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2833322; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2837777; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2881698; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 2900059; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3015736; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3022621; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3059721; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3062695; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3178665; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3209779; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3246013; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3246580; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3310031; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3498563; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3584829; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3666924; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3703495; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3747538; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3778391; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3849241; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3888313; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3918606; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3947292; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 3994725; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4151158; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4173619; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4175897; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4261048; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4311529; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4341174; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4386237; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4430982; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4594230; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4700461; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4705278; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4706562; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4767575; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4837302; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4966300; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 4992252; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 5171564; code bytes = 8030 Found XOR loop in file "157.0.8103.51_chrome_installer.exe" at offset 5221413; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 70923; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 73435; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1271812; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1272088; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 2988585; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 3584636; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4101231; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4178487; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4301228; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4425311; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4433852; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4437722; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4437745; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 4658252; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5135338; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 5154004; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 1236633; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 1999065; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 2304577; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 2792717; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 3447418; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 3485941; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 4512559; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 4512712; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 4765762; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 263341; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1698242; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1747462; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1821511; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 1832641; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2411850; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 2892721; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4006971; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4178486; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4422822; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4428092; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4441702; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4446415; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4459935; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 4465422; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 5052028; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 5156204; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 5165652; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 5170396; code bytes = 80303d:T8ee,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "googlechromestandaloneenterprise64.msi") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "googlechromestandaloneenterprise64.msi") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "googlechromestandaloneenterprise64.msi") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")3e:T4a2,Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")3f:T540,Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "googlechromestandaloneenterprise64.msi") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "googlechromestandaloneenterprise64.msi") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")40:T70b,Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00000080.00000001.307063.00984000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00000080.00000001.307063.00984000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00000080.00000001.307063.00984000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00000080.00000001.307063.00984000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00000080.00000001.307063.00984000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00001792.00000001.307038.0138E000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation SystemExtendedHandleInformation" in "00000000-00001792.00000001.307038.0138E000.00000002.mdmp" Found system information discovery API: "::NtQuerySystemInformation" in "00000000-00001792.00000001.307038.0138E000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00001792.00000001.307038.0138E000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00001792.00000001.307038.0138E000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00001792.00000001.307038.0138E000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001792.00000001.307038.0138E000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00001792.00000001.307038.0138E000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00001792.00000001.307038.0138E000.00000002.mdmp"41:T5c5,Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "window.chrome.webview.postMessage("ui_ready");" (Indicator: "postmessage"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "window.chrome.webview.postMessage("cancel_installation");" (Indicator: "postmessage"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "::PostMessage WM_SET_APP_LOGO failed" (Indicator: "postmessage"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "Mojo.Channel.WriteSendMessageProcessType" (Indicator: "sendmessage"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")42:Tec8,"MSID6AC.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000080) "MSID6AC.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000080) "updater.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001792) "updater.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001792) "updater.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004696) "updater.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004696)43:T553,Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")44:Tb15,Found reference to API "GetVersionExecutablePaths" (Indicator: "GetVersion"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetVersionedInstallDirectory failed." (Indicator: "GetVersion"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "IUpdater::GetVersion failed:" (Indicator: "GetVersion"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetVersion returned" (Indicator: "GetVersion"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetVersionExecutablePaths" (Indicator: "GetVersion"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetVersionedInstallDirectory failed." (Indicator: "GetVersion"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "IUpdater::GetVersion failed:" (Indicator: "GetVersion"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetVersionWW" (Indicator: "GetVersion"; Source: "00000000-00001792.00000001.307038.014B6000.00000002.mdmp")45:T8c6,"msiexec.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004572-00000C17-3415160140 "msiexec.exe" queries volume information of "C:\share" at 00000000-00004572-00000C17-3419873356 "msiexec.