3e0a082fab40d06765e2cff1e1fae9b726ad1614effe0c84669fd86c6ab76110

Analysis

max time kernel
147s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
Size 2.9MB
Sample260803-wccdbadb38
SHA256 3e0a082fab40d06765e2cff1e1fae9b726ad1614effe0c84669fd86c6ab76110
MD5 78691ec2975f2bb05850a3c866319754
SHA1 0acb3a12eb5d2c18526205ee88b72b422041b5b9
SHA512 74e83dd163eef5035f8fb8cf79b3fb3d61d2119953136fd74207520e381139a64b3a058fb57db11827d9e26f22bd51c22d724b7e88e6b29ad3a67f5cbf452ff3
SSDEEP 49152:Ld+1Fxk0bvyIxdIjfpxvnub3x1rnJOYnEQ6iShID6DDM3Nev38IXs0GIbOpr3xQK:Ld0xk0bvyJnnubznJhEiS2+DDj39s0WP
TLSH
T100D52306F7A0C2B2D0804575A582C7E7EC793D7E51416EC37BC91B6F6A25EC4A23AB43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\151.0.7922.72\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 29 IoCs

pid	Process
1080	2BD9.tmp
4612	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
2384	GoogleUpdate.exe
3876	GoogleUpdate.exe
4864	GoogleUpdate.exe
5064	GoogleUpdateComRegisterShell64.exe
5792	GoogleUpdate.exe
4996	GoogleUpdate.exe
1856	GoogleUpdateComRegisterShell64.exe
3180	GoogleUpdateComRegisterShell64.exe
2260	GoogleUpdate.exe
2368	GoogleUpdate.exe
4660	GoogleUpdate.exe
3708	151.0.7922.72_chrome_installer_uncompressed.exe
5608	setup.exe
4976	setup.exe
5852	setup.exe
5520	setup.exe
1908	GoogleUpdateOnDemand.exe
1712	GoogleUpdate.exe
4324	GoogleUpdate.exe
1224	chrome.exe
2828	chrome.exe
3032	chrome.exe
5196	chrome.exe
4908	chrome.exe
3508	chrome.exe
4844	chrome.exe
3512	elevation_service.exe

Loads dropped DLL 37 IoCs

pid	Process
2384	GoogleUpdate.exe
3876	GoogleUpdate.exe
4864	GoogleUpdate.exe
5064	GoogleUpdateComRegisterShell64.exe
5792	GoogleUpdate.exe
4996	GoogleUpdate.exe
4864	GoogleUpdate.exe
1856	GoogleUpdateComRegisterShell64.exe
4864	GoogleUpdate.exe
3180	GoogleUpdateComRegisterShell64.exe
4864	GoogleUpdate.exe
2384	GoogleUpdate.exe
2260	GoogleUpdate.exe
2368	GoogleUpdate.exe
4660	GoogleUpdate.exe
4660	GoogleUpdate.exe
2368	GoogleUpdate.exe
1712	GoogleUpdate.exe
4324	GoogleUpdate.exe
1712	GoogleUpdate.exe
1224	chrome.exe
2828	chrome.exe
1224	chrome.exe
3032	chrome.exe
3032	chrome.exe
5196	chrome.exe
5196	chrome.exe
4908	chrome.exe
4908	chrome.exe
3508	chrome.exe
4844	chrome.exe
3508	chrome.exe
4844	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
1224	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GoogleUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GoogleUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\zh-TW_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\chrome_pwa_launcher.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\fil.pak	setup.exe
File created	C:\Program Files (x86)\GUM381D.tmp\goopdateres_kn.dll	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Update\1.3.31.5\goopdateres_sr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.31.5\goopdateres_sv.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\ar_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\de_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\lv_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\os_update_handler.exe	setup.exe
File created	C:\Program Files (x86)\GUM381D.tmp\psmachine_64.dll	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Update\1.3.31.5\goopdateres_es-419.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\chrome_100_percent.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\et.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.31.5\goopdateres_fi.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateWebPlugin.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\ro_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\zh-CN.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\VisualElements\SmallLogoBeta.png	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.31.5\goopdateres_el.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.31.5\psmachine_64.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\bg_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\es_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\id_NEUTER.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\it.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\nl_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\vk_swiftshader.dll	setup.exe
File created	C:\Program Files (x86)\GUM381D.tmp\goopdateres_cs.dll	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\ar_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\ca_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\MEIPreload\preloaded_data.pb	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.31.5\goopdateres_ca.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\da_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\hi_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\lt_MASCULINE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\uk_MASCULINE.pak	setup.exe
File created	C:\Program Files (x86)\GUM381D.tmp\goopdate.dll	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\GUM381D.tmp\goopdateres_mr.dll	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\lt.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\uk_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\WidevineCdm\manifest.json	setup.exe
File created	C:\Program Files (x86)\GUM381D.tmp\GoogleUpdateWebPlugin.exe	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\GUM381D.tmp\goopdateres_bn.dll	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Update\1.3.31.5\goopdateres_ru.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\en-GB.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\fi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\id_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\pt-PT_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\ur_NEUTER.pak	setup.exe
File created	C:\Program Files (x86)\GUM381D.tmp\GoogleUpdateSetup.exe	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateBroker.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\IwaKeyDistribution\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\ko_FEMININE.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\sk.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\sr_MASCULINE.pak	setup.exe
File created	C:\Program Files (x86)\GUM381D.tmp\goopdateres_es.dll	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\GUM381D.tmp\goopdateres_ro.dll	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\GUM381D.tmp\goopdateres_sr.dll	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\GUM381D.tmp\goopdateres_ta.dll	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\IwaKeyDistribution\iwa-key-distribution.pb	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\ar_NEUTER.pak	setup.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job	GoogleUpdate.exe
File created	C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job	GoogleUpdate.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdateOnDemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2BD9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2260	GoogleUpdate.exe
4324	GoogleUpdate.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3032	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\AppPath = "C:\\Program Files (x86)\\Google\\Update\\1.3.31.5"	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\Policy = "3"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\CLSID = "{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\AppName = "GoogleUpdateWebPlugin.exe"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\AppPath = "C:\\Program Files (x86)\\Google\\Update\\1.3.31.5"	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\Policy = "3"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\AppName = "GoogleUpdateBroker.exe"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\Policy = "3"	GoogleUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ = "IAppWeb"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\Elevation	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.htm	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromeHTML	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3C8EDEA-D6E5-49DF-A344-FE31D1F3F412}\InprocHandler32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.31.5\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{BFB16C71-7209-4534-8A47-AD6BABC3A66F}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromeHTML\Application	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc.1.0	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C8EDEA-D6E5-49DF-A344-FE31D1F3F412}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML\shell\open\command\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --single-argument %1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\google-chrome\URL Protocol	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ = "IJobObserver2"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}\ProxyStubClsid32\ = "{BFB16C71-7209-4534-8A47-AD6BABC3A66F}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc\CLSID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\1.0\0\win64\ = "C:\\Program Files\\Google\\Chrome\\Application\\151.0.7922.72\\elevation_service.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\LocalService = "gupdate"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ = "IAppBundleWeb"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreMachineClass\CLSID\ = "{9B2340A0-4068-43D6-B404-32E27217859D}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Google.Update3WebControl.3	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods\ = "8"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{BFB16C71-7209-4534-8A47-AD6BABC3A66F}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFB16C71-7209-4534-8A47-AD6BABC3A66F}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.31.5\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}\NumMethods\ = "4"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\ProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml\OpenWithProgIds\ChromeHTML	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{BFB16C71-7209-4534-8A47-AD6BABC3A66F}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}\ProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods\ = "5"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreMachineClass\ = "Google Update Core Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\Implemented Categories	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromeHTML\shell\open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32\ = "{BFB16C71-7209-4534-8A47-AD6BABC3A66F}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BFB16C71-7209-4534-8A47-AD6BABC3A66F}\InProcServer32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32\ = "{BFB16C71-7209-4534-8A47-AD6BABC3A66F}"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3C8EDEA-D6E5-49DF-A344-FE31D1F3F412}\InprocHandler32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFB16C71-7209-4534-8A47-AD6BABC3A66F}\ = "PSFactoryBuffer"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\LocalServer32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CredentialDialogMachine\CLSID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}	GoogleUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2384	GoogleUpdate.exe
2384	GoogleUpdate.exe
2384	GoogleUpdate.exe
2384	GoogleUpdate.exe
2384	GoogleUpdate.exe
2384	GoogleUpdate.exe
2368	GoogleUpdate.exe
2368	GoogleUpdate.exe
4324	GoogleUpdate.exe
4324	GoogleUpdate.exe
2384	GoogleUpdate.exe
2384	GoogleUpdate.exe
2384	GoogleUpdate.exe
2384	GoogleUpdate.exe
1224	chrome.exe
1224	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1080	2BD9.tmp

