0089d7884cced364249f825c56d68477d288b12f754188d87434760fc961617f

Analysis

max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe
Size

10.5MB
MD5

c15a975fc6f8904fd0acb9210d245702
SHA1

4f21c1eb79e84d5020a590b8c5693830cbcfc117
SHA256

0089d7884cced364249f825c56d68477d288b12f754188d87434760fc961617f
SHA512

0d497e1b3e11c175267aed6a4f0f09940ef680f82bf6170a9b8fa1a5dde6afbc618dfc58d13e7601ca5611b73b155d0d1df2fa76a6f9ca1fdc573089ef3a5a24
SSDEEP

196608:dCJBYlzkSIEc+waFvtCK4BbCSC3qzF1/goaSZzpBM:cUzkSU+FvV47Ccz/goa03

Score

6^/10

persistence

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_pt-PT.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_sl.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_et.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_ms.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_ru.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_el.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_ja.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_pl.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_sr.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_th.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_th.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_es.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_mr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_sl.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\psuser_64.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\psmachine.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_it.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_am.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_hi.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_ur.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdate.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_hr.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_no.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_ro.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\psmachine_64.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\GoogleUpdateCore.exe	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_lv.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_is.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_da.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_hu.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_te.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_ca.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_ms.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_ru.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\GoogleUpdateCore.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_ca.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_en-GB.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_zh-CN.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\psuser.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_ar.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_et.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_kn.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_ko.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_nl.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_ta.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_fr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_ja.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\GoogleCrashHandler64.exe	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_cs.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_fi.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_sk.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_de.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_en.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\Install\{6D690555-F295-4889-9E8B-A0B528C9282A}\HPE-24.1.1787.4-CIP.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\goopdateres_lt.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\GoogleCrashHandler.exe	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_am.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_ko.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_lt.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_sv.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.351\GoogleUpdateBroker.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_da.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_uk.dll	GoogleUpdateSetup.exe

Executes dropped EXE 15 IoCs

pid	Process
1620	crashpad_handler.exe
3868	crashpad_handler.exe
2692	GoogleUpdateSetup.exe
1536	GoogleUpdate.exe
2352	GoogleUpdate.exe
4940	GoogleUpdate.exe
4728	GoogleUpdateComRegisterShell64.exe
3068	GoogleUpdateComRegisterShell64.exe
2708	GoogleUpdateComRegisterShell64.exe
1584	GoogleUpdate.exe
1036	GoogleUpdateBroker.exe
3564	GoogleUpdate.exe
2636	GoogleUpdate.exe
3220	GoogleUpdate.exe
4612	HPE-24.1.1787.4-CIP.exe

Loads dropped DLL 20 IoCs

pid	Process
3492	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe
3492	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe
840	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe
1536	GoogleUpdate.exe
2352	GoogleUpdate.exe
4940	GoogleUpdate.exe
4728	GoogleUpdateComRegisterShell64.exe
4940	GoogleUpdate.exe
3068	GoogleUpdateComRegisterShell64.exe
4940	GoogleUpdate.exe
2708	GoogleUpdateComRegisterShell64.exe
4940	GoogleUpdate.exe
1584	GoogleUpdate.exe
3564	GoogleUpdate.exe
2636	GoogleUpdate.exe
3220	GoogleUpdate.exe
3220	GoogleUpdate.exe
2636	GoogleUpdate.exe
3564	GoogleUpdate.exe
840	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe

Registers COM server for autorun 1 TTPs 33 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.351\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.351\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.351\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.351\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.351\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.351\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.351\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.351\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.351\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32	GoogleUpdateComRegisterShell64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\LOCALSERVER32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\ProgID\ = "GoogleUpdate.CoCreateAsync.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\ = "Google Update Policy Status Class"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass.1\ = "Google Update Core Class"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ = "IGoogleUpdateCore"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachineFallback.1.0\ = "Google Update Policy Status Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{27634814-8E41-4C35-8577-980134A96544}\ = "IPolicyStatusValue"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{37FB52DA-F779-408D-B505-3F83CFBBFC20}\InprocHandler32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.351\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\GOOGLEUPDATE.EXE	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\LocalService = "gupdate"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\VersionIndependentProgID\ = "GoogleUpdate.CredentialDialogMachine"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\LocalService = "gupdatem"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6365D39F-2E73-4837-BC59-2014AAA20FA7}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.351\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\ = "Google Update Broker Class Factory"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreMachineClass\CurVer\ = "GoogleUpdate.CoreMachineClass.1"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods\ = "17"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ = "IBrowserHttpRequest2"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}	GoogleUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1536	GoogleUpdate.exe
1536	GoogleUpdate.exe
1536	GoogleUpdate.exe
1536	GoogleUpdate.exe
1536	GoogleUpdate.exe
1536	GoogleUpdate.exe
1536	GoogleUpdate.exe
1536	GoogleUpdate.exe
1536	GoogleUpdate.exe
1536	GoogleUpdate.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3492	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe
Token: SeDebugPrivilege	1536	GoogleUpdate.exe
Token: SeDebugPrivilege	1536	GoogleUpdate.exe
Token: SeDebugPrivilege	1536	GoogleUpdate.exe
Token: SeDebugPrivilege	1536	GoogleUpdate.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 1620	3492	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe	90
PID 3492 wrote to memory of 1620	3492	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe	90
PID 3492 wrote to memory of 840	3492	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe	92
PID 3492 wrote to memory of 840	3492	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe	92
PID 840 wrote to memory of 3868	840	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe	93
PID 840 wrote to memory of 3868	840	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe	93
PID 840 wrote to memory of 2692	840	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe	94
PID 840 wrote to memory of 2692	840	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe	94
PID 840 wrote to memory of 2692	840	Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe	94
PID 2692 wrote to memory of 1536	2692	GoogleUpdateSetup.exe	95
PID 2692 wrote to memory of 1536	2692	GoogleUpdateSetup.exe	95
PID 2692 wrote to memory of 1536	2692	GoogleUpdateSetup.exe	95
PID 1536 wrote to memory of 2352	1536	GoogleUpdate.exe	96
PID 1536 wrote to memory of 2352	1536	GoogleUpdate.exe	96
PID 1536 wrote to memory of 2352	1536	GoogleUpdate.exe	96
PID 1536 wrote to memory of 4940	1536	GoogleUpdate.exe	97
PID 1536 wrote to memory of 4940	1536	GoogleUpdate.exe	97
PID 1536 wrote to memory of 4940	1536	GoogleUpdate.exe	97
PID 4940 wrote to memory of 4728	4940	GoogleUpdate.exe	98
PID 4940 wrote to memory of 4728	4940	GoogleUpdate.exe	98
PID 4940 wrote to memory of 3068	4940	GoogleUpdate.exe	99
PID 4940 wrote to memory of 3068	4940	GoogleUpdate.exe	99
PID 4940 wrote to memory of 2708	4940	GoogleUpdate.exe	100
PID 4940 wrote to memory of 2708	4940	GoogleUpdate.exe	100
PID 1536 wrote to memory of 1584	1536	GoogleUpdate.exe	101
PID 1536 wrote to memory of 1584	1536	GoogleUpdate.exe	101
PID 1536 wrote to memory of 1584	1536	GoogleUpdate.exe	101
PID 1036 wrote to memory of 3564	1036	GoogleUpdateBroker.exe	103
PID 1036 wrote to memory of 3564	1036	GoogleUpdateBroker.exe	103
PID 1036 wrote to memory of 3564	1036	GoogleUpdateBroker.exe	103
PID 3220 wrote to memory of 4612	3220	GoogleUpdate.exe	111
PID 3220 wrote to memory of 4612	3220	GoogleUpdate.exe	111
PID 4612 wrote to memory of 3560	4612	HPE-24.1.1787.4-CIP.exe	113
PID 4612 wrote to memory of 3560	4612	HPE-24.1.1787.4-CIP.exe	113
PID 4612 wrote to memory of 4184	4612	HPE-24.1.1787.4-CIP.exe	115
PID 4612 wrote to memory of 4184	4612	HPE-24.1.1787.4-CIP.exe	115

