neshta | aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9

Analysis

max time kernel
93s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
Size

946KB
MD5

2323b76488560e7d4b6a5ba606b0be38
SHA1

73344b3d99b0f2b9201bac612e60231b06358e16
SHA256

aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9
SHA512

841f87fbc6c9c742c8f80134e4cc0a8f784301017e98bef23c60ebc16a717e0a5998308071e1a180a3ccb55042ab03cff016c211de4510ba7753596977f86452
SSDEEP

24576:X4iax8jaE1O4x2h6MIc3IMoqUYE+QYL+uZtUz+y:XQWjaE44w6MIc3I87L+uZtHy

Score

10^/10

neshta discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detect Neshta payload 11 IoCs

resource	yara_rule
behavioral2/memory/4468-317-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/files/0x000700000002027e-320.dat	family_neshta
behavioral2/memory/1496-429-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5028-430-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1496-431-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5028-432-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1496-433-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5028-434-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1496-435-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5028-438-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1496-439-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	GoogleUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
4688	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
5012	GoogleUpdate.exe
5072	GoogleUpdate.exe
4336	GoogleUpdate.exe
1928	GoogleUpdateComRegisterShell64.exe
4384	GoogleUpdateComRegisterShell64.exe
2864	GoogleUpdateComRegisterShell64.exe
5028	svchost.com
1588	GOOGLE~1.EXE
4468	svchost.com
2792	GOOGLE~1.EXE

Loads dropped DLL 10 IoCs

pid	Process
5012	GoogleUpdate.exe
5072	GoogleUpdate.exe
4336	GoogleUpdate.exe
1928	GoogleUpdateComRegisterShell64.exe
4336	GoogleUpdate.exe
4384	GoogleUpdateComRegisterShell64.exe
4336	GoogleUpdate.exe
2864	GoogleUpdateComRegisterShell64.exe
4336	GoogleUpdate.exe
5012	GoogleUpdate.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GUM83C6.tmp\goopdateres_hr.dll	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_id.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_sk.dll	GoogleUpdate.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\GUM83C6.tmp\goopdateres_te.dll	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_da.dll	GoogleUpdate.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\GUM83C6.tmp\psuser_64.dll	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\GUM83C6.tmp\goopdateres_pt-PT.dll	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_am.dll	GoogleUpdate.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\GUM83C6.tmp\GoogleUpdateHelper.msi	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_ja.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdate.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_lt.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_ms.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateBroker.exe	GoogleUpdate.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\GUM83C6.tmp\goopdateres_hi.dll	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\psuser_64.dll	GoogleUpdate.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1329~1.1\GOFB2B~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	svchost.com
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_es-419.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_zh-TW.dll	GoogleUpdate.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	svchost.com
File created	C:\Program Files (x86)\GUM83C6.tmp\goopdateres_id.dll	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	svchost.com
File created	C:\Program Files (x86)\GUM83C6.tmp\goopdateres_ja.dll	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_bg.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\psuser.dll	GoogleUpdate.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	svchost.com
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_kn.dll	GoogleUpdate.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE	svchost.com
File created	C:\Program Files (x86)\GUM83C6.tmp\goopdateres_ca.dll	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\GUM83C6.tmp\goopdateres_kn.dll	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_sv.dll	GoogleUpdate.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE	svchost.com
File created	C:\Program Files (x86)\GUM83C6.tmp\goopdateres_fi.dll	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_iw.dll	GoogleUpdate.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	svchost.com
File created	C:\Program Files (x86)\GUM83C6.tmp\GoogleCrashHandler64.exe	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\GUM83C6.tmp\goopdateres_sk.dll	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_pl.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.29.1\goopdateres_uk.dll	GoogleUpdate.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Program Files (x86)\GUM83C6.tmp\goopdateres_sl.dll	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
File created	C:\Windows\Tasks\GoogleUpdateTaskMachineCore{FBEB78CB-6F61-47CC-9707-02D962432F31}.job	GoogleUpdate.exe
File created	C:\Windows\Tasks\GoogleUpdateTaskMachineUA{2BC1281D-775D-4442-B7DE-A0FD2C328B60}.job	GoogleUpdate.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOOGLE~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOOGLE~1.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5028	svchost.com
1588	GOOGLE~1.EXE

