babadeda | 76b3d17196dd9e99eadd46e8bc760ec8809a0c723f66fb687ab8576dd1299e34

Analysis

max time kernel
191s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BROWSER_.exe
Size

35.1MB
MD5

edde1633579f5e1f0543140cfbfa50fb
SHA1

4233ff7941da62b86fc2c2d92be0572c9ab534c8
SHA256

23b14288d49610a8eef61977b7fc49a963f1261fe29b1668b4443a04eaf493cb
SHA512

e03a1575824ea04d30e3c3290d87e73be689014970e94ddc56f157766bc048faa5129e4589be0b8a404ce75c0fdf4301973c21cb5593a9c6006f26709507bf5c
SSDEEP

786432:SQRwdPcRZMRDY8X9XRTuCpZD7U4qRVOtIqNi0f9jphU7oDM8ETp9an3aZO:1RwdPcRZuDYg1pZfUNRctpNi0f9dhU7a

Score

10^/10

babadeda netsupport crypter evasion loader persistence rat trojan

Malware Config

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 2 IoCs

resource	yara_rule
behavioral2/memory/1720-226-0x00000000189B0000-0x000000001CEB0000-memory.dmp	family_babadeda
behavioral2/memory/1720-228-0x00000000189B0000-0x000000001CEB0000-memory.dmp	family_babadeda

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport
Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
1720	gwspro.exe
1748	client32.exe
2944	uninstall.exe
1568	GoogleUpdate.exe
4304	GoogleUpdate.exe
2756	GoogleUpdate.exe
3704	GoogleUpdateComRegisterShell64.exe
1020	GoogleUpdateComRegisterShell64.exe
1176	GoogleUpdateComRegisterShell64.exe
1584	GoogleUpdate.exe
796	GoogleUpdate.exe
1632	GoogleUpdate.exe

Registers COM server for autorun 1 TTPs 33 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	GoogleUpdate.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NetSupport.url	gwspro.exe

Loads dropped DLL 64 IoCs

pid	Process
5108	BROWSER_.exe
5108	BROWSER_.exe
5108	BROWSER_.exe
5108	BROWSER_.exe
5108	BROWSER_.exe
5108	BROWSER_.exe
5108	BROWSER_.exe
5108	BROWSER_.exe
5108	BROWSER_.exe
5108	BROWSER_.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe
1720	gwspro.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BROWSER_.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	gwspro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	gwspro.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_pt-PT.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_cs.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_th.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_el.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_lv.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_fr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_ko.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_te.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_da.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_fa.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_sk.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateCore.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_hr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_gu.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_hr.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_te.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_kn.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_sl.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_kn.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_sl.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_fil.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_sr.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\psuser_64.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\GoogleCrashHandler.exe	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_iw.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_mr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\Install\{7BCCFEE4-1F45-4F4B-86E6-D0ECF36DA94E}\106.0.5249.119_chrome_installer.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_sw.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_en.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_mr.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\psuser.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\psmachine_64.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\GoogleUpdateComRegisterShell64.exe	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\psuser_64.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_pt-BR.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_ta.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\106.0.5249.119_chrome_installer.exe	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\GoogleUpdateSetup.exe	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_no.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_it.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_tr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_zh-TW.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_en-GB.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_de.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_ko.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{7BCCFEE4-1F45-4F4B-86E6-D0ECF36DA94E}\106.0.5249.119_chrome_installer.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\GoogleUpdateBroker.exe	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_es-419.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_gu.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_ja.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_ur.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\psmachine.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_fr.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_bn.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_es.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_fa.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\GoogleUpdateCore.exe	uninstall.exe
File created	C:\Program Files (x86)\Google\Temp\GUM409E.tmp\goopdateres_bg.dll	uninstall.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_sw.dll	GoogleUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	BROWSER_.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BROWSER_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	BROWSER_.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods\ = "24"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ = "IApp"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\PROGID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ = "IApp2"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ = "IAppBundleWeb"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods\ = "12"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\VersionIndependentProgID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\VersionIndependentProgID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\LocalServer32	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\LOCALSERVER32	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}\ELEVATION	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\PROGID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods\ = "9"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\Elevation\IconReference = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\goopdate.dll,-1004"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ = "IPolicyStatus"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ = "IGoogleUpdate3WebSecurity"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\VersionIndependentProgID\ = "GoogleUpdate.ProcessLauncher"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\GoogleUpdateOnDemand.exe\""	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\ = "PSFactoryBuffer"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods\ = "17"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ = "ServiceModule"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods\ = "13"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID\ = "{B3D28DBD-0DFA-40E4-8071-520767BADC7E}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachine\CurVer\ = "GoogleUpdate.OnDemandCOMClassMachine.1.0"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods\ = "7"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\ = "Google Update Policy Status Class"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ = "IPolicyStatus3"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ = "IAppBundleWeb"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ = "IPolicyStatus"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\Elevation\IconReference = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\goopdate.dll,-1004"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\LOCALSERVER32	GoogleUpdate.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5108	BROWSER_.exe
5108	BROWSER_.exe
1568	GoogleUpdate.exe
1568	GoogleUpdate.exe
1568	GoogleUpdate.exe
1568	GoogleUpdate.exe
1568	GoogleUpdate.exe
1568	GoogleUpdate.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1748	client32.exe
Token: SeDebugPrivilege	1568	GoogleUpdate.exe
Token: SeDebugPrivilege	1568	GoogleUpdate.exe
Token: SeDebugPrivilege	1568	GoogleUpdate.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1748	client32.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 1720	5108	BROWSER_.exe	82
PID 5108 wrote to memory of 1720	5108	BROWSER_.exe	82
PID 5108 wrote to memory of 1720	5108	BROWSER_.exe	82
PID 1720 wrote to memory of 1748	1720	gwspro.exe	84
PID 1720 wrote to memory of 1748	1720	gwspro.exe	84
PID 1720 wrote to memory of 1748	1720	gwspro.exe	84
PID 1720 wrote to memory of 2944	1720	gwspro.exe	85
PID 1720 wrote to memory of 2944	1720	gwspro.exe	85
PID 1720 wrote to memory of 2944	1720	gwspro.exe	85
PID 2944 wrote to memory of 1568	2944	uninstall.exe	86
PID 2944 wrote to memory of 1568	2944	uninstall.exe	86
PID 2944 wrote to memory of 1568	2944	uninstall.exe	86
PID 1568 wrote to memory of 4304	1568	GoogleUpdate.exe	87
PID 1568 wrote to memory of 4304	1568	GoogleUpdate.exe	87
PID 1568 wrote to memory of 4304	1568	GoogleUpdate.exe	87
PID 1568 wrote to memory of 2756	1568	GoogleUpdate.exe	88
PID 1568 wrote to memory of 2756	1568	GoogleUpdate.exe	88
PID 1568 wrote to memory of 2756	1568	GoogleUpdate.exe	88
PID 2756 wrote to memory of 3704	2756	GoogleUpdate.exe	89
PID 2756 wrote to memory of 3704	2756	GoogleUpdate.exe	89
PID 2756 wrote to memory of 1020	2756	GoogleUpdate.exe	90
PID 2756 wrote to memory of 1020	2756	GoogleUpdate.exe	90
PID 2756 wrote to memory of 1176	2756	GoogleUpdate.exe	91
PID 2756 wrote to memory of 1176	2756	GoogleUpdate.exe	91
PID 1568 wrote to memory of 1584	1568	GoogleUpdate.exe	92
PID 1568 wrote to memory of 1584	1568	GoogleUpdate.exe	92
PID 1568 wrote to memory of 1584	1568	GoogleUpdate.exe	92
PID 1568 wrote to memory of 796	1568	GoogleUpdate.exe	93
PID 1568 wrote to memory of 796	1568	GoogleUpdate.exe	93
PID 1568 wrote to memory of 796	1568	GoogleUpdate.exe	93

