Overview

overview

9

Static

static

3

Install-Go...es.exe

windows10-2004-x64

8

Install-Go...es.exe

windows11-ltsc_2024-x64

9

Resubmissions

27/07/2026, 20:01

260727-yrsd7adl219

27/07/2026, 19:57

260727-ypgjxadk615

Analysis

  • user interaction
    yes
  • max time kernel
    241s
  • max time network
    256s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 20:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Install-GooglePlayGames.exe
  • Size 39.4MB
  • Sample260727-yrsd7adl21
  • SHA256 dbcd4db9e8755a1709aef3a365e5e7104afcba58d26ca5a5caa6bc1ed17775d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 46 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 30 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Install-GooglePlayGames.exe
    "C:\Users\Admin\AppData\Local\Temp\Install-GooglePlayGames.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\ye3mi5qn.jag\crashpad_handler.exe
      C:\Users\Admin\AppData\Local\Temp\ye3mi5qn.jag\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=26.5.634.0 --initial-client-data=0x6a8,0x6ac,0x6b0,0x680,0x6b4,0x7ff83f63f8a0,0x7ff83f63f8b0,0x7ff83f63f8c0
      2⤵
      • Executes dropped EXE
      PID:4308
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /C dir /s /-c "C:\"
      2⤵
      • Executes a command shell one-liner
      PID:3176
    • C:\Windows\System32\dxdiag.exe
      "C:\Windows\System32\dxdiag.exe" /t "C:\Users\Admin\AppData\Local\dxdiag.log"
      2⤵
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3512
    • C:\Windows\System32\dxdiag.exe
      "C:\Windows\System32\dxdiag.exe" /t "C:\Users\Admin\AppData\Local\dxdiag.log"
      2⤵
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:5936
    • C:\Users\Admin\AppData\Local\Temp\Install-GooglePlayGames.exe
      "C:\Users\Admin\AppData\Local\Temp\Install-GooglePlayGames.exe" -install gpg_install_c373f1ab-778a-496e-b322-e355694fd2f6 "C:\Users\Admin\AppData\Local\Temp\ye3mi5qn.jag" 0
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6136
      • C:\Users\Admin\AppData\Local\Temp\ye3mi5qn.jag\crashpad_handler.exe
        C:\Users\Admin\AppData\Local\Temp\ye3mi5qn.jag\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=26.5.634.0 --initial-client-data=0x3cc,0x3d0,0x3d4,0x38c,0x3d8,0x7ff83f63f8a0,0x7ff83f63f8b0,0x7ff83f63f8c0
        3⤵
        • Executes dropped EXE
        PID:2996
      • C:\Users\Admin\AppData\Local\Temp\ye3mi5qn.jag\UpdaterSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\ye3mi5qn.jag\UpdaterSetup.exe" /install "runtime=true&needsadmin=true" /silent
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1708
        • C:\Program Files (x86)\Google1708_1845557439\bin\updater.exe
          "C:\Program Files (x86)\Google1708_1845557439\bin\updater.exe" --install=runtime=true&needsadmin=true --silent --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
          4⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:440
          • C:\Program Files (x86)\Google1708_1845557439\bin\updater.exe
            "C:\Program Files (x86)\Google1708_1845557439\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0xf48584,0xf48590,0xf4859c
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4568
    • C:\Program Files\Google\Play Games\Bootstrapper.exe
      "C:\Program Files\Google\Play Games\Bootstrapper.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Program Files\Google\Play Games\current\service\Service.exe
        "C:\Program Files\Google\Play Games\current\service\Service.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4880
        • C:\Program Files\Google\Play Games\current\emulator\crashpad_handler.exe
          "C:\Program Files\Google\Play Games\current\emulator\crashpad_handler.exe" --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=bss_session=f7d3855b-bea4-4bbd-9985-660297ba5d96 --annotation=channel=Beta "--annotation=cpu=Intel Core Processor (Broadwell)" --annotation=gpu_hw_scheduler=False --annotation=prod=Battlestar "--annotation=system=DADY Dady super powerful PC" --annotation=ver=26.7.116.3 --annotation=whpx=False "--attachment=C:\Users\Admin\AppData\Local\Google\Play Games\Logs\emulator_logs\vk_abort_mem_info.log" "--attachment=C:\Users\Admin\AppData\Local\Google\Play Games\Logs\emulator_logs\gpu_crash_dump.bin" --initial-client-data=0xba8,0xbac,0xbb0,0xb84,0xbb4,0x1764231f6b0,0x1764231f6c0,0x1764231f6d0
          4⤵
            PID:4808
          • C:\Program Files\Google\Play Games\current\emulator\gpu_check.exe
            "..\emulator\gpu_check.exe" --out-pipe-handle 6632
            4⤵
              PID:4308
        • C:\Windows\System32\dxdiag.exe
          "C:\Windows\System32\dxdiag.exe" /t "C:\Users\Admin\AppData\Local\dxdiag.log"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:5400
      • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --system --windows-service --service=update-internal
        1⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1596
        • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe
          "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0xf28584,0xf28590,0xf2859c
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3788
      • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --system --windows-service --service=update
        1⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:628
        • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe
          "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0xf28584,0xf28590,0xf2859c
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3992
      • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe
        "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --system --windows-service --service=update
        1⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2296
        • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe
          "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x280,0x284,0x288,0x27c,0x28c,0xf28584,0xf28590,0xf2859c
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1648
        • C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping2296_39329394\HPE-26.7.116.3-CIP.exe
          "C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping2296_39329394\HPE-26.7.116.3-CIP.exe" /o{47B07D71-505D-4665-AFD4-4972A30C6530} /l1518 /noui
          2⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3636
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /C dir /s /-c "C:\Windows\TEMP\Google\Play Games\ahdvn2zb.ocn"
            3⤵
            • Executes a command shell one-liner
            PID:2984
          • C:\Windows\TEMP\Google\Play Games\ahdvn2zb.ocn\7zr.exe
            "C:\Windows\TEMP\Google\Play Games\ahdvn2zb.ocn\7zr.exe" x "-oC:\Program Files\Google\Play Games" -y -bso0 -bsp1 "C:\Windows\TEMP\Google\Play Games\ahdvn2zb.ocn\location_restricted_program_files.7z" "Bootstrapper.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2424
          • C:\Windows\TEMP\Google\Play Games\ahdvn2zb.ocn\7zr.exe
            "C:\Windows\TEMP\Google\Play Games\ahdvn2zb.ocn\7zr.exe" x "-oC:\Program Files\Google\Play Games" -y -bso0 -bsp1 "C:\Windows\TEMP\Google\Play Games\ahdvn2zb.ocn\location_restricted_program_files.7z" "Applicator.26.7.116.3.exe"