C:\Users\Admin\AppData\Local\Temp\Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe
"C:\Users\Admin\AppData\Local\Temp\Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Local\Temp\nuxv0tyt.ovm\crashpad_handler.exe
  C:\Users\Admin\AppData\Local\Temp\nuxv0tyt.ovm\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=24.1.1687.0 --initial-client-data=0x68c,0x690,0x694,0x66c,0x698,0x7ffddef852c8,0x7ffddef852d8,0x7ffddef852e8
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Users\Admin\AppData\Local\Temp\Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe
  "C:\Users\Admin\AppData\Local\Temp\Install-Super Tank_ City 1990-GooglePlayGames-Beta.exe" -install gpg_install_55921bbe-1876-4e7e-bf8a-0f1c286d515f "C:\Users\Admin\AppData\Local\Temp\nuxv0tyt.ovm"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Users\Admin\AppData\Local\Temp\nuxv0tyt.ovm\crashpad_handler.exe
    C:\Users\Admin\AppData\Local\Temp\nuxv0tyt.ovm\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=24.1.1687.0 --initial-client-data=0x3a8,0x3ac,0x3b0,0x384,0x3b4,0x7ffddef852c8,0x7ffddef852d8,0x7ffddef852e8
    3⤵
    - Executes dropped EXE
    PID:3868
- - C:\Users\Admin\AppData\Local\Temp\nuxv0tyt.ovm\GoogleUpdateSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\nuxv0tyt.ovm\GoogleUpdateSetup.exe" /install "runtime=true&needsadmin=true" /silent
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\GoogleUpdate.exe" /install "runtime=true&needsadmin=true" /silent
      4⤵
      Sets file execution options in registry
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1536
    - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2352
    - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4940
      - C:\Program Files (x86)\Google\Update\1.3.36.351\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.351\GoogleUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4728
      - C:\Program Files (x86)\Google\Update\1.3.36.351\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.351\GoogleUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:3068
      - C:\Program Files (x86)\Google\Update\1.3.36.351\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.351\GoogleUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:2708
    - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0UwRUZBNEQtMzAxOC00QjU2LUJDQjctMkI1MjhCQkY2NkIxfSIgdXNlcmlkPSJ7RTc2NjFFMUQtQkRBMS00RkY1LUEyREMtNjNCQzg0NDk4QzY1fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEQjk2QTY1RS1DNkYxLTQ5RkQtQUM2NC1ENUY4MUFGM0EzMUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjEuMy4zNi4xNTEiIG5leHR2ZXJzaW9uPSIxLjMuMzYuMzUxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjI3NzkiLz48L2FwcD48L3JlcXVlc3Q-
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1584

C:\Program Files (x86)\Google\Update\1.3.36.351\GoogleUpdateBroker.exe
"C:\Program Files (x86)\Google\Update\1.3.36.351\GoogleUpdateBroker.exe" -Embedding
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /broker
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3564

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files (x86)\Google\Update\Install\{6D690555-F295-4889-9E8B-A0B528C9282A}\HPE-24.1.1787.4-CIP.exe
  "C:\Program Files (x86)\Google\Update\Install\{6D690555-F295-4889-9E8B-A0B528C9282A}\HPE-24.1.1787.4-CIP.exe" /o{47B07D71-505D-4665-AFD4-4972A30C6530} /l1518 /noui
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C dir /s /-c "C:\Windows\TEMP\Google\Play Games\cfnpao1p.haj"
    3⤵
    PID:3560
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C dir /s /-c "C:\Program Files\Google"
    3⤵
    PID:4184
- - C:\Windows\TEMP\Google\Play Games\cfnpao1p.haj\7zr.exe
    "C:\Windows\TEMP\Google\Play Games\cfnpao1p.haj\7zr.exe" x "-oC:\Program Files\Google\Play Games\current" -y -bso0 -bsp1 "C:\Windows\TEMP\Google\Play Games\cfnpao1p.haj\archive.7z"
    3⤵
    PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\GoogleCrashHandler.exe

