7ac67a69f797ebcff77b0b0234bced5adc586e78369efa2912c2be8b953d907f

Analysis

max time kernel
1049s
max time network
1023s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
25/01/2024, 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG_1993.jpg
Size

296KB
MD5

032e44db264c059a96f35c8a299c66b7
SHA1

270e8a5e521ed71572cb30cb26083b755e9128bc
SHA256

7ac67a69f797ebcff77b0b0234bced5adc586e78369efa2912c2be8b953d907f
SHA512

0aecebf850f0525510293ba723d725ab095a7dbff315ae7b3fa78cd433dced9ca7d8284ae878bed5567f28a436143bde92b96ae93b33fa0b7013710e900e21b8
SSDEEP

6144:wOD0NJYnM4k5x10PldjdO0HogiPiFOt8UKmI1XRFQzT6kl5DxArNTyR:W75z0/Q0HniPi08hzFQfVl5DCrBu

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\121.0.6167.85\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe

Modifies Windows Firewall 1 TTPs 3 IoCs

evasion

Windows Service

T1543.003

pid	Process
900	netsh.exe
4548	netsh.exe
2780	netsh.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe

Executes dropped EXE 59 IoCs

pid	Process
2516	Install-Geometry Dash Lite-GooglePlayGames-Beta.exe
4732	crashpad_handler.exe
1632	Install-Geometry Dash Lite-GooglePlayGames-Beta.exe
4172	crashpad_handler.exe
1032	GoogleUpdateSetup.exe
3092	GoogleUpdate.exe
4208	GoogleUpdate.exe
1900	GoogleUpdate.exe
4880	GoogleUpdateComRegisterShell64.exe
756	GoogleUpdateComRegisterShell64.exe
3492	GoogleUpdateComRegisterShell64.exe
3344	GoogleUpdate.exe
2684	GoogleUpdateBroker.exe
2704	GoogleUpdate.exe
4484	GoogleUpdate.exe
2880	GoogleUpdate.exe
5020	HPE-23.11.1397.6-CIP.exe
3320	7zr.exe
4560	Applicator.exe
1324	InstallHypervisor.exe
3596	GoogleCrashHandler.exe
4928	GoogleCrashHandler64.exe
564	GoogleUpdate.exe
3720	Bootstrapper.exe
1700	Service.exe
5100	crashpad_handler.exe
2772	GoogleUpdate.exe
2516	GoogleUpdate.exe
3356	GoogleUpdate.exe
3736	GoogleCrashHandler.exe
3644	GoogleCrashHandler64.exe
3592	GoogleUpdate.exe
4548	GoogleUpdate.exe
1304	GoogleUpdateSetup.exe
944	GoogleCrashHandler.exe
1464	GoogleCrashHandler64.exe
4668	GoogleUpdate.exe
2196	GoogleUpdate.exe
3732	GoogleUpdate.exe
2988	GoogleUpdate.exe
1592	GoogleUpdateComRegisterShell64.exe
2064	GoogleUpdateComRegisterShell64.exe
4584	GoogleUpdateComRegisterShell64.exe
3512	GoogleUpdate.exe
432	GoogleUpdate.exe
3324	GoogleUpdate.exe
460	GoogleUpdate.exe
3976	GoogleCrashHandler.exe
3380	GoogleCrashHandler64.exe
540	GoogleUpdate.exe
1552	GoogleUpdate.exe
1588	121.0.6167.85_chrome_installer.exe
3164	setup.exe
240	setup.exe
2032	setup.exe
4488	setup.exe
4784	GoogleCrashHandler64.exe
928	GoogleCrashHandler.exe
4992	GoogleUpdate.exe