            3⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3196
          • C:\Windows\TEMP\Google\Play Games\ahdvn2zb.ocn\7zr.exe
            "C:\Windows\TEMP\Google\Play Games\ahdvn2zb.ocn\7zr.exe" x "-oC:\Program Files\Google\Play Games" -y -bso0 -bsp1 "C:\Windows\TEMP\Google\Play Games\ahdvn2zb.ocn\location_restricted_program_files.7z" "Uninstaller.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3840
          • C:\Windows\TEMP\Google\Play Games\ahdvn2zb.ocn\7zr.exe
            "C:\Windows\TEMP\Google\Play Games\ahdvn2zb.ocn\7zr.exe" x "-oC:\Program Files\Google\Play Games\current" -y -bso0 -bsp1 "C:\Windows\TEMP\Google\Play Games\ahdvn2zb.ocn\archive.7z"
            3⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2396
          • C:\Program Files\Google\Play Games\current\GooglePlayGamesServicesInstaller.exe
            "C:\Program Files\Google\Play Games\current\GooglePlayGamesServicesInstaller.exe" /silent
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5476
            • C:\Program Files (x86)\Google5476_89219955\bin\updater.exe
              "C:\Program Files (x86)\Google5476_89219955\bin\updater.exe" --silent --install=appguid={5B9D6427-8AB1-42D0-9F13-4EE089071B8E}&appname=Google+Desktop+Services&needsadmin=true --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
              4⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4052
              • C:\Program Files (x86)\Google5476_89219955\bin\updater.exe
                "C:\Program Files (x86)\Google5476_89219955\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6512.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6512.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xa5d68c,0xa5d698,0xa5d6a4
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4884
          • C:\Windows\system32\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule "Google Play Games Service"
            3⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:2032
          • C:\Windows\system32\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule dir=in action=allow enable=yes profile=domain,private,public protocol=tcp "description=Google Play Games Service" "name=Google Play Games Service" "program=C:\Program Files\Google\Play Games\current\emulator\crosvm.exe"
            3⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:4460
          • C:\Windows\system32\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule dir=in action=allow enable=yes profile=domain,private,public protocol=udp "description=Google Play Games Service" "name=Google Play Games Service" "program=C:\Program Files\Google\Play Games\current\emulator\crosvm.exe"
            3⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:2612
          • C:\Program Files\Google\Play Games\Applicator.26.7.116.3.exe
            "C:\Program Files\Google\Play Games\Applicator.26.7.116.3.exe" "anv" "Admin" "C:\Users\Admin\AppData\Local" skip-make-current
            3⤵
            • Drops file in System32 directory
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5076
            • C:\Program Files\Google\Play Games\current\service\InstallHypervisor.exe
              "C:\Program Files\Google\Play Games\current\service\InstallHypervisor.exe" --ghaxm --install-source "Fresh" --driver-dir "C:\Program Files\Google\Play Games\current\service"
              4⤵
              • Drops file in Drivers directory
              • Drops file in System32 directory
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1216
              • C:\Windows\system32\sc.exe
                "sc" create googlehaxm binpath= "C:\Windows\system32\drivers\GoogleHaxm.sys" type= kernel start= system displayName= "GHAXM"
                5⤵
                • Launches sc.exe
                PID:4340
        • C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping2296_1093601491\GooglePlayGamesServicesInstaller.exe
          "C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping2296_1093601491\GooglePlayGamesServicesInstaller.exe"
          2⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1144
          • C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping2296_1093601491\installer_output1207140187\GooglePlayGamesServicesInstaller.exe
            "C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping2296_1093601491\installer_output1207140187\GooglePlayGamesServicesInstaller.exe"
            3⤵
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5376
            • C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping2296_1093601491\installer_output1207140187\data\installer_windows.assets\crashpad_handler.exe
              "C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping2296_1093601491\installer_output1207140187\data\installer_windows.assets\crashpad_handler.exe" --no-rate-limit "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Google\Play Games Services\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=assembly=ASSEMBLY_INSTALLER "--annotation=dart_version=3.13.0-282.1.beta (beta) (Wed Jul 8 01:25:08 2026 -0700) on \"windows_x64\"" --annotation=prod=Google_Desktop_Services --annotation=release_channel=RELEASE_CHANNEL_PRODUCTION --annotation=ver=26.7.209.0 --initial-client-data=0x588,0x58c,0x590,0x560,0x594,0x7ff83b890b50,0x7ff83b890b60,0x7ff83b890b70
              4⤵
              • Drops file in System32 directory
              • Executes dropped EXE
              PID:4172
            • C:\Program Files\Google\Play Games Services\26.7.209.0\temp-453d776c\7zr.exe
              "C:\Program Files\Google\Play Games Services\26.7.209.0\temp-453d776c\7zr.exe" x "-oC:\Program Files\Google\Play Games Services\26.7.209.0" -y -bso0 -bsp1 "C:\Program Files\Google\Play Games Services\26.7.209.0\temp-453d776c\archive.7z"
              4⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:4008
      • C:\Program Files\Google\Play Games Services\26.7.209.0\Service\GooglePlayGamesServices.exe
        "C:\Program Files\Google\Play Games Services\26.7.209.0\Service\GooglePlayGamesServices.exe"
        1⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:4644
        • C:\Program Files\Google\Play Games Services\26.7.209.0\Service\data\windows.assets\crashpad_handler.exe
          "C:\Program Files\Google\Play Games Services\26.7.209.0\Service\data\windows.assets\crashpad_handler.exe" --no-rate-limit "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Google\Play Games Services\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=assembly=ASSEMBLY_DAEMON "--annotation=dart_version=3.13.0-282.1.beta (beta) (Wed Jul 8 01:25:08 2026 -0700) on \"windows_x64\"" --annotation=prod=Google_Desktop_Services --annotation=release_channel=RELEASE_CHANNEL_PRODUCTION --annotation=ver=26.7.209.0 --initial-client-data=0x8e0,0x828,0x90c,0x8e8,0x920,0x7ff8393c0b50,0x7ff8393c0b60,0x7ff8393c0b70
          2⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          PID:5924
      • C:\Windows\system32\drivers\GoogleHaxm.sys
        C:\Windows\system32\drivers\GoogleHaxm.sys
        1⤵
        • Executes dropped EXE
        PID:3824