C:\Users\Admin\AppData\Local\Temp\BROWSER_.exe
"C:\Users\Admin\AppData\Local\Temp\BROWSER_.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwspro.exe
  "C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwspro.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Users\Admin\AppData\Roaming\NetSupport_v_2.28609\client32.exe
    "C:\Users\Admin\AppData\Roaming\NetSupport_v_2.28609\client32.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1748
- - C:\Users\Admin\AppData\Roaming\NetSupport_v_2.28609\uninstall.exe
    "C:\Users\Admin\AppData\Roaming\NetSupport_v_2.28609\uninstall.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Program Files (x86)\Google\Temp\GUM409E.tmp\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Temp\GUM409E.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={1266CA4D-0917-452A-19FA-B8B51EF60ACD}&lang=ru&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
      4⤵
      Executes dropped EXE
      Sets file execution options in registry
      Checks computer location settings
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1568
    - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4304
    - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2756
      - C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:3704
      - C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:1020
      - C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:1176
    - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjU5QTAxNUUtQjY3MS00QTU3LUE1NjItOEQ5N0FEMjA2RkY5fSIgdXNlcmlkPSJ7RUEyQkQ0Q0UtQjQ1MS00QTQ2LTg2QzQtNTY2NDk0Rjc5NDREfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezkxNjE4RDI0LUYzMUEtNDZBMy1BNzU4LTdGOTVCM0YxQTg3Q30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iNCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjcxIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjEzMiIgbGFuZz0icnUiIGJyYW5kPSIiIGNsaWVudD0iIiBpaWQ9InsxMjY2Q0E0RC0wOTE3LTQ1MkEtMTlGQS1COEI1MUVGNjBBQ0R9Ij48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjkxMjEiLz48L2FwcD48L3JlcXVlc3Q-
        5⤵
        Executes dropped EXE
        
        PID:1584
    - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={1266CA4D-0917-452A-19FA-B8B51EF60ACD}&lang=ru&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{259A015E-B671-4A57-A562-8D97AD206FF9}"
        5⤵
        Executes dropped EXE
        
        PID:796

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BRL000013f4\BR32C8.tmp

Filesize
99KB

MD5
2c9676a3167739f36912818acb8e9860

SHA1
cd9e5e56cc408c40c45caf49614c26fc7fde39f6

SHA256
75fc64a55afa86173947948d78ba5de98dfc35c487166a6682fe71ed5f6f877a

SHA512
a6c375511d9d339b889adcca4a95bc23df9e207f86605f6d6d04ab7e211901cdc3012860ed844a5c36737369e01dc70b212f5960d8a662fdc720ad98e1202aa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\BRL000013f4\BR3394.tmp

Filesize
288KB

MD5
122a3741699fb5c0950273245c9dea15

SHA1
811f9149e3310a8e6521da156f92f3aaab012145

SHA256
f675eba3b22e0a2238ec4961d99de3bacca0ab553ab26eecb49800a12a9371ab

SHA512
567c480f70fdc78769ae45bf83b6632f7ab380ebeb00689028d39ff03840c8b778149a3fafe1dab2ac77a1fd17a23b09f58774b1c5e791bfd33b99528225eccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\BRL000013f4\BR5872.tmp

Filesize
35KB

MD5
08ad4cd2a940379f1dcdbdb9884a1375

SHA1
c302b7589ba4f05c6429e7f89ad0cb84dd9dfbac

SHA256
78827e2b1ef0aad4f8b1b42d0964064819aa22bfcd537ebaacb30d817edc06d8

SHA512
f37bd071994c31b361090a149999e8b2d4a7839f19ea63e1d4563aada1371be37f2bfcc474e24de95ff77ca4124a39580c9f711e2fbe54265713ab76f631835a

