hxxp://clusterduck[.]com

Analysis

max time kernel
241s
max time network
250s
platform
windows10-1703_x64
resource
win10-20231020-es
resource tags

arch:x64arch:x86image:win10-20231020-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
30/10/2023, 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://clusterduck.com

Score

8^/10

evasion persistence

Malware Config

Signatures

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
3512	netsh.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

Executes dropped EXE 18 IoCs

pid	Process
2216	Install-Clusterduck-GooglePlayGames-Beta.exe
4396	crashpad_handler.exe
920	Install-Clusterduck-GooglePlayGames-Beta.exe
2084	crashpad_handler.exe
3224	GoogleUpdateSetup.exe
4932	GoogleUpdate.exe
2304	GoogleUpdate.exe
4052	GoogleUpdate.exe
96	GoogleUpdateComRegisterShell64.exe
196	GoogleUpdateComRegisterShell64.exe
3936	GoogleUpdateComRegisterShell64.exe
3088	GoogleUpdate.exe
372	GoogleUpdateBroker.exe
504	GoogleUpdate.exe
764	GoogleUpdate.exe
596	GoogleUpdate.exe
1856	HPE-23.10.697.3-CIP.exe
3696	GoogleUpdate.exe

Loads dropped DLL 21 IoCs

pid	Process
2216	Install-Clusterduck-GooglePlayGames-Beta.exe
2216	Install-Clusterduck-GooglePlayGames-Beta.exe
920	Install-Clusterduck-GooglePlayGames-Beta.exe
4932	GoogleUpdate.exe
2304	GoogleUpdate.exe
4052	GoogleUpdate.exe
96	GoogleUpdateComRegisterShell64.exe
4052	GoogleUpdate.exe
196	GoogleUpdateComRegisterShell64.exe
4052	GoogleUpdate.exe
3936	GoogleUpdateComRegisterShell64.exe
4052	GoogleUpdate.exe
3088	GoogleUpdate.exe
504	GoogleUpdate.exe
764	GoogleUpdate.exe
596	GoogleUpdate.exe
596	GoogleUpdate.exe
764	GoogleUpdate.exe
504	GoogleUpdate.exe
920	Install-Clusterduck-GooglePlayGames-Beta.exe
3696	GoogleUpdate.exe

Registers COM server for autorun 1 TTPs 33 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HPE-23.10.697.3-CIP.exe.log	HPE-23.10.697.3-CIP.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_fi.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_kn.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_mr.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_pl.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_de.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_es-419.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_am.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_et.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_id.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_sw.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\psuser_64.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_ko.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_ar.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_vi.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdate.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_zh-CN.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\GoogleUpdate.exe	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\GoogleUpdateComRegisterShell64.exe	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_fi.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_hi.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_tr.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_am.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_el.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_lv.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_sl.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_pt-BR.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleCrashHandler64.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_nl.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_no.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_id.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_bg.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_en-GB.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_pl.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_uk.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{47B07D71-505D-4665-AFD4-4972A30C6530}\23.10.697.3\HPE-23.10.697.3-CIP.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\psmachine.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_es.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_gu.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_sr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_ko.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_ta.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_no.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_bg.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_zh-CN.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_el.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_ro.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_ru.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_ta.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\psuser.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\Install\{B45F9133-7C2F-4F65-995E-D4DFC29B4E4E}\HPE-23.10.697.3-CIP.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdate.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_ca.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_ms.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_sl.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_vi.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_en.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_es.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_pt-PT.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_nl.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_is.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_is.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUT2A93.tmp	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateCore.exe	GoogleUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133431413023072607"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	GoogleUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	GoogleUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace	netsh.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoCreateAsync.1.0\CLSID\ = "{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ = "Update3COMClass"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\NumMethods\ = "23"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\Elevation\Enabled = "1"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\goopdate.dll,-3000"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ProxyStubClsid32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods\ = "24"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods\ = "41"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods\ = "9"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\ = "Google Update Legacy On Demand"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\GOOGLEUPDATE.EXE	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\VersionIndependentProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ = "IAppVersion"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass.1\ = "Google Update Core Class"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}\VersionIndependentProgID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods\ = "8"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.ProcessLauncher.1.0\CLSID\ = "{ABC01078-F197-4B0B-ADBC-CFE684B39C82}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods\ = "11"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ = "ICoCreateAsyncStatus"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods\ = "41"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\ProgID\ = "GoogleUpdate.CoCreateAsync.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E}\InprocHandler32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine.dll"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods\ = "4"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\VersionIndependentProgID\ = "GoogleUpdate.Update3WebMachineFallback"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\CLSID\ = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\ = "PSFactoryBuffer"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ = "Google Update Broker Class Factory"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ = "IGoogleUpdate"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}	GoogleUpdate.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
4932	GoogleUpdate.exe
4932	GoogleUpdate.exe
4932	GoogleUpdate.exe
4932	GoogleUpdate.exe
4932	GoogleUpdate.exe
4932	GoogleUpdate.exe
4932	GoogleUpdate.exe
4932	GoogleUpdate.exe
4932	GoogleUpdate.exe
4932	GoogleUpdate.exe
3936	chrome.exe
3936	chrome.exe
920	Install-Clusterduck-GooglePlayGames-Beta.exe
920	Install-Clusterduck-GooglePlayGames-Beta.exe
3696	GoogleUpdate.exe
3696	GoogleUpdate.exe
2216	Install-Clusterduck-GooglePlayGames-Beta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 4176	3412	chrome.exe	71
PID 3412 wrote to memory of 4176	3412	chrome.exe	71
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 4632	3412	chrome.exe	74
PID 3412 wrote to memory of 1972	3412	chrome.exe	73
PID 3412 wrote to memory of 1972	3412	chrome.exe	73
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75
PID 3412 wrote to memory of 996	3412	chrome.exe	75