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            Windows Command Shell

            1
            T1059.003

            System Services

            1
            T1569

            Service Execution

            1
            T1569.002

            Persistence

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Impair Defenses

            1
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            uninstall.cmd
            • Path C:\Program Files (x86)\Google1708_1845557439\bin\uninstall.cmd
            • Size 653B
            • SHA256 a38e49c0e87a9dd81682346392d45c965783c25d5ec6aaa373cb9799c2a602e2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater.exe
            • Path C:\Program Files (x86)\Google1708_1845557439\bin\updater.exe
            • Size 6.3MB
            • SHA256 1640cc889fea7bced6c501988f7cea4a03c22d9970529f387fcdb2695659654e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.exe
            • Path C:\Program Files (x86)\Google5476_89219955\bin\updater.exe
            • Size 4.6MB
            • SHA256 e53e2e023b49daf19b8173f601e194fed6e7050aec0abd485a46d06b62b0757f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GooglePlayGamesServicesInstaller.exe
            • Path C:\Program Files (x86)\GoogleUpdater_chrome_Unpacker_BeginUnzipping2296_1093601491\installer_output1207140187\GooglePlayGamesServicesInstaller.exe
            • Size 38.3MB
            • SHA256 fc548af3eb5d2fe1c96b80988468459fea3778b1764f1be2abec4f46a8e76a1c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.dat
            • Path C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad\settings.dat
            • Size 40B
            • SHA256 0560e44f544908e289e109b657f28b633cec922b087b96d8c4b34b8bbd48181f
            • MD5 SHA1 SHA512
            Submit Download