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	GoogleUpdate.exe
Token: SeDebugPrivilege	2384	GoogleUpdate.exe
Token: SeDebugPrivilege	2384	GoogleUpdate.exe
Token: 33	3708	151.0.7922.72_chrome_installer_uncompressed.exe
Token: SeIncBasePriorityPrivilege	3708	151.0.7922.72_chrome_installer_uncompressed.exe
Token: SeDebugPrivilege	2368	GoogleUpdate.exe
Token: SeDebugPrivilege	4324	GoogleUpdate.exe
Token: SeDebugPrivilege	2384	GoogleUpdate.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 1080	3804	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe	89
PID 1080 wrote to memory of 4612	1080	2BD9.tmp	90
PID 4612 wrote to memory of 2384	4612	2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe	91
PID 2384 wrote to memory of 3876	2384	GoogleUpdate.exe	92
PID 2384 wrote to memory of 4864	2384	GoogleUpdate.exe	94
PID 4864 wrote to memory of 5064	4864	GoogleUpdate.exe	96
PID 4864 wrote to memory of 1856	4864	GoogleUpdate.exe	99
PID 4864 wrote to memory of 3180	4864	GoogleUpdate.exe	100
PID 2384 wrote to memory of 2260	2384	GoogleUpdate.exe	101
PID 2384 wrote to memory of 2368	2384	GoogleUpdate.exe	102
PID 4660 wrote to memory of 3708	4660	GoogleUpdate.exe	107
PID 3708 wrote to memory of 5608	3708	151.0.7922.72_chrome_installer_uncompressed.exe	108
PID 5608 wrote to memory of 4976	5608	setup.exe	109
PID 5608 wrote to memory of 5852	5608	setup.exe	111
PID 5852 wrote to memory of 5520	5852	setup.exe	112
PID 1908 wrote to memory of 1712	1908	GoogleUpdateOnDemand.exe	118
PID 4660 wrote to memory of 4324	4660	GoogleUpdate.exe	119
PID 1712 wrote to memory of 1224	1712	GoogleUpdate.exe	120
PID 1224 wrote to memory of 2828	1224	chrome.exe	121
PID 1224 wrote to memory of 3032	1224	chrome.exe	122
PID 1224 wrote to memory of 5196	1224	chrome.exe	123
PID 1224 wrote to memory of 4908	1224	chrome.exe	124
PID 1224 wrote to memory of 3508	1224	chrome.exe	125
PID 1224 wrote to memory of 4844	1224	chrome.exe	126
PID 1224 wrote to memory of 1948	1224	chrome.exe	129
PID 1224 wrote to memory of 3868	1224	chrome.exe	130
PID 1224 wrote to memory of 3052	1224	chrome.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Users\Admin\AppData\Local\Temp\2BD9.tmp
  "C:\Users\Admin\AppData\Local\Temp\2BD9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe 1072A419F29E71E7EE516CF283CD996083FA8DE692B99EB4169AA498E7D2C52FBF758E620B2131DED943BF7DAC18B2DE16823329CABC48C64E4AB2BBA4851B78
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Program Files (x86)\GUM381D.tmp\GoogleUpdate.exe
      "C:\Program Files (x86)\GUM381D.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={ABEAF2F5-6F67-5047-E06A-AE4AC462C4FB}&lang=en&browser=4&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&installdataindex=defaultbrowser"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2384
    - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3876
    - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4864
      - C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5064
      - C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1856
      - C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3180
    - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMzEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjMxLjUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTI4NUFFQzItOTUyOS00QkYyLTkxOTctNzJFN0UxRjVGMTVBfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezgyMDJBOTNGLUNDMDEtNDg4My05N0ZGLTVDNzI1MUYxM0I0Rn0iIGRlZHVwPSJjciI-PGh3IHBoeXNtZW1vcnk9IjE2IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMTQxLjAuNzM0MC4wIiBuZXh0dmVyc2lvbj0iMS4zLjMxLjUiIGxhbmc9ImVuIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7QUJFQUYyRjUtNkY2Ny01MDQ3LUUwNkEtQUU0QUM0NjJDNEZCfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxNTY4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2260
    - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={ABEAF2F5-6F67-5047-E06A-AE4AC462C4FB}&lang=en&browser=4&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&installdataindex=defaultbrowser" /installsource taggedmi /sessionid "{9285AEC2-9529-4BF2-9197-72E7E1F5F15A}"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:5792

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:4996

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files (x86)\Google\Update\Install\{569BFBDE-5805-4B98-87D6-46809C39C2D9}\151.0.7922.72_chrome_installer_uncompressed.exe
  "C:\Program Files (x86)\Google\Update\Install\{569BFBDE-5805-4B98-87D6-46809C39C2D9}\151.0.7922.72_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\gui8A01.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Program Files (x86)\Google\Update\Install\{569BFBDE-5805-4B98-87D6-46809C39C2D9}\CR_137DF.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{569BFBDE-5805-4B98-87D6-46809C39C2D9}\CR_137DF.tmp\setup.exe" --uncompressed-archive="C:\Program Files (x86)\Google\Update\Install\{569BFBDE-5805-4B98-87D6-46809C39C2D9}\CR_137DF.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\gui8A01.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5608
  - - C:\Program Files (x86)\Google\Update\Install\{569BFBDE-5805-4B98-87D6-46809C39C2D9}\CR_137DF.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{569BFBDE-5805-4B98-87D6-46809C39C2D9}\CR_137DF.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.72 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff6a6783708,0x7ff6a6783718,0x7ff6a6783728
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:4976
  - - C:\Program Files (x86)\Google\Update\Install\{569BFBDE-5805-4B98-87D6-46809C39C2D9}\CR_137DF.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{569BFBDE-5805-4B98-87D6-46809C39C2D9}\CR_137DF.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:5852
    - - C:\Program Files (x86)\Google\Update\Install\{569BFBDE-5805-4B98-87D6-46809C39C2D9}\CR_137DF.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{569BFBDE-5805-4B98-87D6-46809C39C2D9}\CR_137DF.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.72 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff6a6783708,0x7ff6a6783718,0x7ff6a6783728
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5520
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMzEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjMxLjUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTI4NUFFQzItOTUyOS00QkYyLTkxOTctNzJFN0UxRjVGMTVBfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezQ5REM2NzBCLThFOUQtNDRENi1CMzdELUI1MDM5Q0U4MTI4Qn0iIGRlZHVwPSJjciI-PGh3IHBoeXNtZW1vcnk9IjE2IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTUxLjAuNzkyMi43MiIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0iIiBpaWQ9IntBQkVBRjJGNS02RjY3LTUwNDctRTA2QS1BRTRBQzQ2MkM0RkJ9IiBjb2hvcnQ9IjE6Z3UvaTE5OiIgY29ob3J0bmFtZT0iU3RhYmxlIEluc3RhbGxzICZhbXA7IFZlcnNpb24gUGlucyI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9lZGdlZGwubWUuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL2Nocm9tZS9hY3lnNWhzZGlicXo1cTNnZHp4ZzZ2dnZpeDZhXzE1MS4wLjc5MjIuNzIvMTUxLjAuNzkyMi43Ml9jaHJvbWVfaW5zdGFsbGVyX3VuY29tcHJlc3NlZC5leGUiIGRvd25sb2FkZWQ9IjUxMjQ1NzEyOCIgdG90YWw9IjUxMjQ1NzEyOCIgZG93bmxvYWRfdGltZV9tcz0iNTA0NjQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIyMTQ3NiIgZG93bmxvYWRfdGltZV9tcz0iNTQzNzkiIGRvd25sb2FkZWQ9IjUxMjQ1NzEyOCIgdG90YWw9IjUxMjQ1NzEyOCIgaW5zdGFsbF90aW1lX21zPSI1MTM5OSIvPjxkYXRhIG5hbWU9Imluc3RhbGwiIGluZGV4PSJkZWZhdWx0YnJvd3NlciIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5996

C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateOnDemand.exe
"C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateOnDemand.exe" -Embedding
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.72 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe88fec9c0,0x7ffe88fec9d0,0x7ffe88fec9e0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1936,i,4786468626362288684,10705565496691433812,524288 --field-trial-handle=1996,i,7584164247931701447,7824868531819640247,262144 --variations-seed-version --pseudonymization-salt-handle=2000,i,8352923208084990228,4011074094242730434,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2032 /prefetch:11
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Time Discovery
      PID:3032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1620,i,14697489986118918942,6595907448598663276,262144 --field-trial-handle=1996,i,7584164247931701447,7824868531819640247,262144 --variations-seed-version --pseudonymization-salt-handle=2000,i,8352923208084990228,4011074094242730434,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1992 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5196
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,18035067924884047748,1470530883788137438,524288 --field-trial-handle=1996,i,7584164247931701447,7824868531819640247,262144 --variations-seed-version --pseudonymization-salt-handle=2000,i,8352923208084990228,4011074094242730434,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2576 /prefetch:13
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,15804438074558613052,3498510052643686095,2097152 --field-trial-handle=1996,i,7584164247931701447,7824868531819640247,262144 --variations-seed-version --pseudonymization-salt-handle=2000,i,8352923208084990228,4011074094242730434,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3236 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,8097270049244041808,3946140548187036942,2097152 --field-trial-handle=1996,i,7584164247931701447,7824868531819640247,262144 --variations-seed-version --pseudonymization-salt-handle=2000,i,8352923208084990228,4011074094242730434,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3272 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3880,i,16968935879918265836,1083254091274576819,2097152 --field-trial-handle=1996,i,7584164247931701447,7824868531819640247,262144 --variations-seed-version --pseudonymization-salt-handle=2000,i,8352923208084990228,4011074094242730434,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4116 /prefetch:1
      4⤵
      PID:1948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3896,i,15037970334259401693,5783002183954320325,2097152 --field-trial-handle=1996,i,7584164247931701447,7824868531819640247,262144 --variations-seed-version --pseudonymization-salt-handle=2000,i,8352923208084990228,4011074094242730434,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4144 /prefetch:9
      4⤵
      PID:3868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4780,i,8801371865590770685,10968816814355647823,2097152 --field-trial-handle=1996,i,7584164247931701447,7824868531819640247,262144 --variations-seed-version --pseudonymization-salt-handle=2000,i,8352923208084990228,4011074094242730434,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4800 /prefetch:9
      4⤵
      PID:3052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5044,i,3625114302768505460,15494121073459775993,524288 --field-trial-handle=1996,i,7584164247931701447,7824868531819640247,262144 --variations-seed-version --pseudonymization-salt-handle=2000,i,8352923208084990228,4011074094242730434,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:5108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5260,i,5975722707559686265,15567019548444448850,2097152 --field-trial-handle=1996,i,7584164247931701447,7824868531819640247,262144 --variations-seed-version --pseudonymization-salt-handle=2000,i,8352923208084990228,4011074094242730434,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5184 /prefetch:1
      4⤵
      PID:2640
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,7276676376628217464,6306196059797153809,524288 --field-trial-handle=1996,i,7584164247931701447,7824868531819640247,262144 --variations-seed-version --pseudonymization-salt-handle=2000,i,8352923208084990228,4011074094242730434,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5748 /prefetch:14
      4⤵
      PID:2604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5864,i,5606368938235190012,6193210027040561751,2097152 --field-trial-handle=1996,i,7584164247931701447,7824868531819640247,262144 --variations-seed-version --pseudonymization-salt-handle=2000,i,8352923208084990228,4011074094242730434,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5880 /prefetch:1
      4⤵
      PID:5104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5908,i,5131696894679115252,14473360855734731099,2097152 --field-trial-handle=1996,i,7584164247931701447,7824868531819640247,262144 --variations-seed-version --pseudonymization-salt-handle=2000,i,8352923208084990228,4011074094242730434,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5892 /prefetch:1
      4⤵
      PID:5900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6180,i,17288954878628342745,3215151382376583023,2097152 --field-trial-handle=1996,i,7584164247931701447,7824868531819640247,262144 --variations-seed-version --pseudonymization-salt-handle=2000,i,8352923208084990228,4011074094242730434,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5864 /prefetch:1
      4⤵
      PID:6076

