7e7a371a7f563dc181cbe70a684880cbf036a2540b322ab56916b3671ace7df3

Resubmissions

05/11/2023, 19:21

231105-x25a3acf87 8

04/11/2023, 19:48

231104-yjgbysdg91 8

Analysis

max time kernel
600s
max time network
412s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GoogleDesktopSetup.exe
Size

1.9MB
MD5

91f67571db8e365e848f78ab4d6580ea
SHA1

a185b4a309497851603ff060a2de20b4d1560133
SHA256

7e7a371a7f563dc181cbe70a684880cbf036a2540b322ab56916b3671ace7df3
SHA512

9fe1e6ade453c7c80025ba3d0105c6124929fbe5cdebbba3564aa77270cff22ac0b1ce0e557d596c46271f7c5863fe72ba7b8dd705769a92acb94dbb91d327ac
SSDEEP

49152:sfSMWuHHwY6XSls25HoWCbFNFuVXIvRvp3tfNAvWik+:5Mpnz6XG+bFKVXIzUvWD+

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation	GoogleDesktop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation	GoogleDesktopSetup.exe

Executes dropped EXE 10 IoCs

pid	Process
3532	GoogleDesktopSetupHelper.exe
2224	GoogleDesktop.exe
1216	GoogleDesktop.exe
3624	GoogleDesktop.exe
3124	GoogleDesktop.exe
3952	GoogleDesktop64BitLaunch.exe
3168	Explorer.EXE
1784	GoogleDesktop.exe
4820	GoogleDesktop.exe
648	GoogleDesktop.exe