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://clusterduck.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe59b39758,0x7ffe59b39768,0x7ffe59b39778
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:2
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2636 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2628 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4304 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=820 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4452 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5016 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5176 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3020 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5232 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5580 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=692 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4336 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2628 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1524 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3080 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:3592
- C:\Users\Admin\Downloads\Install-Clusterduck-GooglePlayGames-Beta.exe
  "C:\Users\Admin\Downloads\Install-Clusterduck-GooglePlayGames-Beta.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2216
- - C:\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\crashpad_handler.exe
    C:\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=23.10.1138.0 --initial-client-data=0x6e0,0x6e4,0x6e8,0x6b0,0x6ec,0x7ffe420a0f08,0x7ffe420a0f18,0x7ffe420a0f28
    3⤵
    - Executes dropped EXE
    PID:4396
- - C:\Users\Admin\Downloads\Install-Clusterduck-GooglePlayGames-Beta.exe
    "C:\Users\Admin\Downloads\Install-Clusterduck-GooglePlayGames-Beta.exe" -install gpg_install_cd59413a-90c2-4e58-a6e2-cb2a055af8ac "C:\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:920
  - - C:\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\crashpad_handler.exe
      C:\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=23.10.1138.0 --initial-client-data=0x378,0x37c,0x380,0x2ac,0x384,0x7ffe420a0f08,0x7ffe420a0f18,0x7ffe420a0f28
      4⤵
      Executes dropped EXE
      PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\GoogleUpdateSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\GoogleUpdateSetup.exe" /install "runtime=true&needsadmin=true" /silent
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:3224
    - - C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\GoogleUpdate.exe" /install "runtime=true&needsadmin=true" /silent
        5⤵
        Sets file execution options in registry
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4932
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2304
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4052
        
        C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:96
        
        C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:196
        
        C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:3936
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzI1NTlBRjktMjg3MC00RkNFLUIwRDgtQUY1MzlEMjc1NjM2fSIgdXNlcmlkPSJ7M0RFN0FDNTEtNEI4OS00MUI5LTk4RDktNjE5QTM2MDdDRTc0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszOTAxMzhCNy1DNkFFLTQ4QzAtODY5MC1FQjVCOThCRUNDOEN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTUwNjMuMCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjEuMy4zNi4xNTEiIG5leHR2ZXJzaW9uPSIxLjMuMzYuMzExIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjE5MjQiLz48L2FwcD48L3JlcXVlc3Q-
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2640 --field-trial-handle=1596,i,14533738198697650357,4204314815053580824,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4684

C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateBroker.exe
"C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateBroker.exe" -Embedding
1⤵
- Executes dropped EXE
PID:372
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /broker
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:504

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:596
- C:\Program Files (x86)\Google\Update\Install\{B45F9133-7C2F-4F65-995E-D4DFC29B4E4E}\HPE-23.10.697.3-CIP.exe
  "C:\Program Files (x86)\Google\Update\Install\{B45F9133-7C2F-4F65-995E-D4DFC29B4E4E}\HPE-23.10.697.3-CIP.exe" /o{47B07D71-505D-4665-AFD4-4972A30C6530} /l1518 /noui
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1856
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C dir /s /-c "C:\Windows\TEMP\Google\Play Games\f3xaw5o0.wak"
    3⤵
    PID:3404
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C dir /s /-c "C:\Program Files\Google"
    3⤵
    PID:2292
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule "Google Play Games Service"
    3⤵
    - Modifies Windows Firewall
    - Modifies data under HKEY_USERS
    PID:3512
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzhERjgxODItMEY3QS00MkRFLUExQzctMUJGNjY3MjlEMDYxfSIgdXNlcmlkPSJ7M0RFN0FDNTEtNEI4OS00MUI5LTk4RDktNjE5QTM2MDdDRTc0fSIgaW5zdGFsbHNvdXJjZT0idXBkYXRlM3dlYi1uZXdhcHBzIiByZXF1ZXN0aWQ9Ins2RjRGMTFFNC1DNTAxLTRGODItQURBQi1BNTIwQTQ5MzVCODR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTUwNjMuMCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQ3QjA3RDcxLTUwNUQtNDY2NS1BRkQ0LTQ5NzJBMzBDNjUzMH0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjIzLjEwLjY5Ny4zIiBhcD0iYmV0YSxiMmkyZSxDajBJQVJJY2IzSm5ZVzVwWXkxaGNIQnpMV1JsZEdGcGJITXRkMmx1Wkc5M2N4b1dhSFIwY0hNNkx5OTNkM2N1WjI5dloyeGxMbU52YlNqMjV0SUpHQUUiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiIGNvaG9ydD0iMToxMTZsOiIgY29ob3J0bmFtZT0iUHVibGljX0JldGEiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi9QbGF5L29qYXh3Mm5sNmFybjVhaXM0eTJvYjdtemNlXzIzLjEwLjY5Ny4zL0hQRS0yMy4xMC42OTcuMy1DSVAuZXhlIiBkb3dubG9hZGVkPSI3Mzg2MDQwMzIiIHRvdGFsPSI3Mzg2MDQwMzIiIGRvd25sb2FkX3RpbWVfbXM9IjUxNDQzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iNiIgZXJyb3Jjb2RlPSIxMDEwMSIgZXh0cmFjb2RlMT0iMCIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjMwNyIgZG93bmxvYWRfdGltZV9tcz0iNjc0NTkiIGRvd25sb2FkZWQ9IjczODYwNDAzMiIgdG90YWw9IjczODYwNDAzMiIgaW5zdGFsbF90aW1lX21zPSIyMzQzMSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\GoogleCrashHandler.exe

Filesize
294KB

MD5
a11ce10ac47f5f83b9bc980567331a1b

SHA1
63ee42e347b0328f8d71a3aa4dde4c6dc46da726

SHA256
101dbf984c4b3876defe2699d6160acbf1bb3f213e02a32f08fdcdc06821c542

SHA512
ff2f86c4061188ead1bfeebd36de7dbc312adcc95267537697f2bfcbb0c53e7c4ab0cd268cef22f0182391796c4612c97cbdc1266d9ee1960cdd2610d8c2bcb3

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\GoogleCrashHandler64.exe

Filesize
392KB

MD5
b659663611a4c2216dff5ab1b60dd089

SHA1
9a14392a5bdb9ea6b8c3e60224b7ff37091d48b5

SHA256
cad4aa1cf58f6b2e2aceb789d53b18418e67066ec406b2fac786cb845ef89d2b

SHA512
1065f9072cd6f1f4364f1354108f2647ee1d89f87e908a22fcd63bd3149c864c457e62268067a439d0486d8d4aa150aa984ad8ac8b51cae49014b67b80496040

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\GoogleUpdate.exe

Filesize
158KB

MD5
cdf152e23a8cbf68dbe3f419701244fc

SHA1
cb850d3675da418131d90ab01320e4e8842228d7

SHA256
84eaf43f33d95da9ab310fc36dc3cfe53823d2220946f021f18cf3f729b8d64e

SHA512
863e1da5bc779fa02cf08587c4de5f04c56e02902c5c4f92a06f2e631380ecabcc98e35d52609f764727e41b965c0786d24ea23fc4b9776d24d9f13e0d8ae0c2