C:\Program Files\Google\Chrome\Application\151.0.7922.72\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\151.0.7922.72\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1164

C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateBroker.exe
"C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateBroker.exe" -Embedding
1⤵
PID:6016
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /broker
  2⤵
  PID:988

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleCrashHandler.exe

Path C:\Program Files (x86)\GUM381D.tmp\GoogleCrashHandler.exe
Size 282KB
SHA256 457fcb266d6a5f83537b1b2fdd9fa58bd74f920344bd758276e65ce67d4f44fc
MD5 58332c83c4a329a744b0b98f934934bb
SHA1 4cd078891cda46b5f247d8759dc4cbc71a07683e
SHA512 52c13a6c6891cfd7acf84fed629982ce46f060836bd6356c152fb66a486be3eb06cf368650341a8dafe87935d1f1f1030949472a3e0da5be9c0ec3543f763877
SSDEEP 6144:fdrompNRhkx4uuQB239/ayEUoFWAOSB5IaxBqx+G/hOJ:9o6NRh+rB23VabgsB5Zqx+G/AJ
TLSH
T1B254AE02B9E2C472E6B219324D79AA6559FC7D3009318A7F23E40D6DDF74580B729BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleCrashHandler64.exe

Path C:\Program Files (x86)\GUM381D.tmp\GoogleCrashHandler64.exe
Size 357KB
SHA256 18193ae9cca962eef2411eac30d8c1b4c28adfe57cc459f2d1abe7e575de4185
MD5 788321a2c0c45f16820e00a8ba8fd3da
SHA1 3d40455f19df8d365fdae7504597d83088dad227
SHA512 2e00178b57f37bf82a66ed7a00553ce8103bae7975f9f20c7d6d29e4d713d351bc5e1d2575e901dc5d175932daca3b172cb4fb26b2cddf6fa04b74f0c6e2b337
SSDEEP 6144:vXyVG3Bz0uwNp1O2BNPFzvONiL8LWLf1gR24niLoD56s1pGvWGoh12IGIaxkex+e:vcwBz0uwNfOkNPBn8Yr4niLg56sKoX2P
TLSH
T1CC747D15F3A414F8E5AB8235C956CE1AE7B27C560770C6AF23E482963F336614D2FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdate.exe