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005868-00000C17-3420093058 "updater.exe" queries volume information of "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\reports\ae73b3ad-b677-4c6d-8078-599f3333ffdb.dmp" at 00000000-00004696-00000C17-3450555177 "updater.exe" queries volume information of "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments\ae73b3ad-b677-4c6d-8078-599f3333ffdb\updater.log" at 00000000-00004696-00000C17-3450564238 "updater.exe" queries volume information of "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments\ae73b3ad-b677-4c6d-8078-599f3333ffdb\updater_history.jsonl" at 00000000-00004696-00000C17-3450566074 "updater.exe" queries volume information of "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\reports\ae73b3ad-b677-4c6d-8078-599f3333ffdb.dmp" at 00000000-00004696-00000C17-3450569086 "updater.exe" queries volume information of "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments\ae73b3ad-b677-4c6d-8078-599f3333ffdb\updater.log" at 00000000-00004696-00000C17-3450571372 "updater.exe" queries volume information of "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments\ae73b3ad-b677-4c6d-8078-599f3333ffdb\updater_history.jsonl" at 00000000-00004696-00000C17-3450573178 "updater.exe" queries volume information of "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\reports\ae73b3ad-b677-4c6d-8078-599f3333ffdb.dmp" at 00000000-00004696-00000C17-3450577075 "updater.exe" queries volume information of "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments\ae73b3ad-b677-4c6d-8078-599f3333ffdb\updater.log" at 00000000-00004696-00000C17-3450579283 "updater.exe" queries volume information of "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments\ae73b3ad-b677-4c6d-8078-599f3333ffdb\updater_history.jsonl" at 00000000-00004696-00000C17-345058102946:T9cf,"MSID6AC.tmp" called "CreateDirectoryW" with parameter %WINDIR%\SystemTemp\Google80_1960250237 (UID: 00000000-00000080) "MSID6AC.tmp" called "CreateDirectoryW" with parameter %WINDIR%\SystemTemp\Google80_593720390 (UID: 00000000-00000080) "MSID6AC.tmp" called "CreateDirectoryW" with parameter %WINDIR%\SystemTemp\Google80_593720390\bin (UID: 00000000-00000080) "MSID6AC.tmp" called "CreateDirectoryW" with parameter %WINDIR%\SystemTemp\Google80_593720390\bin/Offline (UID: 00000000-00000080) "MSID6AC.tmp" called "CreateDirectoryW" with parameter %WINDIR%\SystemTemp\Google80_593720390\bin/Offline/{b0aa1e03-87ad-415f-bf76-cc7bf36e0115} (UID: 00000000-00000080) "MSID6AC.tmp" called "CreateDirectoryW" with parameter %WINDIR%\SystemTemp\Google80_593720390\bin/Offline/{b0aa1e03-87ad-415f-bf76-cc7bf36e0115}/{8A69D345-D564-463c-AFF1-A69D9E530F96} (UID: 00000000-00000080) "updater.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Google\GoogleUpdater\157.0.8089.0 (UID: 00000000-00001792) "updater.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad (UID: 00000000-00001792) "updater.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\reports (UID: 00000000-00001792) "updater.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments (UID: 00000000-00001792) "updater.exe" called "CreateDirectoryW" with parameter %WINDIR%\SystemTemp\Google1792_606284414 (UID: 00000000-00001792) "updater.exe" called "CreateDirectoryW" with parameter %WINDIR%\SystemTemp\Google1792_606284414\1792_6077804 (UID: 00000000-00001792) "updater.exe" called "CreateDirectoryW" with parameter %WINDIR%\SystemTemp\Google1792_606284414\1792_1640964646 (UID: 00000000-00001792) "updater.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad (UID: 00000000-00004696) "updater.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\reports (UID: 00000000-00004696) "updater.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments (UID: 00000000-00004696) "updater.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments\ae73b3ad-b677-4c6d-8078-599f3333ffdb (UID: 00000000-00004696)47:Tcdb,"MSID6AC.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00000080) "MSID6AC.tmp" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00000080) "MSID6AC.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000080) "MSID6AC.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000080) "MSID6AC.tmp" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000080) "MSID6AC.tmp" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000080) "MSID6AC.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000080) "MSID6AC.tmp" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00000080) "MSID6AC.tmp" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000080) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00001792) "updater.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00001792) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001792) "updater.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001792) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001792) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001792) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001792) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00001792) "updater.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntmarta.dll (UID: 00000000-00001792) "updater.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001792) "updater.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001792) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004696) "updater.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004696) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004696) "updater.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004696) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004696) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004696) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004696) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00004696) "updater.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004696) "updater.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004696) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-power-base-l1-1-0.dll (UID: 00000000-00004696)48:T26d0,"MSID6AC.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00000080) "MSID6AC.tmp" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00000080) "updater.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter AccProvGetCapabilities (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001792) "updater.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter NtSuspendProcess (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter RtlGetUnloadEventTraceEx (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter CallNtPowerInformation (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter NtQueryObject (UID: 00000000-00004696) "updater.exe" called "GetProcAddress" with a parameter NtResumeProcess (UID: 00000000-00004696)49:T594,Found reference to API "CreateDirectory failed while reversing removal of" (Indicator: "CreateDirectory"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "CreateDirectoryAndGetError" (Indicator: "CreateDirectory"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "3593494,8104,3135,,CreateDirectoryW,kernel32.dll,"01:19:55.140",RX=0,PX=0" (Indicator: "CreateDirectory"; Source: "00000000-00001792.00000000.306901.00A50000.00000004.mdmp") Found reference to API "CreateDirectory failed while reversing removal of" (Indicator: "CreateDirectory"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "CreateDirectoryAndGetError" (Indicator: "CreateDirectory"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "Directory::CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")4a:T56c,Found reference to API "CreateFileW failed" (Indicator: "CreateFile"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "kRetryCreateFileMappingOnCommitLimit" (Indicator: "CreateFile"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "kRetryCreateFileMappingOnCommitLimit" (Indicator: "CreateFile"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")4b:T474,Found reference to API "CommandLineToArgv" (Indicator: "CommandLineToArgv"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "CommandLineToArgv" (Indicator: "CommandLineToArgv"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")4c:T4c7,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")4d:T928,Process msiexec.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4572:304:WilStaging_02" Process msiexec.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4572:304:WilStaging_02" Process msiexec.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4572:120:WilError_03" Process msiexec.exe created mutex with name "\BaseNamedObjects\MSILOG_0c5a85b61dd716eGOL.2cbb8ISM_pmeT_lacoL_ataDppA_ayuk1ND_sresU_:C" Process msiexec.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4572:120:WilError_03" Process msiexec.exe created mutex with name "SM0:4572:304:WilStaging_02" Process msiexec.exe created mutex with name "Local\SM0:4572:304:WilStaging_02" Process msiexec.exe created mutex with name "Local\SM0:4572:120:WilError_03" Process msiexec.exe created mutex with name "SM0:4572:120:WilError_03" Process msiexec.exe created mutex with name "\BaseNamedObjects\_MSIExecute" Process msiexec.exe created mutex with name "\BaseNamedObjects\SM0:5868:304:WilStaging_02" Process msiexec.exe created mutex with name "\BaseNamedObjects\Local\SM0:5868:304:WilStaging_02" Process msiexec.exe created mutex with name "\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process msiexec.exe created mutex with name "\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process msiexec.exe created mutex with name "\BaseNamedObjects\SM0:5868:120:WilError_03" Process MsiExec.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4480:168:WilStaging_02" Process MsiExec.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4480:168:WilStaging_02" Process MsiExec.exe created mutex with name "SM0:4480:168:WilStaging_02" Process MsiExec.exe created mutex with name "Local\SM0:4480:168:WilStaging_02" Process MSID6AC.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:80:168:WilStaging_02" Process MSID6AC.tmp created mutex with name "SM0:80:168:WilStaging_02" Process updater.