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\GoogleUpdate.exe

Filesize
158KB

MD5
cdf152e23a8cbf68dbe3f419701244fc

SHA1
cb850d3675da418131d90ab01320e4e8842228d7

SHA256
84eaf43f33d95da9ab310fc36dc3cfe53823d2220946f021f18cf3f729b8d64e

SHA512
863e1da5bc779fa02cf08587c4de5f04c56e02902c5c4f92a06f2e631380ecabcc98e35d52609f764727e41b965c0786d24ea23fc4b9776d24d9f13e0d8ae0c2

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\GoogleUpdateComRegisterShell64.exe

Filesize
181KB

MD5
be535d8b68dd064442f73211466e5987

SHA1
aa49313d9513fd9c2d2b25da09ea24d09cc03435

SHA256
c109bcb63391ac3ea93fb97fbdf3f6ed71316cacb592ef46efaea0024bc9ed59

SHA512
eb50eebeaf83be10aea8088e35a807f9001d07d17d2bc1655c3bc0cb254d0f54303348988514ba5590ebd9d3bde3f1149c3f700f62fbce63c0199ea3cfb1f638

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\GoogleUpdateCore.exe

Filesize
217KB

MD5
af51ea4d9828e21f72e935b0deae50f2

SHA1
c7fe57c2a16c9f5a5ebdd3cc0910427cba5308bd

SHA256
3575011873d0f6d49c783095dae06e6619f8f5463da578fbe284ca5d1d449619

SHA512
ec9828d0bade39754748fb53cfc7efdc5e57955198bac3c248ea9b5a9a607182bb1477819f220549a8e9eadbe6bf69a12da6c8af3761980d2dd9078eaeaa932f

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdate.dll

Filesize
1.9MB

MD5
f3dc510106657e0243cb14ade5260de7

SHA1
316d2fb266cf70364e3cbd86f1f84141a3ec5ddb

SHA256
a11e34b5d5dfc4580caf44adb181880f110a0f487f1dc6893c699c207cdaefb4

SHA512
9c8bf64a0640c595030a09c8c8e56ac9a43f6a385700ffcd2adeb586cf97376c1b624e7f3c2526eb565b09c1f3992df32ad6902ea617bd41af201c7500b28130

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_am.dll

Filesize
42KB

MD5
7b7b7e737b43785f37f8d27fc2332eeb

SHA1
81e1981b5f3df2efb80bb1e32bd7d69c391df975

SHA256
03ce1b6075cb0ae2aed6abce06fef453117b6ee7f6149843d80013f8d5e4915a

SHA512
6d8bb06913a0dade24080a00310d1b4de338815f6c9c805a38e69e984f85be5afbd51b088833397884c02a0e63d8b919d6a940cd2bf471e84e71ffee6667d9fe

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_ar.dll

Filesize
41KB

MD5
0fa547b2b22650283a62e76b9ad54922

SHA1
401c7dcfb4417619d9567346472721a1f77a8f32

SHA256
982061548ab789e04b69a2bf0c50492c45b1d0d0fdb2429c23bb46c37a989899

SHA512
8be9a98aae8862dd6d8baa4f7e3aef3645537bcdea8547186d43ccd7e6a7f3ed946ad54add179a97fe4bbb80dcc7f0aabb089312c3f3913fa653822c4e93551d

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_bg.dll

Filesize
44KB

MD5
c505b06cc74ccbca88bf28c80dd5b513

SHA1
c2003798ef5ef6beb6230447546e74093fcf3dbe

SHA256
67e7e011898e171bfe181b61fc9e669a6457e827ce62541958fdebdc30f65ca4

SHA512
720c102eb40fbc980a502f9168dfb08a35574a0daa6ac23474eaab7bb9aff69e8f9dc60f5cd20501c60a6290c31ab6ffc101950f4786cced3ae0e39e8a3a655f

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_bn.dll

Filesize
44KB

MD5
94c1be1cab14b0cc146736c53f9e6735

SHA1
722a580dcd0d5fcbd9b03788390bcbc7b4f5a7e0

SHA256
650dc6bd49fe0f326cc72e0e6d8eae8dba54e42ff28fb064fc4ebba45ec67bad

SHA512
fde4918ef038519f03498a8f5114aa84a1006f1be4ffa97dee37a0305f763c8f5fc4346382ba01ff491a3bcbc49f6749c4278046509507525377e122f4912535

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_ca.dll

Filesize
44KB

MD5
635d5aca6106761dbdee1d3a340bb2fa

SHA1
98a929f901182e004ab141487e851883605ae5b4

SHA256
a3450652fb18b715bbee3f7ef7969fdfc8cdad75bf3b989e98231d427cb2ab8b

SHA512
add90c9d435504a7ecb46e595a1afeed70f2a4e1d8f7366e31f342c13c4356201e318d5954a6d4872cb71f6ba65937f92f07733e345c466bbafd87daca682eed

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_cs.dll

Filesize
43KB

MD5
79a4a8b69408a483ba9e606b616b783c

SHA1
7edc314fe5097f824326326b7135cfd651251bc5

SHA256
71374a5d1d46ff5b0302f1530b6cdf27ef3ae978cff022804b3eef3d65b32f14

SHA512
89407343a392e0c51445fe012e9c4851b375893cca9e8c4ce7a49f53b279665b8a8d943e9ea55c5e4cefbc10b7e4822de814bce5e6b007449aef3d9ee70d255e

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_da.dll

Filesize
43KB

MD5
5e333a051cb6ffb9eb4140f3a2b3f126

SHA1
7c76efd81e7997aeb0d5c983cbe75a70f14bde86

SHA256
a59929ea99affd91ec27e74264b68ba2f5d70d3e0e3753ecf7277b7d86d549d4

SHA512
5783a1ccd1df82379c642f90c58930754f26a88d532086166ea789e9235868a6298688951d0b9a14380dabf3569eed129a9e7085b612e1b9d7ca9791177a3c4c

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_de.dll

Filesize
45KB

MD5
d6b6b43febc5398e400d349f2b179c30

SHA1
939c021d53eed626b831fcc388ba6ad8e64a18e7

SHA256
b20cc0f04aefce5269e8f3dfef9237b08dfb7a38d32a326d99fd7b5f45b6d2ba

SHA512
b17aeba3c776bc50270d4f80d93d11da038b0281dc5f5b131dd36cf80a921f449c6028b30d27837172e4804d515a1b3023fd83f03f7283b879b472af842b3189