Filesize
294KB

MD5
8eb5a3bca26acb6688a0cd7b35cfdad9

SHA1
209c79d6b18a00f378efa75c7a3e44686f1850a1

SHA256
24dfdf400d8514d3fbfc5f4aa5dd2143f38b160ad142417bbf83e4d2e425dd0c

SHA512
9dc20a43174f103ace495986cda9870ed4b899c74fe85cfd941fe2cc312e883caf9d0f8835fc59f8a7fd82ee350e479896fb31c7d0cd170ff6932fd9e24a0417

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\GoogleCrashHandler64.exe

Filesize
392KB

MD5
15c1cadd3729ae6a4c1f8fa08d61bdc6

SHA1
1486f4eaa1b41b0f2101559ea24630d002bc2d25

SHA256
ce1dd1ba63273aacc0d1ef4e25d8338577d612e88f27d29466168099d3548342

SHA512
70eb764a53647d178278c743f964e03671bd445cc121f8e5a5b17441483b8b150ddf0d91316b8da1a7e289f6d6ebaf7f4952c8745530a700d21269309807f341

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\GoogleUpdate.exe

Filesize
158KB

MD5
bfb045ceef93ef6ab1cef922a95a630e

SHA1
4a89fc0aa79757f4986b83f15b8780285db86fb6

SHA256
1f6b69d11a3066e21c40002a25986c44e24a66f023a40e5f49eecaea33f5576d

SHA512
9c1bfa88b5b5533ede94158fa3169b9e0458f1ceae04dae0e74f4c23a899ce27d9109bd298a2053fb698e2ed403f51a9b828ee9fa9d66b54a18cd0d969edc194

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\GoogleUpdateComRegisterShell64.exe

Filesize
181KB

MD5
4b0bf7525348fd3b55b189c42f90633c

SHA1
3861f8dad235032ff0d68065fde4082b379f02b2

SHA256
f318deb222e9f635f3a7b7de3202169732ebdb4ccf0be5fa8bb94e2e83913b74

SHA512
ae87acaf33c4cc1a1368b427128432b94a8030f8837490ecaf6a394a5e2e5a9340e243f436b894fa269a8bec3d22da93b9e480d33911938e995055c3e7a8cb76

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\GoogleUpdateCore.exe

Filesize
217KB

MD5
e0e328e353efdfccf4aba39bed38ae5c

SHA1
35388f3a1d5f30b913e5ec442ccee88a03df11bd

SHA256
b8ca3d7d6f8f875b88128f9968d7ad2718300115c1bf455fcc3d128c923b2c14

SHA512
32af8dcb139f1c0dc0e23641ad8f87e9cda2071c001405db6a44fce2226a189217dcd5aa47f260eaa3d482aa8bd20f797fc7cb48b3e9195be9e0dd94e79651b5

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdate.dll

Filesize
1.9MB

MD5
edfa8bd2f0c16e230f330eafb3a6e460

SHA1
a82891330547bb25032c28a28991ca015c68cfd6

SHA256
f5b71fee076ccb6564f52cd709f0a30f5a32f7737a4560dcc8f02b264bfd6a9e

SHA512
3fab3b4ad4bb23d01649fd67f285abb5a688abc62f58b8f18ff3f8d36a19c865043c3b216708ad038c32368d0a87f34162df37c8d9941960e35d31917fee1e2e

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_am.dll

Filesize
42KB

MD5
418b407c7b15a719c6f5a142669110f5

SHA1
dae34b810d7c99496fe0468f211db9227405f1c7

SHA256
daf07770a79c900af6aa696bc8ec89393380c52435223922ca2b3d3559f10340

SHA512
bf259b3d1970f8dd3a30718385f8dc984e83ac24aed9e0c10aa6a4dbd8af102b84745b897256c3ce269b73abb6852af9f47e80f36df39a671ccc6a117c6d9f76

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_ar.dll

Filesize
41KB

MD5
8ed294671fc284dce63d0d5a9d83b526

SHA1
a6547da3072ee04ac0a078ebde4509556e2e1fc4

SHA256
8048cd3ebe28e7458af073032cb435ba59e671bffc9ca142380c302ed7e93107

SHA512
318d782bab83fdc5df39fa8d941e33b3c51b3cce9eec3e585a7a54735e57f646d5dd89608d1d87804b35757c3120f4efb43cc67537fac6ca0d8a14f01c0f8dc0

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_bg.dll

Filesize
44KB

MD5
c715cc99f0fd8a65cf6e6fdb4b4d1529

SHA1
856c40d9a4ffe0494cc26bd935f8bf3862e1743c

SHA256
3e61e27a8a9cfa94d7bdf0efb289bb7758f02bc07d0f52f17a965b6871b94a6e

SHA512
0bd4374ba94ff725ad43911260948f595a0ea8dd04d5a0f92306099eede90c306f786a5827648899f0da762d1b2599ce0eb3fa91c04dc0bb363cd288d64695ec

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_bn.dll

Filesize
44KB

MD5
6e8f8ed14c3b47252a72ff6239dbe75e

SHA1
dead9a7befb31ad9bf53c65dec9875b503dff06b

SHA256
aadaec6f8e64d76ead1d67c1d14d7c72e6c9743351fefec5be9cab06f2536c56

SHA512
1e0835cce0c5e32bc500ae1c84697c84165d672e336efbf88ba2481e1d539fdc3eea5b8451eb103f917c680bf0558d879b75d4eea2c053dc274d4fa13322dee0

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_ca.dll

Filesize
44KB

MD5
d69ed8225e072d108b0cb723f25d745c

SHA1
bd9cf36f9cf49fecc742d8b95a425cf0cfadf22a

SHA256
15cb0374dfbf66c413bfdbc69da477c28cda0694f279bfc1011de99687fbf0b8

SHA512
dcdb98c0c5fa9c0cb7e746401f9523048cfc8801376aadb16ed6e2d22d64f2fb944f9220f921151a61e4983bf4293d18fad6dc010ae69841aad449bfc40fd40b