Path C:\Program Files (x86)\GUM381D.tmp\GoogleUpdate.exe
Size 150KB
SHA256 52fc3aa9f704300041e486e57fe863218e4cdf4c8eee05ca6b99a296efee5737
MD5 a8fd9222e4d72596bb37da8be95c0ba4
SHA1 618fcf728b67fe5c89c9502bbcbc02d6b4551db3
SHA512 19a2f52461ab90346ffe370ca9170cf59c644f6b9fda37ca0a0993170d4483e717bb8c78f4a5889be78dd9af3f45abdd82490d1ba51f9542350b711b97d21596
SSDEEP 3072:hYtZ2/ylzQkBv9ahxzHyZtrFgLAQB+VlxKM/XhnI/u4ifw1l44lLgBr7IIliT3gw:LGpV6j1B+067E9
TLSH
T13EE3C612B2F4016DF0F3AB346875A7519A79BC73DE258B6D16C406AD1E30980EE21FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\GUM381D.tmp\GoogleUpdateComRegisterShell64.exe
Size 170KB
SHA256 851217168a52a238ba3cba3b6d0cfe122d4ba2e04fa848838559c0ea24c9fb96
MD5 bf76e03e95fd83c31b32639472a8edcc
SHA1 dd53a2d4513df4d9655dc7c453d9b430e5686729
SHA512 45f56d815fdbeda4ab90a6aa9ae2e47eb3b69f11134d9f0cae6cfbae5e76372824f33be36e900537101a422334ec66d277136520d0008e8e312cf340bb9b6beb
SSDEEP 3072:pvUBxXd7M8i0QlzH0vJZM64L2yjVznreCw5r3YrNZpoY46QLYa1Rtxt8:pvCxtg0QlzH0hZM64iKRreCQkohrJ/M
TLSH
T140048D4BB29520FAE1B29434C961990AE732747607B18B7F43A443B6EF633905E2FF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdate.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdate.dll
Size 1.7MB
SHA256 2200e11c6a72d65902239cdee540b2a7dbabfb9d99d189c8c5171e3334c24bd7
MD5 c19479674473e795a3d80423448a76f7
SHA1 bcc4c4d00dc41fe0237b67f8d5c13bccf3ea4ddc
SHA512 cb76ccf5ffa8c3b7aae58b48cb7a5d8c316d98bf9109c999310ea66bdc1c76a212912cc5e9de9111681c13376c1e66245f64afc5347beac7d639ec1ede3a5c65
SSDEEP 12288:HcwncOESlCXJV7jg/nnyVdSL1HUnfumRKfjeJqbDZdC5RNCHZsmTt+yhYu7:Hc6EHXJV7jg/+4tUnWUJqjXHCmTtlYu7
TLSH
T1EB85083165F583A7F36B3F30681D6B1439EB6F328491854A228B3729B9F2341D166F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_am.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_am.dll
Size 41KB
SHA256 3ef1d9b15455008c5858d4c46d8aa0eb0bd1fcedc806de29736d57b9b1fe90d5
MD5 00dbcb945cf9406c7a6df7b4df177d7e
SHA1 c4f48476bcedc4aa6b6c2d66362904fde1c657ad
SHA512 a370e950a70962a6cd408b02102b07f67d4b446c0373e79224b47e7c907ab20fe6773dcb2b77ecd8de4e93c8242c09613103e728aef64b929e3576670e81893e
SSDEEP 192:VYYeF84lK4dAFlDmdYR7A6eHu2n37jorbyZYaArr9ZCspE+TMoraDDcSwr0UPSwr:V9m84k4+J2L22eMTDkjSXiWi
TLSH
T1DA13527A060C5D0BE353FA31B5959A2E453369C86BE0F74610E4617CACB07332B6EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ar.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_ar.dll
Size 40KB
SHA256 8d43a96cb560230b63c829623cc135be71d983c262678957f1c14cdece51b07f
MD5 3bf24489e943d1dbf24c70cb6beff387
SHA1 bc7b77e9531b000a81ce0370e14a976c521b8778
SHA512 633baaa7867c8fe180703c6d90123dd32bf94d23ea768083d1d16139d41b9cc642878370dcbdbad64518104e03046af466db068c28a6633c930864e3367c0c9c
SSDEEP 192:s3VyVWBWyRgOQbCPrRkQtQ5Qh76+JG4mmi7jorbyZYaArr9ZCspE+TMcrjZJWJcE:s3VyVCWedkCLu+JGA022eMijSIibL
TLSH
T13F133FB20908E97DE7437A30C19ACE3F856351D19DC4732A25A4A93199F07216B1FEEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_bg.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_bg.dll
Size 43KB
SHA256 4dd8e82fa7c163a4a720aa7f1680f62f16667f3625aae3de71c76baf11ccd2dc
MD5 2ae38c2272a242c0d976277907bac47f
SHA1 eb4eb22f7f806cda7596d4c556a2f79902503d74
SHA512 1e767f5ef6d2d4c5bd9c3aa20da3b6f3af20d595b7978d479e2528ed955b7bab5871a434f046071c6f20dea7be346f94395acae172b0f51eddedd81387f63ca3
SSDEEP 192:bcN0dckbFmn7P8aQhHBOcrxl67jorbyZYaArr9ZCspE+TMorNw9JSNkCqcSwr0UH:bI0dckbeGZBOcc22eM39JS+YjSuihi
TLSH
T11F13DA7B65389A08F780B6704A968AFE2533778067E47782619F7874A478331371ED8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_bn.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_bn.dll
Size 44KB
SHA256 becd28b3967bf8535480a7906812be366278a0a6e268fb32cccbd63a166d7d86
MD5 a96e1be5900dc2e07d94f97ea002b52b
SHA1 3085982fe591dc55b37801c1a322ee0f44631c83
SHA512 d0abaf2fda903fed030b9f5bbc9ad1669fe9dae12be38f127a35155626a04a4c3ddf6c117ed8e5e432c115e4d974278c5306cd7f18a556af014f47a3150c66da
SSDEEP 384:TPvtvUx7tYF7qKF0FrHF6zjbmBwa22eMIODYjSrdliLK:7trlF0FrF3BwJODfZliG
TLSH
T11013FC3916087C0AE3ACB93462D59E2F0DE3758057ECF35420E4A5789DB13B61E5EE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ca.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_ca.dll
Size 43KB
SHA256 793d1fc22508cb9e44ba3ad47491b2fed115f9189e587d99ad1169b8130e5801
MD5 fcc0a90f93bd64eb65a81288fa4741ce
SHA1 fcdaf6ac8eabe2a6b2ebd970ac5d7b94433bcc64
SHA512 f4fe3cc6e8eeb61a2d911fe3bc895f12d193df8cf7b8e1a545816cfb5e9d43d88c84b63e7d14d3411de6e23b399be289c543b0b783833d121627b660f3d5b3d9
SSDEEP 192:4711Eft2C/lqA3DV3g532Ctm4Rdairj7jorbyZYaArr9ZCspE+TMor3U9ZgcSwrQ:4Js2ArzVuRm4bPj22eMeU9HjSYi1P
TLSH
T1B713DB7147E85A49F3F33F706875892D4E37B99198F8B34D1250A17888B0B50AA6DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_cs.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_cs.dll
Size 42KB
SHA256 96bc750f60c8dd6f13ae32103c86ca0f337e71db3ede788fd34fc4fb424ab1da
MD5 d6c5d2f301428a7030c363bf2ece9d0c
SHA1 420cc29279662d35eabe62b768102e171e2ef6db
SHA512 3fd4e0f280ef14d3f9be9ea28efa373351f40c4c64df41b8d7512297752a2e1db1614fddf63fe40fdb03eaa03bc9ffd8de69d3b8bea89203f819c8b0b2920b7c
SSDEEP 192:lL52yRT1BUoq1pah3kjoxyRETVW9uDb+fBW7jorbyZYaArr9ZCspE+TMorDjOicP:l8GBWpaJkhYwA+fO22eMbjSMXIiSY
TLSH
T17613FD7116A80949F3B77F3065B14A7E0D3778D1AEF4B34E119061789870780AAAEF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_da.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_da.dll
Size 42KB
SHA256 5471b168fd11baf62724bbb8367e413f0aec8cbb1bc007d7c6a16e45785b3b5f
MD5 60a3832ffd1a8695c9b29d6bde946624
SHA1 f743c2a58cbd5bbe9f308b6bb1996b57d88239a3
SHA512 09c22d91c311eb299838f95054118b773d775ffed08efdf1397b2238428c21799ff7ad028182c72fb1fb2c2bc6c62db289a9d47e5de1a5ab1a4e8976d6952786
SSDEEP 192:zjkCCoAh2FQN0SwtpYGqKab/7jorbyZYaArr9ZCspE+TMori5UcSwr0UPSwNyKhw:zAZfNnwtpTqPX22eMj1jSehiWq
TLSH
T14B13AA7117E84A1DF7B23B30A8B5892D4963BDC099F4F71D2194607C9CB1390A6ADF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_de.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_de.dll
Size 44KB
SHA256 7a5e494020c44b5886dbc8708ab8c77c587fd7374a3abceac332ac3e41f0d725
MD5 3acd6c359757810b1e04cb29cc2c5a40
SHA1 8f9d856aee9cecbcd5267578721aa3af66704c93
SHA512 46ef377b9352c443dad07db1d33a7a186d5e0891a46b4f9582c70b403cf5b7c9f74ef0157d2c4679f2bf50a0151f7e73a19aca8c7fe37dabbe7af324f3beec99
SSDEEP 192:RpKh0rMP2uA+wf8gPNfwCMPcMe6y6oNKVVAzJ7jorbyZYaArr9ZCspE+TMcr4Dg6:RowUM8QtPM0Me6INK/Ax22eMrvjSJZil
TLSH
T1B123647107E44A08F3F23B70A9759A6D4E73BCD1A9F0B75D229060789871740AA6DF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_el.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_el.dll
Size 44KB
SHA256 faf717aa5bb6105e153b55223b8161fbed826f7e53f210d29a7dc0f18c270e96
MD5 03f49287e4123424b130216f2c4d1d3b
SHA1 c3b1c9fe7e9b6f109759030b1b0cb1daabf2a621
SHA512 5f2ade40075e8f59525394ee431c60812f15f8ef788fc1c161b78a55d6ac636bac2fd7b50f6caee0e39eb2475de53b5af74a3c6c355597d059edf78e1726a332
SSDEEP 384:c5VEDleILkSIrGCSqlIxRFiAhAc8zBtfsBsTbI22eMmFjSSO0IiGxs:QeZlLO+R52/wHin
TLSH
T15A13B8BE096B5A09DB92B9F140628A2E4A6BF1C108D4FB6631F07074E97C7115ECFD1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_en-GB.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_en-GB.dll
Size 42KB
SHA256 9dd15d918bff76b4f96a3c9bdcb1b611d6e98d019116a35c818b4011316e6539
MD5 fecd297f108b6aab4065c6697f3b9b1d
SHA1 99c14d1859fb3c30725ec33f7c3005f13bddb579
SHA512 598750475910aa714d35c290263ff5671abe85a5a7c1f7ce061788822b81016db6a305153ae6b8047c6fc3005b640b32a6f435e7ea4e9f34321910a767e02fe1
SSDEEP 192:SSKg375a85yqaPafUMnKfuwL7jorbyZYaArr9ZCspE+TMorF9gV1pcSwr0UPSwNW:S9Uagyh6Quk22eMEgWjSFFik
TLSH
T11013A7B217E44908F7B33F30A9B5992E49337C80A9F4F75D2190607998B1750AA6DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_en.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_en.dll
Size 41KB
SHA256 51b119938d4236e8592262b6e561e2caacea5a36e889c33e77b7994aeda1d258
MD5 353a927fe73f1733ff22b56afaeed693
SHA1 f62806a2eb81915d32e7bd9abaddc6f97988b575
SHA512 162f73887027480ba0389bcfa0532850af2d13c938111c0e1d74c480605ddc4c0674338407548d54b3c296b0004119ec70473a9c187bbd0ab8679f0418aa585e
SSDEEP 192:q0jCWP375a85yjaPaJBopBkRJg7jorbyZYaArr9ZCspE+TMcrOdcSwr0UPSw5zXz:VFVagyWkLRY22eM6jSMFiE
TLSH
T1AF1397B217E44908F3B33F30A9B5996D4937BC80A9F4F75D2190607998B0750AA6DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_es-419.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_es-419.dll
Size 43KB
SHA256 23354fab7696b49b2fcb1e8d3c19df890f47f6f741d15fdb4e5e129651354c67
MD5 2fb1c3fb2b937bbbd2922eb61c068dbe
SHA1 f30d4f950f08073a77fcba359c1a0a9d0d96add1
SHA512 9dacc1ec8cc3c11810ac5e3d7489d2ca312506d52b511183b4107df7bd1f589e36e364f8e93163b479b7f9d105053bbe8dc6d4939b9566ebb97545b4529f5b20
SSDEEP 192:GNw4yPf5pA7FGiS7jorbyZYaArr9ZCspE+TMorol+zcSwr0UPSwNyy27bju3R7:GNRyPfs4122eMll+UjSPi1
TLSH
T17E13A67106E85A49F7F37F30A8755A2D4D37BD8198B8B34D129061798CB0B40AA6DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_es.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_es.dll
Size 44KB
SHA256 410faf660eb345c8b6903ed6e1ca4b009734966634b97f88a1fde1ce1b1b2ef2
MD5 34ce4d172783e66252ce877a6c0e7b7b
SHA1 0ba7171ce6af765a44e916fc9ee743dfa2e4dec3
SHA512 f55dbb54a23ddd30ad88c7f11ab0f0ee63005d2a2f95c8a28bd3413ebea48cf11afcbe38aa255b0c2af86c1482268929e63d7684060bee5198abd85c00901d63
SSDEEP 192:9MlwTX9NmpcagbPQ2e84IE7jorbyZYaArr9ZCspE+TMorJ0ehcSwr0UPSwNZm7bo:9nTtNzf1g22eMJe2jSXiDtR
TLSH
T1E023867116E85A4AF7B33B30A875592D4D3B7CC199B8B34D129061798CB0B40AE6DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_et.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_et.dll
Size 42KB
SHA256 a384789ee0657c9bbda1648f122d2a0169417b31c5c0deeeb3b619b7080a7646
MD5 d52ced8c9b46c41b3e0a2212399dbba0
SHA1 5921f746c34c80c6cb57a7de181c07082ce91c7d
SHA512 be9d5322be4f3630ff2c27dc76a402fc640aac75bef3686e3ebc03e405768bfaa8be876c6151e9fc501dc8c375af3c7ccd06a57262a5c0f416cab2af79771b9e
SSDEEP 192:22R6vrbDFbDmINuBnxLZBfhN03Fp+j3ih/4gz7jorbyZYaArr9ZCspE+TMore3D4:2KKrbDFbDZETJ9TSQw22eMIjSq19i90V
TLSH
T14713A8B256E45909F3F37F30A8B48A6E496379D2ADF0B34D119060789C70781A67DF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_fa.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_fa.dll
Size 41KB
SHA256 95d81b971af84e46fd0065603d1f3e28645d1fab2d398a4bf791ddf80ef98794
MD5 f2fd854c834426b17a8a360582447ec6
SHA1 9557b6821832cb1d6f57b63b7d35ff6eb6c744b8
SHA512 b8ebf50dc7becdccb3848eb0f6660fc3932bf3d783a0901d0d871bad363975363e7ec63c1111964c8007397c9d03293d46a0ee095e7dd7375198dd7c9075e27d
SSDEEP 192:h64lT1Uvm3nPNLEJAisOH57X7jorbyZYaArr9ZCspE+TMorf8FlUYcSwr0UPSwNo:hblZMK9Y5X22eMboZjSdifPeEe
TLSH
T157135F764D56DC78E7527A30C14BCD3F152362D8A9C0BB321AE4607CA9B03A96B4FD1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_fi.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_fi.dll