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\AppName = "GoogleUpdateBroker.exe"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\AppPath = "C:\\Program Files (x86)\\Google\\Update\\1.3.29.1"	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\Policy = "3"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\CLSID = "{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\Policy = "3"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\Policy = "3"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\AppName = "GoogleUpdateWebPlugin.exe"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\AppPath = "C:\\Program Files (x86)\\Google\\Update\\1.3.29.1"	GoogleUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62B032B7-F027-4274-BFB1-A0418EB9D0D9}\InprocHandler32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.29.1\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ = "ICoCreateAsyncStatus"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\LOCALSERVER32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods\ = "8"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods\ = "6"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ = "IAppBundle"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ = "IAppVersion"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ = "ICredentialDialog"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods\ = "10"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\ProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ = "ICoCreateAsync"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods\ = "11"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreMachineClass\CLSID\ = "{9B2340A0-4068-43D6-B404-32E27217859D}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods\ = "43"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods\ = "4"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebMachine.1.0\CLSID\ = "{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\Elevation\IconReference = "@C:\\Program Files (x86)\\Google\\Update\\1.3.29.1\\goopdate.dll,-1004"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc\CLSID\ = "{534F5323-3569-4F42-919D-1E1CF93E5BF6}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\ProgID\ = "GoogleUpdate.CoreMachineClass.1"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\ = "GoogleUpdate Update3Web"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ = "IApp2"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-vnd.google.oneclickctrl.9\CLSID = "{C442AC41-9200-4770-8CC0-7CDB4F245C55}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods\ = "8"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62B032B7-F027-4274-BFB1-A0418EB9D0D9}\InprocHandler32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods\ = "11"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Google.OneClickProcessLauncherMachine\CLSID\ = "{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\ = "{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\ = "GoogleUpdate CredentialDialog"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6F571E3-B4D3-45BA-B8AF-2953CFF41189}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.29.1\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\ = "Google Update Plugin"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5012	GoogleUpdate.exe
5012	GoogleUpdate.exe
5012	GoogleUpdate.exe
5012	GoogleUpdate.exe
5012	GoogleUpdate.exe
5012	GoogleUpdate.exe
5012	GoogleUpdate.exe
5012	GoogleUpdate.exe
5012	GoogleUpdate.exe
5012	GoogleUpdate.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5012	GoogleUpdate.exe
Token: SeDebugPrivilege	5012	GoogleUpdate.exe
Token: SeDebugPrivilege	5012	GoogleUpdate.exe
Token: SeDebugPrivilege	5012	GoogleUpdate.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4688	1496	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe	85
PID 1496 wrote to memory of 4688	1496	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe	85
PID 1496 wrote to memory of 4688	1496	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe	85
PID 4688 wrote to memory of 5012	4688	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe	86
PID 4688 wrote to memory of 5012	4688	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe	86
PID 4688 wrote to memory of 5012	4688	JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe	86
PID 5012 wrote to memory of 5072	5012	GoogleUpdate.exe	87
PID 5012 wrote to memory of 5072	5012	GoogleUpdate.exe	87
PID 5012 wrote to memory of 5072	5012	GoogleUpdate.exe	87
PID 5012 wrote to memory of 4336	5012	GoogleUpdate.exe	88
PID 5012 wrote to memory of 4336	5012	GoogleUpdate.exe	88
PID 5012 wrote to memory of 4336	5012	GoogleUpdate.exe	88
PID 4336 wrote to memory of 1928	4336	GoogleUpdate.exe	89
PID 4336 wrote to memory of 1928	4336	GoogleUpdate.exe	89
PID 4336 wrote to memory of 4384	4336	GoogleUpdate.exe	90
PID 4336 wrote to memory of 4384	4336	GoogleUpdate.exe	90
PID 4336 wrote to memory of 2864	4336	GoogleUpdate.exe	91
PID 4336 wrote to memory of 2864	4336	GoogleUpdate.exe	91
PID 5012 wrote to memory of 5028	5012	GoogleUpdate.exe	92
PID 5012 wrote to memory of 5028	5012	GoogleUpdate.exe	92
PID 5012 wrote to memory of 5028	5012	GoogleUpdate.exe	92
PID 5028 wrote to memory of 1588	5028	svchost.com	93
PID 5028 wrote to memory of 1588	5028	svchost.com	93
PID 5028 wrote to memory of 1588	5028	svchost.com	93
PID 5012 wrote to memory of 4468	5012	GoogleUpdate.exe	94
PID 5012 wrote to memory of 4468	5012	GoogleUpdate.exe	94
PID 5012 wrote to memory of 4468	5012	GoogleUpdate.exe	94
PID 4468 wrote to memory of 2792	4468	svchost.com	95
PID 4468 wrote to memory of 2792	4468	svchost.com	95
PID 4468 wrote to memory of 2792	4468	svchost.com	95

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Program Files (x86)\GUM83C6.tmp\GoogleUpdate.exe
    "C:\Program Files (x86)\GUM83C6.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={0C0E86EB-12AA-2C54-EF22-241318EC4CE5}&lang=ko&browser=2&usagestats=0&appname=Google%20Chrome&needsadmin=prefers"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5072
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4336
    - - C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1928
    - - C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4384
    - - C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2864
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\PROGRA~2\Google\Update\GOOGLE~1.EXE" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjkuMSIgc2hlbGxfdmVyc2lvbj0iMS4zLjI5LjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Mzc2N0VBRjgtNkZGRC00MUEzLTgzOEUtOUZDOEY4MDUxNTk5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezI1ODU3NDEwLURBMUQtNEQzNi04MEE5LTY1ODNDRDE0NzRFM30iIGRlZHVwPSJjciI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzYuMzcxIiBuZXh0dmVyc2lvbj0iMS4zLjI5LjEiIGxhbmc9ImtvIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7MEMwRTg2RUItMTJBQS0yQzU0LUVGMjItMjQxMzE4RUM0Q0U1fSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI4MjkiLz48L2FwcD48L3JlcXVlc3Q-
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\PROGRA~2\Google\Update\GOOGLE~1.EXE
        
        C:\PROGRA~2\Google\Update\GOOGLE~1.EXE /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjkuMSIgc2hlbGxfdmVyc2lvbj0iMS4zLjI5LjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Mzc2N0VBRjgtNkZGRC00MUEzLTgzOEUtOUZDOEY4MDUxNTk5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezI1ODU3NDEwLURBMUQtNEQzNi04MEE5LTY1ODNDRDE0NzRFM30iIGRlZHVwPSJjciI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzYuMzcxIiBuZXh0dmVyc2lvbj0iMS4zLjI5LjEiIGxhbmc9ImtvIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7MEMwRTg2RUItMTJBQS0yQzU0LUVGMjItMjQxMzE4RUM0Q0U1fSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI4MjkiLz48L2FwcD48L3JlcXVlc3Q-
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1588
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\PROGRA~2\Google\Update\GOOGLE~1.EXE" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={0C0E86EB-12AA-2C54-EF22-241318EC4CE5}&lang=ko&browser=2&usagestats=0&appname=Google%20Chrome&needsadmin=prefers" /installsource taggedmi /sessionid "{3767EAF8-6FFD-41A3-838E-9FC8F8051599}"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\PROGRA~2\Google\Update\GOOGLE~1.EXE
        