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_cs.dll

Filesize
43KB

MD5
1a2b18db01c22e2ef828dd0b5140f4c1

SHA1
d376329e5e1048db8224d4c786e7d5c7b668be95

SHA256
ef43254f63d1384b44ea2d0b02bcc176c6e67a20ed815c1e028a0c4c0f7268ce

SHA512
525176002934c494ac542ed5a6bdec5dbce75c92b7eb161fc13676c91e2e7172973786544f912fd6c731186559d0817bded29e0539a2c3a9f514db2390158462

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_da.dll

Filesize
43KB

MD5
fe98be1fe919aca4f759e21dc79eefbc

SHA1
ffa501ea34544b08c51d7a1150309491b3ed3dd9

SHA256
730d76fb5f00e34a1760b4c8814d8ff4be7de0710ca6321a79000dab001cfd46

SHA512
76e98c8f06ed9e38b383678f93ef38753f5c8ec20edd31e68e9abcf44640e6ab2ba89cdb8bf97a914a3b5c280c6abc2012f0237ea7a3d8b652b1aec2e55c81d8

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_de.dll

Filesize
45KB

MD5
dcccbe27e366292aa7f5796ba44d0cf2

SHA1
76cffe494d0847f7d9aeeee48c7f6c687a849993

SHA256
c5af4b1f0e63896ea32954b12757f5cee73b866a6572e592e2d0a1f8e8114def

SHA512
61e2655ab819960fa4157131a400fecdd812a2821927fdc9f1757b599ca0eb5fd3087e259d2e0746b867197a099b540780a6066509dc63deb62f9ee1f5a231e6

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_el.dll

Filesize
44KB

MD5
b049895c8da7a192546057f435107e66

SHA1
7f1938b0464b8da2a8164837dbe4826d2a0a7a50

SHA256
4f91bd2780e8a07f7f293e1d133af79070e8eacf988c9aef402057d5688b1ec0

SHA512
a2874a858d3d7c8219d3bb3a21210b007cf3148b6ae606805ba3a42edeb9357433e73505f1e13c7fb96994fcc1133a7cdc7dc0b7502d025ff726813b0731cf76

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_en-GB.dll

Filesize
42KB

MD5
69d31e43a6a0182bd7e1dcecc754558f

SHA1
b4f712f563518acf6f1d2353e03aff2981d009b8

SHA256
7aa2ce26d8e21eb4774202534f132193c5dbd8c693efb7e7e86effe54892d09d

SHA512
5c471a1aed7193404fb9eaccb2157a01d333ee4ef9be99f4604f049a8ea0b18f6ebd5523f346cb4bd97efa35dfa7309abe2771e4a154f2d45827a791c9665685

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_en.dll

Filesize
42KB

MD5
ddc8a827afa27984c03d10cada39327e

SHA1
d089c4131c030e52b5cd7b4643392a4d9cc66935

SHA256
50f5336a87755a029e56b21d5719a36250aa58c5429a1387e0c365e334bd4a4b

SHA512
e924c8ada788a90cec3caebcaea90aae1e1021b5ae79e9aa4a0db7ce3d9bdaf2a4f21676b7100b73a7b792c646954f58de55b03f075f408bfc72d078219f2632

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_es-419.dll

Filesize
43KB

MD5
8d3f863d40503167df5c5a47bc12f7cf

SHA1
471bf2c2c7ce76eada842f96ccbabcbe602ba769

SHA256
c97c7610318387907716bc813d3ce2298aff7b35b3d03504b208f3ae2d0c90c2

SHA512
6b658a92a54a7514c0f8318df024921cf03d85884ae393cd6f604ba08d973b5abc4100b6edc596d29f2882a858ae384596fa24a624464d1547efb921eac83dde

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_es.dll

Filesize
45KB

MD5
74a36fcea1e1ad6c07fcbde535198c74

SHA1
48e51247a553d2babcd4b84920fdc31e81559e98

SHA256
d0d79d998b1963369ceec1e90a4f820460028dabc6e82d0a0bf4dbb4e84155f1

SHA512
6bfe5fd01bd230a2c5227635385d0765c51aa1941d5bebdff6aa66135873a375643f5069baf1e72dfd27a1769530e398d0bd8fe11183eb75f00ca23de8e08cfc

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_et.dll

Filesize
42KB

MD5
a79ddde77ec7e218eea098cdf254d97d

SHA1
0c751b2b5a30162d9270c83d4e65995191da1369

SHA256
60e0e6b193c3729aa9bb33099820e9540f2c4331534355d18da922d8d653e9fb

SHA512
b94f11b9b7372acaea4ac172f8393fbe4c274c7c69cc58f672b02a3f141200d415a093ab88afaf632aa5a1f6e1c87a911dd8e9f3159e68e44ef3b03376a0ac73

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_fa.dll

Filesize
42KB

MD5
b3dfe146311d95d9eac5e74e3b723a0d

SHA1
002ec7a189ab0f5a9265c587006c1eaf51538881

SHA256
f96751c4f1b6dbe5c694c5edc962a9f8ae31acc8ffe49c449d9f978c93e80710

SHA512
93760f5310672684ac2df6275762b7268e38fe8b8b588673fe1a64b97b3af78b85664a23fce1abb682c1c421f62133ca1fdf803dd4b98aa9071f992fa1b4bc77

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_fi.dll

Filesize
43KB

MD5
0d56238cfb345199ef170ade32fb060d

SHA1
f54795d4c0370a0ff8134edefbdcd25adc973e78

SHA256
40e43508fa6f3314487c768b0d17be723e5493710613f9aec0759444070e1e31

SHA512
dfe21dd9ac6eba7cafaa10d3247378b6dd65e90a521962cbdd35ba6960fc9552a90a03c606445402237cc8e5cac54f85e59d31ed13ae329d867dc3e513fecb9d

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_fil.dll

Filesize
44KB

MD5
488f70652a950be945b28b9667e1cd23

SHA1
7fe910247cc239164f75ac01cf0febee7311605a

SHA256
8d47a73610ef517005e7bf50fcadb9994e1ec23d89ac5cbe17a826c4fb1d4e52

SHA512
a9d908769d6b2b8d0849dd0857a005f444b1795a01eb97e2ed6c276cf9343e71fbd8240552a1e46a23bc7cbaa2a06f19c3e321fafeb52285e176c7ed6a36f1d2