Download Submit
C:\Users\Admin\AppData\Local\Temp\BRL000013f4\BR68A0.tmp

Filesize
169KB

MD5
cf2d7b4de923b25955d96d2e65ce76bc

SHA1
8feee81fe77a7649b969d375778d2b78d842cf48

SHA256
0912c84ded4670c427db1f405eb68a5763eae8fa0a735abe44eea81be7dc44ea

SHA512
d26a0983f0323655eddc48863a409d172a4623bd7ed465b5a4675477938de10127323040da77c80201c3a816315d98cace5194207e22b0a6ac2e65ae6795dc4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\BRL000013f4\BR7B1F.tmp

Filesize
532KB

MD5
a6f7a08b0676f0564a51b5c47973e635

SHA1
d56f5f9e2580b81717317da6582da9d379426d5b

SHA256
5dd27e845af9333ad7b907a37ab3d239b75be6ccc1f51ef4b21e59b037ce778c

SHA512
1101813034db327af1c16d069a4dfa91ab97ee8188f9ed1a6da9d25558866e7e9af59102e58127e64441d3e4a768b2ad788fd0e5a16db994a14637bfbade2954

Download Submit
C:\Users\Admin\AppData\Local\Temp\BRL000013f4\BR85A0.tmp

Filesize
72KB

MD5
c04970b55bcf614f24ca75b1de641ae2

SHA1
52b182caef513ed1c36f28eb45cedb257fa8ce40

SHA256
5ddee4aab3cf33e505f52199d64809125b26de04fb9970ca589cd8619c859d80

SHA512
a5f2660e336bf74a1936fb2e1c724220d862632907f5fd690b365009ac3e1bf35fa6689071f3da4049e495f340ff83f8438b79079ef1f248b9dcaedbdd5d3e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\BRL000013f4\BR87D3.tmp

Filesize
14KB

MD5
77fe66d74901495f4b41a5918acd02ff

SHA1
ce5bbd53152cd5b03df8bcc232a1aea36a012764

SHA256
b017168c69ef40115141813e47122391602e1af28af342c56495b09f1c3c7522

SHA512
cc6e323d0076577a0a04dbe2c33d90dc616cb5ec3637d3df67cbf169766ca2e6de567fcff4f32938fd6118d98e4796642a3010b7264f0ae247fa8f0fe079bd70

Download Submit
C:\Users\Admin\AppData\Local\Temp\BRL000013f4\BR88DE.tmp

Filesize
14KB

MD5
d74aadd701bfacc474c431acab7b9265

SHA1
8a2b424d1f949430ddc1faddee3e9ccb79c95de2

SHA256
f1029f5cca3dabfeffe2c9db6ad84a9ff0f64f5b2fb85cb6ab348740f756e07d

SHA512
0ef85e311fb4843997fd5f87f0a2eec9715e26eae76bfb7bb701d8c043720aeaf7f4825d25187bf35e0a9f00def15ed071120128805445f1330c07c3e0ea5ced

Download Submit
C:\Users\Admin\AppData\Local\Temp\BRL000013f4\BR8AE3.tmp

Filesize
74KB

MD5
924b90c3d9e645dfad53f61ea4e91942

SHA1
65d397199ff191e5078095036e49f08376f9ae4e

SHA256
41788435f245133ec5511111e2c5d52f7515e359876180067e0b5ba85c729322

SHA512
76833708828c8f3fad941abeea158317aff98cf0691b5d5dfa4bca15279cdad1cc23a771258e4de41cf12a58f7033a3ee08b0b5eb834d22be568ea98b183ccd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\BRL000013f4\BR8B13.tmp

Filesize
150KB

MD5
efd81ea220094b0e91630b648d00e731

SHA1
226635424baf8146af055908c4c12b0a3faecd4f

SHA256
931c52c91ffbe12d820ff96570ba8db8abc36ac2fb852c87f2ef99271d7183fa

SHA512
fca9ffbcf94507cda23b5a68c4a598a25f0a0e22a7d429a125acbf95bdd03fd63ac80cf8738ae22d1730a73edb3325edc5b85af8d3337a62a97ac0f63dbccdbe

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\DECO_32.dll

Filesize
222KB

MD5
9932706e9fc0d6fd80d0158bc975ea10

SHA1
d0aeff5c8b43deb9d35264f10b8eb87642e2c726

SHA256
9ce2cd070187852f1ab624c77f1a21b714e43db13366625089a00b3d97f10345

SHA512
77a54976f73d394ffe382b92190296382646ac137ff9e12b5567d3bc2265c2ba242b7d6c737103ebdf779610428f49b920a60bf43dc3ae92b3043603646af6a3

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\DefaultTheme.dll

Filesize
1.3MB

MD5
dc99fd39b53682c85ad34e496398b211

SHA1
194d20d41cc885be04c86fcf1c2c59d6757572ca

SHA256
5749bd96a435534f6b0d9088ee7cea7214fd447d325ec048ec0a5472f2202adb

SHA512
9166bc851577f5e5dc60af08e4c4a55230e9b5ab85e98053f5a654445be0de84e8c1bb720ed12f04a20093d329149f2534f0bfb47a525cab11fd155913479668

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\DefaultTheme.dll

Filesize
1.3MB

MD5
dc99fd39b53682c85ad34e496398b211

SHA1
194d20d41cc885be04c86fcf1c2c59d6757572ca

SHA256
5749bd96a435534f6b0d9088ee7cea7214fd447d325ec048ec0a5472f2202adb

SHA512
9166bc851577f5e5dc60af08e4c4a55230e9b5ab85e98053f5a654445be0de84e8c1bb720ed12f04a20093d329149f2534f0bfb47a525cab11fd155913479668