            metadata.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
            • Size 248B
            • SHA256 17ec8f950a6c8e722b915ca08e557d7bfe40c4ca71da085244ab05e48a110932
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
            • Size 130B
            • SHA256 3565ad66cc5fcc685065eda1fbe4059f8f97d631ea8e0a4140e75905e2f7edd7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 420B
            • SHA256 3cac013a5bc22b8bdc07cb5a07a1083a2d1e469ce68ae43d4bc13a8b75e82518
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 421B
            • SHA256 c06e9a0049bc4c4bac32b80760c6dae788ba68292349590516d62566d7df1e0c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 1KB
            • SHA256 c537d1e5bb315c4c7cedf799f0183cd4cc9d75c266351eba2666c0cf3b18e5cc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 953B
            • SHA256 a0489b401d1d534c5e2e1a026b7e1b7b7bd20ccaf1b4e3e95d1e1fbad89c550e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 983B
            • SHA256 c62a080bb63370d5b28dca51c877b254e6696c730d5da435a3b717e177eb9da2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 1013B
            • SHA256 36a72016b098aa5fd804efce2a64a1b1cf2fcd7ae599b070d9dc29742aaffc48
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
            • Size 758B
            • SHA256 d6c29285da9e77a7e7eae72c58641455f3611a293810201adf9bda5d5d5d131c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 27KB
            • SHA256 226dfea11eaf7dbbc264f4fe87018acb88b6c098cc93e5409cb6420892e841a3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 29KB
            • SHA256 8db9f559f41afb41f4cc51e0a8a30307bd188872b7188da63625bb2c81468a1d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 34KB
            • SHA256 8937650cd550f0f5481e5da136811ea87e0d67f016b1fda35bd68a201b81f9dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 34KB
            • SHA256 a03ef954ac81a30325a26de522b40ad7792df52c22f8c4c49be35d48813da5bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 41KB
            • SHA256 7a12c63068dbc76496446efd1c6027c5180cb158616d0e8680349b4f2725b18f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 45KB
            • SHA256 4a363325bb42df3106a58d7d95ec01fec22ebb370ffb8caa9941ed8829abb9da
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 24.0MB
            • SHA256 e320e72c8ef64bab0a73c48df58f4fba18f11b4a4a131ca77de735c4c251b0eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
            • Size 24.0MB
            • SHA256 ebc7581ad7aebd723b99f23ecbfabf59ac2acea766076a3d0818d9044c7fb302
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 1KB
            • SHA256 06ee5a27cd8e56d9a178cd85531c8c000190b3bd402d220ecfd41c0aa5bd7f7f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 2KB
            • SHA256 68d398cd74ea1122d36d9705e49c8ab5b86e237fa5a960121ef26bed66babf92
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 3KB
            • SHA256 dd143e806c6a50e67e4645d74d63be24c7fb07bebdfeb1ece44852e2d440f62a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 3KB
            • SHA256 da09158fd161b788c855249922a81ff02237352e7fd39f23cd925d4ef7f619e1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 4KB
            • SHA256 4af9b1a3b8c16483a7257152a61a6e1fa43b90a0b1a52df3ae68f12057248c4d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
            • Size 6KB
            • SHA256 9f314b762f678f6492cc9b5ff05353f2bc70294e07260e3307b5a321a85375d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FontManifest.json
            • Path C:\Program Files\Google\Play Games Services\26.7.209.0\Service\data\windows.assets\FontManifest.json
            • Size 153B
            • SHA256 2eac50415f742dca6a7183518450db5bbe36a715867c42d43b7e01a64a45c474
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            NOTICES.Z
            • Path C:\Program Files\Google\Play Games Services\26.7.209.0\Service\data\windows.assets\NOTICES.Z
            • Size 100KB
            • SHA256 80a1e1f8c640546659863e1a72fef76cb357671ce162cd6a17e31d3ba76e7926
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ink_sparkle.frag
            • Path C:\Program Files\Google\Play Games Services\26.7.209.0\Service\data\windows.assets\shaders\ink_sparkle.frag
            • Size 21KB
            • SHA256 1fe8436a743884cb65078fe8c7b38e18f5365f2a2961270916f426fd13c604af
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            stretch_effect.frag
            • Path C:\Program Files\Google\Play Games Services\26.7.209.0\Service\data\windows.assets\shaders\stretch_effect.frag
            • Size 17KB
            • SHA256 bc7599dbbbaab310efe41520574138d21fb18a88c8fe4495ed79315309336f6f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icudtl.dat
            • Path C:\Program Files\Google\Play Games Services\26.7.209.0\Uninstaller\data\icudtl.dat
            • Size 844KB
            • SHA256 325a86063d26334c2eabe1743cea073b612540fbf3d8fc2ef0b5708e3763a8c7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AssetManifest.bin
            • Path C:\Program Files\Google\Play Games Services\26.7.209.0\Uninstaller\data\installer_uninstaller_windows.assets\AssetManifest.bin
            • Size 408B
            • SHA256 75e40e8a2e93983b0e6dfd84f93a6c2eba2e8c08f3d01b31a00d7b41b27d9eed
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            GooglePlayGamesServicesInstaller.exe
            • Path C:\Program Files\Google\Play Games\current\GooglePlayGamesServicesInstaller.exe
            • Size 8.4MB
            • SHA256 5ef173c8f09570c599eb74f2c673225682e9879ebca98e366276b8ee6bd90b7c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
            • Path C:\Users\Admin\AppData\Local\D3DSCache\1f336d8ce05c79d2\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
            • Size 64KB
            • SHA256 0678846f7fc610414afd3e484466b78901d7103fd3fe5717799001f45ace0579
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
            • Path C:\Users\Admin\AppData\Local\D3DSCache\1f336d8ce05c79d2\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
            • Size 4B
            • SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
            • MD5 SHA1 SHA512
            Submit Download