Size 42KB
SHA256 2b628c98debee4333f32b82be0f0400a629c5c53ce85741067cd949992da171c
MD5 6704a26e7cfa8cdc18c82099ab41953e
SHA1 498cc1dcedac5d22f3f705df41b9430350f34f74
SHA512 ce58be44fb93e3252ca4b1be3baed19c42bde95fc68edd1161b44efd8aea571fd31922834041dda8a177492e49f3db7e0e82ce0417e92c57f42875308030e727
SSDEEP 384:x6ghfEzPhXY7RzYd99hKh1GAx22eMGjSmLfihI9:okfEVmKgTuim
TLSH
T1F4139A7202E88A28E7F27F3055B48A2D4A237ED26DF4F35D1990617C9871741A53DF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_fil.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_fil.dll
Size 43KB
SHA256 f5768ac0bb7ffc93a1684184bfa26d4cd1b59f62d3f59017554f2fde85d36eda
MD5 9b7d2c86e7836e83dd5c8139fb850111
SHA1 b2cc5f58d01c963a32b66a7bd7da692c4a3077df
SHA512 8baccbb825d3cc053c6b71057cf4d6f8a5ee4a8246127a7e237d3c72e374177a2dfdd386d396ea6ab8fb9ef20853f8186fc40285baa5b6dd2f6be1b7283b9653
SSDEEP 192:UjGCZKVHN4U2m7HjU2BBweQP+R++23RKybRaw7yjgI7jorbyZYaArr9ZCspE+TMz:Uj5KUNPw+B3RVaw7yp22eMCEjSJiwa
TLSH
T1A313A9B21668590CFBF73B30A9645A6D0A37FC81A9F4B745229051399871380AF6DF3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_fr.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_fr.dll
Size 44KB
SHA256 9697b871323b58616bdf0599b78a338ebe5d52dac71602a9c8f4ce978280f2c5
MD5 39b5b5a163da13a67685ed271e65c7d4
SHA1 4962be09097b1be204fc62935db3611e45ba2081
SHA512 0a09d743ca956ddc6b32536859a3331e69716b6c5868d1c50066be44537d08b8fa6fb73f6ba1c2b9a7ca7460b831a6d3b0470b0a39570ad89d8aedcbc72ad9a5
SSDEEP 192:5MChNqV6eCqWgcE6298EnF6KvOVva69P/+cYKQlX4xj+7jorbyZYaArr9ZCspE+i:5Ta98EoycpW4xU22eMSLjSkimy
TLSH
T11713777117E85A09F7B23B30A879892D0D377D969DB0F71D1190A0BC9870B50AA6DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_gu.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_gu.dll
Size 44KB
SHA256 7aca18a32a0992b41497274be6229c3015fab9c1df6faccaabec49a57f35351e
MD5 59aa2beab959d055288a5add9f42d116
SHA1 6221bb470e004a9527c050bf48aa9f6428649f59
SHA512 408a877e92ced290f7366d94170a9b08395e0dd855d08f4f3fd8541190d37d0c1ccf790c088cdf61be7dd1d8e7e5fe7897fff027d9543e8a3db77236f697d87e
SSDEEP 384:+HP3UreAV4DnYCRfwmkIK22eMEjSmGniFj:AvUre7hbymWih
TLSH
T18B13327A1A0B598FE359B930A1A4993E472714C0DBE0F30310A562B9ADF1323775EF5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_hi.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_hi.dll
Size 42KB
SHA256 55d9fc462329a0e043b2eb07675405ae5c1a0f03a80a49b078cd054827136f28
MD5 9adddf414a4fbdb1c3b3d55d03f232e6
SHA1 f3c84a04912d413db4c25a75f7d681d2abe03ab6
SHA512 a29b1cc5254fa6650127793edefe3ecc1bbd356cfd7d2d7e0eeb9c14222b3098e23e4ed9085f6127410d59d6b803fac98f660ab7e52e62b3f99ba7d910623ea8
SSDEEP 384:wcGh6AN6AQqjexbyqKXhHqCE922eMaU/jSyi1:ZGh6AN6AQqjexbyqKXhHqCRUmyi1
TLSH
T187131D7205004E2CE38C7E78E0658ABF4DE76091AACD338669D171B5ECF537A264ED4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_hr.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_hr.dll
Size 43KB
SHA256 5f28613e3579ceee840ca40bee9ecb883e08d56a217cb184e9ca21bc998c8e68
MD5 fd05f71c6677b96334763d8ce58b4a90
SHA1 f2815dcae9d30e7b9cabbb4d006355ae22c93b5f
SHA512 81aa90c2056e779be92b975e7c79462b06f154f626c29dd3f4e348d027f377c7734f794e621a833d6905ae6f3f41d09030fcc72085b925cc3abd762d1a9d3471
SSDEEP 384:txDNNOXz19szMH5KBL/b22eMKHjSUiqSk:DD+5oL/PUiqJ
TLSH
T14813DD7156E81A49F7F33F3065744B2E093B78E1A9F4B30E118061B89971741AAADF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_hu.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_hu.dll
Size 43KB
SHA256 a64410f363cef01c1a5d456658b59a9229b4459f59ff411449e956f8ede67fc1
MD5 084478344c986857fc934ca4e47e7cc8
SHA1 9b2323425998eb262046ba2700c58af611c4cbb2
SHA512 36690ee993c3bb47634363394eb8365897e21aad78d27f4335e3d8ff9aec5c40253406e0959c274b26172932da451155ebe783a12740518ef634f43561bcd726
SSDEEP 768:9i7U7RPX1C2TycfBwGFTbeSDY6931lBVZpjqAy3FGVsBHi1:9i7U791C2TzpwGFTbZY6d1lBVZ5qAy3q
TLSH
T12013E07112E85949F7B37F3169B58A6E092774E0A9F8F30E5180A1BC9871740EA2DF1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_id.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_id.dll
Size 42KB
SHA256 8a9b0d71af60bfab591afe1e76cbcab7f5d6dd43a8d9abaa1f2f5499b4d77aa2
MD5 3bfefe5a26be24f697f2a7aa51557bac
SHA1 246f00ee4bb3c9e84c3a0d6df73b55105493a2a8
SHA512 03f4a327cb507098611a70e05167b1ceb97d572fcc5260d993f1d6d9f01da1e87b245fd169e1e6b9ca92d52ceecc7982314c83598be0876b532985509f9382be
SSDEEP 384:kWhaL3THRNkAHqQ3lFRf2I9ByrUC22eM3jSHii3:/hihR5DCi3
TLSH
T11813B9B112D8594DFBB33F3055B49A6D0E27BD82ADF0B359219061749C70781AE2EF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_is.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_is.dll
Size 42KB
SHA256 19b7009d4c028b97b0bbfc1e0cc9f468e1dc2a4b948085820d8726403446ecd5
MD5 c9f7ef25e5f06b541249f772f64ab11e
SHA1 cf636b3c87a8bbb4e0f024060f44571bb2df2665
SHA512 c3350f9607246e59186b289965912480b30d15375866ccb1dfaeb571a009a38057977d5cc5c6a51080b899f01b2f67bf67afc3b368f838249e3d679b077a3192
SSDEEP 384:27AbZcioif2lIBuAjYkUVQFoMUefV33D022eMEJ7jSBi4F:nb6ibAIErkUVQF5UefV33ABig
TLSH
T15513E9B59398590CF7F37F3050E59A2E0A27BDC29DF4F709118165788871381AA6DF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_it.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_it.dll
Size 44KB
SHA256 9e2dce5718d0a10dd874e93e5deb45db1c7d76dec12463ebee5867c0f28319fd
MD5 c228e8c1d87063081c0b627c7cfae619
SHA1 7808bc36aae7bfab1accd74a429a6a51b4c650f5
SHA512 8b3c051fa14224ee3a0b23ccb87127e2eae64bb043f0ec17495eaf766aaad35975db422f3c5b91be1c8fe8a9a6014e94389bcc2c766ffba780a77c65ca34e43d
SSDEEP 192:D6TWlNTI6btuPDKYB0i6w3Blf7jorbyZYaArr9ZCspE+TMcrEQfecSwr0UPSw5l0:D4WLIN+shh33D22eMcfTjSTildq
TLSH
T18913737117F85A08F3F33B30A8789A6D4937BD8199B4B35D119150BC9870B10AAADF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_iw.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_iw.dll
Size 40KB
SHA256 70087cbbadb130c1b9187c0143067f8b484b1e49403a29610c3134e35154e7d4
MD5 e5a15bf19e7ad58b20e06fcf618cd8c1
SHA1 de61db44da675a70abb76855c9a256d77fc9ff51
SHA512 19bf21a9a4ec99208e9c4f4dd9516b16f207d283df75752d9b47627694858eb8c4bc952a8c9f956b5215b4256aa7a0c7fff24535036d885ca164a074edc2dc6a
SSDEEP 384:JGwv7hdVexaDywGfJssp22eMSRUQjSNUMi1:g4NM1sRUnZi1
TLSH
T1F50344710A10D9CDEB11FE32D25E8E3E4933E6C056E4735320A86470ADB9791AB5EF2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ja.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_ja.dll
Size 39KB
SHA256 67e106cc59c053a19558b5f98853ec053a66e937c8c7811d712b5475192a6017
MD5 6cf80cf8444c5a60ac7ab64270caef8c
SHA1 1def3d7ae139944a2a095e51ec2379a081194c2f
SHA512 060b556730d46689de8de04e93edf5d0f16ad9654d1c59359d69c8a7384333c2b16123e876e46bef3f71387db11d5541293f612095f753a8a595d206f7edfa7d
SSDEEP 192:qNwNrkl4EAnej0FgW5E9jbjZ7jorbyZYaArr9ZCspE+TMcre4d4uDmwcSwr0UPSR:q+bEHj0FgW822eMgdvGjSPiJy
TLSH
T1DC0371F626104D4EE7F27AB08195EE3E4A37F1D09AD07B8124D0A075E8B07516B1FE6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_kn.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_kn.dll
Size 44KB
SHA256 9aec514ea4a7e54e87470fd54d0d49b91e78e1f109acca62ba87621e67b5ff88
MD5 2b09bff542012b0ff601a226339ccd9a
SHA1 bad683a974f5084b9db43ecc666389cff4ca506a
SHA512 49c51d94db677fe36d652817e84846bd8a94fcc07bdfb350e44c41a4fc211cd27a88e2245c466f236ac1e66dda81862215c0713653f02fcb13d912b8803d1bc9
SSDEEP 192:YHakFHMVlOzM3Hw+a1Osb/pSJGJw7jorbyZYaArr9ZCspE+TMcrJCQcSwr0UPSwv:Y6uEIRBS/22eMJhjS6Ovi7
TLSH
T1DC1330B9063A9C0AE7C0BAFBA192593D852359C257E0F3812094507C9DB07B66B5DFCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ko.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_ko.dll
Size 38KB
SHA256 450b7c9ad8573255f7c5324a722c2c7b93830be727b8dff8de7341b1d05001db
MD5 7cb07af24a968d628b44c3daeb2f563c
SHA1 1f841eea28f40bc24302189798f362e3d3713cd9
SHA512 0443572fe97f3de3a7396926a35aba4f7b35a939b54e889383dd23a24adc1ff644135273d4669f07661f5a4885fb55a27bb90b60f7c3eb15db94a88505567785
SSDEEP 384:OIUVUzd4IY+N1vZsYoRHgA12plxB4xRkkTY1M5tkOg22eMNjSSp/i28:OJVU2mAf/jvTK/iV
TLSH
T1710382770624DD4AE7517A719186CF7E8A3361C09AD27342B5D0B1B8ECB1390B72EE4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_lt.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_lt.dll
Size 42KB
SHA256 bd42f59bdf72e73de1b589762fd3e0a29ca7a34d79ddd3af68c04e3eaf78e1b2
MD5 61f5639c86f0ae717530c675b78bb286
SHA1 34d3ca6fb143e7584dc249a596562431e40c8a7d
SHA512 bc9ba16c286775d82004210697ce630142c7118f1170a2a54dc1a1986fcaa3f1866f2882f559abee846f80c91bb176beaadfd842403dbdebe51bc30c03f813e0
SSDEEP 384:fZ93nc9eHz0CwTmDq092X522eMEzMQ44jSUyiU:hZckHz05TmDq09DM7/biU
TLSH
T13713E0B152B8594DF3F33E3091B58E2E4A37B9D169F0B30A10906179D870790AA6EF1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_lv.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_lv.dll
Size 43KB
SHA256 0b95946af728d6ea0464e91782f2b13d313b8a7bb2f0dd630b83d01994d1b473
MD5 a9af9b87f29b94c6d983221d3e1f5a56
SHA1 19ad611fe1acbd51befedd6e17d311baa7988c7b
SHA512 cc443c5823d3a2dba08e7d23140366b98cd8a7452600f9fec0b48dea692cf1018974d2c56e4e405091a5b16a031bf7affc0f22d6237daa04f4b79d13fea9bffe
SSDEEP 192:W8CUa5yA+IkEuz5QBvBsvRnHqYdzPEIcr4h/asfXGCSBVrXsF6cJtxOpQrj/Mi7N:WjH5yAxOeK6ej22eMojSWAiNU
TLSH
T1E213BAB116A81A19F3F37E3065B48A2D0D3778D16DF4F34F1090A17999B1B40AAADF1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ml.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_ml.dll
Size 45KB
SHA256 89bed392d935352768dccec10c4653f743b01d162489e730762088e7c1cdedae
MD5 cb5c956bbed87f97b0e82984688116fe
SHA1 f1f7ec5063e9754d52148c55077ee8c1a0b77ed3
SHA512 61bdc1a3719893d139acbeee1b7b28ab59bbcfb5802754371190c3d1adcdd10e05eb8a226f89062d8a09400ca66f5241c6dc1a74c2aac3f947cc17dfc62c5a30
SSDEEP 192:wZ41BL6sWWyg0CkTh4+UR4n/JLmnP7jorbyZYaArr9ZCspE+TMornV3wn1cSwr02:wy1BLFZygp8/JLe22eMkqnKjSEi8r
TLSH
T16E23317B1508FE4BFB9CB57079464A2F44AB1A8D8BE4F750109060B97C7A3132E1DE9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_mr.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_mr.dll
Size 43KB
SHA256 a86648bd976b0ac656071988afef0c5546b990fc795ce7118b709006ce4f1c4c
MD5 d1bb5c19370ce579447853e790007110
SHA1 35017227523fa14fc9abbeee11b020f25c2f2a25
SHA512 f92211ffaf82488867e366d662f8277502864d8d4e3331c29bc2e17872579e1f32a873b5b3f872008f599cd0ac851af70d3e5b71b9aa8e27e86cd669a10c0946
SSDEEP 192:M7L7d4/7JFk7bABJjYcL4zX7jorbyZYaArr9ZCspE+TMorUOA5cSwr0UPSwNqG7L:MP7d4/7JK7bABkH22eMJOvjSciIn
TLSH
T1B7131E7905085A1AE35CBAB0F0A45A3F0CE76880A7DCB38519D571BCECF4336665EE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ms.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_ms.dll
Size 42KB
SHA256 c83271699da2bdc3cc900c391e46bef0dbd1ff472606f56b220a30ca37e51d89
MD5 b5fa26645ac880161dcdcab8f327a7d1
SHA1 f7036ef17fe577210ea518754c52da275bb87df4
SHA512 ce46a0532c222dd633b8832c9e4a698d5e0877eb6871ada56bc4f5346d9da87f1ece125f617c3186f028a98760728edd3823ae7c1e519c216bd0a2c8b707c46c