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1792:168:WilStaging_02" Process updater.exe created mutex with name "SM0:1792:168:WilStaging_02" Process updater.exe created mutex with name "SM0:1792:64:WilError_03" Process updater.exe created mutex with name "Local\SM0:1792:168:WilStaging_02"4e:T16f6,"Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Google\Update\ClientState\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp ":Software\Google\Update\ClientStateMedium\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Google\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Google\Update\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Google\Update\Clients\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Policies\Google\Update\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Classes\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Classes\CLSID\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Classes\AppID\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Classes\Interface\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Classes\TypeLib\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "SYSTEM\CurrentControlSet\Services" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Policies\Google\CloudManagement\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Policies\Google\Chrome\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Google\Enrollment\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "Software\Google\\Chrome\Enrollment\" in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001792.00000000.306901.00A50000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesc" in Source: 00000000-00001792.00000000.306901.00A50000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001792.00000001.307038.00A50000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesc" in Source: 00000000-00001792.00000001.307038.00A50000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Policies\Microsoft\Edge\WebView2\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Google\Update\ClientState\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Google\Update\ClientStateMedium\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Google\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Google\Update\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Google\Update\Clients\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Policies\Google\Update\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Classes\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Classes\CLSID\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Classes\AppID\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Classes\Interface\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Classes\TypeLib\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "SYSTEM\CurrentControlSet\Services" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Setup\State" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Policies\Google\CloudManagement\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Policies\Google\Chrome\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Google\Enrollment\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "Software\Google\\Chrome\Enrollment\" in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp "istry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updater.exe" in Source: 00000000-00004696.00000001.307051.00780000.00000004.mdmp4f:T9ba,"MSID6AC.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74210000 "MSID6AC.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 76550000 "MSID6AC.tmp" loaded module "BCRYPTPRIMITIVES.DLL" at base 769e0000 "MSID6AC.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76550000 "MSID6AC.tmp" loaded module "KERNEL32" at base 75e10000 "MSID6AC.tmp" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76550000 "MSID6AC.tmp" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76550000 "MSID6AC.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76550000 "MSID6AC.tmp" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 76490000 "MSID6AC.tmp" loaded module "KERNEL32.DLL" at base 75e10000 "MSID6AC.tmp" loaded module "NTDLL.DLL" at base 77220000 "MSID6AC.tmp" loaded module "KERNELBASE" at base 76550000 "MSID6AC.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74620000 "MSID6AC.tmp" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74700000 "updater.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74210000 "updater.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 76550000 "updater.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 769e0000 "updater.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76550000 "updater.exe" loaded module "KERNEL32" at base 75e10000 "updater.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76550000 "updater.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76550000 "updater.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76550000 "updater.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 76490000 "updater.exe" loaded module "RPCRT4.DLL" at base 75d50000 "updater.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 746d0000 "updater.exe" loaded module "NTMARTA.DLL" at base 746d0000 "updater.exe" loaded module "KERNEL32.DLL" at base 75e10000 "updater.exe" loaded module "NTDLL.DLL" at base 77220000 "updater.exe" loaded module "KERNELBASE" at base 76550000 "updater.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74620000 "updater.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 733c0000 "updater.exe" loaded module "SSPICLI.DLL" at base 73c20000 "updater.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74720000 "updater.exe" loaded module "API-MS-WIN-POWER-BASE-L1-1-0.DLL" at base 7337000050:T5b4,Process "msiexec.exe" (UID: 00000000-00005868) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PSModulePath, APPDATA, USERNAME, Path, PATHEXT, TEMP, USERPROFILE, TMP" Process "msiexec.exe" (UID: 00000000-00005868) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, PROMPT, OneDrive, EFC_5376, HOMEPATH, HOMEDRIVE" Process "MsiExec.exe" (UID: 00000000-00004480) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\DN1kuya", HOMEDRIVE="C:"" Process "MsiExec.exe" (UID: 00000000-00004480) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "updater.exe" (UID: 00000000-00001792) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-8LD9T6N", PROCESSOR_ARCHITEW6432="AMD64"" Process "updater.exe" (UID: 00000000-00001792) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "MsiExec.exe" (UID: 00000000-00003480) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "MsiExec.exe" (UID: 00000000-00003480) was launched with missing environment variables: "USERDNSDOMAIN, PROCESSOR_ARCHITEW6432"51:T538,Found reference to API "sgnScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WebView2: CoreWebView2Environment failed when trying to LoadLibrary: hr=0x" (Indicator: "LoadLibrary"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "sgnScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")52:Ta62,"157.0.8103.51_chrome_installer.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 6 sections"- Location: [%WINDIR%\SystemTemp\Google80_593720390\bin\Offline\{b0aa1e03-87ad-415f-bf76-cc7bf36e0115}\{8A69D345-D564-463c-AFF1-A69D9E530F96}\157.0.8103.51_chrome_installer.exe]- [targetUID: 00000000-00000080] "updater.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 9 sections"- Location: [%WINDIR%\SystemTemp\Google80_593720390\bin\updater.exe]- [targetUID: 00000000-00000080] "uninstall.cmd" has type "DOS batch file ASCII text with CRLF line terminators"- Location: [%WINDIR%\SystemTemp\Google80_593720390\bin\uninstall.cmd]- [targetUID: 00000000-00000080] "updater.7z" has type "7-zip archive data version 0.4"- Location: [%WINDIR%\SystemTemp\Google80_593720390\updater.7z]- [targetUID: 00000000-00000080] "UPDATER.PACKED.7Z" has type "7-zip archive data version 0.4"- Location: [%WINDIR%\SystemTemp\Google80_1960250237\UPDATER.PACKED.7Z]- [targetUID: 00000000-00000080] "updater_history.jsonl" has type "New Line Delimited JSON text data"- Location: [%PROGRAMFILES%\(x86)\Google\GoogleUpdater\updater_history.jsonl]- [targetUID: 00000000-00004696] "updater_history.jsonl" has type "New Line Delimited JSON text data"- Location: [%PROGRAMFILES%\(x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments\ae73b3ad-b677-4c6d-8078-599f3333ffdb\updater_history.jsonl]- [targetUID: 00000000-00004696] "ae73b3ad-b677-4c6d-8078-599f3333ffdb.dmp" has type "Mini DuMP crash report 11 streams Tue Nov 10 23:48:53 2026 0 type"- Location: [%PROGRAMFILES%\(x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\reports\ae73b3ad-b677-4c6d-8078-599f3333ffdb.dmp]- [targetUID: 00000000-00004696] "updater.log" has type "ASCII text with very long lines (880)"- Location: [%PROGRAMFILES%\(x86)\Google\GoogleUpdater\updater.log]- [targetUID: 00000000-00000080] "updater.log" has type "ASCII text with very long lines (880)"- Location: [%PROGRAMFILES%\(x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments\ae73b3ad-b677-4c6d-8078-599f3333ffdb\updater.log]- [targetUID: 00000000-00000080] "OfflineManifest.gup" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%WINDIR%\SystemTemp\Google80_593720390\bin\Offline\{b0aa1e03-87ad-415f-bf76-cc7bf36e0115}\OfflineManifest.gup]- [targetUID: 00000000-00000080] "metadata" has type "data"- Location: [%PROGRAMFILES%\(x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\metadata]- [targetUID: 00000000-00004696] "settings.dat" has type "data"- Location: [%PROGRAMFILES%\(x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\settings.dat]- [targetUID: 00000000-00004696]53:Taa8,"msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 0) "msiexec.exe" monitors "HKCU_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1) "msiexec.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1)54:T4a4,"MSID6AC.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "MSID6AC.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "MSID6AC.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "MSID6AC.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "MSID6AC.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "MSID6AC.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "MSID6AC.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "MSID6AC.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "MSID6AC.tmp" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "MSID6AC.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")55:Ta58,"MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "MSID6AC.TMP"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BF30465B-E93C-46FD-9CDF-F41C8904A01F"; Value: "") "MSID6AC.