            F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
            • Path C:\Users\Admin\AppData\Local\D3DSCache\1f336d8ce05c79d2\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
            • Size 944B
            • SHA256 b0a0fd150dadd50306a14cd01ee84d788a9e6c75c406dee8ce94a09c309ca14e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            settings.dat
            • Path C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad\settings.dat
            • Size 40B
            • SHA256 80787e07b902900a848e49aa57572b7ae070f692638bc8af638c9553dc187453
            • MD5 SHA1 SHA512
            Submit Download

            InstallerCrashReporting.log
            • Path C:\Users\Admin\AppData\Local\Google\Play Games\InstallerCrashReporting.log
            • Size 1KB
            • SHA256 df55a9ab5e6a5bc8b6e96c938794253d79936ed0f5c6631603f5fa9bdb6e0293
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            GpuCheckStderr-1d141d6c-fb5b-452d-975e-be9669190837.log
            • Path C:\Users\Admin\AppData\Local\Google\Play Games\Logs\GpuCheckStderr-1d141d6c-fb5b-452d-975e-be9669190837.log
            • Size 672B
            • SHA256 8cac402bae804a654b4667282c1db661f0fe7b6fe491b35006ce5123004cc1a0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CurrentDatabase_400.wmdb
            • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
            • Size 896KB
            • SHA256 7f5445200291a207cb2ad5feac218a16535fae211607445ba67717fab6a10370
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WMSDKNS.XML
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
            • Size 9KB
            • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CrashReporting.dll
            • Path C:\Users\Admin\AppData\Local\Temp\ye3mi5qn.jag\CrashReporting.dll
            • Size 1.0MB
            • SHA256 00762dd9cb5958426503433c61c1fe817c43717312b74d8d7f3a3099cb37d94f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UpdaterSetup.exe
            • Path C:\Users\Admin\AppData\Local\Temp\ye3mi5qn.jag\UpdaterSetup.exe
            • Size 11.2MB
            • SHA256 95f01bd538abe5a9aab3227b78896e27f278cb8ab6d9d3dfa8ad207eeb4bac10
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            crashpad_handler.exe
            • Path C:\Users\Admin\AppData\Local\Temp\ye3mi5qn.jag\crashpad_handler.exe
            • Size 1.1MB
            • SHA256 3b251ea81c02e9105846d711a53dbfe353dd6d9e821a4fd0db3fc7553a8eea33
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            installer_phenotype_delegate_lib.dll
            • Path C:\Users\Admin\AppData\Local\Temp\ye3mi5qn.jag\installer_phenotype_delegate_lib.dll
            • Size 11.8MB
            • SHA256 9ba7827e40d7c6c64d51375d2a9b3e4d649fbe9318a31ad68a744df3c68e1234
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            recorder_delegate_lib.dll
            • Path C:\Users\Admin\AppData\Local\Temp\ye3mi5qn.jag\recorder_delegate_lib.dll
            • Size 5.2MB
            • SHA256 d633e2ccb3ae2d2ca829c9fb9fa50be55cc43c956b5807df439da0e3bc7381bd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dxdiag.log
            • Path C:\Users\Admin\AppData\Local\dxdiag.log
            • Size 83KB
            • SHA256 fa220be4cd7d4fea6dcfe2828c05931bbf45ef07994d7ac5ee6abccb87b0c6bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dxdiag.log
            • Path C:\Users\Admin\AppData\Local\dxdiag.log
            • Size 83KB
            • SHA256 3cba3fd1f40826e6ec10e9c3184c82203ec5c89c6f50ab346edfdff10b0f3fa2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            location_restricted_program_files.7z
            • Path C:\Windows\TEMP\Google\Play Games\ahdvn2zb.ocn\location_restricted_program_files.7z
            • Size 1.8MB
            • SHA256 e8bc939b474ad855e5e76924349d0cef2c3198ddc87352d35f67ce826def0655
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zr.exe
            • Path C:\Windows\Temp\Google\Play Games\ahdvn2zb.ocn\7zr.exe
            • Size 787KB
            • SHA256 7fe7a82f9cc0293191184203ed7b9e2bedc033753c5ed7350e2bad6cadee1d59
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1216-898-0x00000208CE310000-0x00000208CE324000-memory.dmp
            Download