Loads dropped DLL 64 IoCs

pid	Process
2516	Install-Geometry Dash Lite-GooglePlayGames-Beta.exe
2516	Install-Geometry Dash Lite-GooglePlayGames-Beta.exe
1632	Install-Geometry Dash Lite-GooglePlayGames-Beta.exe
3092	GoogleUpdate.exe
4208	GoogleUpdate.exe
1900	GoogleUpdate.exe
4880	GoogleUpdateComRegisterShell64.exe
1900	GoogleUpdate.exe
756	GoogleUpdateComRegisterShell64.exe
1900	GoogleUpdate.exe
3492	GoogleUpdateComRegisterShell64.exe
1900	GoogleUpdate.exe
3344	GoogleUpdate.exe
2704	GoogleUpdate.exe
4484	GoogleUpdate.exe
2880	GoogleUpdate.exe
2880	GoogleUpdate.exe
4484	GoogleUpdate.exe
2704	GoogleUpdate.exe
1632	Install-Geometry Dash Lite-GooglePlayGames-Beta.exe
1324	InstallHypervisor.exe
1324	InstallHypervisor.exe
1324	InstallHypervisor.exe
1324	InstallHypervisor.exe
1324	InstallHypervisor.exe
1324	InstallHypervisor.exe
1324	InstallHypervisor.exe
1324	InstallHypervisor.exe
1324	InstallHypervisor.exe
564	GoogleUpdate.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.352\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.352\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.352\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.352\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\121.0.6167.85\\notification_helper.exe"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.352\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.352\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\121.0.6167.85\\notification_helper.exe\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.311\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.352\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InstallHypervisor.exe.log	InstallHypervisor.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Applicator.exe.log	Applicator.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HPE-23.11.1397.6-CIP.exe.log	HPE-23.11.1397.6-CIP.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Play Games\current\service\JsonnetWrapper.dll	7zr.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\121.0.6167.85\Locales\tr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\121.0.6167.85\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File opened for modification	C:\Program Files\Google\Play Games\current\licenses\LICENSES_chromium.html	7zr.exe
File created	C:\Program Files\Google\Play Games\current\client\locales\id.pak	7zr.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\121.0.6167.85\Locales\es.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\Install\{B0E939F5-7ED7-4C74-91E4-673A8FA985FF}\HPE-23.11.1397.6-CIP.exe	GoogleUpdate.exe
File opened for modification	C:\Program Files\Google\Play Games\current\client\resources.pak	7zr.exe
File opened for modification	C:\Program Files\Google\Play Games\current\client\locales\pt-BR.pak	7zr.exe
File opened for modification	C:\Program Files\Google\Play Games\current\service\DriverUtils.dll	7zr.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_bn.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\121.0.6167.85\Locales\cs.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_it.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Play Games\current\client\locales\en-US.pak	7zr.exe
File created	C:\Program Files\Google\Play Games\current\client\locales\bn.pak	7zr.exe
File created	C:\Program Files\Google\Play Games\current\service\pss.dll	7zr.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_pt-BR.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\chrome.VisualElementsManifest.xml	setup.exe
File opened for modification	C:\Program Files\Google\Play Games\current\client\locales\es-419.pak	7zr.exe
File opened for modification	C:\Program Files\Google\Play Games\current\service\Service.exe.config	7zr.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\121.0.6167.85\Locales\ca.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_th.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Play Games\current\emulator\avd\aggregate.img	7zr.exe
File created	C:\Program Files\Google\Play Games\current\service\naudio.dll	7zr.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\121.0.6167.85\Locales\uk.pak	setup.exe
File created	C:\Program Files\Google\Play Games\current\client\locales\sw.pak	7zr.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\121.0.6167.85\chrome_wer.dll	setup.exe
File opened for modification	C:\Program Files\Google\Play Games\current\licenses\LICENSES_native.txt	7zr.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\psmachine.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\121.0.6167.85\Locales\ta.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_ro.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files\Google\Play Games\current\service\boringssl_wrapper.dll	7zr.exe
File opened for modification	C:\Program Files\Google\Play Games\current\emulator\crosvm.exe	7zr.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\psuser.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_ko.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.311\goopdateres_no.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Play Games\current\client\locales\nb.pak	7zr.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_cs.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\121.0.6167.85\VisualElements\SmallLogoBeta.png	setup.exe
File created	C:\Program Files\Google\Play Games\current\service\Grpc.Auth.dll	7zr.exe
File opened for modification	C:\Program Files\Google\Play Games\current\client\locales\zh-CN.pak	7zr.exe
File created	C:\Program Files\Google\Play Games\current\client\crash_reporter.cfg	7zr.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_is.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\121.0.6167.85\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\121.0.6167.85\Locales\vi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\121.0.6167.85\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_fi.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\121.0.6167.85\eventlog_provider.dll	setup.exe
File opened for modification	C:\Program Files\Google\Play Games\current\client\locales\th.pak	7zr.exe
File opened for modification	C:\Program Files\Google\Play Games\current\emulator\avd\bios.rom	7zr.exe
File opened for modification	C:\Program Files\Google\Play Games\current\client\locales\mr.pak	7zr.exe
File opened for modification	C:\Program Files\Google\Play Games\current\service\naudio.dll	7zr.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdate.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_am.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Play Games\current\service\Ipc.Protos.dll	7zr.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_iw.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_th.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Play Games\current\client\locales\lt.pak	7zr.exe
File opened for modification	C:\Program Files\Google\Play Games\current\licenses\LICENSES_android.txt	7zr.exe
File opened for modification	C:\Program Files\Google\Play Games\current\client\locales\gu.pak	7zr.exe
File created	C:\Program Files\Google\Chrome\Temp\source3164_798213553\Chrome-bin\121.0.6167.85\Locales\id.pak	setup.exe
File opened for modification	C:\Program Files\Google\Play Games\current\client\locales\vi.pak	7zr.exe
File created	C:\Program Files\Google\Play Games\current\client\locales\hu.pak	7zr.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_te.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_th.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_pt-PT.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\GoogleUpdateBroker.exe	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\GoogleCrashHandler64.exe	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\GoogleUpdateBroker.exe	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_ja.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_ko.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_nl.dll	GoogleUpdateSetup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\GoogleUpdate.exe	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_ro.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_hi.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_pt-BR.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_zh-TW.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_ja.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\psuser.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_de.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_en-GB.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_it.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_mr.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_cs.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_mr.dll	GoogleUpdateSetup.exe
File opened for modification	C:\Windows\SystemTemp\GUT5298.tmp	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\psuser.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_el.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_es-419.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_fi.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_ur.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_hr.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_hu.dll	GoogleUpdateSetup.exe
File opened for modification	C:\Windows\SystemTemp\GUM5297.tmp\GoogleUpdateSetup.exe	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_sr.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_tr.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\GoogleUpdateComRegisterShell64.exe	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_gu.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_ms.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_et.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_ml.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_sk.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_ur.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_ca.dll	GoogleUpdateSetup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_cs.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\GoogleUpdate.exe	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\GoogleUpdateOnDemand.exe	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_ar.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_lv.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_ta.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_no.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\GoogleCrashHandler64.exe	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\psmachine.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\GoogleUpdateCore.exe	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_am.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_es.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_it.dll	GoogleUpdateSetup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_ar.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_id.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_lt.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUMD329.tmp\goopdateres_hu.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_nl.dll	GoogleUpdateSetup.exe
File created	C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_ml.dll	GoogleUpdateSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Applicator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\InstallerPinned = "0"	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506156663112537"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Applicator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Applicator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Applicator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	setup.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Applicator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Applicator.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ProgID\ = "GoogleUpdate.Update3WebMachine.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\LocalServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}\VersionIndependentProgID\ = "GoogleUpdate.PolicyStatusMachineFallback"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreMachineClass\CurVer\ = "GoogleUpdate.CoreMachineClass.1"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.ProcessLauncher.1.0\ = "Google Update Process Launcher Class"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{37FB52DA-F779-408D-B505-3F83CFBBFC20}\InprocHandler32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\ = "Google Update Core Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ = "IAppCommand2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass\CLSID\ = "{E225E692-4B47-4777-9BED-4FD7FE257F0E}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachine\CLSID\ = "{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ = "IAppBundle"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachine.1.0\CLSID\ = "{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ = "ICoCreateAsync"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37FB52DA-F779-408D-B505-3F83CFBBFC20}\InprocHandler32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.352\\psmachine.dll"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\ProgID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\ProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachineFallback.1.0\ = "Google Update Policy Status Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\VersionIndependentProgID\ = "GoogleUpdate.Update3WebSvc"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ = "IJobObserver"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.352\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E}\InprocHandler32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\NumMethods\ = "23"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\LOCALSERVER32	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
1124	chrome.exe
1124	chrome.exe
3476	chrome.exe
3476	chrome.exe
3092	GoogleUpdate.exe
3092	GoogleUpdate.exe
3092	GoogleUpdate.exe
3092	GoogleUpdate.exe
3092	GoogleUpdate.exe
3092	GoogleUpdate.exe
3092	GoogleUpdate.exe
3092	GoogleUpdate.exe
3092	GoogleUpdate.exe
3092	GoogleUpdate.exe
1632	Install-Geometry Dash Lite-GooglePlayGames-Beta.exe
1632	Install-Geometry Dash Lite-GooglePlayGames-Beta.exe
564	GoogleUpdate.exe
564	GoogleUpdate.exe
2516	Install-Geometry Dash Lite-GooglePlayGames-Beta.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
1700	Service.exe
3356	GoogleUpdate.exe
3356	GoogleUpdate.exe
2516	GoogleUpdate.exe
2516	GoogleUpdate.exe
4548	GoogleUpdate.exe
4548	GoogleUpdate.exe
4668	GoogleUpdate.exe
4668	GoogleUpdate.exe
2196	GoogleUpdate.exe
2196	GoogleUpdate.exe
2196	GoogleUpdate.exe
2196	GoogleUpdate.exe
2196	GoogleUpdate.exe
2196	GoogleUpdate.exe
3512	GoogleUpdate.exe
3512	GoogleUpdate.exe
460	GoogleUpdate.exe
460	GoogleUpdate.exe
3324	GoogleUpdate.exe
3324	GoogleUpdate.exe
1552	GoogleUpdate.exe
1552	GoogleUpdate.exe
4992	GoogleUpdate.exe
4992	GoogleUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe
Token: SeShutdownPrivilege	1124	chrome.exe
Token: SeCreatePagefilePrivilege	1124	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe
1124	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 2784	1124	chrome.exe	80
PID 1124 wrote to memory of 2784	1124	chrome.exe	80
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 2268	1124	chrome.exe	82
PID 1124 wrote to memory of 1388	1124	chrome.exe	83
PID 1124 wrote to memory of 1388	1124	chrome.exe	83
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86
PID 1124 wrote to memory of 2856	1124	chrome.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_1993.jpg
1⤵
PID:2008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffee0629758,0x7ffee0629768,0x7ffee0629778
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:2
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3236 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:1
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3208 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4568 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4500 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4824 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5124 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5276 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2556 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5364 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5652 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5560 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Users\Admin\Downloads\Install-Geometry Dash Lite-GooglePlayGames-Beta.exe
  "C:\Users\Admin\Downloads\Install-Geometry Dash Lite-GooglePlayGames-Beta.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\csrrohlp.azr\crashpad_handler.exe
    C:\Users\Admin\AppData\Local\Temp\csrrohlp.azr\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=23.11.1544.0 --initial-client-data=0x678,0x67c,0x684,0x66c,0x680,0x7ffec8780008,0x7ffec8780018,0x7ffec8780028
    3⤵
    - Executes dropped EXE
    PID:4732
- - C:\Users\Admin\Downloads\Install-Geometry Dash Lite-GooglePlayGames-Beta.exe
    "C:\Users\Admin\Downloads\Install-Geometry Dash Lite-GooglePlayGames-Beta.exe" -install gpg_install_6b5f8ed5-bbf0-413d-8755-b3c5f7d9c324 "C:\Users\Admin\AppData\Local\Temp\csrrohlp.azr"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\csrrohlp.azr\crashpad_handler.exe
      C:\Users\Admin\AppData\Local\Temp\csrrohlp.azr\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=23.11.1544.0 --initial-client-data=0x3dc,0x3e0,0x3e4,0x3c0,0x3e8,0x7ffec8780008,0x7ffec8780018,0x7ffec8780028
      4⤵
      Executes dropped EXE
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\csrrohlp.azr\GoogleUpdateSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\csrrohlp.azr\GoogleUpdateSetup.exe" /install "runtime=true&needsadmin=true" /silent
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:1032
    - - C:\Windows\SystemTemp\GUM5297.tmp\GoogleUpdate.exe
        
        C:\Windows\SystemTemp\GUM5297.tmp\GoogleUpdate.exe /install "runtime=true&needsadmin=true" /silent
        5⤵
        Sets file execution options in registry
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3092
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4208
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1900
        
        C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4880
        
        C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:756
        
        C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:3492
      - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REY2MTAxNTktQTRGMC00MzFCLUFCMjAtNTI0QUQ2MEY1OTY3fSIgdXNlcmlkPSJ7QTkyMzQxNDgtNzk1Qi00MkUwLUFENUUtMjcyOUVFRUUyMUU2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5QjAzODZENy1DMkRELTQ2MjYtQTE5RS1FRTAwQkJEOEZGMzV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjE1MSIgbmV4dHZlcnNpb249IjEuMy4zNi4zMTEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNzQ1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3344
- - C:\Program Files\Google\Play Games\Bootstrapper.exe
    "C:\Program Files\Google\Play Games\Bootstrapper.exe" "googleplaygames://deeplink/details?id=com.robtopx.geometryjumplite&eip=CpUBChxjb20ucm9idG9weC5nZW9tZXRyeWp1bXBsaXRlEnUScwpWaHR0cHM6Ly9wbGF5Lmdvb2dsZS5jb20vc3RvcmUvYXBwcy9kZXRhaWxzP2lkPWNvbS5yb2J0b3B4Lmdlb21ldHJ5anVtcGxpdGUmaGw9ZW4mZ2w9VVMSABoXaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8%3D"
    3⤵
    - Executes dropped EXE
    PID:3720
  - - C:\Program Files\Google\Play Games\current\service\Service.exe
      "C:\Program Files\Google\Play Games\current\service\Service.exe" "googleplaygames://deeplink/details?id=com.robtopx.geometryjumplite&eip=CpUBChxjb20ucm9idG9weC5nZW9tZXRyeWp1bXBsaXRlEnUScwpWaHR0cHM6Ly9wbGF5Lmdvb2dsZS5jb20vc3RvcmUvYXBwcy9kZXRhaWxzP2lkPWNvbS5yb2J0b3B4Lmdlb21ldHJ5anVtcGxpdGUmaGw9ZW4mZ2w9VVMSABoXaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8%3D"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1700
    - - C:\Program Files\Google\Play Games\current\emulator\crashpad_handler.exe
        
        "C:\Program Files\Google\Play Games\current\emulator\crashpad_handler.exe" --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=bss_session=487b52ea-4d10-4507-b879-cda3eca38c21 --annotation=channel=Beta "--annotation=cpu=Intel Core Processor (Broadwell)" --annotation=gpu_hw_scheduler=False --annotation=prod=Battlestar "--annotation=system=DADY Standard PC (Q35 + ICH9, 2009)" --annotation=ver=23.11.1397.6 --annotation=whpx=False "--attachment=C:\Users\Admin\AppData\Local\Google\Play Games\Logs\emulator_logs\vk_abort_mem_info.log" --initial-client-data=0xb94,0xb98,0xb9c,0xb70,0xba0,0x7ffec39b0008,0x7ffec39b0018,0x7ffec39b0028
        5⤵
        Executes dropped EXE
        
        PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 --field-trial-handle=1804,i,3089764810592723442,8499924433907283427,131072 /prefetch:8
  2⤵
  PID:1264

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2900

C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateBroker.exe
"C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleUpdateBroker.exe" -Embedding
1⤵
- Executes dropped EXE
PID:2684
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /broker
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2704