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\Eztwain3.dll

Filesize
955KB

MD5
01f52ce786cb11ea2470ec6d77f29b2d

SHA1
dc44c0736feb317d3008c7ad52fb2643e2bddbec

SHA256
4f8e325f92ec8cb31b895b963042332e057a639d1e16b93f0333db0bc9d71dfd

SHA512
f08e230db7ce26a6462d6a32c282560c5cec01dbb749a6ad35f258fd3d5477062b114fbddc91a341515e36fd20fec057595779faa1e3e6e19ac988cbfacb6665

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\GWSHDP.dll

Filesize
277KB

MD5
e1a773c2ceec1d3798be988269b36806

SHA1
06906aee0ddba30e560e4b60e140e0c098519bb2

SHA256
5e920fbcc14ac82ec5abf2ca63523fa17f03a261dc09ee6b1976b291c2ab0097

SHA512
f1468b9b12060a5b5143331cf16d7e30b1c042b621133818cd337d621a8bcc25306dd4c7e97af9ed32573f0da253d6e2d0b88bb75332abf57ae80c75c9055058

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\PCDLIB32.dll

Filesize
185KB

MD5
7f11e662730110fe7395339862ba7e4c

SHA1
1000a7dc52f7f27d9fb248ee5b0e18d43ad1a22d

SHA256
30a5ccaa5b1f4e122a40ba8a6351d1b97d2ba615d60580de7e280202c1d6ad6e

SHA512
07dccbd96ba6ad83aee4f6ad0ce4fbbe6e5de14a835be4393c42cb22dd51663dc2fc8fce104e9296bd1afd776444cff4d7e04fa022150bd32995bd81ce33f66f

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\PCDWRIP.dll

Filesize
320KB

MD5
4a4267c2355ab073b27885e13e58f5f7

SHA1
99c58be2f7f3643e18185223110444d224be54e7

SHA256
b4d83e808ccccb077e93253d7187dc11b0724a84be91452184f082fe564a46dc

SHA512
1ccac485bb0d2b08043196078a4e225fc2a91534f6ef6f0e882e6755c66dd558b4d0c00da3e92ea5c955f3995a3bf970bffeaf6e1fbb1a9cbeb2d6b78a1dff10

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\apng32.dll

Filesize
570KB

MD5
f24096816476ea797435acd2a8b0b4c7

SHA1
a2a1f1e3fc5dcd119cde5919fd046dfcd0638330

SHA256
0d5d934d541754810a90a984730451c6ea060429d86f7eba388d602a9afe7707

SHA512
b1dc96124b2f56e495ac1694c945465c4ede5e92d81bde60e3f31bf55e21837945f4f73f741f1ab8f13e509ae7ea092a1b40055a61c9ca41b4c05f0dce09a97a

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\apng32.dll

Filesize
570KB

MD5
f24096816476ea797435acd2a8b0b4c7

SHA1
a2a1f1e3fc5dcd119cde5919fd046dfcd0638330

SHA256
0d5d934d541754810a90a984730451c6ea060429d86f7eba388d602a9afe7707

SHA512
b1dc96124b2f56e495ac1694c945465c4ede5e92d81bde60e3f31bf55e21837945f4f73f741f1ab8f13e509ae7ea092a1b40055a61c9ca41b4c05f0dce09a97a

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\deco_32.dll

Filesize
222KB

MD5
9932706e9fc0d6fd80d0158bc975ea10

SHA1
d0aeff5c8b43deb9d35264f10b8eb87642e2c726

SHA256
9ce2cd070187852f1ab624c77f1a21b714e43db13366625089a00b3d97f10345

SHA512
77a54976f73d394ffe382b92190296382646ac137ff9e12b5567d3bc2265c2ba242b7d6c737103ebdf779610428f49b920a60bf43dc3ae92b3043603646af6a3

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\eztwain3.dll

Filesize
955KB

MD5
01f52ce786cb11ea2470ec6d77f29b2d

SHA1
dc44c0736feb317d3008c7ad52fb2643e2bddbec

SHA256
4f8e325f92ec8cb31b895b963042332e057a639d1e16b93f0333db0bc9d71dfd

SHA512
f08e230db7ce26a6462d6a32c282560c5cec01dbb749a6ad35f258fd3d5477062b114fbddc91a341515e36fd20fec057595779faa1e3e6e19ac988cbfacb6665

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\fpxacc.dll

Filesize
263KB

MD5
dc563514fc7f69b9a956b685a163a6c7

SHA1
525f2fcafc2beb17966dc937c7b1a773f5bd3034

SHA256
37092ad75a8c98198c4a2a1876856884b200a06167cd76c3e9dd117af97e3aa1

SHA512
ac6ce021ff20cfd33b4e450cb4ac4572411950bf3dab0f325c084420d884ae6fdf88400ed5525c0014c684e8ae96f51c4711f1b2d02229c31ebf3ed416f2067b

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\fpxacc.dll

Filesize
263KB

MD5
dc563514fc7f69b9a956b685a163a6c7

SHA1
525f2fcafc2beb17966dc937c7b1a773f5bd3034

SHA256
37092ad75a8c98198c4a2a1876856884b200a06167cd76c3e9dd117af97e3aa1

SHA512
ac6ce021ff20cfd33b4e450cb4ac4572411950bf3dab0f325c084420d884ae6fdf88400ed5525c0014c684e8ae96f51c4711f1b2d02229c31ebf3ed416f2067b

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwsfiltr.dll

Filesize
8.8MB

MD5
735b7766552aef741b7d76219dfc4e78

SHA1
fed6aba5db69dc0c13d8aafd8e751343eb0e5a2d

SHA256
76a4ad74a53bef71afa0f7be6c055287a11418aa117c2386881d424fd52d3922

SHA512
e3ee40c8377955efd280af9449385b0dab5e3faf2d1c71f1984a5242fd5f320b46389aed5f1d1c022a52836b04c978f9e8934ad7bd2a4d802793a6596cad47c1