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_el.dll

Filesize
44KB

MD5
cf5b984e4cf0bc03d3c4667e8446e33d

SHA1
94d08877d2cecb7b4e0e0be01c6dfe7175c2266e

SHA256
5636fa5f90c6ba45a897d8939be0af15dc29858571ebee9b360b1c565707e9b1

SHA512
2a1538eeb350500365181769265a43877a81f4d1726ad4348ebe7f2454ae7974766f6e8bc09f08a2871de6e3ffc3e005f3539504d363f41f5935cdce1b129b11

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_en-GB.dll

Filesize
42KB

MD5
c3c7577b26d17ca55218b52ad56b0021

SHA1
b5697d0a43261878823f209d2537cd25657304b1

SHA256
fe463b31414f753e5259420464111718c026a9bb1728df40208abd2af6788f36

SHA512
21a410d383d62acc0612c2199841b897db047d0aeddc2f89da875076c71cc86ffc511007af5a142d96d86058559843ab7dc7016f12a117477ac386411931a22b

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_en.dll

Filesize
42KB

MD5
245e27fd9aef7c5ed2db7516f3d8a76e

SHA1
f84ab0728783517c438e0c30c0c354395f337607

SHA256
4e100a27012b1ee9cb9a4684d337a63a6ccce57254ba545f97fb02fee84f8924

SHA512
eebd57100dc11add48bb5f551284947972692e4fa119ca21d798382242131072ec45f9abe099407248dd4f4a61e38cd44e7a1d1b665378d72f604176e3fa70a9

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_es-419.dll

Filesize
43KB

MD5
08f3dd9997f84587c98fa7f99fdc50f0

SHA1
1360bc0159ddd5d6f29b2ab25f196c4211b17578

SHA256
60e1653a9028ab733e967998b3feb966e9e0094283c341edaba61011ea122b77

SHA512
84289804af3a686f9a16a99979656ceb475b1862fbdb5a583ab29dc6a40a4733402df39c2faba244068d78abe22b0603f2c3119233d6feb79435ffe264632cbd

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_es.dll

Filesize
45KB

MD5
a300ef85c334ee12eb0a868160476394

SHA1
091c31d6a137941dfe8195c2db8ab18c57a955a1

SHA256
f888b8cd68713d57f42008b8b9564c858b633b23c4053084afef8ae198d94827

SHA512
f71906d258f3561f7026b7e83bd7f5052a418979946e056a224f6ab0fff3f3bd6541ea14e991c8679c936162bc5c32bb9593603a9722d0a183ae36c85ef9af21

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_et.dll

Filesize
42KB

MD5
22c79d150b82a913b598c8df5b37d8b9

SHA1
6d4cd15f841509485d9d45efda2319d03138d7a4

SHA256
7338dde406ae7a8ed31ff9d9865e7a409cbe310e84af49d041a64288d3f626e6

SHA512
4b31e14e10a2c10026cc8980d73fb1b295d6105e0adaeb2f4481ded4e5e211ac73412f880f75786a44e7f4d2f5e58b241ae1936a910dd16846d9ce82784e0bf5

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_fa.dll

Filesize
42KB

MD5
d30aba2548b3e1541fd887f1f65238b6

SHA1
c98e32df3fe9c57e8e81ecbf59964d4f0f645b6b

SHA256
b50b5a59cb3b7996f4790cefc3ab53449ffeaae2e2c341979e4659c16b2a14b9

SHA512
f5929e032472b9ae8d0e863d09f701717de9df349a95088429a45dac749bc3f6fdd311e6d452b5752024a19bc56b52e8fe16fe93200044fd8cbd9df43119582c

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_fi.dll

Filesize
43KB

MD5
931ea397c00784abfacd115792ac8bd7

SHA1
5d7f9575f1542c9c6ccebad79d8f2a743e12feda

SHA256
1bba6f1fedce53048a7c005225c78d49816b9b3f91713f1f775ed5a39711d2ec

SHA512
cf6ba2bdf384ce7785b7f3254b1efa7c449fc2d0fb28de690e17a5c1159e6ece537fdd2227694dbb5d63a6a669810401b8308a228452adc8548b3d038b6f019a

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_fil.dll

Filesize
44KB

MD5
8d6632dd0febf77679d7a8be4dc25ebe

SHA1
82498060948a8ff6b9726e98d59da148e8010c62

SHA256
db6fe58a08ee3d9d6c9171b867a5aff07897dac7cd48f9b73ef2d4cf5f47f3bf

SHA512
08cdf49c37f19c021b5ecd9583724634f859752f9b3d4743c8adc1787f968b16ee072b83f13f21e1a2125cf01d73546fb88ea70b14f3c0f557e71b7a9f95ebeb

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_fr.dll

Filesize
44KB

MD5
a1addd3b35199eb276f55e158f3ec732

SHA1
a72f1cc7a04d9d7f0ba517c342709048c43ad17f

SHA256
339b96e7e1c7568b13aa5d60338e4bce47356691cbf216d185cc1bbc7d377618

SHA512
f28d6a26d0ea7d0c7b1f220e889d499a3fda0ede47aea0180b89f024c31d59bfd3c2f781e0a6cc2de2744b105333fe27a9a282fb03156dbba49c01280c0f2f72

Download Submit
C:\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdateres_gu.dll

Filesize
44KB

MD5
74a9b0ed18d8fbf9b3a9246486142a4e

SHA1
e9299dbd5375fe1c6b4580d65220f5593cb24d6f

SHA256
de64d90d230f98f75249099ea84f93c99833f020b4b00ebb3c09b67a56325324

SHA512
02da603db1916c1d366bec0a43dc651be140a9d82e584239aca080b347b9e03288991557cb509d74f4ca9d71b2ae73e98206c5c31bb691d174802f29aead1bab

Download Submit
C:\Program Files (x86)\Google\Update\Download\{47B07D71-505D-4665-AFD4-4972A30C6530}\23.10.697.3\HPE-23.10.697.3-CIP.exe

Filesize
537.3MB

MD5
912f7f1ef96f00cec879358ae4970395

SHA1
3e3baad896315e4e4e3c2f6540504ebb57bbe128

SHA256
b37b5c80b8e204a6f2e7dece1ec4ceecc4cedcf3ecae172036a0edc1cf8fca48

SHA512
9fdfdabc9b54c9eef3396f2db2155100dfd36fa06d5ef1d4fffe6f268c211a02c05088293ed9643668ae6452b78d547251e4a9105b39f11c0ccc2331905631b0