SSDEEP 384:ycmv4FCrQLtUv6oNpaMkYjZZ/fbMgTRlREO22eMCYjSSAi47t:QPZf3TFyfSAi4h
TLSH
T18413A9B11298694DFBB77F3055B45A6D0A23BD82ADF4B35D129060389C707C19E2EF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_nl.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_nl.dll
Size 43KB
SHA256 c15c5bd991f92764866751394011715f76fde688e041beafd2eeef5757c56d12
MD5 d71c93a2dbd3466c5e760f0e97496bc7
SHA1 f6bb1985e50b7901c9446828e1e4017c39fae097
SHA512 e8ac7412aa30ec99815f0c861800480545649ce8a7a80402734a3b33fff2518cbf246559eb37eca48df8762c55b576baf6da24e9dc33512925c1f37fe01ca228
SSDEEP 192:t+vCTaXd/mkD3UK38yAa9W/1X57jorbyZYaArr9ZCspE+TMcrXcSwr0UPSw57c7X:UoaXd/T3kV22eMljS4cim
TLSH
T1B91388B217E84A09F7B33B3069B5896D4E737CC1A9F0B75D129061789870740AA6DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_no.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_no.dll
Size 42KB
SHA256 04737bf110148fd72d527e52fec4451eadf6938453c7c3f0efb39563269088d0
MD5 ff73a06cdad7e02e7859c9c85ed103fc
SHA1 4daa755ac3d20c697b4bd211fa2c3992901ab7f1
SHA512 c97e57a6d8702c37d8b09d79149ad07be9d78b6fa79f716d2d56b07a6ee98ab41b5021a84eaf19f897923fd559ab483005274bd469583cb1669358661ad3e412
SSDEEP 384:2r5JZSiyCSiyz9VvAYiTvaK3QH22eMnjSNzir:X9VoYGiK3QKNzir
TLSH
T14D13A9B117E4490DF7B23B30A9B88A2D4967BDD0ADF4F70D129060789871391A67DF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_pl.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_pl.dll
Size 43KB
SHA256 b67738a3e15e9540006696b6dec485f63ae979c3e2902bd973afdfeff46bd117
MD5 b078eb9d50ca147551942046a4835c50
SHA1 63ab449933ed3cd5b08f3dd294326cc22353754b
SHA512 ac2751c2e7cbfd8e0473d8937c6075170aee133319b321ec5d00ab393d8908fca4d8fae5893e6a060984a2610b6de01a9330dadb5ab9ba0f5026e7344fffcb95
SSDEEP 384:15OLn7KZHCCA7U8Gp6a22eMo2LjSD2i7s0:10vy3AIyF2Sai7r
TLSH
T1B213307166F80948F7F37F70A1B55A6D4A777891A9F0B38A218061749870780AB2DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_pt-BR.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_pt-BR.dll
Size 42KB
SHA256 c9886e25632bd282e0b032932bbc8c162152f20acba557534f48bd9518f02d9b
MD5 54ee66e53e9c8e866a9e802bcaeb45df
SHA1 f5b4f2f407921b97cb5916a43ba23d9683de0b1b
SHA512 d1fefc460728777224927d760716a7c572420f3be85a0090072b4f8461be88f8104992b4ce2fb6071868ad718848f84a0a87a99a3585fc767df64c432a9826ac
SSDEEP 192:evOC+ECEcATb1k4J8T+7jorbyZYaArr9ZCspE+TMorgY9EcSwr0UPSwNNk7bjuUF:eGwZcOZX8022eMqfjSpiK
TLSH
T19913B77246F81A49F7F37F3165745A2D89337991ACF4B349119060789CB0B40AA6EF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_pt-PT.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_pt-PT.dll
Size 43KB
SHA256 2223dda270aff074c53c6164c2ac724a62e2b8650a02bed7de97275ba78583f8
MD5 ac701bf7d8449609374915a59568e9a9
SHA1 d8f7e9b916cac9853599964ac250e8585951fa23
SHA512 98fb1054f57d2c9eeae59b4a87f1f35b1e46f64a52863fdf8a1559011d7f437ffe3749e32522016c6ca8a043b08997323ad6523ad912f9f6d78772b1f4783718
SSDEEP 192:8k6/jstlLBvExpCxNowB4t7jorbyZYaArr9ZCspE+TMcrxjcSwr0UPSw5/67bjuP:8TLstnEx6ewBK22eMYEjSc6iEs
TLSH
T19A13B67257B81A09F7F33F3164749A2E49777891A9F8B34D119060789CB0B40AA6DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ro.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_ro.dll
Size 43KB
SHA256 458a00a8f410b15af3506fd8c7cf3046e040ae3fa8a9b20abc1e839a0a6e0e9e
MD5 9d0e9c619ed62aa00def2ccf1feae02d
SHA1 6acb3588023a909a3cc7ec24539302a2ab2ea519
SHA512 5c5a26298266e5da9e6f02248453ea8bc9e82b88257236a4302a078ab86f1baf16c5d2af5898fa41eb50a2f15ad99be366f5631a4c12d89dbda21813dffe49ef
SSDEEP 384:aP50CRNNDMBVx4m0GdVqTFb41naEp422eM2LjSnYiC:C0CRNNDM7qm0GdVqT541naEpNSnYiC
TLSH
T11613CD7117E81A08F3F37F3068745A2D0D3779A299F4F70E158560789A71B80AA6DF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ru.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_ru.dll
Size 42KB
SHA256 a71195e66e1d442a3aa085be00d7e3ac8a9330384ecb2d32853c80b827999040
MD5 6b6934552f82d9bb315ffdcc820ad0ed
SHA1 9d28677d4399b431e1a4a4b38e2d847c91bd9e93
SHA512 e306401b022bd42e3357ef32766499524738070ab8dbf160f1590cda39a7f8f193aed1f6cb9fd8ba3a24504076bb32d791d7d1ac3d8124cee0a66758b1dab9cb
SSDEEP 384:iOhFA47AvHlho4d2Z22eML7y0jSjDiOi5DR1:pAvHUN78ntihz
TLSH
T13013FD7F66288908E750B6B416628DEF1437739067D9B782609F78B4A4B4331372EE4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_sk.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_sk.dll
Size 42KB
SHA256 0a658f7d9369a15e169bb23481b90f5a62e5ffa81f9becd4d8ea996be7f022de
MD5 041a1e40521025f1758603292088909a
SHA1 fdb8d6849c7b050a60f224f62d9692e2abbbfc0f
SHA512 9310bfdb046a3c5290af7dcd8578fb010342e1da7a2007e53ed21f6952e0084fd28d943fa2aeed266da603d6e58c7da55afba7d3415fa026e7eb13c1a4b38635
SSDEEP 192:+SDjwFADgKRHaTkQUVmcZ4lQHKDasT9w47LqeWcZBg7ULutBndS7jorbyZYaArr6:b/48uhJPiR6gLTC22eM1jSL5iJR
TLSH
T13D13107212EC095AF7F37F30A4B5897D0A7B78D1AAF4B34A5480A17498707806A6DF1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_sl.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_sl.dll
Size 43KB
SHA256 f6271557d8826baf49ff1ad0427c0a521d0b922fa45ecc5013b1476624cfe35a
MD5 b3ae185cbd945e4976aa19e5ee4dc49f
SHA1 432b09adbc811bb8287a8ac28c5e26eb1b5ac48c
SHA512 dcef12de0c0ee5f346d3d99753bcaf630ba96180e6786da238b3be72e5a94c620040503821a99868511999aac8be6dc30e05a893bd91b69bd55aeac148d30c08
SSDEEP 384:bBqTsshVyigOHHTpWBdH1i2IXousQ22eMO6ajSfzivYI:tlhOHHy1YZsJsfzivYI
TLSH
T1DA138B7212B8194DF7F37F3050B44A6D493779E1AAF4B30D119061B898B1781AAADF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_sr.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_sr.dll
Size 42KB
SHA256 631072bbf64f7cf993a4fe540b2e1be86da1f62cc3cace32ead1ee2d77132b21
MD5 6fbe46d37d3fc74bc39923f0369c2f08
SHA1 dfc9e55d29e073ed98b271a3461a91c6df9b9d69
SHA512 8139f3d218163e5244af512c6d6b39bf60938f9160a48901dbda696b769f9f8b04b6e6cbbfe976865c151515f306cb3b8c82c7bbbca3fa4fbdaecfefe2f91483
SSDEEP 192:1wl7iw1xfPp56k4iRH0Dt0IkRWPwhlPhdKPFJk38jcS+vkG7y37jorbyZYaArr93:1Mn1xCx7UjYN3tGW22eMyy3ZjSrig
TLSH
T12213B63F65789A08F781B6700AA98AFE246B779067E47782608F7C74A474731331ED4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_sv.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_sv.dll
Size 43KB
SHA256 3cd1a8b7a4b11a55b79929142474bece2e1a81fce55428c5694ebf91876c2968
MD5 f76c760646da06c4f9c210c5b2e072e6
SHA1 e376e680c34f3d9630ca195a32efa48a79e77381
SHA512 47903f80cfe0b61d8099425a568da94e1114622becf35ecf615271ec9a27b88cf2f8fbcfe139ee3de78e9e46b4b95fabead9d0fa29c8147711e6e954af523f96
SSDEEP 192:NPbEHzywM1ywMeoMxYPEO774jZed+TxMxS0zEMU7jorbyZYaArr9ZCspE+TMorp7:NzEExC7Ec3E922eMpmTBjS6siX
TLSH
T1041387B217985918F7B37F70A8B58A2D4867BCC09DF4F319125061BC9870741A6BDF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_sw.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_sw.dll
Size 44KB
SHA256 3f181e059987f9f497c88c3d4f68a8b0e926706caf3c01e7910165a7b415953e
MD5 a77f112695b25e6037c30d03725ae333
SHA1 e9ec8de5898a15884647721124c0a49fac83f06c
SHA512 4ba3c0758307270e4616674cd60062422703dcc20d7956bd286ed0949c04055a723cb6a092c6b2ef9f18dfc60a15d9b98661c71b8d3ee5a28cc64efb08d0a400
SSDEEP 384:6JEgicgiY7upr4M5S22eMaDK4SjSui4x8:aEQ07Gr4M5LDpVui46
TLSH
T1C2130E79161C5D4AF3F3BE31A5D4AA2D0A2379926FF4F341109050789C707A2AA6DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ta.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_ta.dll
Size 44KB
SHA256 e1cb6b26c6649e9c0fd1dc37f1221fc2663236398493277ba653ada687efa625
MD5 6a65488dd1e761b909b49a8444cc53b8
SHA1 7b16982e5ebcdb7051c09a8d5882a21a5512c060
SHA512 ca3a37879889c68db608b7ee446b338964ff96a20b55cc709888fc123778a13230718adf9d2d08049648e4bf8170cd0364a933152a4ef6afa11b7691c5038a0b
SSDEEP 192:jzar05wspwb75p1bGBiZpXbRpqbGbiCD4b5OIc6J2jNH7v7jorbyZYaArr9ZCspd:j+r8wsY51ZLm+4HwH22eMlIjSFirB
TLSH
T1E523223D0A1BBC0BEB50B931B569993E05272980DBE1F3B010A9647C9DF4F22665DF1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_te.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_te.dll
Size 44KB
SHA256 62ce40ff9dad7560fc172ac6735482d059257ba8df6496207c3ed8141b120a1d
MD5 6483752522c32d8d31785e918cb8aaea
SHA1 ce6eab2497fda0ed1cf3f2e89a73bd437aeb8776
SHA512 da2db36c85e47f2bff9378da42bd8960e1091ca458e3175447b7911c321842a4bc071a2c5a3f9dbdbc543a5ca248a10b202c802821c69b0bca4dde48df086611
SSDEEP 192:SXbcvNf0Lw4K1kZ4t657ymVTi8MOYtiuSOnkM7jorbyZYaArr9ZCspE+TMor/8lL:SrcFgw45Z4aJ8LD522eMP6jS3iU
TLSH
T1C7132E7909085C0AE3CCBAB071989A3D4C6355C0AFE0F76290D56078EDB17776A4DEEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_th.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_th.dll
Size 41KB
SHA256 328e6909953b01a7aa39250c2c52223d9f133e11493d13acf8e175ccfb5ed68e
MD5 9b75ec2b81ade3c6b14996d98142a788
SHA1 2a6801569cb94e5513a5e3894d8b97859d22296f
SHA512 7c3ca363f86ab295223ab978e5f3752be1248b921f5e2d38641a35df8b926167b758099f45547ab27a6c9dca7960627e3c3e5c629e76494f8fc2d1e9c68d41e8
SSDEEP 192:7IwW6Ff6KVlr5UDgMKNMZxet1Q7QlJLdCn7jorbyZYaArr9ZCspE+TMcrkwiANc2:7NPlrGsMKNMfetNM22eM/tAyjSBVHfiW
TLSH
T1021341B542755A0AC746B5B0E1D58E3F7C2B7580C8D6B39190AAE930D9B036277FEC0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_tr.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_tr.dll
Size 42KB
SHA256 d1f6265cc4ea76004e74362ce0b7935dd07fcd94b94fbe5f38f4ee93a7086dea
MD5 188e735f07ad6fc06104110a4e691cd3
SHA1 c5e3f05fc93b09e614d6f582183a9078c5aaa74d
SHA512 b93d2c5ac7d326c2285fe58d9f9260bd96e9ee0d3d1b13efddfc96dea02f0be0aeeaadeea5ea04bb502e27dfb94a93c1740583bebe6829e112339e1afe38b6a2
SSDEEP 768:ikp9ABk6qXQEdmvgh3FGk+G9Ahrx++BzQSXVskiVyf:ikZhdmvMFGkSxLQKVsPm
TLSH
T13E13DB7103D85A0AF7F33B7428B5992E0A7379E1B9F0B30E20A1617998B03915A1DF1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_uk.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_uk.dll
Size 42KB
SHA256 8caa128496fdc247b22d4386386011dc4b6cdc8e8c62650ff010b8ac4cdbd722
MD5 d666f0ead9dfc22617ef0dece504f76e
SHA1 9be1becc6e0633be225725abb77a39265ea33c12
SHA512 dda85e288851799cb33aab64f913d4522f7db564e3a1254df99b9fd0e53b247890547908dc95e09ee897093dfec32829f295bb43d47baf642906670551091e29
SSDEEP 384:YWBwKgHWyC2EeovVHE/GfuM22eMZ7jS25iCz:rBw2uUCgiCz
TLSH
T1E313F77B66388958E745B6704A868EEF0467B3901BD8B3C5619F7870A4B8331371ED8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ur.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_ur.dll
Size 42KB
SHA256 750850f66042c4d4cdb68316f0e7025ac52e664f868256bd1ebd765aef81d043
MD5 ddec9bf33ce7e8aa33cb6b0abcee1491
SHA1 05d8b40ebc2830bc958accbee20e784463dded5c
SHA512 3198998ba1c8fa3e0dbf355f878f5adde4f0748be4dec702bea288d7bd671ed9239d795718cf950d05eea8b1204565ee7511beee315f30ef4d392b281bd59233
SSDEEP 384:pKbaq4+OmAcoWu9CeeZyYGk22eMo/jSditep:psaq4+OmAcoWACeesYNdiU
TLSH
T1391340B60524CD7CEB633A78C047C93F1A3361D459C5BB3129EA607999B13E19A6FC0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_vi.dll