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwsfiltr.dll

Filesize
8.8MB

MD5
735b7766552aef741b7d76219dfc4e78

SHA1
fed6aba5db69dc0c13d8aafd8e751343eb0e5a2d

SHA256
76a4ad74a53bef71afa0f7be6c055287a11418aa117c2386881d424fd52d3922

SHA512
e3ee40c8377955efd280af9449385b0dab5e3faf2d1c71f1984a5242fd5f320b46389aed5f1d1c022a52836b04c978f9e8934ad7bd2a4d802793a6596cad47c1

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwshdp.dll

Filesize
277KB

MD5
e1a773c2ceec1d3798be988269b36806

SHA1
06906aee0ddba30e560e4b60e140e0c098519bb2

SHA256
5e920fbcc14ac82ec5abf2ca63523fa17f03a261dc09ee6b1976b291c2ab0097

SHA512
f1468b9b12060a5b5143331cf16d7e30b1c042b621133818cd337d621a8bcc25306dd4c7e97af9ed32573f0da253d6e2d0b88bb75332abf57ae80c75c9055058

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwsjpg.dll

Filesize
529KB

MD5
eac122fbb0d32a242ecc412c125314dc

SHA1
7f5a1cb200270e938ce88bb9fd0752af1a222967

SHA256
026b0032a14ea867f640508fa4959e37215af83458d579c469c6f99b7d1b3522

SHA512
3df8c47e5f14c9318b8524465fc3e0eeb5ca17bb93093b27616ef871c33a6e55a57721aae45bd40986f3f09fc92daa85a773a8426ea4b13f45bad47dc26b70d7

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwsjpg.dll

Filesize
529KB

MD5
eac122fbb0d32a242ecc412c125314dc

SHA1
7f5a1cb200270e938ce88bb9fd0752af1a222967

SHA256
026b0032a14ea867f640508fa4959e37215af83458d579c469c6f99b7d1b3522

SHA512
3df8c47e5f14c9318b8524465fc3e0eeb5ca17bb93093b27616ef871c33a6e55a57721aae45bd40986f3f09fc92daa85a773a8426ea4b13f45bad47dc26b70d7

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwsjpg.dll

Filesize
529KB

MD5
eac122fbb0d32a242ecc412c125314dc

SHA1
7f5a1cb200270e938ce88bb9fd0752af1a222967

SHA256
026b0032a14ea867f640508fa4959e37215af83458d579c469c6f99b7d1b3522

SHA512
3df8c47e5f14c9318b8524465fc3e0eeb5ca17bb93093b27616ef871c33a6e55a57721aae45bd40986f3f09fc92daa85a773a8426ea4b13f45bad47dc26b70d7

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwspng.dll

Filesize
309KB

MD5
a32fe44873d30c83c70f8f811d89dfd7

SHA1
a1879a07bdc6b068fbffb27ed2dbfce1cfeac7a0

SHA256
70ab3b3b2f232f2a20e08feadb9ae5286dd10e71f62321f371e5bb532e0b0f38

SHA512
98739f4a890a0b4d3987717047e9b45dcb8919da74781966bddfdbd6e9efe58bbe9ebd7d5fb5ed4fe3ca4edfa1cc462b65f64a00760ab59257f26ae717d13ede

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwspng.dll

Filesize
309KB

MD5
a32fe44873d30c83c70f8f811d89dfd7

SHA1
a1879a07bdc6b068fbffb27ed2dbfce1cfeac7a0

SHA256
70ab3b3b2f232f2a20e08feadb9ae5286dd10e71f62321f371e5bb532e0b0f38

SHA512
98739f4a890a0b4d3987717047e9b45dcb8919da74781966bddfdbd6e9efe58bbe9ebd7d5fb5ed4fe3ca4edfa1cc462b65f64a00760ab59257f26ae717d13ede

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwspng.dll

Filesize
309KB

MD5
a32fe44873d30c83c70f8f811d89dfd7

SHA1
a1879a07bdc6b068fbffb27ed2dbfce1cfeac7a0

SHA256
70ab3b3b2f232f2a20e08feadb9ae5286dd10e71f62321f371e5bb532e0b0f38

SHA512
98739f4a890a0b4d3987717047e9b45dcb8919da74781966bddfdbd6e9efe58bbe9ebd7d5fb5ed4fe3ca4edfa1cc462b65f64a00760ab59257f26ae717d13ede

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwspro.exe

Filesize
21.8MB

MD5
8dc6f7a135d4a70ff1ef4b25dad052ec

SHA1
7c090065de1090fa92ff01f06739fbca04e6936d

SHA256
af81ae71376bb3abc9eb1a9f59c76224a43b2a68aceb6e5ac3d93f05fc259715

SHA512
f6651693e448861a3a6aee89e5c62fa4dc23305ed9b967d388bcad70cd4d2d3a5b8a69166f69577dde4e165f629805d9d3f97c45a9e26f1f4ffaa1a3c2cf0868

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwspro.exe

Filesize
21.8MB

MD5
8dc6f7a135d4a70ff1ef4b25dad052ec

SHA1
7c090065de1090fa92ff01f06739fbca04e6936d

SHA256
af81ae71376bb3abc9eb1a9f59c76224a43b2a68aceb6e5ac3d93f05fc259715

SHA512
f6651693e448861a3a6aee89e5c62fa4dc23305ed9b967d388bcad70cd4d2d3a5b8a69166f69577dde4e165f629805d9d3f97c45a9e26f1f4ffaa1a3c2cf0868

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwstif.dll

Filesize
337KB

MD5
0d64f5aa32fe233c9e1c904f2c2ee1cb

SHA1
123cba972afcd5fd1807232f6e47dea8e0355fc6

SHA256
8f91fcc534dd362cd396db278bc77e099e640ae512912356a3270d5bb27af1a1

SHA512
f1990718dc1115f23fa5b6f7b5723acf950ce8e964b8ed6604383f72f5aeece5a1e51e6104bb1eefc68d4fc1a2bc269bc76f51edd7f01ccffffbda114a0a6b1f

