HEAD http://redirector.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
request
HEAD http://r3---sn-3u-bh26.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe?cms_redirect=yes&mh=pH&mip=175.208.134.150&mm=28&mn=sn-3u-bh26&ms=nvh&mt=1616285776&mv=m&mvi=3&pcm2cms=yes&pl=18&shardbypass=yes
request
GET http://r3---sn-3u-bh26.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe?cms_redirect=yes&mh=pH&mip=175.208.134.150&mm=28&mn=sn-3u-bh26&ms=nvh&mt=1616285776&mv=m&mvi=3&pcm2cms=yes&pl=18&shardbypass=yes
request
POST https://update.googleapis.com/service/update2?cup2key=10:1683974852&cup2hreq=a9181ed9908f976df95c753d960b297e152c2e5cee68d3bc2ac7106a7606fbcb
request
POST https://update.googleapis.com/service/update2
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L o/` à X Nv @ À @ øu S @ H .text TV X `.rsrc @ Z @ @.reloc ` @ B base_address:0x00400000 process_identifier:2648 process_handle:0x00000244
1
1
0
WriteProcessMemory
buffer: 8 P h ¬ P ê ¬4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n ° S t r i n g F i l e I n f o è 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 l % I n t e r n a l N a m e h Q v s Q a Z W V Y m E H M p P X v h U V P d L u V P B z c v Q . e x e ( L e g a l C o p y r i g h t t % O r i g i n a l F i l e n a m e h Q v s Q a Z W V Y m E H M p P X v h U V P d L u V P B z c v Q . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
base_address:0x00438000 process_identifier:2648 process_handle:0x00000244
1
1
0
WriteProcessMemory
buffer: p P6 base_address:0x0043a000 process_identifier:2648 process_handle:0x00000244
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L o/` à X Nv @ À @ øu S @ H .text TV X `.rsrc @ Z @ @.reloc ` @ B base_address:0x00400000 process_identifier:2648 process_handle:0x00000244
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L o/` à X Nv @ À @ øu S @ H .text TV X `.rsrc @ Z @ @.reloc ` @ B base_address:0x00400000 process_identifier:2648 process_handle:0x00000244
buffer: 8 P h ¬ P ê ¬4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n ° S t r i n g F i l e I n f o è 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 l % I n t e r n a l N a m e h Q v s Q a Z W V Y m E H M p P X v h U V P d L u V P B z c v Q . e x e ( L e g a l C o p y r i g h t t % O r i g i n a l F i l e n a m e h Q v s Q a Z W V Y m E H M p P X v h U V P d L u V P B z c v Q . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
base_address:0x00438000 process_identifier:2648 process_handle:0x00000244
1
1
0
WriteProcessMemory
buffer: p P6 base_address:0x0043a000 process_identifier:2648 process_handle:0x00000244
tmt.exe