            memory/1216-896-0x00000208CE350000-0x00000208CE38E000-memory.dmp
            Download

            memory/1216-897-0x00000208CE390000-0x00000208CE3BC000-memory.dmp
            Download

            memory/1216-895-0x00000208B5C10000-0x00000208B5C18000-memory.dmp
            Download

            memory/1216-894-0x00000208B5250000-0x00000208B52BE000-memory.dmp
            Download

            memory/2204-63-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-17-0x00000182B7B30000-0x00000182B7B38000-memory.dmp
            Download

            memory/2204-47-0x00000182B6260000-0x00000182B6270000-memory.dmp
            Download

            memory/2204-66-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-65-0x00000182B6260000-0x00000182B6270000-memory.dmp
            Download

            memory/2204-86-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-1-0x00000182B6260000-0x00000182B6270000-memory.dmp
            Download

            memory/2204-713-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-2-0x00000182B6270000-0x00000182B66C2000-memory.dmp
            Download

            memory/2204-4-0x000001829C170000-0x000001829C17A000-memory.dmp
            Download

            memory/2204-985-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-42-0x00000182BD940000-0x00000182BD9B6000-memory.dmp
            Download

            memory/2204-5-0x000001829DA40000-0x000001829DA6A000-memory.dmp
            Download

            memory/2204-7-0x000001829DA70000-0x000001829DA86000-memory.dmp
            Download

            memory/2204-386-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-41-0x00000182B6260000-0x00000182B6270000-memory.dmp
            Download

            memory/2204-39-0x00000182B8AD0000-0x00000182B8B08000-memory.dmp
            Download

            memory/2204-40-0x00000182B8AA0000-0x00000182B8AAE000-memory.dmp
            Download

            memory/2204-38-0x00000182B8A50000-0x00000182B8A58000-memory.dmp
            Download

            memory/2204-37-0x00000182B6260000-0x00000182B6270000-memory.dmp
            Download

            memory/2204-9-0x000001829DAA0000-0x000001829DAAA000-memory.dmp
            Download

            memory/2204-384-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-21-0x00000182B8060000-0x00000182B811A000-memory.dmp
            Download

            memory/2204-12-0x000001829DAD0000-0x000001829DADC000-memory.dmp
            Download

            memory/2204-19-0x00000182B7D60000-0x00000182B7D72000-memory.dmp
            Download

            memory/2204-20-0x00000182B7D70000-0x00000182B7D96000-memory.dmp
            Download

            memory/2204-18-0x00000182B7CE0000-0x00000182B7D5A000-memory.dmp
            Download

            memory/2204-11-0x000001829DAB0000-0x000001829DAC0000-memory.dmp
            Download

            memory/2204-174-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-67-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-70-0x00000182BDE00000-0x00000182BDE08000-memory.dmp
            Download

            memory/2204-69-0x00000182BDDD0000-0x00000182BDDFE000-memory.dmp
            Download

            memory/2204-15-0x00000182B7A30000-0x00000182B7B22000-memory.dmp
            Download

            memory/2204-64-0x00000182B6260000-0x00000182B6270000-memory.dmp
            Download

            memory/2204-186-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-188-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-189-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-191-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-192-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-193-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-194-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-195-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-196-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-197-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-201-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-16-0x00000182B6240000-0x00000182B6256000-memory.dmp
            Download

            memory/2204-208-0x00000182B7DA0000-0x00000182B7F97000-memory.dmp
            Download

            memory/2204-14-0x00000182B77B0000-0x00000182B782E000-memory.dmp
            Download

            memory/2204-13-0x00000182B6210000-0x00000182B6236000-memory.dmp
            Download

            memory/2204-0-0x000001829B410000-0x000001829BD26000-memory.dmp
            Download

            memory/2204-3-0x000001829C150000-0x000001829C15A000-memory.dmp
            Download

            memory/2204-6-0x00000182B67C0000-0x00000182B6948000-memory.dmp
            Download

            memory/2204-8-0x000001829DA90000-0x000001829DA98000-memory.dmp
            Download

            memory/2204-10-0x00000182B61B0000-0x00000182B6210000-memory.dmp
            Download

            memory/2204-68-0x00000182BDDB0000-0x00000182BDDB6000-memory.dmp
            Download

            memory/3512-73-0x000002A2FA1E0000-0x000002A2FA1E1000-memory.dmp
            Download

            memory/3512-72-0x000002A2FA1E0000-0x000002A2FA1E1000-memory.dmp
            Download

            memory/3512-71-0x000002A2FA1E0000-0x000002A2FA1E1000-memory.dmp
            Download

            memory/3512-80-0x000002A2FA1E0000-0x000002A2FA1E1000-memory.dmp
            Download

            memory/3512-79-0x000002A2FA1E0000-0x000002A2FA1E1000-memory.dmp
            Download