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4484

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:2880
- C:\Program Files (x86)\Google\Update\Install\{B0E939F5-7ED7-4C74-91E4-673A8FA985FF}\HPE-23.11.1397.6-CIP.exe
  "C:\Program Files (x86)\Google\Update\Install\{B0E939F5-7ED7-4C74-91E4-673A8FA985FF}\HPE-23.11.1397.6-CIP.exe" /o{47B07D71-505D-4665-AFD4-4972A30C6530} /l1518 /noui
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:5020
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C dir /s /-c "C:\Program Files\Google"
    3⤵
    PID:1860
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C dir /s /-c "C:\Windows\TEMP\Google\Play Games\1satkwda.zw4"
    3⤵
    PID:2752
- - C:\Windows\TEMP\Google\Play Games\1satkwda.zw4\7zr.exe
    "C:\Windows\TEMP\Google\Play Games\1satkwda.zw4\7zr.exe" x "-oC:\Program Files\Google\Play Games\current" -y -bso0 -bsp1 "C:\Windows\TEMP\Google\Play Games\1satkwda.zw4\archive.7z"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:3320
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule "Google Play Games Service"
    3⤵
    - Modifies Windows Firewall
    PID:900
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule dir=in action=allow enable=yes profile=domain,private,public protocol=tcp "description=Google Play Games Service" "name=Google Play Games Service" "program=C:\Program Files\Google\Play Games\current\emulator\crosvm.exe"
    3⤵
    - Modifies Windows Firewall
    PID:4548
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule dir=in action=allow enable=yes profile=domain,private,public protocol=udp "description=Google Play Games Service" "name=Google Play Games Service" "program=C:\Program Files\Google\Play Games\current\emulator\crosvm.exe"
    3⤵
    - Modifies Windows Firewall
    PID:2780
- - C:\Program Files\Google\Play Games\current\Applicator.exe
    "C:\Program Files\Google\Play Games\current\Applicator.exe" "anv" "23.11.1397.6" "Admin" "C:\Users\Admin\AppData\Local"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:4560
  - - C:\Program Files\Google\Play Games\current\service\InstallHypervisor.exe
      "C:\Program Files\Google\Play Games\current\service\InstallHypervisor.exe" --ghaxm --update-or-install --driver-dir "C:\Program Files\Google\Play Games\current\service" --install-dir "C:\Program Files\Google\Play Games\current" --version "23.11.1397.6" --log-source "1518"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      PID:1324
- C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUM5NEVEMTAtRTdDNy00QTNBLUE0M0YtN0IzQzQ2OTVFRUVCfSIgdXNlcmlkPSJ7QTkyMzQxNDgtNzk1Qi00MkUwLUFENUUtMjcyOUVFRUUyMUU2fSIgaW5zdGFsbHNvdXJjZT0idXBkYXRlM3dlYi1uZXdhcHBzIiByZXF1ZXN0aWQ9IntFRTdDQ0VBOC0zQjRDLTRENUEtODFDRC0wMzU4OTE1MzVGRUV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDdCMDdENzEtNTA1RC00NjY1LUFGRDQtNDk3MkEzMEM2NTMwfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMjMuMTEuMTM5Ny42IiBhcD0iYmV0YSxiMmkyZSxDbHNJQVJJY2IzSm5ZVzVwWXkxaGNIQnpMV1JsZEdGcGJITXRkMmx1Wkc5M2N4b1dhSFIwY0hNNkx5OTNkM2N1WjI5dloyeGxMbU52YlNqOHJkTUpNaHhqYjIwdWNtOWlkRzl3ZUM1blpXOXRaWFJ5ZVdwMWJYQnNhWFJsR0FFIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIiBjb2hvcnQ9IjE6MTE2bDoyNjczQDAuMCIgY29ob3J0bmFtZT0iUHVibGljX0JldGEiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi9QbGF5L2FkdWxqNXBueGJ6N3Bpend4eWJmazd3dHEybmFfMjMuMTEuMTM5Ny42L0hQRS0yMy4xMS4xMzk3LjYtQ0lQLmV4ZSIgZG93bmxvYWRlZD0iNzYwMjc3Mjg4IiB0b3RhbD0iNzYwMjc3Mjg4IiBkb3dubG9hZF90aW1lX21zPSI1ODU4NyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjE4MSIgZG93bmxvYWRfdGltZV9tcz0iNjY2NTkiIGRvd25sb2FkZWQ9Ijc2MDI3NzI4OCIgdG90YWw9Ijc2MDI3NzI4OCIgaW5zdGFsbF90aW1lX21zPSIyNzgxNyIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:564

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
1⤵
- Executes dropped EXE
PID:2772
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /cr
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3356
- C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource core
  2⤵
  - Executes dropped EXE
  PID:3592

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2516

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4548
- C:\Program Files (x86)\Google\Update\Install\{98763483-6331-4D19-8099-19B05B9ACD31}\GoogleUpdateSetup.exe
  "C:\Program Files (x86)\Google\Update\Install\{98763483-6331-4D19-8099-19B05B9ACD31}\GoogleUpdateSetup.exe" /update /sessionid "{FA9D912F-A018-4673-B8BF-D881B659E83C}"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1304
- - C:\Windows\SystemTemp\GUMD329.tmp\GoogleUpdate.exe
    C:\Windows\SystemTemp\GUMD329.tmp\GoogleUpdate.exe /update /sessionid "{FA9D912F-A018-4673-B8BF-D881B659E83C}"
    3⤵
    - Sets file execution options in registry
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:2196
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Modifies registry class
      PID:3732
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Modifies registry class
      PID:2988
    - - C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:1592
    - - C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:2064
    - - C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:4584
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RkE5RDkxMkYtQTAxOC00NjczLUI4QkYtRDg4MUI2NTlFODNDfSIgdXNlcmlkPSJ7QTkyMzQxNDgtNzk1Qi00MkUwLUFENUUtMjcyOUVFRUUyMUU2fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7NTJFNUY4MkEtQkMwMS00MDA2LUI0RUQtMzhGNUYyRDEwRTY3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjEuMy4zNi4zMTEiIG5leHR2ZXJzaW9uPSIxLjMuMzYuMzUyIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNDAiIGluc3RhbGxkYXRlPSI2MjMwIiBjb2hvcnQ9IjE6OWNvOjIwNHJAMC4wLDFvMzNAMC4wIiBjb2hvcnRuYW1lPSJFdmVyeW9uZSBFbHNlIj48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3512
- C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.311\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RkE5RDkxMkYtQTAxOC00NjczLUI4QkYtRDg4MUI2NTlFODNDfSIgdXNlcmlkPSJ7QTkyMzQxNDgtNzk1Qi00MkUwLUFENUUtMjcyOUVFRUUyMUU2fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntCRkI0NEUzQy04QUEzLTQ3OEUtOTIxMS1BOTA0NTU2MjU1RUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjMxMSIgbmV4dHZlcnNpb249IjEuMy4zNi4zNTIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0MCIgaWlkPSJ7NTI0RjkzMUQtREYyNC1CNDRCLURDMUYtRjY1ODRGQzhDNEREfSIgY29ob3J0PSIxOjljbzoyMDRyQDAuMCwxbzMzQDAuMCIgY29ob3J0bmFtZT0iRXZlcnlvbmUgRWxzZSI-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9lZGdlZGwubWUuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL3VwZGF0ZTIvYWM3c3hzY3V2N3R4cml0amxzcXk0bHBqd2doYV8xLjMuMzYuMzUyL0dvb2dsZVVwZGF0ZVNldHVwLmV4ZSIgZG93bmxvYWRlZD0iMTM3NjMwNCIgdG90YWw9IjEzNzYzMDQiIGRvd25sb2FkX3RpbWVfbXM9IjM2OTc5Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4668

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3324

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
1⤵
- Executes dropped EXE
PID:432
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /cr
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:460
- C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource core
  2⤵
  - Executes dropped EXE
  PID:540

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1552
- C:\Program Files (x86)\Google\Update\Install\{DD22495D-2FE6-494D-9ACF-B46EEFF0E4A9}\121.0.6167.85_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{DD22495D-2FE6-494D-9ACF-B46EEFF0E4A9}\121.0.6167.85_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level
  2⤵
  - Executes dropped EXE
  PID:1588
- - C:\Program Files (x86)\Google\Update\Install\{DD22495D-2FE6-494D-9ACF-B46EEFF0E4A9}\CR_6F26B.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{DD22495D-2FE6-494D-9ACF-B46EEFF0E4A9}\CR_6F26B.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{DD22495D-2FE6-494D-9ACF-B46EEFF0E4A9}\CR_6F26B.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    PID:3164
  - - C:\Program Files (x86)\Google\Update\Install\{DD22495D-2FE6-494D-9ACF-B46EEFF0E4A9}\CR_6F26B.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{DD22495D-2FE6-494D-9ACF-B46EEFF0E4A9}\CR_6F26B.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=121.0.6167.85 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff6cc7657f8,0x7ff6cc765804,0x7ff6cc765810
      4⤵
      Executes dropped EXE
      PID:240
  - - C:\Program Files (x86)\Google\Update\Install\{DD22495D-2FE6-494D-9ACF-B46EEFF0E4A9}\CR_6F26B.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{DD22495D-2FE6-494D-9ACF-B46EEFF0E4A9}\CR_6F26B.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:2032
    - - C:\Program Files (x86)\Google\Update\Install\{DD22495D-2FE6-494D-9ACF-B46EEFF0E4A9}\CR_6F26B.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{DD22495D-2FE6-494D-9ACF-B46EEFF0E4A9}\CR_6F26B.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=121.0.6167.85 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff6cc7657f8,0x7ff6cc765804,0x7ff6cc765810
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4488
- C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Qjc4Rjc0RTUtMTAwRi00REYxLTk1QjEtNTBGNjI3RDJEOTEzfSIgdXNlcmlkPSJ7QTkyMzQxNDgtNzk1Qi00MkUwLUFENUUtMjcyOUVFRUUyMUU2fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntERkY2MUYzMi1FRUUyLTRGMkUtQkRCQi1FRTYwN0FFMkUwNER9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIxMjEuMC42MTY3Ljg1IiBhcD0ieDY0LXN0YWJsZS1zdGF0c2RlZl8xIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0MCIgaW5zdGFsbGRhdGU9IjYyMzAiIGNvaG9ydD0iMTpndS8yNmkzOjI2aTlAMC41IiBjb2hvcnRuYW1lPSJNMTIxIFJvbGxvdXQiPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi9jaHJvbWUvYWNiMnlqNzY3MnhmMm5jNHZkN2N0M2d4a3E0cV8xMjEuMC42MTY3Ljg1LzEyMS4wLjYxNjcuODVfY2hyb21lX2luc3RhbGxlci5leGUiIGRvd25sb2FkZWQ9IjExMzIyNTI2NCIgdG90YWw9IjExMzIyNTI2NCIgZG93bmxvYWRfdGltZV9tcz0iMjgzMDAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMjY0IiBkb3dubG9hZF90aW1lX21zPSIyOTM1MSIgZG93bmxvYWRlZD0iMTEzMjI1MjY0IiB0b3RhbD0iMTEzMjI1MjY0IiBpbnN0YWxsX3RpbWVfbXM9IjMxMTE4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe

Filesize
294KB

MD5
8eb5a3bca26acb6688a0cd7b35cfdad9

SHA1
209c79d6b18a00f378efa75c7a3e44686f1850a1

SHA256
24dfdf400d8514d3fbfc5f4aa5dd2143f38b160ad142417bbf83e4d2e425dd0c

SHA512
9dc20a43174f103ace495986cda9870ed4b899c74fe85cfd941fe2cc312e883caf9d0f8835fc59f8a7fd82ee350e479896fb31c7d0cd170ff6932fd9e24a0417

Download Submit
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe

Filesize
392KB

MD5
15c1cadd3729ae6a4c1f8fa08d61bdc6

SHA1
1486f4eaa1b41b0f2101559ea24630d002bc2d25

SHA256
ce1dd1ba63273aacc0d1ef4e25d8338577d612e88f27d29466168099d3548342

SHA512
70eb764a53647d178278c743f964e03671bd445cc121f8e5a5b17441483b8b150ddf0d91316b8da1a7e289f6d6ebaf7f4952c8745530a700d21269309807f341

Download Submit
C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.36.352\GoogleUpdateSetup.exe

Filesize
1.3MB

MD5
aa2acb405b8c367628021506eb08b1db

SHA1
90b602689c1fd42d0e846c389d73d0010d047603

SHA256
0522b4b7c07ce8eb43cb094316b0211c02aa45f7abeb4884308c11019d93defd

SHA512
27f02e213e65a7c22a18c11bce31dc21376bdb0688454992a03c1a4c4571c874a98fa434d96cc5a0221f3fc004490f0b460e55b95c8a519594e55b6abe0e3e19

Download Submit
C:\Program Files (x86)\Google\Update\Download\{47B07D71-505D-4665-AFD4-4972A30C6530}\23.11.1397.6\HPE-23.11.1397.6-CIP.exe

Filesize
63.3MB

MD5
3e3e0adeda9c2c55e5320386c082acf6

SHA1
7cd844b0cde350896186cdbf9abc6ff21906add7

SHA256
507889f54692979920187467b6c7f2705eccf585de54a25f8596bd677a2e852e

SHA512
36f66f5cbb531813f0f0421cae3b5b4ac6b6cf829bbb40acc9d9fd4d4369908aab4c374e203071ec320542dadec3cbea6c1f7c17c5144dd2b88091ae6ca2a99c

Download Submit
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\121.0.6167.85\121.0.6167.85_chrome_installer.exe

Filesize
29.4MB

MD5
2b9044a057ae25e42e30fb298e01f0f5

SHA1
f18c78be3d219cdc42eda3bbcd83b877f8d94356

SHA256
fe46db909f300c61022d73fec7a64764248c9738b56b1bf6cefa4c99aea9cba1

SHA512
d629ba0f8d28a4917c6b1a5d7835ee0a08c35929ad7b7bc7a1ee574a08d2b055f3f0980061a98a8adc0bff858e759e06cd710a4a78c67436aeb95b6d577dcf94

Download Submit
C:\Program Files\Google\Chrome\Application\121.0.6167.85\Installer\setup.exe

Filesize
4.1MB

MD5
43a00e536374ace2b8afb139fcabedf7

SHA1
593af1d45cb84a78ac1b50a4f44741004dc9a137

SHA256
2068525d7d0b3e38299b330d5ebebb80f7fb85413423f48238e97d10f7d4845a

SHA512
4eabdec8bb23e8bc8d60ebbe6130bce54c171d42982074067597ce207ba9e16442b5bfbc1f19cd7f3291153c885323fca48db7fd1894cd8e40013c7c2acd4c2e

Download Submit
C:\Program Files\Google\Chrome\Application\SetupMetrics\20240125003606.pma

Filesize
2KB

MD5
5d6927b70b60129f0b10e65b2785e122

SHA1
de6396c6c9ebea7ff5baba667aec1b20ef25eafd

SHA256
9b0568a33cf98bbc503edaca3784f60c7e3ddddd4791f08c25fc877871b73976

SHA512
ed622d3283a18a393817785f26c56d1d41614ac2deb23b64b7763d42f2249c6c3f44638eaf2d97ca3b49d3fdf84a0eefbc17988783cb69f86b9ffae43c16e60e

Download Submit
C:\Program Files\Google\Play Games\Bootstrapper.exe

Filesize
365KB

MD5
5bae25238267e9086ebb6f671e934d48

SHA1
5531d5688f3cfef496ca70a290bd6ed7113d3ed6

SHA256
3d4c635d08a6bb8fec9034aba7b940f8bddbe0d26115389e9e17db6fdea98c0e

SHA512
c6fbdb6b5efa854b85e81af7baed6512e48345bde15cb87066019e9b5366a9fcb3f55cd892537dce723409c7cdeb5951e2e0b868f20ecda1b6f0a60e448e3d33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

Filesize
201KB

MD5
c445ab4315d0633d446998c80764cc36

SHA1
47d3dee9845cc6e29b6771dd6560793b8b93000e

SHA256
5635695eeb70b51c449aea7a5bd3c9699c3c28c64498fb7fcb8173aad45d7242

SHA512
83a32ffdddf3ee56e89f232c8d05a4b00265895b0e41d13700f90fa389f0bf3f112c291c24c3819751803322b11e2ff866971d835d601672b36818c4e099bff1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000044

Filesize
500KB

MD5
d462760f3500fc14e8e4bd4cdd783810

SHA1
fc3654869bc73e0871754a9ffdae9b816d384bc5

SHA256
2a2d180340a1adbc9a7be44bac9c7c946fedccca2711ebf5f8fc6cad7b725ab1

SHA512
c6c4866763cf9f6faebd1e1aaf708315f61e33e808297017f724589de1fafb8b28551c37318171c9bce064e2e3a94428201142a5a85e8b2a241d7811f5ec53de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000045

Filesize
35KB

MD5
d7837d57990b09db8abf2620ad81c219

SHA1
6467cd0a0d1523f3b59fc0c7e228bf1c52f6a0aa

SHA256
73aa0f7185d43398f1ba46080ff457b6f7edba17e679e1a63218f6b90c5a7114

SHA512
d1a8894fb14d24031850100178882ea6fbf39b0aae01a2ca6b5b5b168d8f0623e1de330490b9e0c0fd922033a516ea038c67d9ffa54ca157b34cf2ffd80f7f97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bfbac855eef6f3930768cecb484e131e

SHA1
f444877c3d60bb92c6b7b6c595fa889d1517b870

SHA256
a7f71c74fe11bccd25d20e55c27149b02ce649d214c6fb107b24df46b5ad5d8f

SHA512
c6415fb35496ac5c89b81ae7bc7513c13aed1eb88b9547b93dda979baf9b9cf253b99d39dd4f93e51f9bf63a6837914434b6ba6beddb406b585564e15fadf69b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
8f3ee916585b00232aa574d4dcb819c8

SHA1
432cdc670fecf2dd0dc0d76c5c2858bdbcb69e7c

SHA256
9a4e8640e9301a88a6dfe46ca33f63ae7900fa3557b767923e2341f01b553bca

SHA512
a97cb242033be580b4bcd54032844c6845b23822712a9b299c37d4c443ab34b905b2c2ad7594f14b7f81e4089938cf3cd9ef1e2575d1a75955b8041f2dabf3b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
cc889e1f5e2c42d32a5fdd40e22daa88

SHA1
e31f608c747cdb53abe13ef0d716d3a0077c48ca

SHA256
cd009c79c1fe6b07299641c2be01ab7fdb48e1dc166db2bacf64c08be24b4cd5

SHA512
eb97c28fc4340202e6cda5b7b29644153958741a509ea24fe7e10b07bcc3482ce255a34860532e73b6dc487d1022f5a8a674b146127322f87fe16fad96fc0cf8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
071ca402763ff692a430c85280f56415

SHA1
a2e21e8aa817251c35ee924def29953bfa6a49fc

SHA256
350d23e64a9eded0fa3c61c3ddc3db64b069d7ebc3ab23294ab933fe6146c96b

SHA512
eeae22f9f4a6786e424dfab6ae77097acd8aba53f450ff488aaa4be0a3a5d70dcb17c7ba491cccff9a2e9268af1913b64784ba49823ec95b132c239a66bfee6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
648e82c3fb292a24250534977983341d

SHA1
c7889c87f09d95b8b6b1ad7711c041c566fab232

SHA256
8b8e64db3aa31a4852b9f049b68d8bed45b54befd1fb3ae1bbc5a384475ecf42

SHA512
8dea08da8022c4f4be2db03f5e36131697187358dc08b683d72d3ef0a932d6b8028f33035c99808bbd53abd7f4c66bff6af89e6e217fbc8260191bcc61dd97b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
742229799090773514c08a19a42a1d3b