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C1376338-0984-48B8-B933-9C7D779FD84D"; Value: "")56:T4ce,Found reference to API "RegisterTaskDefinition failed:" (Indicator: "RegisterTask"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "RegisterTaskDefinition failed:" (Indicator: "RegisterTaskDefinition"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "RegisterTaskDefinition" (Indicator: "RegisterTask"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "RegisterTaskDefinition" (Indicator: "RegisterTaskDefinition"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "RegisterTaskDefinition failed:" (Indicator: "RegisterTask"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "RegisterTaskDefinition failed:" (Indicator: "RegisterTaskDefinition"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "RegisterTaskDefinition" (Indicator: "RegisterTask"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "RegisterTaskDefinition" (Indicator: "RegisterTaskDefinition"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")57:T5ec,"msiexec.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\SYSTEM32\AcLayers.DLL" "msiexec.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "msiexec.exe" trying to touch file "C:\WINDOWS\system32\oleaut32.dll" "msiexec.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\FLTLIB.DLL" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\MSVCP140.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\VCRUNTIME140.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\VCRUNTIME140_1.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\msiexec.exe" "msiexec.exe" trying to touch file "\Global??\FltMgrMsg" "msiexec.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\msiexec.exe.Local\" "msiexec.exe" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_270f70857386168e\COMCTL32.DLL" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\msi.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\bcrypt.dll" "msiexec.exe" trying to touch file "\Device\KsecDD" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\srpapi.dll" "msiexec.exe" trying to touch file "\Device\CNG" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\MsiMsg.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\system32\uxtheme.dll"58:T6b5,"MSID6AC.tmp" touched file "C:\Program Files (x86)\Google\GoogleUpdater\6008b36d-9b10-4a08-bd1e-efff6942b5e0.tmp" "MSID6AC.tmp" touched file "C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "updater.exe" touched file "C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "updater.exe" touched file "C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" "updater.exe" touched file "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad" "updater.exe" touched file "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\reports" "updater.exe" touched file "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments" "updater.exe" touched file "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\metadata" "updater.exe" touched file "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\uninstall.cmd" "updater.exe" touched file "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\updater.exe" "updater.exe" touched file "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\settings.dat" "updater.exe" touched file "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\reports\ae73b3ad-b677-4c6d-8078-599f3333ffdb.dmp" "updater.exe" touched file "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments\ae73b3ad-b677-4c6d-8078-599f3333ffdb\updater.log" "updater.exe" touched file "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments\ae73b3ad-b677-4c6d-8078-599f3333ffdb" "updater.exe" touched file "C:\Program Files (x86)\Google\GoogleUpdater\157.0.8089.0\Crashpad\attachments\ae73b3ad-b677-4c6d-8078-599f3333ffdb\updater_history.jsonl"59:T880,"msiexec.exe" trying to access non-existent file "C:\WINDOWS\system32\TSAPPCMP.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "MsiExec.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "MsiExec.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "MSID6AC.tmp" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "MSID6AC.tmp" trying to access non-existent file "C:\WINDOWS\Installer\SSPICLI.DLL" "MSID6AC.tmp" trying to access non-existent file "C:\WINDOWS\Installer\FLTLIB.DLL" "MSID6AC.tmp" trying to access non-existent file "C:\WINDOWS\Installer\MSVCP140.dll" "MSID6AC.tmp" trying to access non-existent file "C:\WINDOWS\Installer\VCRUNTIME140.dll" "MSID6AC.tmp" trying to access non-existent file "C:\WINDOWS\Installer\CRYPTSP.DLL" "MSID6AC.tmp" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "updater.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "updater.exe" trying to access non-existent file "C:\WINDOWS\SystemTemp\Google80_593720390\bin\dbghelp.dll" "updater.exe" trying to access non-existent file "C:\WINDOWS\SystemTemp\Google80_593720390\bin\MSIMG32.dll" "updater.exe" trying to access non-existent file "C:\WINDOWS\SystemTemp\Google80_593720390\bin\WTSAPI32.dll" "updater.exe" trying to access non-existent file "C:\WINDOWS\SystemTemp\Google80_593720390\bin\Secur32.dll" "updater.exe" trying to access non-existent file "C:\WINDOWS\SystemTemp\Google80_593720390\bin\UxTheme.dll" "updater.exe" trying to access non-existent file "C:\WINDOWS\SystemTemp\Google80_593720390\bin\USERENV.dll" "updater.exe" trying to access non-existent file "C:\WINDOWS\SystemTemp\Google80_593720390\bin\WINHTTP.dll" "updater.exe" trying to access non-existent file "C:\WINDOWS\SystemTemp\Google80_593720390\bin\WINMM.dll"5a:Ta06,Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")5b:Tad6,Found reference to API "GetNamedPipeClientSessionId" (Indicator: "GetNamedPipe"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetNamedPipeServerProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "GetNamedPipeClientProcessId failed" (Indicator: "GetNamedPipe"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetNamedPipeServerProcessId failed" (Indicator: "GetNamedPipe"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "ImpersonateNamedPipeClient" (Indicator: "ImpersonateNamedPipeClient"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "::GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetNamedPipeClientSessionId" (Indicator: "GetNamedPipe"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "GetNamedPipeServerProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")5c:Tf6f,Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp")5d:T19a1,Found URL "http://dl.google.com/edgedl/chrome/install/157.0.8103.51/" - Source: "00000000-00000080.00000000.306194.40554000.00000004.mdmp") Found URL "http://www.google.com" - Source: "00000000-00000080.00000000.306194.40554000.00000004.mdmp") Found URL "http://www.google.com/" - Source: "00000000-00000080.00000000.306194.40554000.00000004.mdmp") Found URL "https://update.googleapis.com/service/update2/jsonhttps://clients2.google.com/cr/reporthttps://dl.google.com/update2/installers/icons/https://play.googleapis.com/logdg/5sjqdmngu5+aj5hyrgyk1oem9xi1p3nnpt8l63cw=" - Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespacexmlnshttp://www.w3.org/2000/xmlns/..\..\components\named_mojo_ipc_server\named_mojo_message_pipe_server.ccstartserverprocess" - Source: "00000000-00000080.00000001.307063.00984000.00000002.mdmp") Found URL "http://support.google.com/installer/%s?product=%s&error=%d" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "https://update.googleapis.com/service/update2/jsonhttps://clients2.google.com/cr/reporthttps://dl.google.com/update2/installers/icons/https://play.googleapis.com/logdg/5sjqdmngu5+aj5hyrgyk1oem9xi1p3nnpt8l63cw=" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://applicationslink" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://navigation" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://px;" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "https://www.world" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://www.years" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://interested" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://familiar" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "https://was" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "https://ain" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://whether" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://interpreted" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://);" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://.jpg" - Source: "00000000-00001792.00000001.307038.0138E000.00000002.mdmp") Found URL "http://\" (Indicator: \"SHA512\"; File: \"googlechromestandaloneenterprise64.msi\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 73BA0000\n \"MSID6AC.tmp\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 73D50000\n \"updater.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 73D50000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"msiexec.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"msiexec.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"MSID6AC.tmp\" renamed original file\"C:\\Program Files (x86)\\Google\\GoogleUpdater\\updater.log\" to \"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\updater.log.old\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"updater.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\Installer\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000080.00000000.306194.0EFC0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000080.00000000.306194.0EFC0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001792.00000000.306901.00A50000.00000004.mdmp, 00000000-00001792.00000001.307038.00A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match – cryptographic algorithms\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$3c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004696-00000C2C-3449485776\")\n Found reference to API \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"file/memory contains long string(File: \"uninstall.cmd\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004696-00000C2C-3449485776\")\n Found string \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found string \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"updater.exe\" called \"NtSuspendProcess\" with parameters (UID: 00000000-00004696)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"MSID6AC.tmp\" called \"QueryPerformanceCounter\" (UID: 00000000-00000080)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"msiexec.