Download Submit
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Filesize
158KB

MD5
cdf152e23a8cbf68dbe3f419701244fc

SHA1
cb850d3675da418131d90ab01320e4e8842228d7

SHA256
84eaf43f33d95da9ab310fc36dc3cfe53823d2220946f021f18cf3f729b8d64e

SHA512
863e1da5bc779fa02cf08587c4de5f04c56e02902c5c4f92a06f2e631380ecabcc98e35d52609f764727e41b965c0786d24ea23fc4b9776d24d9f13e0d8ae0c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034

Filesize
184KB

MD5
990324ce59f0281c7b36fb9889e8887f

SHA1
35abc926cbea649385d104b1fd2963055454bf27

SHA256
67bcedd3040fc55d968bbe21df05c02b731181541aff4ae72b9205300a4a3ecc

SHA512
31e83da1ac217d25be6e7f35a041881b926f731fff69db6f144e4fe99b696a31f9ab7766ca22cf5a482743c2a2d00a699ca2c2d67837a86c471a2dd3bed9ea1f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
888B

MD5
92eb6d0a95f46eb6857a065e3581e31a

SHA1
3c217245464beadb134124afeb0effef05cedee7

SHA256
8c697f55c0917433808ae58c106cdda3ac405254073b26da81a3bd6ebc949a17

SHA512
d23803e7d103fbe3f87309e6ed98fd98b9883172c93d83c1947850418a293f382de22b8c094641259d143c2ad741c3d5b7ac260e6d9ae7122c27072c14d8f863

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
bee165e9eedffcad9e09c1bfd4accd0e

SHA1
ccc30d2343ae6bc6449bb30890aaf02ca1f88c69

SHA256
64a333846439d4f3f3f464a90ef1eedebc14a9d3729415cf0afe442a6d1e71be

SHA512
cdd4a3e2d0b5cb8ff1fec7f26f3148a917bb1e9c1016b51ca915d49433226a964130fbabcb2fde7c9b34c88ca909533ffabab9a378af2de95a5b7e6d7c4e7b66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
71963236c424b0c1c2c7dcb56a29b9e2

SHA1
9b4ba7abd7b858b2a6c1bfb7b033fce6c0044200

SHA256
f36a815a615fbcee812bdf183b9382b33e1bc2e5fba0251c2ae833ca1469c5c9

SHA512
56472a6defae8506d7742e7dff511d699d003ed8b974c3028720316f6c16412b519b97545c19c78b3d42babbf34c77733b5278d8203c115cda18c614cd7b36fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e0c23124a918423d993aa11f3455601f

SHA1
a06fc9056b55cb35121df62996b5e731157a60a3

SHA256
0406b4928d0e9664930a5c43fc9cf16d11556a598f02066fe2295cd85241f939

SHA512
8c2d88d43d9d379aa7d84ab24b7b3329f278f626a44f4e2bae37fed331fb6406559f318496ab27c0f2cf3187669f467b5ef66427024cc8b44f5ad70cf3edcf91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
369B

MD5
ed73b780fff946c14e52c4f6bf36db64

SHA1
04b9a3b466ff5d4bacbf87c1a48fed3a53d89ca3

SHA256
92376fdae906876d04fb7e39c09850773e88b2c0b1424125f6769d5ea81cd094

SHA512
8185984f9ce29d33200b2957770e1eacbd42e66bebd953a2b533fd83861ac3c8099f6b556b6d88fecc8e628b13d874be8aa7b7dbf29c24f474b2c1fc43eb9e52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
fbb411f7f7bc9d5f963cad4e97e5294f

SHA1
9dd1af1ed848a10cadcdc75c0b8ef04d23e18d99

SHA256
2822117497c5e716d0a4ef74e17261489a7cd050af783757331da33f3d15c03b

SHA512
421c61e03a4f0a50399fead2f071830aed29f3d56e5843f7553af5c30bbb969cd69f58edcdbec0e62321b120ab3e29a39bc461a9d3cc4d7a9401a5bd6d7c1c14

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a0527e2e-e2e5-4c34-b584-6f5a7fe0f623.tmp

Filesize
1KB

MD5
46ae4e8a541aa31cfb059123be6a13ea

SHA1
c8c56a864f503c54cbef5dd314428b9081d65ebc

SHA256
b8aaeee01680fed1e557e51fdd0f3cb7cae31ee9e419608894f6fbc870af3dba

SHA512
49441eb89adbace3781b2cb1a56366765245b23eb204dc9b75f49fc44e894e39462172814ec830aa3fd672162ccb96884c2403f0c53ade7253462c862b87a852

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
d3f7be159d67f99b1b7f0c53607f30a2

SHA1
95f7147f78f3731e3aa58de8d2bae8de5edfcb42

SHA256
422bdb845fc6b4936233a1b51833215751b99d65dd76182f7c0d1adf614a4368

SHA512
1b396b2c76a4c0a228fc1eb2b8976e94b2bf61faae12186dd556b9487af077e70a9c421e1afd89ad6a8089b2bdf25191375878c56ad5fceea6330339573354a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
dbc3d5e0e067472bbe9e662b4b957bfa

SHA1
3320780f3ee0d19d2362d1781246372b3dc16fad

SHA256
eb9f446aec0f532466d74ec975c5e5e578631c34dcf6edd94d446e5c006c2fa7

SHA512
e86e927b6121d4d74bc1fdbf6d208fc6e5b71fbc81f495b8f718f3253716bdb4f1406379d19c0e2f36ef8f8191e3475c74a1427dc8e754cb86a08e9e782a6d84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3f5f2d8003280bb6f16446e07cd509ff

SHA1
03ff52855a600cda50f342622ff736e0178c266d

SHA256
7f5afe44f8490f2aafcff988e9188450399efb0a625630e91b21be323b39d730

SHA512
ad2b83e77a85333507c865c3272ff851f8f97ba0d8ca84e7e8258f547319ea5d5c8a62cace0ad0be6b5c1e85528971becfeca8a941d6ad65fcc9d80cb2055c99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
86ad9023cc7b943ba8c924be1fcc5890

SHA1
b394f50b6eea3a9b40a65378ed48da5d2f69061d

SHA256
491310b92263c032bb4bf6aac8a80a897703c38169a31caf78be6d2c42e3a297

SHA512
8d15baf361b0ab906c39e5a96b313ac36b53297872f63dc59691bf093a262e8a431c267e86acd7c59ef191945dbd556d8536df6666a0a229318515b729c74125

