Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 15:52
General
- Target 2026-11-11_22ddf11905c1519395713b0324232161_amadey_elex_smoke-loader.exe
- Size 2.9MB
- Sample261113-tbe2psds8s
- SHA256 b0e865aaabc0d5398b38ee70ecc79bb14ae02f30d0a9667ea7d31ca52419dbc6
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 53 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 32 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 36 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 11 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 33 IoCs
- Suspicious use of SendNotifyMessage 16 IoCs
- Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-11_22ddf11905c1519395713b0324232161_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-11_22ddf11905c1519395713b0324232161_amadey_elex_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"C:\Users\Admin\AppData\Local\Temp\3BE6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-11-11_22ddf11905c1519395713b0324232161_amadey_elex_smoke-loader.exe 2C944F50E8E90D2DD3E95B58C3644D51CF9304767A44A2091EE155753E6ACB43CED0486367DC57AD819872B5628C29926E185B826315C40DC10CC0D30FD669D92⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-11-11_22ddf11905c1519395713b0324232161_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-11_22ddf11905c1519395713b0324232161_amadey_elex_smoke-loader.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\GUM4AAB.tmp\GoogleUpdate.exe"C:\Program Files (x86)\GUM4AAB.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={ABEAF2F5-6F67-5047-E06A-AE4AC462C4FB}&lang=en&browser=4&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&installdataindex=defaultbrowser"4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMzEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjMxLjUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTlENjk1RDctMDAxNy00MTI4LUFDQjYtNjM4Q0Q4OTY3NkRCfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezc1QzFFODJGLUQ5MjYtNDNGMy05REM0LTU4NjExMUMyNzNCMn0iIGRlZHVwPSJjciI-PGh3IHBoeXNtZW1vcnk9IjE2IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMTQxLjAuNzM0MC4wIiBuZXh0dmVyc2lvbj0iMS4zLjMxLjUiIGxhbmc9ImVuIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7QUJFQUYyRjUtNkY2Ny01MDQ3LUUwNkEtQUU0QUM0NjJDNEZCfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIyNDc3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={ABEAF2F5-6F67-5047-E06A-AE4AC462C4FB}&lang=en&browser=4&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&installdataindex=defaultbrowser" /installsource taggedmi /sessionid "{19D695D7-0017-4128-ACB6-638CD89676DB}"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google\Update\Install\{122648B8-C753-49D5-9623-DDA2E9A72CF7}\157.0.8103.79_chrome_installer_uncompressed.exe"C:\Program Files (x86)\Google\Update\Install\{122648B8-C753-49D5-9623-DDA2E9A72CF7}\157.0.8103.79_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\gui372E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google\Update\Install\{122648B8-C753-49D5-9623-DDA2E9A72CF7}\CR_12025.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{122648B8-C753-49D5-9623-DDA2E9A72CF7}\CR_12025.tmp\setup.exe" --mini-installer-path="C:\Program Files (x86)\Google\Update\Install\{122648B8-C753-49D5-9623-DDA2E9A72CF7}\157.0.8103.79_chrome_installer_uncompressed.exe" --archive-resource-name="CHROME.7Z" --archive-resource-type="BN" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\gui372E.tmp"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google\Update\Install\{122648B8-C753-49D5-9623-DDA2E9A72CF7}\CR_12025.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{122648B8-C753-49D5-9623-DDA2E9A72CF7}\CR_12025.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=157.0.8103.79 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff6d1f3e768,0x7ff6d1f3e778,0x7ff6d1f3e7884⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Program Files (x86)\Google\Update\Install\{122648B8-C753-49D5-9623-DDA2E9A72CF7}\CR_12025.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{122648B8-C753-49D5-9623-DDA2E9A72CF7}\CR_12025.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google\Update\Install\{122648B8-C753-49D5-9623-DDA2E9A72CF7}\CR_12025.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{122648B8-C753-49D5-9623-DDA2E9A72CF7}\CR_12025.