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004572)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"MSID6AC.tmp\" called \"IsWow64Process\" with parameter \"80\" - (UID: 00000000-00000080)\n \"updater.exe\" called \"IsWow64Process\" with parameter \"1792\" - (UID: 00000000-00001792)\n \"updater.exe\" called \"IsWow64Process\" with parameter \"4696\" - (UID: 00000000-00004696)\n \"updater.exe\" called \"IsWow64Process\" with parameter \"1792\" - (UID: 00000000-00004696)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"MSID6AC.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000080)\n \"updater.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001792)\n \"updater.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004696)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$42","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"::IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"MSID6AC.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"updater.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"msiexec.exe\" queried token user identity (UID: 00000000-00004572)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$45","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"updater.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"::OpenSCManager Failed\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"OpenSCManager\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"::OpenSCManager Failed\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"OpenSCManager\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"updater.exe\" called \"CopyFileW\" to copy %WINDIR%\\SystemTemp\\Google80_593720390\\bin\\uninstall.cmd to new location %PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\uninstall.cmd (UID: 00000000-00001792)\n \"updater.exe\" called \"CopyFileW\" to copy %WINDIR%\\SystemTemp\\Google80_593720390\\bin\\updater.exe to new location %PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\updater.exe (UID: 00000000-00001792)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$46","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"MSID6AC.tmp\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\updater.exe\" --silent --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={\" - (UID: 00000000-00000080)\n \"updater.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\updater.exe --crash-handler --system \"--database=%PROGRAMFILES%\\(x86)\\Google\\Google\" - (UID: 00000000-00001792)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"updater.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\crashpad_1792_GVSHXCQSKHVPFZUS\" - (UID: 00000000-00001792)\n \"updater.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\crashpad_1792_GVSHXCQSKHVPFZUS\" - (UID: 00000000-00004696)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$47","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"\"MSID6AC.tmp\" called \"MoveFileW\" with parameter %PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\updater.log & %PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\updater.log.old (UID: 00000000-00000080)","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$48","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteAndWait\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \": ::ShellExecuteEx failed\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileEx failed while reversing movement of\" (Indicator: \"MoveFile\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"MoveFileEx failed while reversing movement of\" (Indicator: \"MoveFile\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$4d","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"157.0.8103.51_chrome_installer.exe\" as clean (type is \"PE32+ executable for MS Windows 10.00 (GUI) x86-64 6 sections\"), Antivirus vendors marked dropped file \"updater.exe\" as clean (type is \"PE32 executable for MS Windows 10.00 (GUI) Intel i386 9 sections\"), Antivirus vendors marked dropped file \"uninstall.cmd\" as clean (type is \"DOS batch file ASCII text with CRLF line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\crashpad_1792_GVSHXCQSKHVPFZUS\n Found string - \\\\.\\pipe\\crashpad_%lu_","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4e","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 7F4D0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 80010000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 769E0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73F30000\n \"MSID6AC.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 769E0000\n \"updater.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 769E0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 4C9B0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 820C0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75D50000\n \"MSID6AC.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75D50000\n \"updater.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75D50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"googlechromestandaloneenterprise64.msi\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"googlechromestandaloneenterprise64.msi\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"updater.exe\" touched \"TaskScheduler class\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\updater.exe\" [Source: 00000000-00000080-00000BC0-3443526518]\n Observed system executable string:\"\"%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\updater.exe\" --silent --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={\" [Source: 00000000-00000080-00000C47-26132565630]\n Observed system executable string:\"%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\updater.exe --crash-handler --system \"--database=%PROGRAMFILES%\\(x86)\\Google\\Google\" [Source: 00000000-00001792-00000C47-2983721556], Observed system executable string:\"%WINDIR%\\SystemTemp\\Google1792_606284414\\1792_1640964646\\updater.exe\" [Source: 00000000-00001792-00000C59-3448346358]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$50","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"MSID6AC.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"MSID6AC.tmp\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SCURRENCY\")\n \"MSID6AC.tmp\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"ICALENDARTYPE\")\n \"MSID6AC.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"MSID6AC.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"updater.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"updater.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SCURRENCY\")\n \"updater.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"ICALENDARTYPE\")\n \"updater.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"updater.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00005868)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding B3E9B1006981A4458A8F5D70C6C9C109\" (UID: 00000000-00004480)\n Spawned process \"MSID6AC.tmp\" with commandline \"--silent --install=\"appguid={8A69D345-D564-463C-AFF1-A69D9E530F9 ...\" (UID: 00000000-00000080), Spawned process \"updater.exe\" with commandline \"--silent --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96 ...\" (UID: 00000000-00001792), Spawned process \"updater.exe\" with commandline \"--crash-handler --system \"--database=%PROGRAMFILES%\\\\(x86)\\\\Goog ...\" (UID: 00000000-00004696)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding A144A2495AD66CB83EAC68A17D879714 E Global\\\\MSI0000\" (UID: 00000000-00003480)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00005868)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding B3E9B1006981A4458A8F5D70C6C9C109\" (UID: 00000000-00004480)\n Spawned process \"MSID6AC.tmp\" with commandline \"--silent --install=\"appguid={8A69D345-D564-463C-AFF1-A69D9E530F9 ...\" (UID: 00000000-00000080), Spawned process \"updater.exe\" with commandline \"--silent --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96 ...\" (UID: 00000000-00001792), Spawned process \"updater.exe\" with commandline \"--crash-handler --system \"--database=%PROGRAMFILES%\\\\(x86)\\\\Goog ...\" (UID: 00000000-00004696)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding A144A2495AD66CB83EAC68A17D879714 E Global\\\\MSI0000\" (UID: 00000000-00003480)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"RegisterServiceCtrlHandler failed\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to schedule tasks using COM objects","description":"Observed string: \"CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\" (Indicator: \"clsid\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\") in Source: 00000000-00001792.00000001.307038.00A50000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":3,"id":"string-400","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"msiexec.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"MsiExec.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"MSID6AC.tmp\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$52","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"OfflineManifest.gup\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\Offline\\{b0aa1e03-87ad-415f-bf76-cc7bf36e0115}\\OfflineManifest.gup]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$53","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$54","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"msiexec.exe\" queries basic process information of the \"C:\\Windows\\System32\\msiexec.exe\" (UID: 4572)\n \"msiexec.exe\" queries basic process information of the \"C:\\Windows\\System32\\msiexec.exe\" (UID: 5868)\n \"msiexec.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\msiexec.exe\" (UID: 5868)\n \"msiexec.exe\" queries basic process information of the \"C:\\Windows\\Installer\\MSID6AC.tmp\" (UID: 5868)\n \"MsiExec.