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0d03a62772809a0507a3a29e76aea986

SHA1
0fb605ef712550a26693ad48d1364f15ec5c4c07

SHA256
8684b715155cb807983ab480ead290d6375af1cd2adc966c6c4b5d71a55d9530

SHA512
8ef7fb279d8f004089674145b98dd4c2b74b705af0c48530a1528f53d40148aebfc0e7ac738103b96d308c30a83247b098bc6147d39f686a619f0ff3babcb6fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
209KB

MD5
64c8b76708bd6a156d4c52b9dcaf6bf1

SHA1
e21cba638364dc1afb8c08643923ae7ba67cdc9b

SHA256
1a257b4448aae3232b61a5445c903b84bca36011845b5eac4699bae54e957376

SHA512
a006f0281d2ae70cd0263fcb48427e50b5af5d59440109fff5d57c5b53ae265e44b583cdd022235e920ae6fe04858b2c6dd23ab41ba00de539f2e4b844a499ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
209KB

MD5
6562217c98393b5e6af83893463b1524

SHA1
8ee1cfc8d27a453660e92931379a800a3e25e0fd

SHA256
796553bea071eef59af9d622d45d4885d0e12e0802bb8c4372110a6d17fe31e9

SHA512
f9982a3db2bd4c0fc87c3ff549aae02048b3b948e340513d98d64d2cef6c533fa6e15d2a097d8d85da4097c5b931cbd9ef9114a971d8fb2c8e2087b1276376be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
94KB

MD5
6113c3fa3a54e015c8ed7ee2ba891162

SHA1
54f0f049e03acfebd7ef2215d281f1523f921e73

SHA256
e51a10e90a29bc76690802c5260efc454e530a70b68fa1beb10ad3f91e74758d

SHA512
9bf11a106c0f535f306c2386cf5aac491d883f1b9acb71742f91d727239a6018d5bd81e4edc6bd32b96dce2ed094b6dc3836e429b79c65b4105b138dc4a7dd2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
108KB

MD5
1bb77c8ef1f7abd0c383d846bcb19f9d

SHA1
838b2f4f73bb7e5bf72e8c801ac2b6f64f833384

SHA256
d7640f653ef804796449d3c300d9eb1a80834071338ec055875bfbde7796e0bf

SHA512
607d99e7b3c4022140d8b3a35187d08bc41e93fee7e2eccafecac14f9a7c4545076228f9df2e78ddf81a897d94e507d0b29394ab7632ebed4dc9f6de00c0c7f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
102KB

MD5
5ccb340945adcd1064c094cc89374c72

SHA1
6616044cbdbfe7a412164e2f2cca9cb031a2802b

SHA256
f441641cb770905d6a8180134b9091bcd174eaa80014dee123be3e8fec558624

SHA512
e0759d254d33cc2c97f3150555905ca3916a6066e8f33d853009e311067bf6f88c8d222ec45cae5c22da3c5b0555900cbb86365fe563cd40cca55c969df41a5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe587088.TMP

Filesize
92KB

MD5
031bb667b569fe2e084b13cea3b303e4

SHA1
bc44ad42e14d47d3489395bd5b7b0c51662bd716

SHA256
5cb71feaa86e61e9d34a3b018f00d1bc455857eda8cb4a34967c52309a9e126d

SHA512
37019f3530428bf198d70fb573d6d69d063b4e6be2b4fc37d6840080a037c6e1c67948d4c608f872eca38e43fb3d2b86c9d6eff376acbf5b4d2106dd4fe89168

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad\settings.dat

Filesize
40B

MD5
73924321657c84ba423104535066c996

SHA1
76b085875aa9ea5a95e38f49df766a097449f611

SHA256
e2af0de3f3dea51825e8fb787304c9ad96ff32e7a6890c7aa3cde02818d8df28

SHA512
e91e155c13f50017b687401508d463eb5bb72cd5f9d2f00c3dd18d42a97714bc2f4cd0d9b5341a0018976d8197ac0d3e1d809840c62e207616b7df5d7c938f54

Download Submit
C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad\settings.dat

Filesize
40B

MD5
73924321657c84ba423104535066c996

SHA1
76b085875aa9ea5a95e38f49df766a097449f611

SHA256
e2af0de3f3dea51825e8fb787304c9ad96ff32e7a6890c7aa3cde02818d8df28

SHA512
e91e155c13f50017b687401508d463eb5bb72cd5f9d2f00c3dd18d42a97714bc2f4cd0d9b5341a0018976d8197ac0d3e1d809840c62e207616b7df5d7c938f54

Download Submit
C:\Users\Admin\AppData\Local\Google\Play Games\InstallerCrashReporting.log

Filesize
1KB

MD5
88d48fb97e66ccb08cf92e22d503cc70

SHA1
ae909b4738d18fe0529e77765d25f27a64743867

SHA256
936618398334e925e611f8188bb0c2eeea46f327259a6474dde8079c89c466f8

SHA512
fa99c95d1fd11315f50d29a55702cc413755ac6e49e192ae7876ae4aab091f5aae24867eab6414851c971403c08df61331d3cc60be816c2060a4c7ce4cb97a43

Download Submit
C:\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\CrashReporting.dll

Filesize
947KB

MD5
e84629e65c8ce7366c33fd0f744dd587

SHA1
b5d0c6be50b917368cb75f5723f3bf1cb57ede49

SHA256
b7096a54125cd5ee41d907de06e4cb75473d2768f3b92b2e3f230e83694dbf1b

SHA512
a226a4d14ce2ec67aaea9967d4e36cfc4302c8264f9bd82fd88bc864b6d75fb3736ebe8a5670f63df1078a0b582d4f5551e53d26de8ef923721084bc00eda0fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\GoogleUpdateSetup.exe

Filesize
1.3MB

MD5
88df743dce878baf2c1970012a937677

SHA1
50954fedcec5ea422c8fd31d5e43bf53cef416d8

SHA256
888eef05873881feb3739d48cd36b25e18830fd33508dd145db56ddc504c36c6

SHA512
af3cb14dff5c4aa15d961002c7babd0d772fb699a0fd90eda1927f29843056322ba46b2eac03a9f08e6a65cccecee4f4d42a9f953ca758378bbd13c3fe662113

Download Submit
C:\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\GoogleUpdateSetup.exe