Path C:\Program Files (x86)\GUM381D.tmp\goopdateres_vi.dll
Size 42KB
SHA256 0aeac9e11fd3d68c2b94ea10d8a36c4c99f7805f0b5727803f375cb160486c26
MD5 7b612c8301f5318b2eaac5fe9ca990dc
SHA1 29667e8e94275f92fb58ec7d04b9631b11eb8572
SHA512 2e8eda622945db6ea0ab6e1e4de6ded8926dce3cda11a3c60d4ba7011f000bd3e237312ee3e940ab1167548439f6567ae71394f74a1d2b46c91406e7091df398
SSDEEP 192:Xc676zLrEFUEN+mVNjXvCOAqFjncSW7jorbyZYaArr9ZCspE+TMorCoAlW1cSwr4:XzOfKFjncF22eMT5lBjSgi1
TLSH
T126133071C62B5A4DF7A237304099993D0D27B9D095F6F3029286A5B4A9B07416F0FF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_MASCULINE.pak

Path C:\Program Files\Google\Chrome\Temp\source5608_1159373093\Chrome-bin\151.0.7922.72\Locales\am_MASCULINE.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

trusted_vault.pb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
Size 84B
SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
MD5 85d7a7c1e12b26cd994cd41e587629d6
SHA1 bf53173aa4b19a217eb542951dbafe3ec3506810
SHA512 b3562e0466d9e218e96be44a01feac567e2843f61d1fe5201a5c7d6eef0e714cb5d7d8aa380dbe4f341aca2c46e615f3bfd29621a4898cb8e027cf1155b8df83
TLSH
T115A0128266008642461DB130C80B4C4018311C5A0B34400111F36EA362D5900C541440
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0c94d9e5eb0bd63b76b285ed4d693274a3b106e25f228149811e1f64b3791073
MD5 582dbf50501ada3f73dc78c66b3b5a10
SHA1 092b5613f4ea9a225761bb7f48f92464b89f08ff
SHA512 7c8f0a15a6fdc6395e1a4ebcf4385b6cfc707f656ca6c3c9d18ef6e73e0fc8f46f30cabd45ab04c1d5e459c6727dd7f43374c7791be387a82b984d7f07141995
SSDEEP 96:gC6Md+qKJku7fby2f2eaPphq3RDotok5pBDpkB6AGyvODLLan/bjh4a:gCjAJr7fbyVlmDUDpxpIkFLLan/b1
TLSH
T105A11972B4625C3B5EB7D548B5223E03DFB4B2A77862ABA4D9DD5F0C10E70E80742217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-03_78691ec2975f2bb05850a3c866319754_amadey_elex_smoke-loader.exe
Size 1.0MB
SHA256 219af25bbf742afb1f108e27f7fcc26bf46e8c813d912e513708c9811475794c
MD5 d409059307ada1246aa63236d58e5fa1
SHA1 32c3a452b7525b3acca1f1fc6b098d8ac21298b8
SHA512 ec6322d3ebc34868ba259c1dd3b307bcc4a7bd6fda2f53c9f808f604d1ef79d1e7efc3f51014073a3d62be3695bea63d16eec4121c659441e4861f442cf5817e
SSDEEP 24576:YEj5VL1fY1kXharTtiux8sBrgxVIj9R2V3EWUXlVhRA:Yi4korTtlB8jIj9sV4jrA
TLSH
T13235121136D44035E5F11F3055BAC6A11BBEFC605E309B9F238589AC4BB46C2BA78BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2BD9.tmp