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwstif.dll

Filesize
337KB

MD5
0d64f5aa32fe233c9e1c904f2c2ee1cb

SHA1
123cba972afcd5fd1807232f6e47dea8e0355fc6

SHA256
8f91fcc534dd362cd396db278bc77e099e640ae512912356a3270d5bb27af1a1

SHA512
f1990718dc1115f23fa5b6f7b5723acf950ce8e964b8ed6604383f72f5aeece5a1e51e6104bb1eefc68d4fc1a2bc269bc76f51edd7f01ccffffbda114a0a6b1f

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwstif.dll

Filesize
337KB

MD5
0d64f5aa32fe233c9e1c904f2c2ee1cb

SHA1
123cba972afcd5fd1807232f6e47dea8e0355fc6

SHA256
8f91fcc534dd362cd396db278bc77e099e640ae512912356a3270d5bb27af1a1

SHA512
f1990718dc1115f23fa5b6f7b5723acf950ce8e964b8ed6604383f72f5aeece5a1e51e6104bb1eefc68d4fc1a2bc269bc76f51edd7f01ccffffbda114a0a6b1f

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwstxtr.dll

Filesize
8.8MB

MD5
01a2a91d47aee9ed5ded3906b5445c6a

SHA1
c3877815053c706a72c7a57244c2e8eff799a48d

SHA256
0777a20e126badc87177973bc324963e22ad133b69af0ab71f84b3342487d817

SHA512
dacea5bffdfd0c05b1b87145c9a5ef0e5fb38e67d8c092c1ee45d35b5445f6d417071a1ee96bbd30088c2b2da0c5a43baf5bb35687c2cff4345acb36e6e5be8e

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwstxtr.dll

Filesize
8.8MB

MD5
01a2a91d47aee9ed5ded3906b5445c6a

SHA1
c3877815053c706a72c7a57244c2e8eff799a48d

SHA256
0777a20e126badc87177973bc324963e22ad133b69af0ab71f84b3342487d817

SHA512
dacea5bffdfd0c05b1b87145c9a5ef0e5fb38e67d8c092c1ee45d35b5445f6d417071a1ee96bbd30088c2b2da0c5a43baf5bb35687c2cff4345acb36e6e5be8e

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwszip.dll

Filesize
223KB

MD5
6a6097d8afca60c9a260b080f33b9e09

SHA1
cb9b800c40a40d3e519ef306becc07ce4fee784f

SHA256
2ea236b7434f0d570e5d2f480ffe53fc2dda34a4963ebe2a3ba62cb547a6e98f

SHA512
df8b72ddd52b0ead992c272671c71329f8de4ab3764ab59c6e8728a9a258b2037d5d858ec01c4f9493102592922a6e630ae81a66cb07f417369158513883d887

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwszip.dll

Filesize
223KB

MD5
6a6097d8afca60c9a260b080f33b9e09

SHA1
cb9b800c40a40d3e519ef306becc07ce4fee784f

SHA256
2ea236b7434f0d570e5d2f480ffe53fc2dda34a4963ebe2a3ba62cb547a6e98f

SHA512
df8b72ddd52b0ead992c272671c71329f8de4ab3764ab59c6e8728a9a258b2037d5d858ec01c4f9493102592922a6e630ae81a66cb07f417369158513883d887

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\imatch.dll

Filesize
353KB

MD5
14b533e180b8c4a1954e09e4f56f0b05

SHA1
51c9da4f81b83319c2efeb4d08ad8971b732f33d

SHA256
0e5e4c2ac303baec9c6a5f20d9044ef84c064e48e25ce13cc1c9fb5ac1507b8a

SHA512
7c6632eb8c01794af712b1232b32c8ea797ffd29196ba146ac0678ed84a3fb1ccb22c845ccfcea672137dbc8ec6dc58f65ed0fe5b5eaa5a9bdbbfc420f2025c2

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\imatch.dll

Filesize
353KB

MD5
14b533e180b8c4a1954e09e4f56f0b05

SHA1
51c9da4f81b83319c2efeb4d08ad8971b732f33d

SHA256
0e5e4c2ac303baec9c6a5f20d9044ef84c064e48e25ce13cc1c9fb5ac1507b8a

SHA512
7c6632eb8c01794af712b1232b32c8ea797ffd29196ba146ac0678ed84a3fb1ccb22c845ccfcea672137dbc8ec6dc58f65ed0fe5b5eaa5a9bdbbfc420f2025c2

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\libogg.dll

Filesize
17KB

MD5
b05f5447cd2457ede470a822c4f5bfe9

SHA1
56e68959d483174e841844a1d1b3f6f7fc0ebc51

SHA256
b5ee1821c351a38494f69ff5408762fada4ad103b82c1ba4a87e67ddfba1d62a

SHA512
3d690bfe2d380541b24e695966bd1b16afb2e1b0d77d3610f3c1d080e98ccdef17674b0f51a8f3f55515bec885fcdc7ae2e7ae6b4bcc8cf3df7301becab31953

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\libogg.dll

Filesize
17KB

MD5
b05f5447cd2457ede470a822c4f5bfe9

SHA1
56e68959d483174e841844a1d1b3f6f7fc0ebc51

SHA256
b5ee1821c351a38494f69ff5408762fada4ad103b82c1ba4a87e67ddfba1d62a

SHA512
3d690bfe2d380541b24e695966bd1b16afb2e1b0d77d3610f3c1d080e98ccdef17674b0f51a8f3f55515bec885fcdc7ae2e7ae6b4bcc8cf3df7301becab31953

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\libvorbis.dll

Filesize
641KB

MD5
9cfe7e14c0c9a1a94a005388d53f0bb2

SHA1
acb77c0c73b15a1d37bca58be5288bc072c69de6

SHA256
0ddf0cb5fa7cd28918b4b7efcb131948ad6c13c65be6b26dbedd62534530f126

SHA512
132975cfd47da538d2e121438d09e72cc1480195787af4a3fc4839fd868d72dfd673bd100c23ec8927e5cf3fd677a906ffc2415a5bd8b8c2f9aa921751bac894