Filesize
1.3MB

MD5
88df743dce878baf2c1970012a937677

SHA1
50954fedcec5ea422c8fd31d5e43bf53cef416d8

SHA256
888eef05873881feb3739d48cd36b25e18830fd33508dd145db56ddc504c36c6

SHA512
af3cb14dff5c4aa15d961002c7babd0d772fb699a0fd90eda1927f29843056322ba46b2eac03a9f08e6a65cccecee4f4d42a9f953ca758378bbd13c3fe662113

Download Submit
C:\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\crashpad_handler.exe

Filesize
1.1MB

MD5
4d57a065a8edcf63c063be429dd9bacb

SHA1
520af5c307d0528e183fa8748234a2c6b86ecc9c

SHA256
a225070803ff653cb2ca94c94a050992c1e43c08ec95065fa779d6a9b44ce4bb

SHA512
0906dcdb897727c92fa8e962f1fc2511bc73a1038b8c542bff735e27a1c96ea09fc383774c94ff16496383a82d6bf9658446ca90bbc06e55a95d65717f2dd745

Download Submit
C:\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\crashpad_handler.exe

Filesize
1.1MB

MD5
4d57a065a8edcf63c063be429dd9bacb

SHA1
520af5c307d0528e183fa8748234a2c6b86ecc9c

SHA256
a225070803ff653cb2ca94c94a050992c1e43c08ec95065fa779d6a9b44ce4bb

SHA512
0906dcdb897727c92fa8e962f1fc2511bc73a1038b8c542bff735e27a1c96ea09fc383774c94ff16496383a82d6bf9658446ca90bbc06e55a95d65717f2dd745

Download Submit
C:\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\crashpad_handler.exe

Filesize
1.1MB

MD5
4d57a065a8edcf63c063be429dd9bacb

SHA1
520af5c307d0528e183fa8748234a2c6b86ecc9c

SHA256
a225070803ff653cb2ca94c94a050992c1e43c08ec95065fa779d6a9b44ce4bb

SHA512
0906dcdb897727c92fa8e962f1fc2511bc73a1038b8c542bff735e27a1c96ea09fc383774c94ff16496383a82d6bf9658446ca90bbc06e55a95d65717f2dd745

Download Submit
C:\Users\Admin\Downloads\Install-Clusterduck-GooglePlayGames-Beta.exe

Filesize
10.3MB

MD5
a7a0273234425b1c45acfe024a78d035

SHA1
e853a1a6f70a6526e5808cf1aea8b102e4799b2e

SHA256
7f28b9a8959c0b134f7bc38552a8d3db9e2d10c577730b2e63f5670814f271a1

SHA512
7fe3babda5e426c6e4973780a0ef4cefd312966f3c760b5aad46b6f3f0ea4fc87bf482623a86fea87444c3a64a383b1f16a9a7be302d6a9c72932cf9652141c3

Download Submit
C:\Users\Admin\Downloads\Install-Clusterduck-GooglePlayGames-Beta.exe

Filesize
10.3MB

MD5
a7a0273234425b1c45acfe024a78d035

SHA1
e853a1a6f70a6526e5808cf1aea8b102e4799b2e

SHA256
7f28b9a8959c0b134f7bc38552a8d3db9e2d10c577730b2e63f5670814f271a1

SHA512
7fe3babda5e426c6e4973780a0ef4cefd312966f3c760b5aad46b6f3f0ea4fc87bf482623a86fea87444c3a64a383b1f16a9a7be302d6a9c72932cf9652141c3

Download Submit
C:\Users\Admin\Downloads\Install-Clusterduck-GooglePlayGames-Beta.exe

Filesize
10.3MB

MD5
a7a0273234425b1c45acfe024a78d035

SHA1
e853a1a6f70a6526e5808cf1aea8b102e4799b2e

SHA256
7f28b9a8959c0b134f7bc38552a8d3db9e2d10c577730b2e63f5670814f271a1

SHA512
7fe3babda5e426c6e4973780a0ef4cefd312966f3c760b5aad46b6f3f0ea4fc87bf482623a86fea87444c3a64a383b1f16a9a7be302d6a9c72932cf9652141c3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 685383.crdownload

Filesize
10.3MB

MD5
a7a0273234425b1c45acfe024a78d035

SHA1
e853a1a6f70a6526e5808cf1aea8b102e4799b2e

SHA256
7f28b9a8959c0b134f7bc38552a8d3db9e2d10c577730b2e63f5670814f271a1

SHA512
7fe3babda5e426c6e4973780a0ef4cefd312966f3c760b5aad46b6f3f0ea4fc87bf482623a86fea87444c3a64a383b1f16a9a7be302d6a9c72932cf9652141c3

Download Submit
\Program Files (x86)\Google\Temp\GUM2A92.tmp\goopdate.dll

Filesize
1.9MB

MD5
f3dc510106657e0243cb14ade5260de7

SHA1
316d2fb266cf70364e3cbd86f1f84141a3ec5ddb

SHA256
a11e34b5d5dfc4580caf44adb181880f110a0f487f1dc6893c699c207cdaefb4

SHA512
9c8bf64a0640c595030a09c8c8e56ac9a43f6a385700ffcd2adeb586cf97376c1b624e7f3c2526eb565b09c1f3992df32ad6902ea617bd41af201c7500b28130

Download Submit
\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\CrashReporting.dll

Filesize
947KB

MD5
e84629e65c8ce7366c33fd0f744dd587

SHA1
b5d0c6be50b917368cb75f5723f3bf1cb57ede49

SHA256
b7096a54125cd5ee41d907de06e4cb75473d2768f3b92b2e3f230e83694dbf1b

SHA512
a226a4d14ce2ec67aaea9967d4e36cfc4302c8264f9bd82fd88bc864b6d75fb3736ebe8a5670f63df1078a0b582d4f5551e53d26de8ef923721084bc00eda0fa

Download Submit
\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\CrashReporting.dll

Filesize
947KB

MD5
e84629e65c8ce7366c33fd0f744dd587

SHA1
b5d0c6be50b917368cb75f5723f3bf1cb57ede49

SHA256
b7096a54125cd5ee41d907de06e4cb75473d2768f3b92b2e3f230e83694dbf1b

SHA512
a226a4d14ce2ec67aaea9967d4e36cfc4302c8264f9bd82fd88bc864b6d75fb3736ebe8a5670f63df1078a0b582d4f5551e53d26de8ef923721084bc00eda0fa

Download Submit
\Users\Admin\AppData\Local\Temp\5wa0u2ze.tlc\recorder_delegate_lib.dll