        C:\PROGRA~2\Google\Update\GOOGLE~1.EXE /handoff appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={0C0E86EB-12AA-2C54-EF22-241318EC4CE5}&lang=ko&browser=2&usagestats=0&appname=Google%20Chrome&needsadmin=prefers /installsource taggedmi /sessionid {3767EAF8-6FFD-41A3-838E-9FC8F8051599}
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe

Filesize
9.4MB

MD5
322302633e36360a24252f6291cdfc91

SHA1
238ed62353776c646957efefc0174c545c2afa3d

SHA256
31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c

SHA512
5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\GoogleCrashHandler.exe

Filesize
239KB

MD5
7dc16faea44c8d96a1c113305a4059a2

SHA1
c2ec609d2cbeec9c4f15d5497b221a9a5bb4535f

SHA256
9feda3752a98aec53b8e1aa8ca7416e84fe01954b2b40404fa925b7e099d733e

SHA512
e32529445acc1825db8e8c5824487c9dab30581fc13e4ce4a54fce4230c29b6b0b922b6eebe1e6bb141964a5d89e179eeebedf35396d7a430b4d7b7823c78447

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\GoogleCrashHandler64.exe

Filesize
299KB

MD5
73f542663fd48b49a798a56daa18c136

SHA1
017dfabde52be0b33089e38c40ed20e59d3b0373

SHA256
0fb06831bc0b8d32d1c41648bb3318df5fed8ff839ed0222b62937d0d3eb1874

SHA512
01a08765103186ff259555de466827f7b649a4a6bb556d8d67341634b01346c4b316f78fd1ea4fd4836cbed2b21bbe79e077ba62d4a0e9a60f2e4bc3f5fbba8e

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\GoogleUpdate.exe

Filesize
140KB

MD5
88fbbb1c601a6bc42054e57c2897fa45

SHA1
e025a9721b37725e6dc6e069a9335239437b3e7c

SHA256
928c5bab515035de659c4255c209d33c407716da325798951b2e8da9bb230a9f

SHA512
f8858437408fc162b9330c6e04f2ff1b8237e1894d8972b2b2a87573edf04e86aaf49eeffaa4a816289e8a00c0b8befc7d4dd6203bbadda4b9465966e8eadc09

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\GoogleUpdateComRegisterShell64.exe

Filesize
127KB

MD5
5424fdf3776f5458eafaabfb87aa9285

SHA1
5f7a8c5ff1582257d356a404cd6f12c4a6a82aa9

SHA256
bffe720c49c36535b99fee62567118219a304273994fdd3c281dbf504bee6d34

SHA512
cf175d397d18d0c05e7639c99ac4cc4a3ae83dd091f442ba4ccde74d7f0947510b7fb6e09d03cd6ee2d2ac921acee8f7c5508cca7a38193649f457e319dd3663

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdate.dll

Filesize
1.6MB

MD5
56a9edf0ecef72b4eb446d46808c4bac

SHA1
987b9b497503360f764c306ec6540304716fa48e

SHA256
fd138050b4939a5cab11d160829b80dbbe30f8d8999f8d602b0fdb8c3bac1c78

SHA512
37ce8a64e556f2fb7923c30ef62cdedee3d1954d4a02f7b3102d1c3056afd70f7970aca582ef1b13b499c1b609933d434fcad7502f22ef9064d8799afc2f6a27

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_am.dll

Filesize
37KB

MD5
949cbdd7a39f11c0472089cbde74fecf

SHA1
7a7d4c720099f05ea273fadff162c6407a792b29

SHA256
9c0d513acbcb9ee61e4e388d4a3c158b0a2b2cea9f9cc7851d842ff16483489e

SHA512
30cc095b1886dcea0a04cd308887790f8f8d395e2d7b3a80fd77808e086899197c3ad9a750a8a532401ebf96576f8af37e884203e01fe83b2cd55081da2d2b95

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_ar.dll

Filesize
36KB

MD5
d7fe95e5b8b682b89108c4f1e6231ebb

SHA1
e344291e0ad682ec309c40dd06ab209dc6cf6706

SHA256
3180750de22f2606d51700a53bb5b88c321037103dfb7d88e3ce10e58d79a33f

SHA512
5b57646f7559dd49cd948dacdaa4e35cf410bb68fcb07e0842f5407b50e06bc29d2832aca79970e3b29b3ab83573da5a8b2a14e5bebcc15e019cf0fed788935c

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_bg.dll

Filesize
39KB

MD5
e8da477e6457882058c71182088c92b9

SHA1
c9b427de5e66ec7952e9f815ae9f7a325b43d7e3

SHA256
6e38ee9f780303620bef28a23704651223d2bc158d212a7e3f66f70f0b8ce44c

SHA512
04792dd737e29d092d80b4ae2d0698f307a44507248f967ecdbd7e19470f367267655d4aa6b560573508e8484098420a096d9cd8069ef27b7414a3ec284366cd

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_bn.dll

Filesize
39KB

MD5
cf80cbd346d07fab17e587223be09be0

SHA1
f6868a10a7a79b63e22df7a0ff0be893aea921a2

SHA256
c7d626ca0a2bf3c97a107676b3508e051ffd74ea149290d28a39f27b0880f1ba

SHA512
5f0a12520048a0bafb07867d5f2ea056856565f7a67d004e5a049a49046a559484d1f2724570defd6f57122b985afdbc49830b9ca5e7e9ebe5c4a59f9fbbadf8

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_ca.dll

Filesize
39KB

MD5
48a5e78a7b7e760f1c450cfe98068f7f

SHA1
8ed89dc3d3121d4b12521b1e387d7caf572dda17

SHA256
795fc0cfe8e44e75ac054abc089a8e7865a0a106ccf84551eff547f2447352e4

SHA512
8eabeb943ec167c3f176ce4ad672b37d9c93db851fbf4a2ccb5f33a909b64dc2347c3bc15d02106216dc4efe595e5cfe4400d9de3949e409155ad8ea257d637c

