Ghost32.exe Google Drive -

Using Sysmon and EDR telemetry, the following chain was observed:

Restores a computer to a previous state using a .GHO image file. ghost32.exe google drive