Filesize
4.3MB

MD5
8925e3a3888f094b6a84365d7837e7c8

SHA1
3475d66f7bb3a260c169f6de742273db847cfee2

SHA256
dbbb5fad87c29cbb1341c0b61a0b205c0d1a9cc9ca4cee2a21dcd26c49eecc2f

SHA512
20d19825baf10f2739607d669b24470bdf01df0fc1e8368899c3b85c278c3e5d96118ce08e4fffad9d159b9618e336eb680c07a363f4d5bff84e4d3c80bd056b

Download Submit
memory/920-395-0x000001D88C360000-0x000001D88C370000-memory.dmp

Filesize
64KB

Download
memory/920-660-0x000001D8A6B70000-0x000001D8A6BE6000-memory.dmp

Filesize
472KB

Download
memory/920-740-0x00007FFE46780000-0x00007FFE4716C000-memory.dmp

Filesize
9.9MB

Download
memory/920-394-0x00007FFE46780000-0x00007FFE4716C000-memory.dmp

Filesize
9.9MB

Download
memory/920-662-0x000001D8A6A20000-0x000001D8A6A3E000-memory.dmp

Filesize
120KB

Download
memory/920-667-0x00007FFE46780000-0x00007FFE4716C000-memory.dmp

Filesize
9.9MB

Download
memory/920-669-0x000001D88C360000-0x000001D88C370000-memory.dmp

Filesize
64KB

Download
memory/1856-726-0x0000020D360F0000-0x0000020D360F6000-memory.dmp

Filesize
24KB

Download
memory/1856-725-0x0000020D35F10000-0x0000020D35F2E000-memory.dmp

Filesize
120KB

Download
memory/1856-723-0x0000020D1D540000-0x0000020D1D558000-memory.dmp

Filesize
96KB

Download
memory/1856-724-0x0000020D1D570000-0x0000020D1D580000-memory.dmp

Filesize
64KB

Download
memory/1856-722-0x00007FFE46780000-0x00007FFE4716C000-memory.dmp

Filesize
9.9MB

Download
memory/1856-721-0x0000020D1B8D0000-0x0000020D1B9F4000-memory.dmp

Filesize
1.1MB

Download
memory/1856-728-0x0000020D1D570000-0x0000020D1D580000-memory.dmp

Filesize
64KB

Download
memory/1856-727-0x0000020D36220000-0x0000020D36250000-memory.dmp

Filesize
192KB

Download
memory/1856-734-0x00007FFE46780000-0x00007FFE4716C000-memory.dmp

Filesize
9.9MB

Download
memory/2216-346-0x000001B5710B0000-0x000001B571116000-memory.dmp

Filesize
408KB

Download
memory/2216-370-0x000001B575DC0000-0x000001B575E00000-memory.dmp

Filesize
256KB

Download
memory/2216-357-0x000001B5716B0000-0x000001B5716B8000-memory.dmp

Filesize
32KB

Download
memory/2216-352-0x000001B571640000-0x000001B571660000-memory.dmp

Filesize
128KB

Download
memory/2216-351-0x000001B571730000-0x000001B571832000-memory.dmp

Filesize
1.0MB

Download
memory/2216-350-0x000001B571410000-0x000001B5714C8000-memory.dmp

Filesize
736KB

Download
memory/2216-349-0x000001B571120000-0x000001B571126000-memory.dmp

Filesize
24KB

Download
memory/2216-348-0x000001B570F80000-0x000001B570F88000-memory.dmp

Filesize
32KB

Download
memory/2216-347-0x000001B571140000-0x000001B5711BC000-memory.dmp

Filesize
496KB

Download
memory/2216-407-0x000001B571130000-0x000001B571140000-memory.dmp

Filesize
64KB

Download
memory/2216-345-0x000001B56EDE0000-0x000001B56EE08000-memory.dmp

Filesize
160KB

Download
memory/2216-344-0x000001B570FA0000-0x000001B5710AE000-memory.dmp

Filesize
1.1MB

Download
memory/2216-343-0x000001B56EDC0000-0x000001B56EDE0000-memory.dmp

Filesize
128KB

Download
memory/2216-342-0x000001B56EDB0000-0x000001B56EDBA000-memory.dmp

Filesize
40KB

Download
memory/2216-341-0x000001B56ED10000-0x000001B56ED1A000-memory.dmp

Filesize
40KB

Download
memory/2216-368-0x000001B571130000-0x000001B571140000-memory.dmp

Filesize
64KB

Download
memory/2216-369-0x000001B571710000-0x000001B571718000-memory.dmp

Filesize
32KB

Download
memory/2216-367-0x000001B571130000-0x000001B571140000-memory.dmp

Filesize
64KB

Download
memory/2216-371-0x000001B576600000-0x000001B576638000-memory.dmp

Filesize
224KB

Download
memory/2216-340-0x000001B5706D0000-0x000001B570786000-memory.dmp

Filesize
728KB

Download
memory/2216-339-0x000001B571130000-0x000001B571140000-memory.dmp

Filesize
64KB

Download
memory/2216-338-0x00007FFE46780000-0x00007FFE4716C000-memory.dmp

Filesize
9.9MB

Download
memory/2216-337-0x000001B56E6D0000-0x000001B56E972000-memory.dmp

Filesize
2.6MB

Download
memory/2216-372-0x000001B571130000-0x000001B571140000-memory.dmp

Filesize
64KB

Download
memory/2216-373-0x000001B577750000-0x000001B577776000-memory.dmp

Filesize
152KB

Download
memory/2216-378-0x000001B577970000-0x000001B577A46000-memory.dmp

Filesize
856KB

Download
memory/2216-380-0x000001B577900000-0x000001B577962000-memory.dmp

Filesize
392KB

Download
memory/2216-379-0x00007FFE46780000-0x00007FFE4716C000-memory.dmp

Filesize
9.9MB

Download
memory/2216-381-0x000001B577AA0000-0x000001B577AE6000-memory.dmp

Filesize
280KB

Download
memory/2216-482-0x000001B571130000-0x000001B571140000-memory.dmp

Filesize
64KB

Download
memory/2216-382-0x000001B571130000-0x000001B571140000-memory.dmp

Filesize
64KB

Download
memory/2216-392-0x000001B576D60000-0x000001B576D66000-memory.dmp

Filesize
24KB

Download
memory/2216-396-0x000001B571130000-0x000001B571140000-memory.dmp

Filesize
64KB

Download
memory/2216-743-0x00007FFE46780000-0x00007FFE4716C000-memory.dmp

Filesize
9.9MB

Download