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\libvorbis.dll

Filesize
641KB

MD5
9cfe7e14c0c9a1a94a005388d53f0bb2

SHA1
acb77c0c73b15a1d37bca58be5288bc072c69de6

SHA256
0ddf0cb5fa7cd28918b4b7efcb131948ad6c13c65be6b26dbedd62534530f126

SHA512
132975cfd47da538d2e121438d09e72cc1480195787af4a3fc4839fd868d72dfd673bd100c23ec8927e5cf3fd677a906ffc2415a5bd8b8c2f9aa921751bac894

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\pcdlib32.dll

Filesize
185KB

MD5
7f11e662730110fe7395339862ba7e4c

SHA1
1000a7dc52f7f27d9fb248ee5b0e18d43ad1a22d

SHA256
30a5ccaa5b1f4e122a40ba8a6351d1b97d2ba615d60580de7e280202c1d6ad6e

SHA512
07dccbd96ba6ad83aee4f6ad0ce4fbbe6e5de14a835be4393c42cb22dd51663dc2fc8fce104e9296bd1afd776444cff4d7e04fa022150bd32995bd81ce33f66f

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\pcdwrip.dll

Filesize
320KB

MD5
4a4267c2355ab073b27885e13e58f5f7

SHA1
99c58be2f7f3643e18185223110444d224be54e7

SHA256
b4d83e808ccccb077e93253d7187dc11b0724a84be91452184f082fe564a46dc

SHA512
1ccac485bb0d2b08043196078a4e225fc2a91534f6ef6f0e882e6755c66dd558b4d0c00da3e92ea5c955f3995a3bf970bffeaf6e1fbb1a9cbeb2d6b78a1dff10

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\qtmlClient.dll

Filesize
232KB

MD5
172cddaa4d578d0c1adc98b78b1a9810

SHA1
5fdc3adf63f99b67a19ecf121ad372e4379eb3d5

SHA256
cdf59914f79903e0964facb10c19558ef398f95519587fdcd53cbf181cf254a6

SHA512
91c71b46c5d51da147a929a7d6302c83c70726ab2f2b83f4679c2836d0453748f265054915edfee389377415a385b1e2a9307e80ee3de397d9294c72603eebe4

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\qtmlclient.dll

Filesize
232KB

MD5
172cddaa4d578d0c1adc98b78b1a9810

SHA1
5fdc3adf63f99b67a19ecf121ad372e4379eb3d5

SHA256
cdf59914f79903e0964facb10c19558ef398f95519587fdcd53cbf181cf254a6

SHA512
91c71b46c5d51da147a929a7d6302c83c70726ab2f2b83f4679c2836d0453748f265054915edfee389377415a385b1e2a9307e80ee3de397d9294c72603eebe4

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\swfex.dll

Filesize
180KB

MD5
67f16582d51d20bc4aef0a19731d3280

SHA1
61679dbe1d13d9c25000142fd51b9f4e952a7098

SHA256
87eb8bc7404a7f7019dda05896831f77649479dbe761ac1efc8af37e4ea2bcb0

SHA512
159043e070e0e237c2a9fd3721b3bd687cff50f79f12312037d68b471c1d3418c41a7f8a23889ffe4994e5a950b4642a77071e47ad9c358f56f432ed9ce96f96

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\swfex.dll

Filesize
180KB

MD5
67f16582d51d20bc4aef0a19731d3280

SHA1
61679dbe1d13d9c25000142fd51b9f4e952a7098

SHA256
87eb8bc7404a7f7019dda05896831f77649479dbe761ac1efc8af37e4ea2bcb0

SHA512
159043e070e0e237c2a9fd3721b3bd687cff50f79f12312037d68b471c1d3418c41a7f8a23889ffe4994e5a950b4642a77071e47ad9c358f56f432ed9ce96f96

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\swfex.dll

Filesize
180KB

MD5
67f16582d51d20bc4aef0a19731d3280

SHA1
61679dbe1d13d9c25000142fd51b9f4e952a7098

SHA256
87eb8bc7404a7f7019dda05896831f77649479dbe761ac1efc8af37e4ea2bcb0

SHA512
159043e070e0e237c2a9fd3721b3bd687cff50f79f12312037d68b471c1d3418c41a7f8a23889ffe4994e5a950b4642a77071e47ad9c358f56f432ed9ce96f96

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\turbojpeg.dll

Filesize
664KB

MD5
81c0d4330aefd7287395dcc3a7ad5896

SHA1
4d20f691ebc46b36061cee8f5a52fc822ee247a0

SHA256
ad75b80862195b952053322b9054e3c75983897591f9420b897fa2343c428b36

SHA512
bb01f24eff62c7ad449aa61dd865056e0b9a9053aa510a8d6c53f82af58268e0514259e15fd4dc6261077495dace35af434550d2c9744977d6253590e1518c35

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\turbojpeg.dll

Filesize
664KB

MD5
81c0d4330aefd7287395dcc3a7ad5896

SHA1
4d20f691ebc46b36061cee8f5a52fc822ee247a0

SHA256
ad75b80862195b952053322b9054e3c75983897591f9420b897fa2343c428b36

SHA512
bb01f24eff62c7ad449aa61dd865056e0b9a9053aa510a8d6c53f82af58268e0514259e15fd4dc6261077495dace35af434550d2c9744977d6253590e1518c35

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\util32.dll

Filesize
67KB

MD5
f0727cb46641ae290305602792f93592

SHA1
985a8ff6ffd7bb2031d7d5a480af1c276cadff45

SHA256
1edcb48235a8740203238dc23e047a77f9692699439021fe3f30a408e57570b8

SHA512
cd3b5a2928f4fc6a428b0e9c995e2151986b3c57034f11f91a44918759f218edcfe6783f3149ac319d64fde3bf9cd404cb5e8579bce5dc89e1410df23dac87e1