SHA1
0a12e2432ea8f0d78677a5ce36b24bffca430864

SHA256
69884a82c6b6aaeee0e9015e03899d61b71d03f8394f28578485dbc9c639a1c7

SHA512
9186cb044c74ad913158d5b554b8c8e58c5207a4835fa8853d9c01d2a2e24b8ceaabe76928bd808862b7efe829fff8165451e99deb9402311f4d60d6e26f983c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
369B

MD5
63582962610cdd7c5cc13f430ef93767

SHA1
fdfd19e054e543a94a038b9da573ec7c163aae2e

SHA256
5f634598324a2773880ac7a14d898d024f5fe0ca0d9948a51667388ee7334720

SHA512
9c55f2cc02b425b1b61e5b9b17d3c5ff06bdb3282e2839da267225a91ab82559ac7b92bf67e6bd777e8ad1601116d23a978a37b945c69f7e18ac1fc2a0a1e9ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
369B

MD5
31d2cef09334f1ed856cb162542a94ba

SHA1
7770629525ee2122954111c66182b174d4b8f39d

SHA256
4e3b83fd93b439fa9dd13ee5149b289b0662e55721cb614325651cb17bcf95ad

SHA512
568768aa3e6f215b6f24137097f6192fba6942ed988d70a04ee7d5ab0f70d2fb36ca6c84422f3410e27b9433dfd4b93ca577b69d58a020fdf2ead83067077fd3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
8c855041d30f5619d626a1f3a86e0bf7

SHA1
711c29fd1ac0b77a57088c2827717c471a4006ad

SHA256
81350a4003c5b4642f8ec2511fb4712af7c0627257ea200f3c3ebfc38393d3f4

SHA512
bc44cb6d5ad5f1f3cf507b2983520346dd2ace1e10ca6f0960a43cefc97c6a4c339c8d295a99bb57f009e138829d7ae36ceef09101d6819cc70ca66438f157a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ecb26b066ad7d56e3e11ac06c00f3f45

SHA1
8cf35eb0ac7fab57674c01f923fe70fee38a0504

SHA256
e682f4c7b5ab31378a0610a19f83755f1bb3ec80b53f2920fff3e85f4a7e37eb

SHA512
156afcef7b4853d02dc335b695e78cc45f891943cff14925bca1f4134aee765e886e777593102a8e1cc505f16f2b426aa4ce4e4f99d0bf281d3f0d8e35bfc492

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
0d4a79b6d52dfb7abd20e0cba7ff3264

SHA1
29ba1b054f848cd44030089381a8b2fca34c2716

SHA256
685973fd14be7a6a40d78bff5657ddecb43fda1541648bda458afaf22c706192

SHA512
244f5840d421289136becd5d4425e3ebcf9c14131b3705074c6473dda891ee297cfd0be49a47221f27fe1dd217ff4128eb3a1dca46385efc307b2dbce58febfb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ba25ccb9325172f146d5d986eec2bab3

SHA1
8d162f093e93804be1c58ece764bb09074ea0d31

SHA256
99dc709895d1700ed23a0a0a336bfa46cfe742ac89746b251b71015eb3b47e54

SHA512
e1df024a11e2357ee365c63cb02135dd6a9b388c5c605c6c1287b601b4d6eea2c4858ed16d47ed725e76f93777bffab782bf91554a549d89a75e602d3582b16c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a72fa6eb646b22c764d49c03e33e8814

SHA1
2450381040d56e2bd0c3d0075b4f86f2287de7a0

SHA256
01ccfd820fd1418e2300603cac0a998d36fdd3b537eba553fd8ce419f1acb973

SHA512
13e7deffcc824c9d7db0243b672238e1d276f4007d9f5031f8386bd55b2b652f917208a1b99974f4069c4c8fdcc1744445b284790656dbdd4f41c3bda0e9517c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e126292be35229b17178853a13277626

SHA1
a344d9a15d9eb5ace34bb57f2b70d3d3de181b32

SHA256
ab7a8df677cfc7853583043277ad80528d7146e0996aff4d79b929e84c56fe07

SHA512
e3011db9deb693baf40e8f6fa065edbe880839fe31e4a2cf305e4f93b1c1eb94a91939f98b5788bbbe85b5faa10ade75befb41ed50bae3dbacb3f4aabfe86c4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e3dc2ebeeaef206dc78502f5719adc02

SHA1
fab07413e06a0f5cac9f2409db758ef019a98e68

SHA256
1e245bd05d6222fb831f5db07e99b096375d72d22bc8d23b6236d351aed072d5

SHA512
0b9bcaa647f1991c14e196c15bc5c60bd280111eb9d2be7add960e3574e8c7ba54aec082518cf104bff640993b1e9228757fb6c1bc5253eb7eaa3475301aa109

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\da930aef-5cf1-4d26-8546-5ef069ee4aca.tmp

Filesize
1KB

MD5
938cec4e8d42b55ab1427ceda36f9e1f

SHA1
29cfa4174098d2323511ec0f5e772c03520a6d21

SHA256
4ae9d235bdb47700eacd3577468efff5630a2117c881a438fe31a9d888ff9b1b

SHA512
99aa667c2d80d8628e6c777a719ec944c3fef167d43a8dbf555e8b796b06c887563dd900145cc8321455d894b1c30e68109503243db05743e9add07daeaab585

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
7ec0e4b23dfc194fec8248e81d7bc310

SHA1
822050e3e76aeafa92bd288e24bb4f1344e2000f

SHA256
247bd72359781c16a352fc9aece579ff11548e632c700a9692633035ce948fb8

SHA512
413d4c72291794c40d9438111befebcf1ddc883a14a900d12f7216cf424c3ce40455bb046ebcb4b0b04b94b307e086d97f3a070f91d03fa1bd02747ce2f20426

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b9dc2eb0ff85612f8a9ee9a3514ceb3c

SHA1
e357f273dd0991b06e859756242770082c9b0d71

SHA256
8979ecb101e91a83f408e8851e258c045bfd38a301cb8c289f90f674a6b1d10d

SHA512
22dc28c33507fbdf97eadb23e17e081cb9ace56eba9cee82153fac963d8cd9249c02c2680e465e424cfcd0d9d8bfb64637a9db77817504f181f095fd4ce5243f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
dbcdc6ff32c614228eda6b4c0aff136c

SHA1
abc7f941cf785b9aba6654eb8bd794282f909d6f

SHA256
b534a33f09e1c4127ad2bc8087708797f9fdbe2f9011ee8251b5092c55a8f483

SHA512
d16b9b96c81b2a3a9a61c25352db7fe7991920d5642cf3a9d4416e14f036a64c47b2b89ab03d80a161a5089734078d2099c5f89eed3abb970cd05032ec163bf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a90a379dc5a661c1f6868fd16045cb5f

SHA1
a3189e4177c6ce7a1eeb40050fa50bcbe2e6f0e6

SHA256
2e1a634ae18a079dfcc850dcde762d47f96f709f4e81d0ab3fac8ad56eac60f4

SHA512
0c1277a626b747854ea59393acda330c16bc51f2499744ae257580a9ffcbd5b513c3ecf3b01a7332120c0555d87afdbd6180cf8962ec2b2740bd0e8a27e432f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
c5b3d64d644e3898e58837d7a50b31c6

SHA1
e8f3530c649b56a741ff320b0b6483ddcd0ea066

SHA256
6a1d3ce4ada50574ab2eff6cf1ee9626e86fda40de6e1d9b3bc23aad105239f9

SHA512
0fc34427583faf442e4f679c2cb837c8724492269f1bfce936ba7fead2dd9fc2eb9da32322421ee36401eafe930f3514251ec6a1100180bc635ef2a9f41bfb28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
229KB

MD5
f5979ee803d51ed972c7c069679fe87c

SHA1
16a91f2ec903eeead6cb961aec4e06ea492cbc69

SHA256
54bb4a435059f8ba37182280ad6440424b871919b09bc102f9d773f7a3996a57

SHA512
fa976871de62d9ba164b133aba7567a715ed1503d604842140a7e53c54bb72448b7ebfbbb2f91d710b20a0e9e0461415669f4c0686493a7cd48034c5e764a8ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
3d9747ed0a025b5021595640b25c1ef9

SHA1
4205f5b0d51c65976c4c3857f51b6e54044e21b0

SHA256
4a256a0cdea9b9e2c97a1c82132e5c14a271b24f98b31914a1e2651636e833b0

SHA512
d03e95aae2ed6a52259a3bc192451c81377b2be1582f4aab998f42fbfbdf1ca7cb3eb72362c1d772505d5328a0bc80ce14a382637446fd00517b5387f2515f0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
90KB

MD5
b88ce4fcd1dc8045dabecdc9907598c0

SHA1
e7b0f7f2f76e541b5eb0b3af36c12a2e188f0f9d

SHA256
cb5adbc35c4fca4bf46e8e52418fefa9e83cbe1df36fd06d4633e07327bb0b0c

SHA512
fdd4e9ecf94f79d15873dab03790c22bf2241f56b6a0d2d288161488f231da2520be1a42f10ad2cd96efab4ef22a2ecabaaeeeb8b1d60aa56ed43804d776fc7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
95KB

MD5
84290cceef97143694999995661805d2

SHA1
2a4d7afccd62c765b3f3528c805218a3e30e7ca0

SHA256
20aa226b28c9df836b11439c2fe4012b60b2573f5203c726258a6bc2c2614761

SHA512
dd954d9947b8f75798cb8eb1d8a857f47cd858ec64e91348683a6f038fe54006207c143cfc8dfdbfd61e28782f47cc58b2f0b5e95c6dafcbb45e2e29b8a91413

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5929c5.TMP

Filesize
88KB

MD5
efcf3c9ea23247991b1db8bd5df51146

SHA1
90d3e5dd25a5afc0e63db1ffa050a3aa09e26619

SHA256
672909af4dff283343022fe008f7f1835e0f1c739bd8c2548f090cff45abf232

SHA512
d0f970bb8f13d4219b1dc27ddeb2c26207387747d6d80857fbcbd7410eba44c52c9f1c1d5fdcfdce6ee594994b9a5cae5677f919fa7d5038047b65b1cdec4166