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_cs.dll

Filesize
38KB

MD5
1cc0144a40ebb98a6a56e46c113b5942

SHA1
ed4d434a4fb8945b132e4b29078a29cc93e58dee

SHA256
a7835f9c8bf94a5bd42c0928847e41c79e740fe35b4c2d1fdf5236fef64a99dc

SHA512
1e63c55a8efc37583bc82a777a575c0961bc906d0829697e7685b3ed5950c0ed784c5a38c19167d9b8a2a84bb93f176d4cc9bf6f2ccdc2c639569ce2e673b0ba

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_da.dll

Filesize
38KB

MD5
794b9152881d5adaabc433d078c18995

SHA1
d56200d8635bd62f717820efc28ad36106c9e09c

SHA256
f9692696d0e452a753ba157af10ef9eb70d55ec2880229d0a6ec59cc58c543aa

SHA512
7c15cb35a3b54b1d50ceff5602e3c1a5b3a81bd46dfbac6624e93c59461481214a22dc41c322e84dd59ae88a6b1dbbd785de64fcada0cf1b79a7562df15effc4

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_de.dll

Filesize
40KB

MD5
13f431929b2d1fa8772ebe3b77e0a95a

SHA1
d80ea155362ce810c096bf7e62c3e938e1736eb0

SHA256
3994380cfe6a5b2e4e299f3516226040f4b6b9392faa36efa83a020df2288c54

SHA512
fa862b4fe7412c8c73435aba46371bcf76b0169611cf295ebaddf3030c85f7e603cbe8413004c98edbca41fbb5805c2137d23b649785e9b24885b12950813e39

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_el.dll

Filesize
39KB

MD5
c8224a92933be8a7c6f45a32fe69b24d

SHA1
15ceb922f9bf4605952a3e13b8b12c0ad0baa65f

SHA256
0dbac07b603c1a14b04beb0bf0868df99ec2de47a3494655a057fd98d4b54058

SHA512
27a65d0f079bf483d0e7fa7879cc730fcd5f62b67f89936c21badbb9c64e881496411e4a61fdd8aef8fe97dbc02590045033ec8ee3fd15058d90ad21a4f79379

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_en-GB.dll

Filesize
37KB

MD5
6f6a8775f89f24ef22300c8181da78b8

SHA1
bf7e9bbb85f72e566e3118ff469757d658125e42

SHA256
adc3226e2893d7855a575dc84cc87f180dab45a35e83e82944c0cba0756d4705

SHA512
a73cd8deba133faa736204476461af657fc733433398e6b6744e6e06d38a8183be22768ab3842d90b8858f1c8aa5cdee212f1aefdf55e05f9709d61d3801c584

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_en.dll

Filesize
37KB

MD5
a96f428b9219faf6698c914d7a465d15

SHA1
cac29ba25e9c614b06f642526588c892d54290b9

SHA256
11e531a22bc5cad48a7e1d63b8ec15830c598d30f38c2dc992d362f555aa0b37

SHA512
3967154759d845aa6a3bba7dfec29553790f080fc07ab79a83b4b6ac3e0dbc3ca50fa6d83079832d095ccca586577f9656651e97955cd40b2bd0146ae202d3f9

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_es-419.dll

Filesize
38KB

MD5
1e22b3094af9a935c60c49535686a6ba

SHA1
258b7d36760873074a904179dcffb7cab8b195bb

SHA256
610d9a4567af3da0e9ab12eddb2f5446c66528158aba22d892cc9f0f39c3e851

SHA512
3987332c3b08d8147d1c7d87843704812a111d080e8e8c062a363c40f421bc5dd07b4338dc62bba725f523d978c5e7b3c13db4723c7e25a13efb8caa92c71748

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_es.dll

Filesize
40KB

MD5
575eca90e1d4c16ccc15492c6f0b1679

SHA1
76b0d669aa8881c85daad740d885eb7a6f00d29b

SHA256
d7db60c5d5a3dbb4deb8faa3f769f7e735f5f7f47ca08f4813f4fc7b7d78859d

SHA512
ca7c72854872dc3b12f4cdc66df86c1df9fabd469276fe8a61159a56b44f2500417499dd3b03430d44fc015fec4eb18cfc2881eaa4558cfc6f5c974dfb749087

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_et.dll

Filesize
37KB

MD5
a6d480ba1bd4cf7ac0c0b0f56a3ff0ff

SHA1
aa97867cd16a21e0ecd20779235d7d2c87f6ae3a

SHA256
e41acbc8ea404e0374d7df0d855e467bfad8f9abd7d33df16168860bd807a337

SHA512
126b74d70f23ff462d194466a64bdffcb86d2511445420ac27b8aebd339aeeb8741f36d6bcbbd7e209fee875175360dd7e195091f5a79cf284b549dda9c6f4da

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_fa.dll

Filesize
37KB

MD5
7723919eb0bd3ef37d753ce50fa58a41

SHA1
a456d7de5448b389591c4ec7aafafebcf515d21a

SHA256
d9b9614ec7d25aecdcdc1de3fcf1a48c889dd0e43651eaeb0b5310466ea8d8d9

SHA512
176022e0a1fd3cfd9711ef958c0fec1d0f1400750e6fb132f2caa6537325bbf0e4c1468be8bb5b2c4b6f8e238c318dd5fb737fdd847be10cbfb7890e305f2dab