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\util32.dll

Filesize
67KB

MD5
f0727cb46641ae290305602792f93592

SHA1
985a8ff6ffd7bb2031d7d5a480af1c276cadff45

SHA256
1edcb48235a8740203238dc23e047a77f9692699439021fe3f30a408e57570b8

SHA512
cd3b5a2928f4fc6a428b0e9c995e2151986b3c57034f11f91a44918759f218edcfe6783f3149ac319d64fde3bf9cd404cb5e8579bce5dc89e1410df23dac87e1

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\util32.dll

Filesize
67KB

MD5
f0727cb46641ae290305602792f93592

SHA1
985a8ff6ffd7bb2031d7d5a480af1c276cadff45

SHA256
1edcb48235a8740203238dc23e047a77f9692699439021fe3f30a408e57570b8

SHA512
cd3b5a2928f4fc6a428b0e9c995e2151986b3c57034f11f91a44918759f218edcfe6783f3149ac319d64fde3bf9cd404cb5e8579bce5dc89e1410df23dac87e1

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\webp.dll

Filesize
523KB

MD5
6bb6ef53bdc0d27a56db202f33a89e30

SHA1
292f51edd8abb2dae92c646196e67459e56bcc82

SHA256
888461862802a909b5d63fd4eb447ee0969c2b6840587481e74cdba0473738d1

SHA512
9c9449d24f38f8454611343354d782eb9add163a35855b160f76f87a701491f5499646e163a35b44d65168ad2b8ddb00acea7bce9c3e0fafb84068b4860ff50b

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\webp.dll

Filesize
523KB

MD5
6bb6ef53bdc0d27a56db202f33a89e30

SHA1
292f51edd8abb2dae92c646196e67459e56bcc82

SHA256
888461862802a909b5d63fd4eb447ee0969c2b6840587481e74cdba0473738d1

SHA512
9c9449d24f38f8454611343354d782eb9add163a35855b160f76f87a701491f5499646e163a35b44d65168ad2b8ddb00acea7bce9c3e0fafb84068b4860ff50b

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\wthnl.dll

Filesize
109KB

MD5
29421f04688f0b790469d4b4ab5efdb2

SHA1
0a57f1c054fe841221f4c255c90d04ca9e409794

SHA256
b32cddf0c6e505ea0bb75873b85879c763b73a83b32eaf3bf2b88ea6196ca127

SHA512
7bb4fe85d232f31318e3533e8101a8ab960da59ff7cad88138cef68061d00c08066b2041cb0841a8e3b4977531b48a7fc02bb2aa26154a5f0a0aca38208bff7a

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\wthnl.dll

Filesize
109KB

MD5
29421f04688f0b790469d4b4ab5efdb2

SHA1
0a57f1c054fe841221f4c255c90d04ca9e409794

SHA256
b32cddf0c6e505ea0bb75873b85879c763b73a83b32eaf3bf2b88ea6196ca127

SHA512
7bb4fe85d232f31318e3533e8101a8ab960da59ff7cad88138cef68061d00c08066b2041cb0841a8e3b4977531b48a7fc02bb2aa26154a5f0a0aca38208bff7a

Download Submit
C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\wthnl.dll

Filesize
109KB

MD5
29421f04688f0b790469d4b4ab5efdb2

SHA1
0a57f1c054fe841221f4c255c90d04ca9e409794

SHA256
b32cddf0c6e505ea0bb75873b85879c763b73a83b32eaf3bf2b88ea6196ca127

SHA512
7bb4fe85d232f31318e3533e8101a8ab960da59ff7cad88138cef68061d00c08066b2041cb0841a8e3b4977531b48a7fc02bb2aa26154a5f0a0aca38208bff7a

Download Submit
memory/1720-216-0x000000000F2B0000-0x000000000F2DE000-memory.dmp

Filesize
184KB

Download
memory/1720-227-0x00000000253A0000-0x0000000025733000-memory.dmp

Filesize
3.6MB

Download
memory/1720-206-0x0000000003D10000-0x0000000003D4B000-memory.dmp

Filesize
236KB

Download
memory/1720-217-0x000000000F2E0000-0x000000000F321000-memory.dmp

Filesize
260KB

Download
memory/1720-214-0x000000000E950000-0x000000000F21B000-memory.dmp

Filesize
8.8MB

Download
memory/1720-215-0x000000000F290000-0x000000000F2AD000-memory.dmp

Filesize
116KB

Download
memory/1720-220-0x0000000010D70000-0x0000000010E2C000-memory.dmp

Filesize
752KB

Download
memory/1720-226-0x00000000189B0000-0x000000001CEB0000-memory.dmp

Filesize
69.0MB

Download
memory/1720-213-0x000000000E7F0000-0x000000000E94B000-memory.dmp

Filesize
1.4MB

Download
memory/1720-228-0x00000000189B0000-0x000000001CEB0000-memory.dmp

Filesize
69.0MB

Download
memory/1720-194-0x0000000003B21000-0x0000000003B59000-memory.dmp

Filesize
224KB

Download
memory/1720-204-0x0000000003CC1000-0x0000000003CEC000-memory.dmp

Filesize
172KB

Download
memory/1720-231-0x00000000253A0000-0x0000000025733000-memory.dmp

Filesize
3.6MB

Download
memory/1720-208-0x000000000E680000-0x000000000E6C2000-memory.dmp

Filesize
264KB

Download
memory/1720-211-0x000000000E6D0000-0x000000000E763000-memory.dmp

Filesize
588KB

Download
memory/1720-212-0x000000000E770000-0x000000000E7E5000-memory.dmp

Filesize
468KB

Download