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_gu.dll

Filesize
44KB

MD5
6c548cd39dc7da1bfbd2dab1a9d614dd

SHA1
9461ef67c9d7f2066fbf3c2b6db80a9397026196

SHA256
299b22085e3ab0cd813bd6a226763dd7e8f83f46c72aff82d27a5aaf66bbddb5

SHA512
97939b4040712e07af5876ee753a405ace6cd373ff5dae882750640114ddbb9b08e1ede5327f09ac88644baced8ada4129e9c563015cea0d36bb31276343c7d4

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_hi.dll

Filesize
43KB

MD5
ae97b0884025bb6526dd1e0aeb4e26c4

SHA1
9d89dc1a5ff310a38b1a1ad0bedbe6abd9956619

SHA256
7135d984bb602943c0545c628e8dd55b8c8309ba2ad5c9408b4290efa718d521

SHA512
14c370a17973bbc2b89653ee4215601cf28c480502d51507626fdfbf5a32363a56a1a290b7fc2efa611166512a225f4fc7c4fc21720e6a7d3c760017f8120534

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_hr.dll

Filesize
43KB

MD5
5927d2da6e75c35314f2cb814de0ea6d

SHA1
65d5c5fad9c6718566e057ce6615287cf383d2a0

SHA256
c6e1d126af9c781f37c9ff958cdd003e8f4097c7c0bbba19cabf69d1b9ce898a

SHA512
996fff42b0c443ffe25294991e9425972e57e663a8159c183ba088f0b55b6534c95417a29fca04cfe3528df7e970c0f5f9cb72823202d6729c6ceebe8c5f3b70

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_hu.dll

Filesize
43KB

MD5
40bbad8fbea40e5bfb9161c5aa8c70ed

SHA1
f65f31086333f1b7fbe443037abbad202550175a

SHA256
5e223e560ec266011afa68fc298d2bbadf3eb5b16cee33cf2129cbb69c5fbc57

SHA512
b54031c97b59b4426345f8600827102915daeafe33c023f7478839ea0a3f159f35c878e749fc248d4cbd7ae62b19ae668ac797672c5642bbdc55ef6e5af4989d

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_id.dll

Filesize
42KB

MD5
0aa670bc2dd150fa5123b83bccf5fe12

SHA1
4870a864fe6143eb5222e8d8e73f5fda56e287ad

SHA256
ede96cb0ccb194ded60e47d1e5267e7d9b4be17486d6815dd83b9e113a9d461d

SHA512
54c35d31972956dabe61dff647671f3c35f7ce89460577b4131050498760320ced266fe06f1a6b885562213e59352db52918e742433ec834f65c0853fa73516f

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_is.dll

Filesize
42KB

MD5
aef60779077e9f87af913004cb60ecfd

SHA1
d6f2d022bdccce977629242a1d96ad0ae07265fb

SHA256
abf4ca30494eadc3b1f5840ffb0ccd2f7edba3b1f2e6798709ec2f05133ad050

SHA512
c82f5a4e51d7c64bf73d5f7b596797f84743c66304f5b9fad1301571b3949efa7da75b35551c517cfd92b109fbc005695b12d5d34ee30700af5ecf8baf5d8c83

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_it.dll

Filesize
44KB

MD5
232b8861fdad435fd31e125056aadc95

SHA1
fa85b685c0a376b08c5858294cc25a2d0d236a00

SHA256
b71afc27c4c6ce8759595f4a4ca3045f8348020fee8f9fb84458f98b9da7a004

SHA512
cd364c636ec62784d6829284247a72f07f5c1250fc28416a320c779424c9df85b698f13c8cfbb4b060b2da32487f4c6df42ce178d1a4f6c6a03f8defaf1388ba

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_iw.dll

Filesize
40KB

MD5
6d04e00145390e4d125c6ce37e0e7c0a

SHA1
1d9a191462c4927d84fc10a4b657abefc8862a24

SHA256
b406ef6c77fbbab2b722df7ac3cbde3aca8a73f3d4f4745a48ca11ca6af53198

SHA512
88bcfe01b0de70d91f63d2888cf24782cfe2960124dc455a669fae2001b5aab4c1999446d2fd3115c6c4e660780f6fb9fc39044c4a1936cbc47914d75e87617c

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_ja.dll

Filesize
39KB

MD5
ca6d439a8ff4f33b7b18a2e0aa69d09e

SHA1
2ce96633bbc013d5418894af9a02b0243f56e89f

SHA256
4bfecde36d9851a0c7c2bcac76b8ba103261b2c66d409dffd756e1ec3ed6668d

SHA512
1514f0d469dc0a8c5ff75d4b5eab4378c7ff8fe84307004c6d9028716eb62bcc230cc0e99d33558f847821a844a022da79e0e60e5e3593d4932dc7c7f6d9c825

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_kn.dll

Filesize
44KB

MD5
f0b14a9d80eea1f6def5c27590069708

SHA1
4521f35d60730b57196edb6186aae7c9e4f8ef7e

SHA256
83d621aabe3120ea87ce6c45a099ceb0b4ba2b61f810d549e5e73b59f39a2be2

SHA512
f8326580b12eede8017f3cbfb3732b383dc0c5ebf9ef35f20a2575f17a132af2a7e03d4bd53e0c13398492a3c648cca8c228bbb4e0c5024bbefed3c000d39968

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_ko.dll

Filesize
38KB

MD5
8a65732d96bc6ba596e6114a82270cd1

SHA1
48640a6b313294f5c6a82a5ccc5c4e981d0ae5f1

SHA256
022e8b4c03ea94797df3bc315112eccbe913f15f32e3ce22479b421062441b3e

SHA512
c6a65988e31bc24ce75050b77c74d807c7367ad30af635c0769513ea7e068c26bfa2dcad0a5084b2ca72a7bebe300bdfe79b99d3f298be4c133fd93fb2f96c8c