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_fi.dll

Filesize
38KB

MD5
136657ea12652d31bab3f5b9a264e81e

SHA1
73425e3323d0c19ea5074e0f2244e7afe6cef4e0

SHA256
4f1aaa0d73d6140b167f5be01fa779ca5c5126c56a64f97d2ff1df8e8d360830

SHA512
08b5d13508821ad382bc29b5e96afe79045f4c8f69a548e08859fa2ec543db4e6ffdc0e4d6d7e8b1bf59978487609603daba1f31052c83802d7dd60eb4561387

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_fil.dll

Filesize
39KB

MD5
1c857dd9b882d048e6bead17a34fe158

SHA1
faf2bc953a8d6aab5cdbce808b5ddaf279047de6

SHA256
3f36f76fe9ef6294f0f74c030e4246de5033156c347c78f560f6c01ffb3f80ba

SHA512
972acb2ebd65974cbe2356e0027ce89d3e2fdeb90b5c8d498e952166731d34f5c636f035c879832c46b049e0737b6de9ac52ede8fcd186b44aeeec816fbfc208

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_fr.dll

Filesize
39KB

MD5
271c77932ac715f1afaad0e62f589960

SHA1
5b4c47ac06238fe36871b04bc46c41164b8d3729

SHA256
6aeca6aeceb9ffdd4d336b3a6e6085574134c1dc43a6a4dea5e107f230a7b6c0

SHA512
16dc7df8fca7f70208eb038989d45b14d820e1c91c0270c374148a62d3a40aa02c7f3d62edb998fc9f7548d4b863d9a3af0d39306dc0e1ad732f6170e2bd5954

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_gu.dll

Filesize
39KB

MD5
2cc1d463aa06f6b5f52e3bd899d68487

SHA1
250912f5f8e42039753d23309b790f4897f306f7

SHA256
10b28942c2b1332ce332cefba426ada83f5edf0a742cc84e12062ec614200795

SHA512
041af21e6a7573b8dbc649817cdf1d44f2a6ebeb4c15f42442e7d86986baa394b1db56b7479210a9a91d7762079f0f0b1e470b63738ee97b681e864ac5e04bf6

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_hi.dll

Filesize
38KB

MD5
5693ceb953641059ebcbae48c2352136

SHA1
e272a5bea6a37dd049b045da7afea039b6595982

SHA256
2659f5944739b65af1ede517c3f7ea891b7108cb711f863916ff4e0ab95fa3cf

SHA512
61996c285a3543e370b87985154d93e042d9348c7a115193c8fde35689cbdcc89cf2e05dcbfef1d9ebf2d669b1421e8e424c73be51146d774c6d9fcc9ac88b16

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_hr.dll

Filesize
38KB

MD5
66ef2e938824dbb7235271f1078de85d

SHA1
6775dd3af801f9732cea6a0971c13e7d5d2b79c4

SHA256
0ee944d0f28efd972cb0f9c9f74f77f271f7fc6601fd4c26c47aadae22f55af9

SHA512
d96670fc1c150cf1a6f2ba056ead1e9d3be84e3f2f22cef998c1d89d7b598a282329f05e04e1bee9b1dc6831e0e277e5df72a25829dbc84770c126cc00a714ab

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_hu.dll

Filesize
38KB

MD5
de8ce5c14938e792583904af942957a6

SHA1
248735b31e418819f49ab6e6143e0421cb541e0e

SHA256
cf7ea4616c0133cea443ceb9ba18fe5be29496c2690a6d157048cbdfcc58c006

SHA512
00934dbec015fa66424473d086c77b8fed7474b95f596a26502a21944eedfeeb2ce3fedb0bdff39661513d215fcae6265b96ff4baec6e7c2321c68c2637865eb

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_id.dll

Filesize
37KB

MD5
7a28097be0a4c2a5c3f4adabf1e39a77

SHA1
2e3fbaf0ad99721a1a26edd434e02b7da3961afc

SHA256
2cfcd743e935763e6d4c6e38fa59c66156fa5509c481a682f46d213ee53e303d

SHA512
f09d9aff1235d448b9eac4fdbee97dfdc43c2fddc19219ef9cca464f8e99f3bb74e56eb0460a3e89c57c1e2904f6c96c5e976e196f6be28366b80131f3fb2437

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_is.dll

Filesize
38KB

MD5
64c26403ccab9824c347d471e39fdc26

SHA1
42f61b152d1370aa6a0f0a7ac878d4c8dccc5453

SHA256
519e0040b44b7ae7b25372ff3ca61b508378d98d2f2a324925cf9241d05c2cfd

SHA512
f527dfa5709e90faf87debb43b7bd62f43ac7a1d4adcad9de05c21abd7cd6eafe5d1aaebf408a341bf4681fb025ae2e899feba1fc2569af57e595ace3fff5644

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_it.dll

Filesize
39KB

MD5
0d6766b2dc0b6e757e4db21f18cf8e93

SHA1
5578dc20e1ec3c8c03a00311205c10b0cc7f16ae

SHA256
2c51e3db1da14244ebf92538d5d0d39da73f4dc3e1eac1913f860e8e1783fd0b

SHA512
a05fe06a5ed6a5519c48384d9c16014f0c1f10b97caa064a9cbc99870f51161a04a13760c8fd6642d4c8a9f4af65b6849b7244f19998bad9e6f759c7abffecf7

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_iw.dll

Filesize
35KB

MD5
9acb33ef5dd1ec154d70d424f927f0f0

SHA1
79c76279699678a23c4df9be1af088fef599a6cb

SHA256
483a6793e59cc27f3b711d0fd9e94f6b7ff5d749f819d800fd971a593e6c9d8b

SHA512
a83889f101a63659df14013091e204a57f64f83982012469810a5dbf7c8274f8ee93826ac346c7678791aa8c699c158d4395aa88de1d6d6e6c7814399d6d8ecb