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=157.0.8103.79 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff6d1f3e768,0x7ff6d1f3e778,0x7ff6d1f3e7885⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMzEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjMxLjUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTlENjk1RDctMDAxNy00MTI4LUFDQjYtNjM4Q0Q4OTY3NkRCfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezU4RTNBOTBFLTE4ODItNEI5NC1CODhBLUY3MjdCODMwNjYxOX0iIGRlZHVwPSJjciI-PGh3IHBoeXNtZW1vcnk9IjE2IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTU3LjAuODEwMy43OSIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0iIiBpaWQ9IntBQkVBRjJGNS02RjY3LTUwNDctRTA2QS1BRTRBQzQ2MkM0RkJ9IiBjb2hvcnQ9IjE6Z3UvaTE5OiIgY29ob3J0bmFtZT0iU3RhYmxlIEluc3RhbGxzICZhbXA7IFZlcnNpb24gUGlucyI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9lZGdlZGwubWUuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL2Nocm9tZS9hY2FiM3N3eXpxZ3N6YnNmNm5wb2FucWJ2Z3ZxXzE1Ny4wLjgxMDMuNzkvMTU3LjAuODEwMy43OV9jaHJvbWVfaW5zdGFsbGVyX3VuY29tcHJlc3NlZC5leGUiIGRvd25sb2FkZWQ9IjUyODk0NTA2NCIgdG90YWw9IjUyODk0NTA2NCIgZG93bmxvYWRfdGltZV9tcz0iNDM0NzAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzNzkiIGRvd25sb2FkX3RpbWVfbXM9IjQ4MjQ0IiBkb3dubG9hZGVkPSI1Mjg5NDUwNjQiIHRvdGFsPSI1Mjg5NDUwNjQiIGluc3RhbGxfdGltZV9tcz0iNDQ0MDEiLz48ZGF0YSBuYW1lPSJpbnN0YWxsIiBpbmRleD0iZGVmYXVsdGJyb3dzZXIiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateOnDemand.exe"C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateOnDemand.exe" -Embedding1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --user-stream-region=232,65568 "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=157.0.8103.79 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ffa3d26d0c0,0x7ffa3d26d0d0,0x7ffa3d26d0e04⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1912,i,16809018688896204544,6688038625057066490,524288 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2356 /prefetch:114⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-recent-crash-count=0 --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=WAAAAAAAAABgAAACAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1688,i,10203328195552966934,7979861159058064803,262144 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2312 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,14296688359915351906,977967479327779803,524288 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2548 /prefetch:134⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --top-chrome-webui --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,9548202976241977988,13328135277151219324,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3296 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3576,i,13659643154656965463,7232384375674645529,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3676 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --ntp-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3616,i,472661215781171924,6523075459130329140,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3688 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5028,i,15667838529509292978,2443580829563354594,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5080 /prefetch:94⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5052,i,11968101795301812171,9244461882042821997,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5124 /prefetch:94⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4884,i,3059832664081085352,11759785231235116109,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5100 /prefetch:94⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5608,i,13556886113317831156,17788887428836986654,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5624 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,1035985464020403626,3339263283060498962,524288 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5724 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6424,i,4659976696234227900,8021902120801120354,524288 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6428 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6500,i,16458898710351744368,11276699186118554413,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6572 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6544,i,4377868556331757400,8128575115916246986,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6592 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6484,i,17856550229615178668,10795717597933508968,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6616 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6968,i,14678003406818684927,9080742970619111038,524288 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6976 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6816,i,17036303411972909154,7114637333805861821,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6808 /prefetch:14⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6708,i,4803998887039700864,13758980440981417830,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=7120 /prefetch:14⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=7380,i,15048586320140521181,11261707690835875546,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=7360 /prefetch:14⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7484,i,5055163263802436108,18353557486186710107,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7340 /prefetch:14⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7620,i,12557674594209732649,10797057198997925452,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7472 /prefetch:14⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7336,i,18219712238891537882,9868555218607316706,524288 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7588 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7632,i,4660356895787708733,12123825875742113132,524288 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7468 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7352,i,7013822369092380019,17602011533726475993,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6964 /prefetch:14⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7528,i,8050986281563162110,733652788947851439,1572864 --field-trial-handle=2316,i,12794919226674106817,16287110333580584129,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,13036461569865571777,16910099542123802860,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7688 /prefetch:94⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
-
C:\Program Files\Google\Chrome\Application\157.0.8103.79\elevation_service.exe"C:\Program Files\Google\Chrome\Application\157.0.8103.79\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateBroker.exe"C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleUpdateBroker.exe" -Embedding1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /broker2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
GoogleCrashHandler.exe
GoogleCrashHandler64.exe
GoogleUpdate.exe
GoogleUpdateComRegisterShell64.exe
goopdate.dll
goopdateres_am.dll
goopdateres_ar.dll
goopdateres_bg.dll
goopdateres_bn.dll
goopdateres_ca.dll
goopdateres_cs.dll
goopdateres_da.dll
goopdateres_de.dll
goopdateres_el.dll
goopdateres_en-GB.dll
goopdateres_en.dll
goopdateres_es-419.dll
goopdateres_es.dll
goopdateres_et.dll
goopdateres_fa.dll
goopdateres_fi.dll
goopdateres_fil.dll
goopdateres_fr.dll
goopdateres_gu.dll
goopdateres_hi.dll
goopdateres_hr.dll
goopdateres_hu.dll
goopdateres_id.dll
goopdateres_is.dll
goopdateres_it.dll
goopdateres_iw.dll
goopdateres_ja.dll
goopdateres_kn.dll
goopdateres_ko.dll
goopdateres_lt.dll
goopdateres_lv.dll
goopdateres_ml.dll
goopdateres_mr.dll
goopdateres_ms.dll
goopdateres_nl.dll
goopdateres_no.dll
goopdateres_pl.dll
goopdateres_pt-BR.dll
goopdateres_pt-PT.dll
goopdateres_ro.dll
goopdateres_ru.dll
goopdateres_sk.dll
goopdateres_sl.dll
goopdateres_sr.dll
goopdateres_sv.dll
goopdateres_sw.dll
goopdateres_ta.dll
goopdateres_te.dll
goopdateres_th.dll
goopdateres_tr.dll
goopdateres_uk.dll
goopdateres_ur.dll
goopdateres_vi.dll
npGoogleUpdate3.dll
setup.exe
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
chrome.exe
chrome_proxy.exe
am_FEMININE.pak
BookmarkMergedSurfaceOrdering34309bbb-3ee2-48a2-bb40-f8ef4b222d4d.tmp
messages.json
craw_background.js
SCT Auditing Pending Reportsa415d33a-94ff-4c76-b184-c0b8bbd01e85.tmp
Preferences7aa670e2-2c00-4f6b-a564-57db0dfa406e.tmp
Secure Preferencesa9d03f91-6766-4fc0-8596-69730e6de7ce.tmp
temp-index
CURRENT
MANIFEST-000001
temp-index
the-real-index
data_0
data_1
data_2
data_3
128.png
192.png
256.png
32.png
48.png
64.png
96.png
128.png
192.png
256.png
32.png
48.png
64.png
96.png
128.png
192.png
256.png
32.png
64.png
96.png
128.png
192.png
256.png
32.png
48.png
64.png
96.png
128.png
192.png
256.png
32.png
48.png
64.png
96.png
128.png
192.png
256.png
32.png
48.png
64.png
96.png
48.png
Local State79c5dd17-a73d-4e43-a95e-f646995418c0.tmp
Local Statef6700344-616f-4fee-a4bd-8149f95c3e49.tmp
VariationsSeedV2717499a3-9ba8-4c73-92ae-46987ab71130.tmp
VariationsSeedV29321a0df-1270-48b2-be5f-eaa98354c9df.tmp
VariationsSeedV2d95b86d9-a36a-4fb2-87fe-112260a4066c.tmp
2026-11-11_22ddf11905c1519395713b0324232161_amadey_elex_smoke-loader.exe
3BE6.tmp
57fb8372-23cb-4840-8545-da5f25ddeb37.tmp
messages.json
GoogleUpdateTaskMachineUA.job
memory/2236-1303-0x000001984A040000-0x000001984A281000-memory.dmp
memory/2264-6-0x0000000000400000-0x00000000006E6000-memory.dmp
memory/3488-1321-0x0000029828390000-0x00000298285D1000-memory.dmp
memory/4104-0-0x0000000000400000-0x00000000006E6000-memory.dmp
memory/4328-1304-0x0000022110C10000-0x0000022110E51000-memory.dmp
memory/4328-1970-0x00007FF6D1810000-0x00007FF6D2009000-memory.dmp
memory/5732-1993-0x00007FF6D1810000-0x00007FF6D2009000-memory.dmp
memory/5732-1329-0x0000026D03FC0000-0x0000026D04201000-memory.dmp