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_lt.dll

Filesize
42KB

MD5
ee1e1ba70e4c75ac786d1815f9e8903e

SHA1
2f7d4bd9ef18a6ed26bb0bafcdd0510e2e4a91f2

SHA256
926681fdd9a0b9554bee09e4edc1cdfd451943e51df17f713c5705f36d4f6a01

SHA512
3f13fec7c244b25746312c9cc9cd234b196d8c52822fea534c13cfb215cdd6892a5325371d1baaa7219bdf9e3fa50211396fb51ea9f34df10caf597ca641d7b4

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_lv.dll

Filesize
43KB

MD5
3e4fd166c0650897190690cc649a3277

SHA1
09e3ac95e54901de4cdf089b17ac823f7d304153

SHA256
693322193a570d82f6ec2cb44c1b5aa35304d2276942d04a857148a1b99a0931

SHA512
1436905284bbb50796ccdbb556d789c8b79e2eb621b8be92485361aa63158b03e61054c3c371fa7403fdee9ef25a009e8e1665e8bb933ebe1f8b0acd324692e5

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_ml.dll

Filesize
46KB

MD5
d306f4020bb3b59573394a4b8bbda5ad

SHA1
2d3db5163817293f9379aa1bd26d37729c331cfe

SHA256
d2a71290a4bdf815e8d91613bc83f7d6300e0203a1c7dda1dc28fe2bd2266f7b

SHA512
5e8adbeac1ee6ce78f990b07f82ece85f270166991124af36f27e6ec7962c1cf02a98de8f4cf3b21462c2a9680e418947f42204457942fc314116bc8e24a63d7

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_mr.dll

Filesize
44KB

MD5
f7ce1d1130f8f9752b95bc1b05913385

SHA1
7f3734c7569ad96bb37ed6194f7ff30b30c607d4

SHA256
907adf05f6bbe26470bfbefa47b50d804fb786dd750ce53c2287423d22eeba0f

SHA512
fc53e8a1f5f1843860a092f8f8b8d99b786d2f479fdc674000c0c8f8ada40485f1829320b60863ee6586e20b2a09f6d790fc77c428e6e4aa34a91c71a25d58e5

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_ms.dll

Filesize
42KB

MD5
6942a314b45262a5ff1cd44b583397be

SHA1
b414898cac368f99d94392fa719e8b755be292e5

SHA256
211c235db5eeb1285d7aeecccda1eae5b9548de4a8943b3b296260165a616a38

SHA512
de277ca55fcfb8c72336fa09e98df22bbd2b7400d4327dfd59f73aea240184e30dd9daa2295ee1c1418a39c1036ed752b6f9a8bd4559579a219ccae657e105db

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_nl.dll

Filesize
44KB

MD5
8525224a91c6a2f629db261ddbfbc286

SHA1
67518c812ef4a8b2bcf12d25b8fd6bc1b18b4872

SHA256
ae5f51786484b02a133b05fc68d7a804b4a9246f7bd53ab5cd79a5e8ea5e02fe

SHA512
6c512d269937019f4c8d94d36619571fe14ec560841e4f8ea5d492c21d884d95109f4a4e7a66d0d3e094d8f6781f39f62e4d27282e0beefb910d49ff2a9f4139

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_no.dll

Filesize
43KB

MD5
a95352e72502961c5f7bdcbfe4a69551

SHA1
e515f94853bf011689b5c1b6f36924ca312ff099

SHA256
c4380ee11a274085aa496454d005470810531ce0055ae742b1ff0e23186aea90

SHA512
0d78b56120bbd1ed1eeb8f3206ed8bb7778f8d2c62f67b0d88e163884b2cf5bfcc2e502cc698ba597ad8a84305e9ac1db8b9b78455b19d7a9583638ff624ebe6

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_pl.dll

Filesize
43KB

MD5
fa40196b6861837f55e428ce83bb3634

SHA1
39e62e20d87346f77e45a1b193f4b1b7f31b127f

SHA256
5e7884cceaadecb4635bfe32efbcb79bf6592c2ef4b5015d5a40854a9d137e49

SHA512
a999fd22b91943970859fee2141ac0c2a185e82104a4980bd29d74326089bf0ca65bdcefe7b344bd6ca1b733f37e395f3171ab2bd4b5137d8521ff7eb5421969

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_pt-BR.dll

Filesize
43KB

MD5
37fef520ec91a3f9311dc6e23a8ab9bb

SHA1
3838c3ea89598ceb20ec67895250a1a4528dcab9

SHA256
900c30ff375dc10b250ab32266b0154393581e0ee428fef80d83cdcf60ee91a3

SHA512
2ca2a88dbcf319e8fd0c8b45cbdb639b650a13001d4f3ea6dc16f516099abe3ea81fc5302f53f129e7fbb359bc3901dd2dba012ac4d6e9ace3e6942ca8e42495

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_pt-PT.dll

Filesize
43KB

MD5
262734cf3e4efa687a737c0955a766b8

SHA1
415fad5ad780798852e31d72e04834a007a421db

SHA256
7d5aa88074903adaa4b8cc4788269b616d591080f73aee63603ee0c0ebac60e2

SHA512
3a168fb720c149c021b6aed69ed019571b37ffe642aae450c2a4daa48105d8a1727f9016aa7d30c417740abe09585ab57ff2a70a0ff197f88262be6ef8e55dec

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_ro.dll

Filesize
43KB

MD5
6a652a2781d2d7fda7792d7fbf8c90db

SHA1
92d12c87e2a1919bfb0021c61f2b2f84298ba1d0

SHA256
070e59922583b36807f907e6cd579ea089e2b0b44321ea3fd25827234b12fe9b

SHA512
048ec65c970a9bc508581a925fa3b4d64919c75770dc4d39762024fa1cd1fcabfca4bd68951b2d2ab38885b8f5ff29e3408dcd55deb7523ff2283818aad79f5f

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_ru.dll

Filesize
42KB

MD5
76aa3153f078bb5c4951911a3601a2b4

SHA1
e3f8a01ef1ed42a2e250cbec08ab9a5ee97e59dd

SHA256
04028a3875bd25f62ee9c003a72ac56b148a0317447442398d94f8c3d7334c39

SHA512
aa7d744fa4a1fe5be14ddc3de90d748ef03a77c7ddc3a518a98096ddc6ca96c95310e5a7d21476d475ae6fbc40abb5f4a4ce2393acdd9be443c44d68979c7c74