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad\settings.dat

Filesize
40B

MD5
11534f61e8bbfd82e2857156f19a59a9

SHA1
0c03c7605431a5f6b8734956d95ef9d0bfb6a61c

SHA256
59fafd16e043d3634b4a639b620ac471c8030acdd63e1a7fc824a5d320d34cd2

SHA512
83a41ac0b3ff2476fcc9a2b1c83961405fefca33c48a0a761313b3c4c6510e9176cbad8b7336e92c66b68e2099dab9fa596180d4cf19a902e643269e75f7f726

Download Submit
C:\Users\Admin\AppData\Local\Google\Play Games\InstallerCrashReporting.log

Filesize
630B

MD5
b1eec14f16c05063bd67efb340c89451

SHA1
e3b696bf426f639f68d9c7557ea4a73f9c3d6bc5

SHA256
f0ee8a82641f9d6531256d82b841770bbd6544ac6b155278df73cd01906d29e6

SHA512
cfd46f063293b3761fb34f73a383424b7faea419efd93492749167495314f61ce28efc94d2ffb0422aa4ae4405ef5253ca8fb0cbe6b67fd930709e3486cc46cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrrohlp.azr\CrashReporting.dll

Filesize
120KB

MD5
cd203ae3af554a3c0b7cf6a68a8a3d9a

SHA1
0f91d5d6e8db290a0fc18016f92071da81d2ca0d

SHA256
f0e8b9fcfd929924c8cd649744becff5aa3d2887d346513c55b47b7c93985ef6

SHA512
52c12d813bc59ac54c2a5702c70b50faefda458a38df514a5c3915314736365bd22c4e7f171aca9dac83051fa47dd42c9f9eff9835122c19d5cfdfb4efe8e23b

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrrohlp.azr\CrashReporting.dll

Filesize
943KB

MD5
ecb2da56dd6419b2cbbdb17e6eb840dd

SHA1
1bbd521a484a0c1e9ff4f91ba4a633b92bb608ca

SHA256
43af6e708ae5049b226c586d0839c653a52991e32fb4483519f0920a299517ae

SHA512
8936f16820aa75adf3cf366fa5cf6724f73c129a76d4b430f77c6918e2c2516d39bb420670f371b5dd4aecbb841456d3b480ea500f98b7cf0e2e66a3b28b2894

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrrohlp.azr\GoogleUpdateSetup.exe

Filesize
1.3MB

MD5
88df743dce878baf2c1970012a937677

SHA1
50954fedcec5ea422c8fd31d5e43bf53cef416d8

SHA256
888eef05873881feb3739d48cd36b25e18830fd33508dd145db56ddc504c36c6

SHA512
af3cb14dff5c4aa15d961002c7babd0d772fb699a0fd90eda1927f29843056322ba46b2eac03a9f08e6a65cccecee4f4d42a9f953ca758378bbd13c3fe662113

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrrohlp.azr\crashpad_handler.exe

Filesize
135KB

MD5
5233221691de6f9db237da4f93e959f3

SHA1
309334dbc51aa619c998409a9a2f9ca770dbecf8

SHA256
67fa63c3bf8e87efa55f892dd12a952da4f5c0634c317d3e84093bee571588f5

SHA512
4426c2b064950c394704818dc1590457ff7ce2b77a980dc91a80bd7c37e4aa79ec1d63f0517d198bbbd6ddf1a7a9164c7830452976e61fd94d4ac967ab7df59b

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrrohlp.azr\crashpad_handler.exe

Filesize
36KB

MD5
9d32bb8e38f96a82697ca4a64d8ff0c0

SHA1
2ef57152048fcd4fb9251007cd7c4fff9bbdff32

SHA256
e1840713b157a6f31550692bfde00652dfcca4c13a4e0405cf36a6d8a0dc8cc8

SHA512
a8b2db60eb10086bd7d092a392b01c7c9dff9163d1c7a5b74f11424d5797424d800495e9e73da6d5915b7dcdfe6d44f7de28a6cb7a1036c4c40575c8a47f46ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrrohlp.azr\crashpad_handler.exe

Filesize
1.1MB

MD5
5efa3eebfbacdddb556b94f52964b136

SHA1
5919e983774c73d3525572415e17f58a3bb0ca0c

SHA256
ddcddf8643ad858b7da356e0de79a4e4ae87f7c1dc63cc8bdcb585d2c805ee96

SHA512
0da91ec06dd56131757768bb6fabfbe5ef2743c50da18587f0d805e2a2f45fad595d7bc8dcf8f613afc7577143ed238fc13c9b17381019fff78358784be901b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrrohlp.azr\recorder_delegate_lib.dll

Filesize
193KB

MD5
2478cbde7494177030007327688b4344

SHA1
ffe7b9353fb29d5bc10706b214ea7414b1fdcef6

SHA256
59084593380b183372b79a0aeb7937421958b542411cfd7cce849f20ed6a7b59

SHA512
ebd503f04eb045b9401546845e0d4e77bc1ae14780f524e41749e06ea9b1967f905a9f3f1b6df8675a516bf01d5c2c16ed7db60034a784ca1c300160c93bf90a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Install-Geometry Dash Lite-GooglePlayGames-Beta.exe

Filesize
1.7MB

MD5
1f257b04f6c8942a57567c9d9662033f

SHA1
41cebb6b37b5de0d6657442fe14caa39ec15f78f

SHA256
0f44aff9b34e4dea605c6912fa36688f29460aa396a98f1b5f5ca9d5ec88cba9

SHA512
8354ee23e499c678dde9b5347937ab3d9117bc359253a2f05536040cd37fa5ff341fb16e87c51a69d48db3b1bc2f95e5aa2bb85cbb98badcb3746df6b00d9120

Download Submit
C:\Users\Admin\Downloads\Install-Geometry Dash Lite-GooglePlayGames-Beta.exe

Filesize
1.4MB

MD5
d6c57d3feee3a140321f217d6d96f1c9

SHA1
353f825ded55d300b473078158cf1947a6703e66

SHA256
c4fa2703034ca7d6ca5edf38d69016efb6c044399418f084501819b2fc4eb488

SHA512
a08611f93e937d89f163538dd28587cd81887cb72550a2e85e724a2fb4184592b32a2ce4e8b09f4eff3333ce1393010de2f44bfcac1806fb38d52eeae9355f99

Download Submit
C:\Users\Admin\Downloads\Install-Geometry Dash Lite-GooglePlayGames-Beta.exe

Filesize
1.4MB

MD5
9abbae5ffe38cb3ab7a1af8a46add75c

SHA1
19455469bd302c94ffdf0f8ca265befbd3981c64

SHA256
3272b2d765e1e79bfb1b017ccc09d77956fb5fb88cf001573136d1a1303547dc

SHA512
2fee6952339f5afb02ab4ccf3555e8d4496f5a7c3d993f700189dab74b6d79b55a90d5860ac35994516b5b6deaaeacc7ddf0fa26ea5887465ea1d335f2712dbf

Download Submit
C:\Users\Admin\Downloads\Install-Geometry Dash Lite-GooglePlayGames-Beta.exe

Filesize
3.2MB

MD5
041d73c0e732150e38823643946ef49a

SHA1
934e384fe846a9f0f4b3eb530f6b01d2499d581e

SHA256
679568467cad409851fbccf76c3e534c0759a8060998b1fb03d1a5cc13ea2f7d

SHA512
01316f0baaa3d220258f2913d4a1233c3813272a0f8cc8dd79597fe3a4c21509e0bf4bd50ebfae31edbaced634ae5667d2d8da333ef0f3c26f9e414a50b0d3a6

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\GoogleCrashHandler.exe

Filesize
294KB

MD5
a11ce10ac47f5f83b9bc980567331a1b

SHA1
63ee42e347b0328f8d71a3aa4dde4c6dc46da726

SHA256
101dbf984c4b3876defe2699d6160acbf1bb3f213e02a32f08fdcdc06821c542

SHA512
ff2f86c4061188ead1bfeebd36de7dbc312adcc95267537697f2bfcbb0c53e7c4ab0cd268cef22f0182391796c4612c97cbdc1266d9ee1960cdd2610d8c2bcb3

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\GoogleCrashHandler64.exe

Filesize
392KB

MD5
b659663611a4c2216dff5ab1b60dd089

SHA1
9a14392a5bdb9ea6b8c3e60224b7ff37091d48b5

SHA256
cad4aa1cf58f6b2e2aceb789d53b18418e67066ec406b2fac786cb845ef89d2b

SHA512
1065f9072cd6f1f4364f1354108f2647ee1d89f87e908a22fcd63bd3149c864c457e62268067a439d0486d8d4aa150aa984ad8ac8b51cae49014b67b80496040

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\GoogleUpdate.exe

Filesize
158KB

MD5
cdf152e23a8cbf68dbe3f419701244fc

SHA1
cb850d3675da418131d90ab01320e4e8842228d7

SHA256
84eaf43f33d95da9ab310fc36dc3cfe53823d2220946f021f18cf3f729b8d64e

SHA512
863e1da5bc779fa02cf08587c4de5f04c56e02902c5c4f92a06f2e631380ecabcc98e35d52609f764727e41b965c0786d24ea23fc4b9776d24d9f13e0d8ae0c2

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\GoogleUpdateComRegisterShell64.exe

Filesize
181KB

MD5
be535d8b68dd064442f73211466e5987

SHA1
aa49313d9513fd9c2d2b25da09ea24d09cc03435

SHA256
c109bcb63391ac3ea93fb97fbdf3f6ed71316cacb592ef46efaea0024bc9ed59

SHA512
eb50eebeaf83be10aea8088e35a807f9001d07d17d2bc1655c3bc0cb254d0f54303348988514ba5590ebd9d3bde3f1149c3f700f62fbce63c0199ea3cfb1f638