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_ja.dll

Filesize
34KB

MD5
57ae4d67067d45ff30e8e668f4299654

SHA1
5bf26a45199ff75b2712800b522f140fc6ca20f4

SHA256
06b2d0c9b449e0f5386a83ee7aaf9741583918c023445052f0e733c81accf541

SHA512
0926e4efb241f1f0ca38f29972d0fae30cad254e70f4bb5dc6d364c84d0734a95a1b104b4250e7a1b03b771fd1ac8c2d2962f511de5eb9970600d412e00d2539

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_kn.dll

Filesize
39KB

MD5
c6b120e1dc145cdd9c20466fb4f41d59

SHA1
29b6c5678323f00919af7d893cfceaf4441ff8c4

SHA256
cd4f29a02dcd6c040113234fe685fc08ff728850a158319aa49aac346d76b193

SHA512
a61861633d298bd7b597cbbfa760118628548642774b9783bfd4350a2bca5f4fec1f26fc13d42bf7b175a6956da00e944d06af6d8ec0ae6079231d1f37a4917c

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_ko.dll

Filesize
34KB

MD5
8bea945ac0072425751e62d67af193cf

SHA1
ccac417f8864822a7e28a9011993525a63903d87

SHA256
a75abfb69b7a9980a0325a3b0ef13cf6e1cc08e5c660f69b4f445b243ecdbc36

SHA512
21aa8d26cffde22a4c82accb9b61a7885d4ea9fbf9cf85440dc7ed31d3b615d7e196d1d9cbd482ffe784bb5d5e1e6534031d2b4beda517616aabadb470bae490

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_lt.dll

Filesize
37KB

MD5
b9f817aa59e7f216990e28bb2b322822

SHA1
0d87ee49c035a80ed177024fc0a7dc0524591ac1

SHA256
29709aaf8cc71abf20a67137740ec69cccf55775ce1d84b0ed2c1ad726568bfe

SHA512
2bbcfda213022d2c1e4da221c924dbf8250e46562c3c9815792b47238be2d2f33385d868d693557c63cfe377e41bb8419a5eb1b6cc6c064375cd1b662fd3a135

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_lv.dll

Filesize
38KB

MD5
dbe4d2ce3f565621e72e8d51323464c3

SHA1
b92501a3fe3c524712e1e542f09840cafe084390

SHA256
b0ccbf0055df6ac3a65a51b31a80a1be3073e533ceca46ee44b80aa90aec99f4

SHA512
6a8b830643c85c08356da4031b54a4588ebccd850afaa741b553580c9cfb637736e3895a06b01fb49f9e26909ef402988ef3915aea37660b31055c7a99718537

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_ml.dll

Filesize
41KB

MD5
5f94b40090c67f22a3cbc179637d98ff

SHA1
f7d0fdc2115bb5d90aa23ca0ba295cce90cf02f6

SHA256
66fec298e9ac00098b7bb6008c25520b0d86574a2d92f84a5bae383e73e4286f

SHA512
d36a21acae7e5a90ed80e15db0f9202709578356767192a217618367abe7d855b6b9d45ca40541fefd401019a9a6064b50d27c9a164aacd5a230d1ab6ecdb657

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_mr.dll

Filesize
39KB

MD5
736126bc41a068fef010ffdb32161f82

SHA1
737cadaf7ed78b029dbdb188f5065885be4b6f9b

SHA256
d786900a2633b6f1c31d0b710811a6d6ca445513b9a618dba383d0776ed44b86

SHA512
087c9d85ef2060e96d03f6d17358cdc9902d50258be4c18b6c8c1ed755c8eb5e39b0a8c99184709f40c4e375d0713c18b6a9b6838006821ae404d2e6e9dba8df

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_ms.dll

Filesize
37KB

MD5
73866aeee02ec7b1daee1769db41fdcc

SHA1
e51007210ec629b6919ac7ae45f393420c29d43d

SHA256
f58ef79dfd1e74fafcfa291b4c11575a124be1f496e4268823cc21b87332b8df

SHA512
bfe3da23999fd90b22388042b8c0d7297d69f202ebd9b307702d876d6863f981541a234a9b209be7b0c793d67553a74bcc73de34788bc71e3fc92365ca0bd7ac

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_nl.dll

Filesize
39KB

MD5
5b33b8147fa51c3561b8210752ae1535

SHA1
2decd54043009bc46ac059cf31ed6b855df830ff

SHA256
088f0b1d5b1bb3c01e57b6103723e061927ec2af7f8e9bddb29a72dfce86886d

SHA512
88533929c17476d084b678990a1c46f4c8bf8a91d98388b30a1a971dd4a22f09dd5cf63264cc754cdb1cab7ca38bf9b3efe20cc0fcb853c0c7b94e5f7caaebbe

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_no.dll

Filesize
38KB

MD5
86ac9b5b3b0146ec66208453d5bbbad2

SHA1
1980a09a47553d90b2af67551e84cb6000cfb64e

SHA256
b15dcc6bc551bb7b1e2b394eb782794fc165965135180c06dd3582323fd7c4f5

SHA512
5ed2a0899d5eb896fed3a09e698ff57f3a1ae41ab89e906b588f294f6aa0dff01c4257bec13ad31e0362e7520bb07e68ef47e802930bd41ae766955e297eee8f

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_pl.dll

Filesize
38KB

MD5
8d2234c272199bb271300476ebf78b6a

SHA1
039f539d23dfaaabe6520cd5f83f1d638a4f46a1

SHA256
52d9c9582f53dc4574bd8aa502ecc3d7e76317ba996e3813c0aaea56a55ca531

SHA512
8474ef64b767e6f88e3c04734c444122bd12fd49e8c05e5851ba60b89e7b14b9263771644b2e4df9a828f0dd8196fe6d5ce824001ed6d066a9a356a5e43647bc