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_sk.dll

Filesize
43KB

MD5
352d9b2b10353a6108035d42bf397c65

SHA1
37f0468b9650daba7ad8d8194c2e5d9ebc4f105a

SHA256
c236a03f43539943e8766d871b98ff7a696fcd4baa2a6db33b1e6fa80aafa9ed

SHA512
f95d23849236e1c77804698781e0a654eeb0ccb618edc3c5b2f8026355a8ba16535d5f7b6cf323aea7d4deca7296095945c29bc3954a63cea2d1fed609a9a331

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_sl.dll

Filesize
43KB

MD5
e1bc06bf23d731b666e5f42b787b2b98

SHA1
5dedcfc1f7d79d6b6d1e20d43c27281eef267cea

SHA256
ae8f83502ce30b31cf462003c6eea63635d865d747d3c3c0d29fa1f603584f21

SHA512
e84c8866b014a55e72e6fa9a17a08ae2063d253962a5c608c0737f5672e3df84c5f37c53d7246d17d847d4192fe988425fdfa4855f594d9a73565f7e1fa05544

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_sr.dll

Filesize
43KB

MD5
301101a45a861cc17c9713ee0315a2cc

SHA1
9c153142ccb9d8f2797ec98435686315f91af6bc

SHA256
8559a01db09ecf7ad9ab1059123af7471685a3d36387bcbf9874dee030011be0

SHA512
d00fccfa7afb6cac94b744a855f8bc28837bedcbafb164383e2d47a2a19e4281ad295e910f37ee24c7091cefebe10e60ac5e69722f718d1540bb074beca9ce3d

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCBAD.tmp\goopdateres_sv.dll

Filesize
43KB

MD5
157e114596bca18c385c31630d6bf897

SHA1
b68d289a1aaf43d32e024167f1982a1182fd5d64

SHA256
93ef6771b4e97c531e3c836765af22750fdbd049dbec71eee1dfd0b30ccd9bf0

SHA512
ed6fb2032194bd9fca19311a3f84b581fb0866d16dacc5045c16a7eea83b63bb0f116a5d4d2bfbdbbccc17a51eaf6ccc366f6809f9dc0428d8b4cd189b7dd22e

Download Submit
C:\Program Files (x86)\Google\Update\Download\{47B07D71-505D-4665-AFD4-4972A30C6530}\24.1.1787.4\HPE-24.1.1787.4-CIP.exe

Filesize
4.3MB

MD5
14375a9fc59214ec65b147366579705b

SHA1
80101fc08d0cd75a9a847d18ff6cab9d0086f2bf

SHA256
4f995f90e8f6a00a8bf58470d4ded755533f71ad7811232868ad8a2bbb5ae352

SHA512
72efbc4ca93fbd47e991a10fbddbcb3b966c1b0b2cb8c2ee463b7fc9ec94a283ca1bac673db672dc0214693fae659fb35cf5133428729ae0dd06c24837526a1f

Download Submit
C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad\settings.dat

Filesize
40B

MD5
7c20ecd89ad9721d25eb89d49854978a

SHA1
90c16f5d520e7ec86728a09b320a3e117c2c09fa

SHA256
0ef9bfa092dd5d04f33011f02d7034036d4a1bdf6dd08a29b900a4c03e0ad2a9

SHA512
b9bfeb6421e91fee7ebfb887807c6b255dd20272eb45ffbf29611ed9d9b49c151dbaccc603842d59b6f5ef9e6229d293a37e92a24798ce62dd5929bcaf052dae

Download Submit
C:\Users\Admin\AppData\Local\Google\Play Games\InstallerCrashReporting.log

Filesize
1KB

MD5
bae5434796f9087af7e5b351b00df913

SHA1
4de8401f80180e76df0a44a2efab4d4f646f648d

SHA256
ba609d2438a7573c0d8117b6aace017e94164f4d170744da0c217f351960aac1

SHA512
3a7de813cdbe8002b61b9650452144767b70966a54a528e3ea411d603a4f2c9b6686d38110acca6c37a2e89b7f79cda9f8cc0af003baaac08a5c977622346e69

Download Submit
C:\Users\Admin\AppData\Local\Temp\nuxv0tyt.ovm\CrashReporting.dll

Filesize
961KB

MD5
7b3f74266ca7cc7329eac63f8368db65

SHA1
db49159afcdf3676d6a6bc791f8f7c26ceeeb145

SHA256
9335fe5ed02defb1395ab3e02926edbf90205c40d2e8bfb6247df102307ba557

SHA512
930c4f1eeba8b1daf62ea3a29458dbcdd58c30c924d4e5ed5dc16073fafa7a8e2887c2e9627f970d197f848637f58b8cca6bd298a066e78c5d8eab7e0995bbb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nuxv0tyt.ovm\GoogleUpdateSetup.exe

Filesize
1.3MB

MD5
6350a2dda4b9651cd3820cead9c1d0ad

SHA1
81ee28f9992861f1fca795c6c15ece91c353b58e

SHA256
69110434f3990b28394ab382c7ec3eb23ce9aabbe441053909bc2f4b16e8d614

SHA512
5094919c83ced46023eaa5c6dd1b2453dba5d257f41d37bbb58be7c1cb1544140cbe094508df73b11015139ed58c56157717815ebdbae96ef3bcb59ae157566f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nuxv0tyt.ovm\crashpad_handler.exe

Filesize
1.1MB

MD5
168e890d04cfee8b8420c90d1d229364

SHA1
442f93cb1272b93cc3073f8eeb0732a3c60bc5c9

SHA256
f37ed95b97a9c6d6d48c2675defaa53e68b487d271e78294d1af3a431ac25b91

SHA512
29d4d3d3a880c70c8c44ea1496f09f4ca1bcbe071dd81e8c700a53d070d8240d0d819a9fe356f175554075a089f6945d7f6390fb1dcf4a152c064a71df3fa48a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nuxv0tyt.ovm\recorder_delegate_lib.dll