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\msiexec.exe\" (UID: 4480)\n \"MSID6AC.tmp\" queries basic process information of the \"C:\\Windows\\Installer\\MSID6AC.tmp\" (UID: 80)\n \"MSID6AC.tmp\" queries basic process information of the \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\updater.exe\" (UID: 80)\n \"updater.exe\" queries basic process information of the \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\updater.exe\" (UID: 1792)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$55","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"MSID6AC.tmp\" reads file \"c:\\windows\\systemtemp\\google80_1960250237\\updater.packed.7z\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"References task scheduler-related strings","description":"$56","origin":"File/Memory","mitre_attack_id":"T1053","relevance":1,"id":"string-401","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$57","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$58","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"MSID6AC.tmp\" touched file \"C:\\Windows\\SystemTemp\\Google80_1960250237\\UPDATER.PACKED.7Z\"\n \"MSID6AC.tmp\" touched file \"C:\\Windows\\SystemTemp\\Google80_593720390\\updater.7z\"\n \"MSID6AC.tmp\" touched file \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\Offline\\{b0aa1e03-87ad-415f-bf76-cc7bf36e0115}\\OfflineManifest.gup\"\n \"MSID6AC.tmp\" touched file \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\Offline\\{b0aa1e03-87ad-415f-bf76-cc7bf36e0115}\\{8A69D345-D564-463c-AFF1-A69D9E530F96}\\157.0.8103.51_chrome_installer.exe\"\n \"MSID6AC.tmp\" touched file \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\uninstall.cmd\"\n \"MSID6AC.tmp\" touched file \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\updater.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$59","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"msiexec.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\msiexec.exe.Local\\\"\n \"msiexec.exe\" trying to access non-existent file \"A:\"\n \"msiexec.exe\" trying to access non-existent file \"B:\"\n \"msiexec.exe\" trying to access non-existent file \"D:\"\n \"msiexec.exe\" trying to access non-existent file \"E:\"\n \"msiexec.exe\" trying to access non-existent file \"F:\"\n \"msiexec.exe\" trying to access non-existent file \"G:\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"MSID6AC.tmp\" writes file \"c:\\program files (x86)\\google\\googleupdater\\updater.log\"\n \"MSID6AC.tmp\" writes file \"c:\\windows\\systemtemp\\google80_1960250237\\updater.packed.7z\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"MSID6AC.tmp\" writes a file \"C:\\Program Files (x86)\\Google\\GoogleUpdater\\updater.log\"\n \"MSID6AC.tmp\" writes a file \"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\updater.log\"\n \"updater.exe\" writes a file \"C:\\Program Files (x86)\\Google\\GoogleUpdater\\updater.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Network Related","name":"Able to check internet connectivity using ping command","description":"file/memory contains long string with (Indicator: \"ping -\"; File: \"uninstall.cmd\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found string \"ping 0, Ge\" (Indicator: \"ping \"; Source: \"00000000-00001792.00000000.306901.05950000.00000004.mdmp, 00000000-00001792.00000001.307038.05950000.00000004.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"--%s%sContent-Disposition: form-data; name=\"%s\"\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"Fhttps://update.googleapis.com/service/update2/json\" (Indicator: \".googleapis.com\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found string \"https://play.googleapis.com/log\" (Indicator: \".googleapis.com\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found string \"Fhttps://update.googleapis.com/service/update2/json\" (Indicator: \".googleapis.com\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found string \"https://play.googleapis.com/log\" (Indicator: \".googleapis.com\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"6.0.2.0\" found in string \"WiX Toolset (6.0.2.0)\"\n \"0.0.0.0\"\n Potential IP \"1.3.2.1\" found in string \"1.3.2.1-motley\"\n \"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001792.00000000.306901.00A50000.00000004.mdmp, 00000000-00001792.00000001.307038.00A50000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLED4C9EB21175BD681626FA524E979]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001792.00000000.306901.00A50000.00000004.mdmp, 00000000-00001792.00000001.307038.00A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001792.00000000.306901.00A50000.00000004.mdmp, 00000000-00001792.00000001.307038.00A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"MSID6AC.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"updater.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"updater.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"updater.exe\" called \"GetComputerNameW\" (UID: 00000000-00001792)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"MSID6AC.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}\n \"updater.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"updater.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"file/memory contains long string with (Indicator: \"findstr \"; File: \"uninstall.cmd\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwords\" (Indicator: \"password\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found string \"passwords\" (Indicator: \"password\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found string \"passwords/manual_filling_controller/0x?\" (Indicator: \"password\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"secret\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found string \"stratesecretar\" (Indicator: \"secret\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$66","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\"\n Found registry deletion API: \"NtDeleteKey\" in \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\"\n Found registry deletion API: \"NtDeleteKey\" in \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$67","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00000080.00000001.307063.00984000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001792.00000001.307038.0138E000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"googlechromestandaloneenterprise64.msi\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"msiexec.exe\" opened \"\\Device\\KsecDD\"\n \"MsiExec.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"MSID6AC.tmp\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-18\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEMTEMP\\GOOGLE80_593720390\\BIN\\UPDATER.EXE\"; Value: \"\")\n \"updater.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-18\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEMTEMP\\GOOGLE80_593720390\\BIN\\UPDATER.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$6b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Attempts to access unusual system drive letters","description":"\"msiexec.exe\" touched \"K:\"\n \"msiexec.exe\" touched \"L:\"\n \"msiexec.exe\" touched \"M:\"\n \"msiexec.exe\" touched \"N:\"\n \"msiexec.exe\" touched \"O:\"\n \"msiexec.exe\" touched \"P:\"\n \"msiexec.exe\" touched \"Q:\"","origin":"API Call","mitre_attack_id":"T1120","relevance":7,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00000080.00000001.307063.00984000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001792.00000001.307038.0138E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"MSID6AC.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"updater.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"updater.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\TYPELIB\\{18BAD37E-7352-5807-A52D-3DE45685C036}\\1.0\\0\\WIN32\"; Key: \"(DEFAULT)\"; Value: \"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\updater.exe\\5\"), \"updater.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\TYPELIB\\{18BAD37E-7352-5807-A52D-3DE45685C036}\\1.0\\0\\WIN64\"; Key: \"(DEFAULT)\"; Value: \"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\updater.exe\\5\"), \"updater.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\TYPELIB\\{47684956-E38D-5054-B7C0-647972248642}\\1.0\\0\\WIN32\"; Key: \"(DEFAULT)\"; Value: \"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\updater.exe\\5\"), \"updater.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\TYPELIB\\{47684956-E38D-5054-B7C0-647972248642}\\1.0\\0\\WIN64\"; Key: \"(DEFAULT)\"; Value: \"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\updater.exe\\5\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"$6c","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"updater.exe queries ProcessDebugPort (UID: 1792)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\Offline\\{b0aa1e03-87ad-415f-bf76-cc7bf36e0115}\\{8A69D345-D564-463c-AFF1-A69D9E530F96}\\157.0.8103.51_chrome_installer.exe\" has high entropy 7.99967\n Dropped file \"%WINDIR%\\SystemTemp\\Google80_593720390\\updater.7z\" has high entropy 7.99965\n Dropped file \"%WINDIR%\\SystemTemp\\Google80_1960250237\\UPDATER.PACKED.7Z\" has high entropy 7.99965","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Drops compressed file on the system","description":"\"updater.7z\" has type \"7-zip archive data version 0.4\"\n \"UPDATER.PACKED.7Z\" has type \"7-zip archive data version 0.4\"","origin":"Binary File","mitre_attack_id":"T1027.015","relevance":1,"id":"binary-84","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"157.0.8103.51_chrome_installer.exe\" has type \"PE32+ executable for MS Windows 10.00 (GUI) x86-64 6 sections\"- Location: [%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\Offline\\{b0aa1e03-87ad-415f-bf76-cc7bf36e0115}\\{8A69D345-D564-463c-AFF1-A69D9E530F96}\\157.0.8103.51_chrome_installer.exe]- [targetUID: 00000000-00000080]\n \"updater.exe\" has type \"PE32 executable for MS Windows 10.00 (GUI) Intel i386 9 sections\"- Location: [%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\updater.exe]- [targetUID: 00000000-00000080]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"MSID6AC.tmp\" wrote 36352 bytes starting with PE header signature to file \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\Offline\\{b0aa1e03-87ad-415f-bf76-cc7bf36e0115}\\{8A69D345-D564-463c-AFF1-A69D9E530F96}\\157.0.8103.51_chrome_installer.exe\": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0600 ...