Path C:\Users\Admin\AppData\Local\Temp\2BD9.tmp
Size 2.9MB
SHA256 7f0c49a8d7e61fd2d9a64b07ab56b948c46a3013ef5b7f933c5559ee0dd1e36c
MD5 d6602fa8d6cf18f62722ffb99669e1e9
SHA1 446a5be199b3b77ea36edb3fa5daaf4a4d20c475
SHA512 29313ffb3729ce22d55515eef1ed98bd6cbb2883b00655c20ca0f1a823fdbc7637228cc920030446057583c47247c5bd45109b18c25b7c90d1054fd31eefaee7
SSDEEP 49152:Ld+1Fxk0bvyIxdIjev/IfjxCzaNecjGYY1m992i2wohID6DDM3Nev38IXs0GIbON:Ld0xk0bvyA/IrRIU/Gwo2+DDj39s0W1Z
TLSH
T1D4D52315EBA1C3B1D0804172A082C7EBE8B53D7A5A415E933FC90B7F6E26DC09726797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdateTaskMachineUA.job

Path C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
Size 914B
SHA256 f4e69eb131d6c4b191b4ab96c10d27ab69b9fa8894593682fcb5a30bf81b66cc
MD5 68532a30b48e5a7e1f2331a3b3e8e363
SHA1 2127a782f0fae63761a0b1916ddd2064e8ca7237
SHA512 2bf10f9a24d09322a5325665a4607fae1a87c5cd6d4202af6a8bfab3e7654b98a79a4185b13b9bde1107211387e6d583b2b994a517e595aace5ea9a7af73d648
TLSH
T184112561B7F54268F7FB7F74AEB025811AB6BC23AC30C25D0001454D4C66A90C9B4B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1080-6-0x0000000000400000-0x00000000006E6000-memory.dmp

Download

memory/3804-0-0x0000000000400000-0x00000000006E6000-memory.dmp

Download