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_pt-BR.dll

Filesize
38KB

MD5
2ff041fbf7c188568f815f7fb097abe3

SHA1
c4c60c72b5c0369c042738e9136c858bcf74f7a0

SHA256
4006c3460b4f6c3fc4f63f16578e9b599211540874bc615ef341ab06312b136e

SHA512
f6ef39eaa82524bc67450c4cb908af72c9c113452025ef8c5cae3f4bb3ee14a1abae8f96221e36d8d06325733cb955994d64d7adcda911b3398a259a88595811

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_pt-PT.dll

Filesize
38KB

MD5
047eaa80646d93c7b608986cc5c8f492

SHA1
e13d7f084bd8274b24b91f0a5cf580fdd5697e42

SHA256
be321f8e9343b4892d4eb1b86f3a15f4fbe25b90cc3e1381cf05be7bd8990f57

SHA512
0e464b82709041612dabcb54f425aea2d72c0ec73035a18c8424ed25847abc57256aa2e47cd45820593e7007c6cd5896cad616ba082bf21c1899d2265db60494

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_ro.dll

Filesize
38KB

MD5
c0782d9740811e5fef9e2500c7de747f

SHA1
dc8e512407079f60940148db119c49680fbcb3d4

SHA256
37f0d2e905e2314980e1ce573db4a5db3c21d881a495011b731c535086ffa24f

SHA512
0ae3e08795eccfd54e86df8562c8b28bdfc854385f18796871442c7790345d19944b9cba51f25e635e9662b257a876fa6dc1497b9bfe1b9a642bc503b6a82bfd

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_ru.dll

Filesize
37KB

MD5
15c83c84b3771e803b93c33e89c90951

SHA1
f7c49cb987bb25e8535fc02f913d2d9e325ceb4a

SHA256
d680efd7d70374124c7ba3a8f0a229c34717fa0d3302a8ca3a4c6cf0a85e0b7f

SHA512
a25ee6cb2a1de8f4e08c3bd6f55b985687ac5efe9b99658841271a00c49c92d1a2cb2a2ca7bf404672740d650f3c5a66fb05ea84f51f9f10c11d7b24cc749a49

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_sk.dll

Filesize
38KB

MD5
ce675a9fa01132b6028205845537782a

SHA1
cee76d13eb350664c67c30196f0d3a8d90b41f07

SHA256
7cd1408adef514b1f999947766c85497b4f7844ddb61ee767f4b5f70684ab9c3

SHA512
2108baa7365074bf3d00b86008a0d6951f7c7c56d8504b9b1a02d4cbfe4d89e1ca00cd07b4991c56ad52e933776b9147c611d012b5d817d4434cd57700e6ce05

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_sl.dll

Filesize
38KB

MD5
7e353417712ebd0eeb7820f8193aeb3d

SHA1
baac5ab8e5afa79cacbe27dc932b5a36604e9b12

SHA256
0fb51c67042c316139fa0cb423716fc543b161a41cc8c6267e5e06d3d950703f

SHA512
07daf7c3286eaccae419f0eaf5696b21a245ff1399f2d694b070aea3f5dfc8322e1216331be6ed1ca17fb7f282ab4092a62c381d77271fdd80a7faa6aaa4dd92

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_sr.dll

Filesize
38KB

MD5
6583ebd9d5de4b34a38d33d76f7be9fd

SHA1
3513714b396909b455e4657ea7a921254bcda8a9

SHA256
15744393ee61c3b80502ceeb3539512d647585ca4b0d41b1ca0f294b70d497b0

SHA512
0f6aaddd3117a57e8c9728d48105813a8b61f34b4eb5d0f2daa95050484d8da4b09a0bdc2718cf14fedd74cc9cc222ed58fd58d2eb0ab30bb02f2240b92f4940

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_sv.dll

Filesize
38KB

MD5
a81609331cca7de48bc73759ba49f8e1

SHA1
0f44746841d6edaade192fec6779e368b36eb1cf

SHA256
3c318f1ba1f9a22b27be22f71aa14a2ffd143f3c5950c815b459eb4ce9d38c99

SHA512
dfef19dccec8e4c498206052841a9847f860dc831a0ba10ff96961a129a525648223b1eea66d293e8cdf5dbbe5814e56e1094335f047650f9d03091506e2c297

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_sw.dll

Filesize
39KB

MD5
02a8291af1ea81e83d582207bbf6a507

SHA1
1dddaaf8a1768a4dc334887d849fe7b194eb5d2a

SHA256
bf0dfabab8aba1a7245732648582690726ed8477a338deb69b71e1c4f96aa193

SHA512
befbe2fc91cd1c0154a02f410a641ffd5fbea23a2b0e5a2de4c0648db4934c8dccb997466f95fbde6ac39131b812badd124fd2c64348db212d262e65accee5c8

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_ta.dll

Filesize
40KB

MD5
41c8270d368ee70faaa09c68a740f374

SHA1
5336158f5ad120a3f13009726c7658819c19b384

SHA256
1a69b26392f957b9fb2c4b5d89428d8f7adbce6c5a2099c2bc0f13386f5329d0

SHA512
3730a39c90c8fc8eca042318117d5912f80d4780c7a04e7cf7d1f3e839fb02aca7da40a44c2d94cd8436ae4c77068d92137eb13b8edf014a6cb0beecbbbc0db1

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_te.dll

Filesize
39KB

MD5
906338580d30032217acfe7878e0c4ee

SHA1
232a7363e7737c89a3ebf4592575d708083a719c

SHA256
d60d0eb31e988c28311999918f085a054e434fae73714ee46ef5f1595f91735b

SHA512
75eda5dc3efc8f98b7353bce5662d93cabf821aa7e6183872be6115260d805c9c8eb02a085c5f2378364a73cfb44298939fb11bdb3307b02aa8f3b656d1e7186