            memory/3512-83-0x000002A2FA1E0000-0x000002A2FA1E1000-memory.dmp
            Download

            memory/3512-82-0x000002A2FA1E0000-0x000002A2FA1E1000-memory.dmp
            Download

            memory/3512-81-0x000002A2FA1E0000-0x000002A2FA1E1000-memory.dmp
            Download

            memory/3512-78-0x000002A2FA1E0000-0x000002A2FA1E1000-memory.dmp
            Download

            memory/3512-77-0x000002A2FA1E0000-0x000002A2FA1E1000-memory.dmp
            Download

            memory/3636-218-0x000001BC1DA30000-0x000001BC1DA5C000-memory.dmp
            Download

            memory/3636-220-0x000001BC36250000-0x000001BC36268000-memory.dmp
            Download

            memory/3636-887-0x000001BC374B0000-0x000001BC374BA000-memory.dmp
            Download

            memory/3636-216-0x000001BC1CE80000-0x000001BC1D022000-memory.dmp
            Download

            memory/3636-217-0x000001BC1D8C0000-0x000001BC1D8D8000-memory.dmp
            Download

            memory/3636-219-0x000001BC1D8F0000-0x000001BC1D8F6000-memory.dmp
            Download

            memory/3636-221-0x000001BC374A0000-0x000001BC374AA000-memory.dmp
            Download

            memory/3636-385-0x000001BC37140000-0x000001BC37337000-memory.dmp
            Download

            memory/3636-222-0x000001BC37700000-0x000001BC37732000-memory.dmp
            Download

            memory/4644-835-0x000001F1CDC40000-0x000001F1CE0C5000-memory.dmp
            Download

            memory/4644-836-0x000001F1CBAB0000-0x000001F1CBAB1000-memory.dmp
            Download

            memory/4644-833-0x000001F1CDC40000-0x000001F1CE0C5000-memory.dmp
            Download

            memory/4644-838-0x000001F1CBB20000-0x000001F1CBB26000-memory.dmp
            Download

            memory/4644-832-0x000001F1CBAA0000-0x000001F1CBAA1000-memory.dmp
            Download

            memory/4644-834-0x000001F1CDC40000-0x000001F1CE0C5000-memory.dmp
            Download

            memory/4880-937-0x000001763F410000-0x000001763F416000-memory.dmp
            Download

            memory/4880-955-0x000001763F6D0000-0x000001763F6DA000-memory.dmp
            Download

            memory/4880-1115-0x0000017642220000-0x000001764233D000-memory.dmp
            Download

            memory/4880-1100-0x0000017642220000-0x000001764233D000-memory.dmp
            Download

            memory/4880-931-0x0000017626B80000-0x0000017626B86000-memory.dmp
            Download

            memory/4880-929-0x0000017626B70000-0x0000017626B76000-memory.dmp
            Download

            memory/4880-930-0x000001763F500000-0x000001763F5F2000-memory.dmp
            Download

            memory/4880-933-0x0000017626BC0000-0x0000017626BC8000-memory.dmp
            Download

            memory/4880-934-0x0000017626CE0000-0x0000017626CE6000-memory.dmp
            Download

            memory/4880-935-0x0000017626D20000-0x0000017626D28000-memory.dmp
            Download

            memory/4880-936-0x000001763F400000-0x000001763F40C000-memory.dmp
            Download

            memory/4880-948-0x000001763F6A0000-0x000001763F6C0000-memory.dmp
            Download

            memory/4880-941-0x000001763F480000-0x000001763F486000-memory.dmp
            Download

            memory/4880-942-0x000001763F490000-0x000001763F49C000-memory.dmp
            Download

            memory/4880-943-0x000001763F4A0000-0x000001763F4AA000-memory.dmp
            Download

            memory/4880-917-0x0000017624E30000-0x0000017624EAC000-memory.dmp
            Download

            memory/4880-919-0x00000176400C0000-0x0000017640D7A000-memory.dmp
            Download

            memory/4880-920-0x000001763F860000-0x000001763FCB2000-memory.dmp
            Download

            memory/4880-925-0x0000017626B40000-0x0000017626B4A000-memory.dmp
            Download

            memory/4880-926-0x0000017626B50000-0x0000017626B5A000-memory.dmp
            Download

            memory/4880-928-0x0000017626B60000-0x0000017626B70000-memory.dmp
            Download

            memory/4880-927-0x0000017626D00000-0x0000017626D16000-memory.dmp
            Download

            memory/4880-932-0x000001763F420000-0x000001763F43C000-memory.dmp
            Download

            memory/4880-939-0x000001763F440000-0x000001763F44C000-memory.dmp
            Download

            memory/4880-938-0x000001763F460000-0x000001763F474000-memory.dmp
            Download

            memory/4880-940-0x000001763F450000-0x000001763F456000-memory.dmp
            Download

            memory/4880-946-0x000001763F780000-0x000001763F858000-memory.dmp
            Download