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\GoogleUpdateCore.exe

Filesize
217KB

MD5
af51ea4d9828e21f72e935b0deae50f2

SHA1
c7fe57c2a16c9f5a5ebdd3cc0910427cba5308bd

SHA256
3575011873d0f6d49c783095dae06e6619f8f5463da578fbe284ca5d1d449619

SHA512
ec9828d0bade39754748fb53cfc7efdc5e57955198bac3c248ea9b5a9a607182bb1477819f220549a8e9eadbe6bf69a12da6c8af3761980d2dd9078eaeaa932f

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdate.dll

Filesize
1.9MB

MD5
f3dc510106657e0243cb14ade5260de7

SHA1
316d2fb266cf70364e3cbd86f1f84141a3ec5ddb

SHA256
a11e34b5d5dfc4580caf44adb181880f110a0f487f1dc6893c699c207cdaefb4

SHA512
9c8bf64a0640c595030a09c8c8e56ac9a43f6a385700ffcd2adeb586cf97376c1b624e7f3c2526eb565b09c1f3992df32ad6902ea617bd41af201c7500b28130

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_am.dll

Filesize
42KB

MD5
7b7b7e737b43785f37f8d27fc2332eeb

SHA1
81e1981b5f3df2efb80bb1e32bd7d69c391df975

SHA256
03ce1b6075cb0ae2aed6abce06fef453117b6ee7f6149843d80013f8d5e4915a

SHA512
6d8bb06913a0dade24080a00310d1b4de338815f6c9c805a38e69e984f85be5afbd51b088833397884c02a0e63d8b919d6a940cd2bf471e84e71ffee6667d9fe

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_ar.dll

Filesize
41KB

MD5
0fa547b2b22650283a62e76b9ad54922

SHA1
401c7dcfb4417619d9567346472721a1f77a8f32

SHA256
982061548ab789e04b69a2bf0c50492c45b1d0d0fdb2429c23bb46c37a989899

SHA512
8be9a98aae8862dd6d8baa4f7e3aef3645537bcdea8547186d43ccd7e6a7f3ed946ad54add179a97fe4bbb80dcc7f0aabb089312c3f3913fa653822c4e93551d

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_bg.dll

Filesize
44KB

MD5
c505b06cc74ccbca88bf28c80dd5b513

SHA1
c2003798ef5ef6beb6230447546e74093fcf3dbe

SHA256
67e7e011898e171bfe181b61fc9e669a6457e827ce62541958fdebdc30f65ca4

SHA512
720c102eb40fbc980a502f9168dfb08a35574a0daa6ac23474eaab7bb9aff69e8f9dc60f5cd20501c60a6290c31ab6ffc101950f4786cced3ae0e39e8a3a655f

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_bn.dll

Filesize
44KB

MD5
94c1be1cab14b0cc146736c53f9e6735

SHA1
722a580dcd0d5fcbd9b03788390bcbc7b4f5a7e0

SHA256
650dc6bd49fe0f326cc72e0e6d8eae8dba54e42ff28fb064fc4ebba45ec67bad

SHA512
fde4918ef038519f03498a8f5114aa84a1006f1be4ffa97dee37a0305f763c8f5fc4346382ba01ff491a3bcbc49f6749c4278046509507525377e122f4912535

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_ca.dll

Filesize
44KB

MD5
635d5aca6106761dbdee1d3a340bb2fa

SHA1
98a929f901182e004ab141487e851883605ae5b4

SHA256
a3450652fb18b715bbee3f7ef7969fdfc8cdad75bf3b989e98231d427cb2ab8b

SHA512
add90c9d435504a7ecb46e595a1afeed70f2a4e1d8f7366e31f342c13c4356201e318d5954a6d4872cb71f6ba65937f92f07733e345c466bbafd87daca682eed

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_cs.dll

Filesize
43KB

MD5
79a4a8b69408a483ba9e606b616b783c

SHA1
7edc314fe5097f824326326b7135cfd651251bc5

SHA256
71374a5d1d46ff5b0302f1530b6cdf27ef3ae978cff022804b3eef3d65b32f14

SHA512
89407343a392e0c51445fe012e9c4851b375893cca9e8c4ce7a49f53b279665b8a8d943e9ea55c5e4cefbc10b7e4822de814bce5e6b007449aef3d9ee70d255e

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_da.dll

Filesize
43KB

MD5
5e333a051cb6ffb9eb4140f3a2b3f126

SHA1
7c76efd81e7997aeb0d5c983cbe75a70f14bde86

SHA256
a59929ea99affd91ec27e74264b68ba2f5d70d3e0e3753ecf7277b7d86d549d4

SHA512
5783a1ccd1df82379c642f90c58930754f26a88d532086166ea789e9235868a6298688951d0b9a14380dabf3569eed129a9e7085b612e1b9d7ca9791177a3c4c

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_de.dll

Filesize
45KB

MD5
d6b6b43febc5398e400d349f2b179c30

SHA1
939c021d53eed626b831fcc388ba6ad8e64a18e7

SHA256
b20cc0f04aefce5269e8f3dfef9237b08dfb7a38d32a326d99fd7b5f45b6d2ba

SHA512
b17aeba3c776bc50270d4f80d93d11da038b0281dc5f5b131dd36cf80a921f449c6028b30d27837172e4804d515a1b3023fd83f03f7283b879b472af842b3189

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_el.dll

Filesize
44KB

MD5
cf5b984e4cf0bc03d3c4667e8446e33d

SHA1
94d08877d2cecb7b4e0e0be01c6dfe7175c2266e

SHA256
5636fa5f90c6ba45a897d8939be0af15dc29858571ebee9b360b1c565707e9b1

SHA512
2a1538eeb350500365181769265a43877a81f4d1726ad4348ebe7f2454ae7974766f6e8bc09f08a2871de6e3ffc3e005f3539504d363f41f5935cdce1b129b11

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_en-GB.dll

Filesize
42KB

MD5
c3c7577b26d17ca55218b52ad56b0021

SHA1
b5697d0a43261878823f209d2537cd25657304b1

SHA256
fe463b31414f753e5259420464111718c026a9bb1728df40208abd2af6788f36

SHA512
21a410d383d62acc0612c2199841b897db047d0aeddc2f89da875076c71cc86ffc511007af5a142d96d86058559843ab7dc7016f12a117477ac386411931a22b

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_en.dll

Filesize
42KB

MD5
245e27fd9aef7c5ed2db7516f3d8a76e

SHA1
f84ab0728783517c438e0c30c0c354395f337607

SHA256
4e100a27012b1ee9cb9a4684d337a63a6ccce57254ba545f97fb02fee84f8924

SHA512
eebd57100dc11add48bb5f551284947972692e4fa119ca21d798382242131072ec45f9abe099407248dd4f4a61e38cd44e7a1d1b665378d72f604176e3fa70a9

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_es-419.dll

Filesize
43KB

MD5
08f3dd9997f84587c98fa7f99fdc50f0

SHA1
1360bc0159ddd5d6f29b2ab25f196c4211b17578

SHA256
60e1653a9028ab733e967998b3feb966e9e0094283c341edaba61011ea122b77

SHA512
84289804af3a686f9a16a99979656ceb475b1862fbdb5a583ab29dc6a40a4733402df39c2faba244068d78abe22b0603f2c3119233d6feb79435ffe264632cbd

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_es.dll

Filesize
45KB

MD5
a300ef85c334ee12eb0a868160476394

SHA1
091c31d6a137941dfe8195c2db8ab18c57a955a1

SHA256
f888b8cd68713d57f42008b8b9564c858b633b23c4053084afef8ae198d94827

SHA512
f71906d258f3561f7026b7e83bd7f5052a418979946e056a224f6ab0fff3f3bd6541ea14e991c8679c936162bc5c32bb9593603a9722d0a183ae36c85ef9af21

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_et.dll

Filesize
42KB

MD5
22c79d150b82a913b598c8df5b37d8b9

SHA1
6d4cd15f841509485d9d45efda2319d03138d7a4

SHA256
7338dde406ae7a8ed31ff9d9865e7a409cbe310e84af49d041a64288d3f626e6

SHA512
4b31e14e10a2c10026cc8980d73fb1b295d6105e0adaeb2f4481ded4e5e211ac73412f880f75786a44e7f4d2f5e58b241ae1936a910dd16846d9ce82784e0bf5

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_fa.dll

Filesize
42KB

MD5
d30aba2548b3e1541fd887f1f65238b6

SHA1
c98e32df3fe9c57e8e81ecbf59964d4f0f645b6b

SHA256
b50b5a59cb3b7996f4790cefc3ab53449ffeaae2e2c341979e4659c16b2a14b9

SHA512
f5929e032472b9ae8d0e863d09f701717de9df349a95088429a45dac749bc3f6fdd311e6d452b5752024a19bc56b52e8fe16fe93200044fd8cbd9df43119582c

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_fi.dll

Filesize
43KB

MD5
931ea397c00784abfacd115792ac8bd7

SHA1
5d7f9575f1542c9c6ccebad79d8f2a743e12feda

SHA256
1bba6f1fedce53048a7c005225c78d49816b9b3f91713f1f775ed5a39711d2ec

SHA512
cf6ba2bdf384ce7785b7f3254b1efa7c449fc2d0fb28de690e17a5c1159e6ece537fdd2227694dbb5d63a6a669810401b8308a228452adc8548b3d038b6f019a

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_fil.dll

Filesize
44KB

MD5
8d6632dd0febf77679d7a8be4dc25ebe

SHA1
82498060948a8ff6b9726e98d59da148e8010c62

SHA256
db6fe58a08ee3d9d6c9171b867a5aff07897dac7cd48f9b73ef2d4cf5f47f3bf

SHA512
08cdf49c37f19c021b5ecd9583724634f859752f9b3d4743c8adc1787f968b16ee072b83f13f21e1a2125cf01d73546fb88ea70b14f3c0f557e71b7a9f95ebeb