Filesize
4.5MB

MD5
28f06bc35021d85a98539a035b2c9a71

SHA1
8d36ecb2b9e5270c1c5ac81bcd9bf858e9f61a8c

SHA256
231014af8dbc27ac20b222a00a2c3dfda4e0aa111fb710d7315b5b19e47a2f57

SHA512
cfec5eadc5cca9bc48006a80bca181ecf7949a2b9582ff5ca3ea577ec5892a10a8d4897fbc3e6eeb5b4a1b2de3d42d703cd2dae4c982668f93968e2de2e8599e

Download Submit
memory/840-320-0x000002427EB30000-0x000002427EBA6000-memory.dmp

Filesize
472KB

Download
memory/840-323-0x000002427EAF0000-0x000002427EB0E000-memory.dmp

Filesize
120KB

Download
memory/840-346-0x00007FFDDD6F0000-0x00007FFDDE1B1000-memory.dmp

Filesize
10.8MB

Download
memory/840-347-0x000002427D9A0000-0x000002427D9B0000-memory.dmp

Filesize
64KB

Download
memory/840-41-0x00007FFDDD6F0000-0x00007FFDDE1B1000-memory.dmp

Filesize
10.8MB

Download
memory/840-42-0x000002427D9A0000-0x000002427D9B0000-memory.dmp

Filesize
64KB

Download
memory/3492-4-0x0000024D41C60000-0x0000024D41C6A000-memory.dmp

Filesize
40KB

Download
memory/3492-32-0x0000024D5D880000-0x0000024D5D88E000-memory.dmp

Filesize
56KB

Download
memory/3492-10-0x0000024D5CF00000-0x0000024D5CF78000-memory.dmp

Filesize
480KB

Download
memory/3492-9-0x0000024D43570000-0x0000024D43594000-memory.dmp

Filesize
144KB

Download
memory/3492-8-0x0000024D41CA0000-0x0000024D41CAE000-memory.dmp

Filesize
56KB

Download
memory/3492-7-0x0000024D5BF90000-0x0000024D5C09E000-memory.dmp

Filesize
1.1MB

Download
memory/3492-6-0x0000024D41C80000-0x0000024D41CA2000-memory.dmp

Filesize
136KB

Download
memory/3492-5-0x0000024D41C70000-0x0000024D41C7A000-memory.dmp

Filesize
40KB

Download
memory/3492-12-0x0000024D435A0000-0x0000024D435A8000-memory.dmp

Filesize
32KB

Download
memory/3492-3-0x0000024D5BD90000-0x0000024D5BDA0000-memory.dmp

Filesize
64KB

Download
memory/3492-13-0x0000024D5D220000-0x0000024D5D2DA000-memory.dmp

Filesize
744KB

Download
memory/3492-0-0x0000024D41600000-0x0000024D418B0000-memory.dmp

Filesize
2.7MB

Download
memory/3492-2-0x00007FFDDD6F0000-0x00007FFDDE1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3492-1-0x0000024D5BDA0000-0x0000024D5BE56000-memory.dmp

Filesize
728KB

Download
memory/3492-18-0x0000024D5D1A0000-0x0000024D5D1A8000-memory.dmp

Filesize
32KB

Download
memory/3492-29-0x0000024D5BD90000-0x0000024D5BDA0000-memory.dmp

Filesize
64KB

Download
memory/3492-28-0x0000024D5D1C0000-0x0000024D5D1C8000-memory.dmp

Filesize
32KB

Download
memory/3492-30-0x0000024D5BD90000-0x0000024D5BDA0000-memory.dmp

Filesize
64KB

Download
memory/3492-31-0x0000024D5D8C0000-0x0000024D5D8F8000-memory.dmp

Filesize
224KB

Download
memory/3492-11-0x0000024D5CF80000-0x0000024D5D008000-memory.dmp

Filesize
544KB

Download
memory/3492-33-0x0000024D5BD90000-0x0000024D5BDA0000-memory.dmp

Filesize
64KB

Download
memory/3492-34-0x0000024D614E0000-0x0000024D61506000-memory.dmp

Filesize
152KB

Download
memory/3492-322-0x0000024D5BD90000-0x0000024D5BDA0000-memory.dmp

Filesize
64KB

Download
memory/3492-37-0x0000024D62F50000-0x0000024D630D6000-memory.dmp

Filesize
1.5MB

Download
memory/3492-328-0x0000024D5BD90000-0x0000024D5BDA0000-memory.dmp

Filesize
64KB

Download
memory/3492-330-0x0000024D5BD90000-0x0000024D5BDA0000-memory.dmp

Filesize
64KB

Download
memory/3492-331-0x0000024D5BD90000-0x0000024D5BDA0000-memory.dmp

Filesize
64KB

Download
memory/3492-38-0x0000024D62DE0000-0x0000024D62DE6000-memory.dmp

Filesize
24KB

Download
memory/3492-39-0x0000024D62480000-0x0000024D62486000-memory.dmp

Filesize
24KB

Download
memory/3492-40-0x00007FFDDD6F0000-0x00007FFDDE1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4612-359-0x00000273D5D90000-0x00000273D5EBC000-memory.dmp

Filesize
1.2MB

Download
memory/4612-360-0x00007FFDDD6F0000-0x00007FFDDE1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4612-361-0x000002739A1E0000-0x000002739A1F0000-memory.dmp

Filesize
64KB

Download
memory/4612-362-0x0000027381860000-0x0000027381878000-memory.dmp

Filesize
96KB

Download
memory/4612-363-0x000002739B070000-0x000002739B092000-memory.dmp

Filesize
136KB

Download
memory/4612-364-0x000002739B0E0000-0x000002739B0E6000-memory.dmp

Filesize
24KB

Download
memory/4612-367-0x000002739A1E0000-0x000002739A1F0000-memory.dmp

Filesize
64KB

Download
memory/4612-366-0x000002739A1E0000-0x000002739A1F0000-memory.dmp

Filesize
64KB

Download
memory/4612-365-0x00000273D6230000-0x00000273D6262000-memory.dmp

Filesize
200KB

Download