            memory/4880-956-0x000001763F6E0000-0x000001763F6EA000-memory.dmp
            Download

            memory/4880-965-0x000001763F740000-0x000001763F74C000-memory.dmp
            Download

            memory/4880-964-0x0000017641BE0000-0x0000017641CCA000-memory.dmp
            Download

            memory/4880-963-0x000001763FE70000-0x000001763FEE8000-memory.dmp
            Download

            memory/4880-962-0x000001763F760000-0x000001763F77C000-memory.dmp
            Download

            memory/4880-961-0x000001763F730000-0x000001763F73E000-memory.dmp
            Download

            memory/4880-960-0x000001763FDF0000-0x000001763FE6E000-memory.dmp
            Download

            memory/4880-959-0x000001763FD30000-0x000001763FD6A000-memory.dmp
            Download

            memory/4880-958-0x000001763F720000-0x000001763F72C000-memory.dmp
            Download

            memory/4880-957-0x000001763F710000-0x000001763F71A000-memory.dmp
            Download

            memory/4880-944-0x000001763F620000-0x000001763F634000-memory.dmp
            Download

            memory/4880-954-0x000001763FCC0000-0x000001763FD22000-memory.dmp
            Download

            memory/4880-953-0x000001763F6F0000-0x000001763F70E000-memory.dmp
            Download

            memory/4880-952-0x000001763F6C0000-0x000001763F6CE000-memory.dmp
            Download

            memory/4880-951-0x000001763F660000-0x000001763F66A000-memory.dmp
            Download

            memory/4880-950-0x000001763F600000-0x000001763F60C000-memory.dmp
            Download

            memory/4880-945-0x000001763F670000-0x000001763F69C000-memory.dmp
            Download

            memory/4880-949-0x000001763F4B0000-0x000001763F4B6000-memory.dmp
            Download

            memory/4880-947-0x000001763F640000-0x000001763F65C000-memory.dmp
            Download

            memory/5024-914-0x0000021919CA0000-0x0000021919CFC000-memory.dmp
            Download

            memory/5076-893-0x000001AB9B010000-0x000001AB9B0BA000-memory.dmp
            Download

            memory/5376-757-0x000002B3BACE0000-0x000002B3BACE6000-memory.dmp
            Download

            memory/5376-750-0x000002B3BA720000-0x000002B3BA721000-memory.dmp
            Download

            memory/5376-751-0x000002B3BA730000-0x000002B3BA9C5000-memory.dmp
            Download

            memory/5376-753-0x000002B3BA730000-0x000002B3BA9C5000-memory.dmp
            Download

            memory/5376-752-0x000002B3BA730000-0x000002B3BA9C5000-memory.dmp
            Download

            memory/5376-754-0x000002B3BA9D0000-0x000002B3BA9D1000-memory.dmp
            Download

            memory/5400-1038-0x0000027F830A0000-0x0000027F830A1000-memory.dmp
            Download

            memory/5400-1040-0x0000027F830A0000-0x0000027F830A1000-memory.dmp
            Download

            memory/5400-1039-0x0000027F830A0000-0x0000027F830A1000-memory.dmp
            Download

            memory/5400-1035-0x0000027F830A0000-0x0000027F830A1000-memory.dmp
            Download

            memory/5400-1042-0x0000027F830A0000-0x0000027F830A1000-memory.dmp
            Download

            memory/5400-1034-0x0000027F830A0000-0x0000027F830A1000-memory.dmp
            Download

            memory/5400-1041-0x0000027F830A0000-0x0000027F830A1000-memory.dmp
            Download

            memory/5400-1043-0x0000027F830A0000-0x0000027F830A1000-memory.dmp
            Download

            memory/5400-1036-0x0000027F830A0000-0x0000027F830A1000-memory.dmp
            Download

            memory/5936-120-0x000002807DA00000-0x000002807DA01000-memory.dmp
            Download

            memory/5936-113-0x000002807DA00000-0x000002807DA01000-memory.dmp
            Download

            memory/5936-121-0x000002807DA00000-0x000002807DA01000-memory.dmp
            Download

            memory/5936-114-0x000002807DA00000-0x000002807DA01000-memory.dmp
            Download

            memory/5936-125-0x000002807DA00000-0x000002807DA01000-memory.dmp
            Download

            memory/5936-122-0x000002807DA00000-0x000002807DA01000-memory.dmp
            Download

            memory/5936-115-0x000002807DA00000-0x000002807DA01000-memory.dmp
            Download

            memory/5936-123-0x000002807DA00000-0x000002807DA01000-memory.dmp
            Download

            memory/5936-124-0x000002807DA00000-0x000002807DA01000-memory.dmp
            Download

            memory/6136-180-0x000002453A4B0000-0x000002453A4CE000-memory.dmp
            Download

            memory/6136-179-0x000002453A4F0000-0x000002453A566000-memory.dmp
            Download

            memory/6136-178-0x000002453A410000-0x000002453A41A000-memory.dmp
            Download