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_th.dll

Filesize
37KB

MD5
752c0f6f229df85ac24dc097e2f299a9

SHA1
017853b09123bde697e7037d4d369825ca361d75

SHA256
24cc596085ff60228290b1d2aca944856a003db25374ab07409fbb4d8ce8c0c1

SHA512
43de9beb7d73d878b7528dc94edf992c1e7b9ba588bb5753a6f6c18431404d208094d9bdc835cc4a8f212b1b68fdd317a6a23104387ea9c7fe2ba9eaab9c9bc0

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_tr.dll

Filesize
38KB

MD5
a08d5d788adf592857e6518c58d2058f

SHA1
e4487a6a1ae1ee3b661a350626d048b63a09f8c2

SHA256
9659fdcc4c1553071b51af4de21ed14113b6bee6d62a14168d6b595243f8c1c9

SHA512
fd35efabe90758cea5ce204c7b306209390195327f75ebaf94df30e913d68bceb9fd26374a4d9d33e1abceb173fff1eb7b1be43b4bc99fd91db4a944a7aba629

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_uk.dll

Filesize
38KB

MD5
3a44fa2404b4705d95f5b76e2722d877

SHA1
583e73528dccf4159561064693a8436e3a7d6006

SHA256
e3cadfa3da53a8a4b591b919f5d4866d69c14406bdf482a2051b46fb60350917

SHA512
82197b3a5e66821f24a0e1c5f17d610355ed09e268ac5f5fcfc4639327b30c3f2a6c8ea36555f6887e7de87ea32dbcf1779ccf0a5fd727a628d5dcad90691cc7

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_ur.dll

Filesize
38KB

MD5
c7b389dcdcbf45c959a1904edd76eaf7

SHA1
e9d2e54f991dd65b231205808b33484c5d034c76

SHA256
a642cd042b3ab4a7a3f108573d1e6a7d3a766f6d895bca83b7499c6a3d3ac5b6

SHA512
e3763eec8819082280e1f025cc496cce94ed0ad41fde2392212462b29af846ce047baa9747ebb989f4a44d563559dc970b0f4b1d3ca21bb7efb2b99528d4f3eb

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_vi.dll

Filesize
37KB

MD5
082bef93b1f95c8c905e57737b6bdb2e

SHA1
22a1ff4d2487fab3cbdfeae19e5c2ce648942254

SHA256
40b8016613d9b48abcdb6ce2c19928f2a6c114610fe9b0ace90740773a46ed09

SHA512
937663b94534acb09e2578a56179e2ca4c3c1b323e17dfca1edad3c345235577cc6689fe86d20a43cc28a4156a002d3aa148f9774e53de9888125b2c258b3aec

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_zh-CN.dll

Filesize
32KB

MD5
00daa25a9933cd655f4a93685a811bc1

SHA1
f7862de7d192821fda41b153a34069baa5610665

SHA256
3904ab6c2961c55ab9295c2d3a2ea8ca748dcfb379e527af8139b3300ab6cef3

SHA512
9868440f2d3bdf108a7ad37fcabe7e969a5941c2927bea1db48216b5138f7f881267648130994ed85e6dbebcfb378b5334aaf5ca1f16a37ea520bd67f1fdaab1

Download Submit
C:\Program Files (x86)\GUM83C6.tmp\goopdateres_zh-TW.dll

Filesize
32KB

MD5
2d054293e035e00cea8901ae8dabf531

SHA1
daed6cf274c0e34c2f9cc5aae259d43355a61b7e

SHA256
5fa9ca4af42b0e735ad42627c3a002fce6b4e24df9dd185af751795b50ee0ac7

SHA512
abd472655e081c5793514c8aabc52ff6fd83341aabd510279294224c17ed1865a3a861a2c186751035024d060f7b0fd7188defb8f34c74ef084bbc551e7aad90

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_aedaacc27faafa87dd57de005f05ba19a1467fc9553647edc6cc807e49e848b9.exe

Filesize
906KB

MD5
8c349afdf77e88f26eccd9f1abaf731c

SHA1
dc1b1c0572731c4ba0c5f16c45ad1d18123eb8f0

SHA256
684e598b7b9a897f0fa0e150c2f1ac08fc52ac98879df5464918d9da5773a422

SHA512
5bb5803e83599935e5dd55773f31552db1e9dc2a8b7999752fccc40ea8d2e9020943e60326138b8f38e823875efda2fac76a76161329b90310a098bf2369106e

Download Submit
C:\Windows\Tasks\GoogleUpdateTaskMachineUA{2BC1281D-775D-4442-B7DE-A0FD2C328B60}.job

Filesize
700B

MD5
e9b9848a3ea9b9db71418be3c0def496

SHA1
20a11e38d14c06478fa18c3f81a2a6dbea41173b

SHA256
667b9c387c9618675f78d6291c9171388a3589c187c2d2060eab3a76ae2ade83

SHA512
53e26cbb3297d988caadf8c6c33ab910a3bb63a32f6fb49378fd3e24233cdeec50c29e4c42f833e27f3853a697d0cf2abe36c07823a74b196e309e3785e1bed6

Download Submit
C:\Windows\directx.sys

Filesize
40B

MD5
31dce455088e7e8fad4b513121de3de0

SHA1
31b0b4be199b728ca764441bde022d2685d750ae

SHA256
1158d85d0a265fa259faacb7464ee20f3b34ec22ffa580520af04d75c23cffa9

SHA512
a4d2ea5c75e9b9d9b2524f19a52426130e83c83ddd85f0e6f2e0a4b3eb9720f38719d95bb06a24c3a0cdce75817e3c846ebcdd4896626276fc2b0ec5b776cc51

Download Submit
memory/1496-439-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1496-429-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1496-431-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1496-433-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1496-435-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4468-317-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5012-87-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/5028-434-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5028-438-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5028-432-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5028-430-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download