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_fr.dll

Filesize
44KB

MD5
a1addd3b35199eb276f55e158f3ec732

SHA1
a72f1cc7a04d9d7f0ba517c342709048c43ad17f

SHA256
339b96e7e1c7568b13aa5d60338e4bce47356691cbf216d185cc1bbc7d377618

SHA512
f28d6a26d0ea7d0c7b1f220e889d499a3fda0ede47aea0180b89f024c31d59bfd3c2f781e0a6cc2de2744b105333fe27a9a282fb03156dbba49c01280c0f2f72

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_gu.dll

Filesize
44KB

MD5
74a9b0ed18d8fbf9b3a9246486142a4e

SHA1
e9299dbd5375fe1c6b4580d65220f5593cb24d6f

SHA256
de64d90d230f98f75249099ea84f93c99833f020b4b00ebb3c09b67a56325324

SHA512
02da603db1916c1d366bec0a43dc651be140a9d82e584239aca080b347b9e03288991557cb509d74f4ca9d71b2ae73e98206c5c31bb691d174802f29aead1bab

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_hi.dll

Filesize
43KB

MD5
de5befeb7f8c2e82792309004770b56e

SHA1
3d6161743fc04dfcb7d3d9ccffc5ea77541e12a2

SHA256
8f1bb869bada9387c67bdd23d28029161a2023ddcd185bb26c800680819ed017

SHA512
a892c618a38f125a65587e8c5051e76e41f46f2556a858be8b708791d58e118b30598fde5f9d19b93e3b6bf91ba8715aa6679b8cb7b6027e08b8333ee270ea22

Download Submit
C:\Windows\SystemTemp\GUM5297.tmp\goopdateres_hr.dll

Filesize
43KB

MD5
5c970b5b1f9da695d89a4fb87d1539a5

SHA1
17ec05aba3fefca2650eb576e3651f7c8e185692

SHA256
d35d809b09338750c590e2f72ff7c8500fb4fc827171b899f443ae0775485301

SHA512
523356783e85eed1222178990e1a1c1615aa817954a66b4f135eaef1f626f921c97b369d1f992c8db8c7884d2609e19b13c8526e9a305e054fdef8d9cf20ee49

Download Submit
memory/1324-1151-0x000001E99A580000-0x000001E99A600000-memory.dmp

Filesize
512KB

Download
memory/1324-1162-0x00007FFECCCE0000-0x00007FFECD7A2000-memory.dmp

Filesize
10.8MB

Download
memory/1324-1149-0x000001E998840000-0x000001E9988AE000-memory.dmp

Filesize
440KB

Download
memory/1324-1159-0x000001E9B3020000-0x000001E9B3046000-memory.dmp

Filesize
152KB

Download
memory/1324-1152-0x000001E99A600000-0x000001E99A666000-memory.dmp

Filesize
408KB

Download
memory/1324-1155-0x000001E998D20000-0x000001E998D42000-memory.dmp

Filesize
136KB

Download
memory/1324-1156-0x000001E998CE0000-0x000001E998CE8000-memory.dmp

Filesize
32KB

Download
memory/1324-1154-0x00007FFECCCE0000-0x00007FFECD7A2000-memory.dmp

Filesize
10.8MB

Download
memory/1324-1153-0x000001E998CF0000-0x000001E998D12000-memory.dmp

Filesize
136KB

Download
memory/1324-1157-0x000001E998D70000-0x000001E998D84000-memory.dmp

Filesize
80KB

Download
memory/1324-1160-0x000001E998DB0000-0x000001E998DB8000-memory.dmp

Filesize
32KB

Download
memory/1632-512-0x00007FFECCCE0000-0x00007FFECD7A2000-memory.dmp

Filesize
10.8MB

Download
memory/1632-513-0x0000022C12280000-0x0000022C122A2000-memory.dmp

Filesize
136KB

Download
memory/1632-1186-0x00007FFECCCE0000-0x00007FFECD7A2000-memory.dmp

Filesize
10.8MB

Download
memory/1632-766-0x0000022C2C950000-0x0000022C2C9C6000-memory.dmp

Filesize
472KB

Download
memory/1632-767-0x0000022C2C910000-0x0000022C2C92E000-memory.dmp

Filesize
120KB

Download
memory/1632-514-0x0000022C122D0000-0x0000022C122F4000-memory.dmp

Filesize
144KB

Download
memory/1632-786-0x0000022C12270000-0x0000022C12280000-memory.dmp

Filesize
64KB

Download
memory/1632-785-0x00007FFECCCE0000-0x00007FFECD7A2000-memory.dmp

Filesize
10.8MB

Download
memory/2516-451-0x0000019B513A0000-0x0000019B51420000-memory.dmp

Filesize
512KB

Download
memory/2516-447-0x0000019B51200000-0x0000019B5130E000-memory.dmp

Filesize
1.1MB

Download
memory/2516-773-0x0000019B51390000-0x0000019B513A0000-memory.dmp

Filesize
64KB

Download
memory/2516-770-0x0000019B51390000-0x0000019B513A0000-memory.dmp

Filesize
64KB

Download
memory/2516-510-0x0000019B56530000-0x0000019B56536000-memory.dmp

Filesize
24KB

Download
memory/2516-491-0x00007FFECCCE0000-0x00007FFECD7A2000-memory.dmp

Filesize
10.8MB

Download
memory/2516-440-0x0000019B36840000-0x0000019B36AE4000-memory.dmp

Filesize
2.6MB

Download
memory/2516-441-0x0000019B388F0000-0x0000019B389A6000-memory.dmp

Filesize
728KB

Download
memory/2516-443-0x0000019B51390000-0x0000019B513A0000-memory.dmp

Filesize
64KB

Download
memory/2516-442-0x00007FFECCCE0000-0x00007FFECD7A2000-memory.dmp

Filesize
10.8MB

Download
memory/2516-444-0x0000019B36F00000-0x0000019B36F0A000-memory.dmp

Filesize
40KB

Download
memory/2516-446-0x0000019B36F30000-0x0000019B36F52000-memory.dmp

Filesize
136KB

Download
memory/2516-445-0x0000019B36F10000-0x0000019B36F1A000-memory.dmp

Filesize
40KB

Download
memory/2516-453-0x0000019B51630000-0x0000019B516EA000-memory.dmp

Filesize
744KB

Download
memory/2516-448-0x0000019B36F50000-0x0000019B36F5C000-memory.dmp

Filesize
48KB

Download
memory/2516-450-0x0000019B51310000-0x0000019B51376000-memory.dmp

Filesize
408KB

Download
memory/2516-775-0x0000019B51390000-0x0000019B513A0000-memory.dmp

Filesize
64KB

Download
memory/2516-479-0x0000019B56630000-0x0000019B567B8000-memory.dmp

Filesize
1.5MB

Download
memory/2516-452-0x0000019B370B0000-0x0000019B370B8000-memory.dmp

Filesize
32KB

Download
memory/2516-475-0x0000019B56310000-0x0000019B56336000-memory.dmp

Filesize
152KB

Download
memory/2516-474-0x0000019B51390000-0x0000019B513A0000-memory.dmp

Filesize
64KB

Download
memory/2516-473-0x0000019B55850000-0x0000019B5585E000-memory.dmp

Filesize
56KB

Download
memory/2516-469-0x0000019B51390000-0x0000019B513A0000-memory.dmp

Filesize
64KB

Download
memory/2516-472-0x0000019B55880000-0x0000019B558B8000-memory.dmp

Filesize
224KB

Download
memory/2516-470-0x0000019B55800000-0x0000019B55808000-memory.dmp

Filesize
32KB

Download
memory/2516-449-0x0000019B36F60000-0x0000019B36F84000-memory.dmp

Filesize
144KB

Download
memory/2516-471-0x0000019B51390000-0x0000019B513A0000-memory.dmp

Filesize
64KB

Download
memory/2516-458-0x0000019B515B0000-0x0000019B515B8000-memory.dmp

Filesize
32KB

Download
memory/3720-1185-0x0000024332450000-0x00000243324AC000-memory.dmp

Filesize
368KB

Download
memory/4560-1148-0x00007FFECCCE0000-0x00007FFECD7A2000-memory.dmp

Filesize
10.8MB

Download
memory/4560-1164-0x00007FFECCCE0000-0x00007FFECD7A2000-memory.dmp

Filesize
10.8MB

Download
memory/4560-1146-0x000001D115EB0000-0x000001D115ECC000-memory.dmp

Filesize
112KB

Download
memory/5020-838-0x00000271B9840000-0x00000271B9872000-memory.dmp

Filesize
200KB

Download
memory/5020-1176-0x00007FFECCCE0000-0x00007FFECD7A2000-memory.dmp

Filesize
10.8MB

Download
memory/5020-1150-0x00000271B9310000-0x00000271B9320000-memory.dmp

Filesize
64KB

Download
memory/5020-1147-0x00007FFECCCE0000-0x00007FFECD7A2000-memory.dmp

Filesize
10.8MB

Download
memory/5020-1165-0x00000271B9830000-0x00000271B983A000-memory.dmp

Filesize
40KB

Download
memory/5020-1158-0x00000271B9310000-0x00000271B9320000-memory.dmp

Filesize
64KB

Download
memory/5020-839-0x00000271B9310000-0x00000271B9320000-memory.dmp

Filesize
64KB

Download
memory/5020-837-0x00000271B9300000-0x00000271B9306000-memory.dmp

Filesize
24KB

Download
memory/5020-834-0x00000271A0A50000-0x00000271A0A68000-memory.dmp

Filesize
96KB

Download
memory/5020-835-0x00000271B9310000-0x00000271B9320000-memory.dmp

Filesize
64KB

Download
memory/5020-836-0x00000271A0BC0000-0x00000271A0BE2000-memory.dmp

Filesize
136KB

Download
memory/5020-833-0x00007FFECCCE0000-0x00007FFECD7A2000-memory.dmp

Filesize
10.8MB

Download
memory/5020-832-0x000002719ED50000-0x000002719EE74000-memory.dmp

Filesize
1.1MB

Download