\n \"MSID6AC.tmp\" wrote 16896 bytes starting with PE header signature to file \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\updater.exe\": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010900 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"updater.exe\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"updater.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$6d","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"MSID6AC.tmp\" marked \"C:\\Program Files (x86)\\Google\\GoogleUpdater\\6008b36d-9b10-4a08-bd1e-efff6942b5e0.tmp\" for deletion\n \"MSID6AC.tmp\" marked \"C:\\Windows\\SystemTemp\\Google80_593720390\\updater.7z\" for deletion\n \"MSID6AC.tmp\" marked \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\Offline\\{b0aa1e03-87ad-415f-bf76-cc7bf36e0115}\\OfflineManifest.gup\" for deletion\n \"MSID6AC.tmp\" marked \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\Offline\\{b0aa1e03-87ad-415f-bf76-cc7bf36e0115}\\{8A69D345-D564-463c-AFF1-A69D9E530F96}\\157.0.8103.51_chrome_installer.exe\" for deletion\n \"MSID6AC.tmp\" marked \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\uninstall.cmd\" for deletion\n \"MSID6AC.tmp\" marked \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\updater.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$6e","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"MsiExec.exe\"\n \"Wow64Transition@NTDLL.DLL\" in \"MSID6AC.tmp\"\n \"Wow64Transition@NTDLL.DLL\" in \"updater.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"updater.log\" contains indicator \"WinHTTP\" (Line: 1; Offset: 674)\n \"updater.log\" contains indicator \"WinHTTP\" (Line: 2; Offset: 731)\n \"updater.log\" contains indicator \"WinHTTP\" (Line: 13; Offset: 713)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32+ executable for MS Windows 10.00 (GUI) x86-64 6 sections\" was dropped at \"%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\Offline\\{b0aa1e03-87ad-415f-bf76-cc7bf36e0115}\\{8A69D345-D564-463c-AFF1-A69D9E530F96}\\157.0.8103.51_chrome_installer.exe\"\n File type \"PE32 executable for MS Windows 10.00 (GUI) Intel i386 9 sections\" was dropped at \"%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\updater.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"updater.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 733C0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"MSID6AC.tmp\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\updater.exe\" (Handle: 800)\n \"MSID6AC.tmp\" wrote 00000008 bytes to a remote process \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\updater.exe\" (Handle: 800)\n \"MSID6AC.tmp\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\updater.exe\" (Handle: 800)\n \"updater.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\updater.exe\" (Handle: 744)\n \"updater.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\updater.exe\" (Handle: 744)\n \"updater.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SystemTemp\\Google80_593720390\\bin\\updater.exe\" (Handle: 744)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"updater.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00001792)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]}],"intel_graph":{"map":{"File:03d772dcf319b83404a0e94d846798d8549f51c3d1a527cb5126e738cde2c0ad":{"type":"File","value":"03d772dcf319b83404a0e94d846798d8549f51c3d1a527cb5126e738cde2c0ad"},"File:2deaa6c0765b2b0892ce90c1dca378134d125c83c1e84e42d729d98739c16b3e":{"type":"File","value":"2deaa6c0765b2b0892ce90c1dca378134d125c83c1e84e42d729d98739c16b3e"},"File:3fda938edd9b314035619e50621519d6ebb49938616716b27ba2ac885abd9b1d":{"type":"File","value":"3fda938edd9b314035619e50621519d6ebb49938616716b27ba2ac885abd9b1d"},"File:4b115cbca0849914d3d8a306ec458c5df6858dd5315c4c039ad865e3534db619":{"type":"File","value":"4b115cbca0849914d3d8a306ec458c5df6858dd5315c4c039ad865e3534db619"},"File:647a73346905ecfc5d52660653b39404475088a2df07e845b85c2a7a12bc945e":{"type":"File","value":"647a73346905ecfc5d52660653b39404475088a2df07e845b85c2a7a12bc945e"},"File:69a1ef98b68184ae68a25a45428ced6e1a564e3e193b08c27ae9029649fa150c":{"type":"File","value":"69a1ef98b68184ae68a25a45428ced6e1a564e3e193b08c27ae9029649fa150c"},"File:763a9b549c3279a3fe25f7291095e3a783d7fd20e8a92acdfca80792a467cf65":{"type":"File","value":"763a9b549c3279a3fe25f7291095e3a783d7fd20e8a92acdfca80792a467cf65"},"File:78d49cd5d11cf98fad8e1a8c0c093db03b558c20e750d0b172f7cc434d9c11bd":{"type":"File","value":"78d49cd5d11cf98fad8e1a8c0c093db03b558c20e750d0b172f7cc434d9c11bd"},"File:8d18cc57dc8474526236dacf93ca8b703c6024ff14b62a0b06de4e68d47b1f72":{"type":"File","value":"8d18cc57dc8474526236dacf93ca8b703c6024ff14b62a0b06de4e68d47b1f72"},"File:9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89":{"type":"File","value":"9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89"},"File:a38e49c0e87a9dd81682346392d45c965783c25d5ec6aaa373cb9799c2a602e2":{"type":"File","value":"a38e49c0e87a9dd81682346392d45c965783c25d5ec6aaa373cb9799c2a602e2"},"File:f9ef0a19d7039b881915f7cf381713187bc77124803814b8a57b5a72a33d9c27":{"type":"File","value":"f9ef0a19d7039b881915f7cf381713187bc77124803814b8a57b5a72a33d9c27"}},"chains":[{"id":"sandbox_files","root":"File:9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89","edges":[{"edge_kind":"extracted","from_key":"File:9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89","to_key":"File:69a1ef98b68184ae68a25a45428ced6e1a564e3e193b08c27ae9029649fa150c"},{"edge_kind":"extracted","from_key":"File:9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89","to_key":"File:a38e49c0e87a9dd81682346392d45c965783c25d5ec6aaa373cb9799c2a602e2"},{"edge_kind":"extracted","from_key":"File:9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89","to_key":"File:4b115cbca0849914d3d8a306ec458c5df6858dd5315c4c039ad865e3534db619"},{"edge_kind":"extracted","from_key":"File:9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89","to_key":"File:647a73346905ecfc5d52660653b39404475088a2df07e845b85c2a7a12bc945e"},{"edge_kind":"extracted","from_key":"File:9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89","to_key":"File:03d772dcf319b83404a0e94d846798d8549f51c3d1a527cb5126e738cde2c0ad"},{"edge_kind":"extracted","from_key":"File:9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89","to_key":"File:8d18cc57dc8474526236dacf93ca8b703c6024ff14b62a0b06de4e68d47b1f72"},{"edge_kind":"extracted","from_key":"File:9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89","to_key":"File:78d49cd5d11cf98fad8e1a8c0c093db03b558c20e750d0b172f7cc434d9c11bd"},{"edge_kind":"extracted","from_key":"File:9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89","to_key":"File:3fda938edd9b314035619e50621519d6ebb49938616716b27ba2ac885abd9b1d"},{"edge_kind":"extracted","from_key":"File:9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89","to_key":"File:f9ef0a19d7039b881915f7cf381713187bc77124803814b8a57b5a72a33d9c27"},{"edge_kind":"extracted","from_key":"File:9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89","to_key":"File:2deaa6c0765b2b0892ce90c1dca378134d125c83c1e84e42d729d98739c16b3e"},{"edge_kind":"extracted","from_key":"File:9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89","to_key":"File:763a9b549c3279a3fe25f7291095e3a783d7fd20e8a92acdfca80792a467cf65"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":36,"imported_dlls_count":110,"dropped_files_count":0,"extracted_files_count":11,"files_written_count":27,"files_deleted_count":0,"registry_keys_created_count":16,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":16,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6af3acccb59818c743092ec2","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"whitelisted","threat_score":85,"submit_name":"googlechromestandaloneenterprise64.msi","analysis_start_time":"2026-11-10T23:46:53+00:00","indicators_count":{"informative":183,"suspicious":33,"malicious":4},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}],"processes":[{"pid":4572,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\googlechromestandaloneenterprise64.msi\"","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00004572","icon":"$6f"},{"pid":5868,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00005868","icon":"$70"},{"pid":4480,"ppid":5868,"name":"MsiExec.exe","command_line":"-Embedding B3E9B1006981A4458A8F5D70C6C9C109","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00005868","uid":"00000000-00004480"},{"pid":80,"ppid":5868,"name":"MSID6AC.tmp","command_line":"--silent --install=\"appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={6A53A0E1-7CB0-475F-BCE7-776E79878891}&browser=5&usagestats=0&appname=Google%20Chrome&needsadmin=true&ap=x64-stable-statsdef_0&brand=GCEA\" --installsource=enterprisemsi --appargs=\"appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&installerdata=%7B%22distribution%22%3A%7B%22msi%22%3Atrue%2C%22system_level%22%3Atrue%2C%22verbose_logging%22%3Atrue%2C%22msi_product_id%22%3A%22D3F029FC-8F70-3482-97F1-AE0937B0EEE5%22%2C%22allow_downgrade%22%3Afalse%7D%7D\"","sha256":"dfe2cd901da389dd24f1cafe920f896d0df07b5cc744d2e1a57290d1aaa162f8","normalized_path":"%WINDIR%\\Installer\\MSID6AC.tmp","parent_uid":"00000000-00005868","uid":"00000000-00000080"},{"pid":1792,"ppid":80,"name":"updater.exe","command_line":"--silent --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={6A53A0E1-7CB0-475F-BCE7-776E79878891}&browser=5&usagestats=0&appname=Google%20Chrome&needsadmin=true&ap=x64-stable-statsdef_0&brand=GCEA --installsource=enterprisemsi --appargs=appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&installerdata=%7B%22distribution%22%3A%7B%22msi%22%3Atrue%2C%22system_level%22%3Atrue%2C%22verbose_logging%22%3Atrue%2C%22msi_product_id%22%3A%22D3F029FC-8F70-3482-97F1-AE0937B0EEE5%22%2C%22allow_downgrade%22%3Afalse%7D%7D --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2 --offlinedir={b0aa1e03-87ad-415f-bf76-cc7bf36e0115}","sha256":"c6438f11cb92a90090ceeedac75feef9e4d8b4249b75dc3854aa20f2687e6789","normalized_path":"%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\updater.exe","parent_uid":"00000000-00000080","uid":"00000000-00001792"},{"pid":4696,"ppid":1792,"name":"updater.exe","command_line":"--crash-handler --system \"--database=%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\Crashpad\" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=157.0.8089.0 \"--attachment=%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\updater.log\" \"--attachment=%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\updater_history.jsonl\" --initial-client-data=0x2d4,0x2d8,0x2dc,0x2d0,0x2e0,0x14a165c,0x14a1668,0x14a1674","sha256":"c6438f11cb92a90090ceeedac75feef9e4d8b4249b75dc3854aa20f2687e6789","normalized_path":"%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\updater.exe","parent_uid":"00000000-00001792","uid":"00000000-00004696"},{"pid":3480,"ppid":5868,"name":"MsiExec.exe","command_line":"-Embedding A144A2495AD66CB83EAC68A17D879714 E Global\\MSI0000","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00005868","uid":"00000000-00003480"}],"all_imported_dlls":["nsi.dll","vssapi.dll","RstrtMgr.dll","winmm.dll","AcLayers.dll","shlwapi.dll","advapi32.dll","rpcrt4.dll","gdi32.dll","vcruntime140.dll","fltLib.dll","SHCore.dll","profapi.dll","dhcpcsvc6.dll","rasadhlp.dll","OnDemandConnRouteHelper.dll","mscoreei.dll","vcruntime140_clr0400.dll","setupapi.dll","winnsi.dll","mscoree.dll","srclient.dll","fusion.dll","ntasn1.dll","wow64win.dll","ws2_32.dll","propsys.dll","wldp.dll","mpr.dll","VxSSL32.dll","secur32.dll","wtsapi32.dll","KernelBase.dll","uxtheme.dll","gpapi.dll","cryptnet.dll","version.dll","msihnd.dll","powrprof.dll","umpdc.dll","msi.dll","sfc_os.dll","wow64.dll","wow64cpu.dll","win32u.dll","bcryptprimitives.dll","msisip.dll","WinTypes.dll","ncrypt.dll","ServicingCommon.dll","msimg32.dll","ntmarta.dll","rsaenh.dll","mswsock.dll","pcacli.dll","wow64con.dll","kernel32.dll","msvcp_win.dll","oleaut32.dll","TextInputFramework.dll","wintrust.dll","clbcatq.dll","windows.storage.dll","wow64base.dll","msvcrt.dll","TextShaping.dll","cryptsp.dll","webio.dll","ucrtbase_clr0400.dll","sfc.dll","gdi32full.dll","shell32.dll","msasn1.dll","winhttp.dll","userenv.dll","clr.dll","dbghelp.dll","crypt32.dll","ntdll.dll","apphelp.dll","ole32.dll","imm32.dll","vcruntime140_1.dll","wkscli.dll","dnsapi.dll","ucrtbase.dll","srpapi.dll","msctf.dll","kernel.appcore.dll","netapi32.dll","cryptbase.dll","vsstrace.dll","taskschd.dll","sechost.dll","combase.dll","comctl32.dll","bcrypt.dll","dhcpcsvc.dll","sspicli.dll","FWPUCLNT.DLL","CoreMessaging.dll","user32.dll","VxSSL64.dll","coml2.dll","netutils.dll","IPHLPAPI.DLL","CoreUIComponents.dll","spp.dll","vcruntime140_1_clr0400.dll","msvcp140.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"157.0.8103.51_chrome_installer.exe","sha256":"69a1ef98b68184ae68a25a45428ced6e1a564e3e193b08c27ae9029649fa150c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"uninstall.cmd","sha256":"a38e49c0e87a9dd81682346392d45c965783c25d5ec6aaa373cb9799c2a602e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"updater.exe","sha256":"4b115cbca0849914d3d8a306ec458c5df6858dd5315c4c039ad865e3534db619","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"updater.log","sha256":"647a73346905ecfc5d52660653b39404475088a2df07e845b85c2a7a12bc945e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"updater_history.jsonl","sha256":"03d772dcf319b83404a0e94d846798d8549f51c3d1a527cb5126e738cde2c0ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"metadata","sha256":"8d18cc57dc8474526236dacf93ca8b703c6024ff14b62a0b06de4e68d47b1f72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"ae73b3ad-b677-4c6d-8078-599f3333ffdb.dmp","sha256":"78d49cd5d11cf98fad8e1a8c0c093db03b558c20e750d0b172f7cc434d9c11bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"settings.dat","sha256":"3fda938edd9b314035619e50621519d6ebb49938616716b27ba2ac885abd9b1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"UPDATER.PACKED.7Z","sha256":"f9ef0a19d7039b881915f7cf381713187bc77124803814b8a57b5a72a33d9c27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"OfflineManifest.gup","sha256":"2deaa6c0765b2b0892ce90c1dca378134d125c83c1e84e42d729d98739c16b3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"updater.7z","sha256":"763a9b549c3279a3fe25f7291095e3a783d7fd20e8a92acdfca80792a467cf65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"\\SystemRoot\\AppPatch\\msimain.sdb","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%SAMPLEDIR%\\MSI8bbc1.tmp","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\6008b36d-9b10-4a08-bd1e-efff6942b5e0.tmp","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\updater.log","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%WINDIR%\\SystemTemp\\Google80_1960250237\\UPDATER.PACKED.7Z","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%WINDIR%\\SystemTemp\\Google80_593720390\\updater.7z","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\Offline\\{b0aa1e03-87ad-415f-bf76-cc7bf36e0115}\\OfflineManifest.gup","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\Offline\\{b0aa1e03-87ad-415f-bf76-cc7bf36e0115}\\{8A69D345-D564-463c-AFF1-A69D9E530F96}\\157.0.8103.51_chrome_installer.exe","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\uninstall.cmd","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%WINDIR%\\SystemTemp\\Google80_593720390\\bin\\updater.exe","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\updater_history.jsonl","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"pipe\\crashpad_1792_GVSHXCQSKHVPFZUS","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\Crashpad","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\Crashpad\\reports","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\Crashpad\\attachments","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\Crashpad\\metadata","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\uninstall.cmd","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\updater.exe","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\Crashpad\\settings.dat","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\Crashpad\\reports\\ae73b3ad-b677-4c6d-8078-599f3333ffdb.dmp","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\Crashpad\\attachments\\ae73b3ad-b677-4c6d-8078-599f3333ffdb\\updater.log","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\Crashpad\\attachments\\ae73b3ad-b677-4c6d-8078-599f3333ffdb","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\GoogleUpdater\\157.0.8089.0\\Crashpad\\attachments\\ae73b3ad-b677-4c6d-8078-599f3333ffdb\\updater_history.jsonl","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\GOOGLE\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\GOOGLE\\UPDATE\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\GOOGLE\\UPDATE\\CLIENTS\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\GOOGLE\\UPDATE\\CLIENTS\\{44FC7FE2-65CE-487C-93F4-EDEE46EEAAAB}\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\GOOGLE\\UPDATE\\CLIENTSTATE\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\GOOGLE\\UPDATE\\CLIENTSTATE\\{44FC7FE2-65CE-487C-93F4-EDEE46EEAAAB}\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{6D40BDAD-BF13-535B-BC3B-EEEE65B1D745}\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\APPID\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\APPID\\{6D40BDAD-BF13-535B-BC3B-EEEE65B1D745}\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\INTERFACE\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\INTERFACE\\{18BAD37E-7352-5807-A52D-3DE45685C036}\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\INTERFACE\\{18BAD37E-7352-5807-A52D-3DE45685C036}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\INTERFACE\\{18BAD37E-7352-5807-A52D-3DE45685C036}\\TYPELIB\\","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4572:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\BaseNamedObjects\\MSILOG_0c5a85b61dd716eGOL.2cbb8ISM_pmeT_lacoL_ataDppA_ayuk1ND_sresU_:C","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4572:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"SM0:4572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"Local\\SM0:4572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"Local\\SM0:4572:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"SM0:4572:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\BaseNamedObjects\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\BaseNamedObjects\\SM0:5868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:5868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\BaseNamedObjects\\SM0:5868:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"SM0:4480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"Local\\SM0:4480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:80:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"SM0:80:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1792:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"SM0:1792:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"SM0:1792:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"Local\\SM0:1792:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1792:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1792:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\BaseNamedObjects\\G{A5732CF5-E5AD-47A5-8131-DC4CCA530B02}.157.0.8089.0","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4696:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"SM0:4696:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"Local\\SM0:4696:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4696:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"SM0:3480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]},{"name":"Local\\SM0:3480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3acccb59818c743092ec2"}]}]}},"report_ids":{"sandbox_job_ids":["6af3acccb59818c743092ec2"]}}}]]}] 2c:[["$","title","0",{"children":"Sample 9882b8794c34… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 9882b8794c34…. Threat score 0/100. 0/0 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89"}],["$","meta","4",{"property":"og:title","content":"Sample 9882b8794c34… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 9882b8794c34…. Threat score 0/100. 0/0 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9882b8794c342d73862865ce2bd89481edd60308b61a59e4c6f8fbaa31539d89"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 9882b8794c34… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 9882b8794c34…. Threat score 0/100. 0/0 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L71","11",{}]] 32:null