Loads dropped DLL 49 IoCs

pid	Process
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
3532	GoogleDesktopSetupHelper.exe
3532	GoogleDesktopSetupHelper.exe
3532	GoogleDesktopSetupHelper.exe
2224	GoogleDesktop.exe
2224	GoogleDesktop.exe
2224	GoogleDesktop.exe
1216	GoogleDesktop.exe
1216	GoogleDesktop.exe
1216	GoogleDesktop.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
3624	GoogleDesktop.exe
3624	GoogleDesktop.exe
3624	GoogleDesktop.exe
3624	GoogleDesktop.exe
3624	GoogleDesktop.exe
3124	GoogleDesktop.exe
3124	GoogleDesktop.exe
3124	GoogleDesktop.exe
3124	GoogleDesktop.exe
3952	GoogleDesktop64BitLaunch.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
4820	GoogleDesktop.exe
4820	GoogleDesktop.exe
4820	GoogleDesktop.exe
4820	GoogleDesktop.exe
4820	GoogleDesktop.exe
648	GoogleDesktop.exe
648	GoogleDesktop.exe
648	GoogleDesktop.exe
648	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Google Desktop Search = "\"C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup"	GoogleDesktopSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopSetupHelper.exe	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktopIE.dll	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktopSSD.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\ac ### files - your system	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopOffice.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopSSD.dll	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktop.exe	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktopMozillaStub.xpt	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_gpac.xml	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\aa ### WARNING - Do not	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleServices.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\ak ### GoogleDesktopSetup.exe -uninstall	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.dll	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktopCommon.dll	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktopMozillaStub.js	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\ae ###	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktop.exe	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopMozilla.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_topic_sites.dat	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopSetup.exe	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopSetup.exe	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\ad ### may stop working	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktopMail.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\aj ###	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopHyper.dll	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_Weather_en.gg_NEW_	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\ab ### move or delete these	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopResources_en.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\favicon.ico	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktopResources_en.dll	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktopAPI2.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopResources_en.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopIE.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\gzlib.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopMail.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleUIEngine.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\af ### To uninstall use	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\ag ### Add-Remove programs	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopCommon.dll	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktopHyper.dll	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktopNetwork3.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\temp	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopDeskbar2.dll	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleServices.dll	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktopDeskbar2.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\ai ### or run	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopCommon.dll	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_plugin_common.js	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\test	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_gzlib.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopAPI2.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop64Bit.dll	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop64BitLaunch.exe	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleUIEngine.dll	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktop64BitLaunch.exe	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\ah ### in the control panel	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktopOffice.dll	GoogleDesktopSetup.exe
File created	C:\Program Files (x86)\Google\Google Desktop Search\_NEW_sites.txt	GoogleDesktopSetup.exe
File opened for modification	C:\Program Files (x86)\Google\Google Desktop Search\al ###	GoogleDesktopSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoogleDesktop.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	GoogleDesktop.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{5D80A6D1-B500-47DA-82B8-EB9875F85B4D}	GoogleDesktopSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{5D80A6D1-B500-47DA-82B8-EB9875F85B4D}\Compatibility Flags = "1024"	GoogleDesktopSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}	GoogleDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}\URL = "http://127.0.0.1:4664/search&s=DIz7iYXZVeSCc9ASbfoSdQnPhFM?q={searchTerms}"	GoogleDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}\FaviconPath = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\favicon.ico"	GoogleDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}\DisplayName = "Google Desktop"	GoogleDesktop.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E7C0BEB7-446B-43BF-83E3-5EC37A9DBCC8}\TypeLib\ = "{E3B60D50-19AB-4A32-A8B1-A09113AB2BA4}"	GoogleDesktop.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65E256AC-B335-4004-8C6A-5A7F986CD0A4}\TypeLib	GoogleDesktop.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{654AF3CA-DE94-4ABA-A4EE-9EB7E595BF6A}	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAD8EDC0-78A3-4B7D-A5E1-1F50DB967650}\TypeLib\Version = "3.0"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8269ECFE-EC9A-44B3-906D-6CA873E7B1B6}\VersionIndependentProgID	GoogleDesktop.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5AC3BFC-F648-4557-B90A-33C2F4DFA979}\InprocServer32	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktop.search\URL Protocol	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BBE42CD-CF0E-4A2C-82BF-9D096C462621}\TypeLib	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5E46143-1803-4E90-A85E-342AD9E7730B}\VersionIndependentProgID	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A32A8CE-0B16-43A9-BEAF-F5263039581B}\TypeLib	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktop.QueryAPI	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4516155C-B94E-4334-8D26-D4BF0932581C}\Description	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82F11EB2-19AF-415D-816E-05FBA034A616}\InprocServer32\ = "\"C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktop.exe\""	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4516155C-B94E-4334-8D26-D4BF0932581C}\Programmable	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8F549279-DE9A-4250-A985-4D9B7ECD48B6}\TypeLib\Version = "2.1"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7A6064BC-3B10-42AD-9C1D-6C7E14E268EA}\ProxyStubClsid32	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktop.SchemaPropertyFilter.1\ = "GoogleDesktop Schema Property Filter"	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A515151-B135-458A-AE5C-985B5796B5FA}\Programmable	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D763E7F-3EE1-4527-9AA2-CAA63091AF08}\Programmable	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7DE4137F-B1DF-4786-AEA0-192EA48643C6}\TypeLib\Version = "2.1"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CEA958A8-244C-49D7-819C-880648B32A69}	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{420D1EA4-82A2-4C34-862A-716C73852BC3}\TypeLib	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7358FE98-6DA0-4165-A591-626AAF08467C}\InprocServer32\ThreadingModel = "Apartment"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08A02699-A4BC-41A0-BFEE-A58395ED22A7}	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9EC0695-290D-4420-9522-870AC77A085B}\InprocServer32\ThreadingModel = "Both"	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6A77759F-49D8-438F-95D2-CAB7AC63FC20}\TypeLib\Version = "2.1"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB8B07A0-B8D1-44E0-A262-C9B7212AEC68}	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC129136-EB1C-4FFF-B0A2-6D6761BE4138}\VersionIndependentProgID\ = "GoogleDesktop.Registrar"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{86EB2E81-9323-4F83-A3EC-EF1800F3D9D5}\ProxyStubClsid32	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktop.OfficeAddin\CurVer	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C6F11D4-CF22-4E1F-A271-2A4A0393ADAC}\VersionIndependentProgID	GoogleDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\AppID\ = "GoogleDesktopChromeHistoryIndexer"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C92D45D1-9956-4B69-8B1C-3CF5CD109908}\VersionIndependentProgID\ = "GoogleDesktop.MICF"	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B41F373F-04FE-4D69-A972-DEB002444278}\TypeLib\Version = "3.0"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktop.EventPublisher.1\ = "EventPublisher Class"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECCB4495-7F5B-4B4E-A887-7A66BE948AC1}\MiscStatus	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94BB7FC1-B109-4628-9D15-6B4F8B9BF73C}\ = "@C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktopResources_en.dll,-9130;Stocks Options"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7BBE42CD-CF0E-4A2C-82BF-9D096C462621}\TypeLib	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FEF88129-AF9F-4FC3-9B28-772CF06F8C7E}\InprocServer32\ThreadingModel = "Both"	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A734302-566D-4C1C-B805-4643F6A95565}	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{634E2122-6BB7-430F-B452-CF04C8722C47}\Description\ = "@C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktopResources_en.dll,-9095;Shows recent unread emails"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BA6059E-03F3-4931-9BC0-375B694CAE3F}\ProgID\ = "GoogleDesktop.QueryRegistration.1"	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A4B7022B-3E03-45EC-937F-0EBB587EC6CA}\ProgID	GoogleDesktopSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD080A96-9FA5-4115-87EB-E076A236A179}\TypeLib	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktop.OfficeAddin\CLSID\ = "{FC4482E9-08FC-493A-BA7D-7ED5A6DD0938}"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44E352D9-4919-4DD8-A210-B38947CC1F37}\NumMethods	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB8B07A0-B8D1-44E0-A262-C9B7212AEC68}\TypeLib	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktop.QueryRegistration.1\ = "GoogleDesktop.QueryRegistration"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C94C3A12-6985-4476-8063-1A1D55F98C21}\InprocServer32	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94BB7FC1-B109-4628-9D15-6B4F8B9BF73C}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleServices.DLL"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktop.QueryAPI.1\CLSID\ = "{4E26495C-CA41-4085-96C4-8CA805AF297E}"	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0519A8C8-EB41-48AF-AB2D-A3D5BB0C7E4C}\TypeLib\ = "{3D056FE7-EA8E-481A-B18F-0B02EBF6B3C1}"	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED67B5F2-FC10-4E04-BABA-20A5D0DCCA83}\ = "IGoogleDesktopOrkutPanel"	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBA13A6F-E595-48B7-AB73-2630042A4E93}\InprocServer32\ThreadingModel = "Apartment"	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4853C4B-43EB-41DE-A0B1-B5B97C31CB0A}\TypeLib	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB8B07A0-B8D1-44E0-A262-C9B7212AEC68}\Programmable	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktopSearch.EventFactory.1\CLSID\ = "{579822B3-44CD-4786-83E0-AE32BCB9E6B1}"	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{654AF3CA-DE94-4ABA-A4EE-9EB7E595BF6A}\InprocServer32\ThreadingModel = "Both"	GoogleDesktopSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4516155C-B94E-4334-8D26-D4BF0932581C}\MiscStatus\1	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295E081E-1920-4D5C-802A-77D6B48C0856}\MiscStatus\ = "0"	GoogleDesktop.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{163BDD74-7164-4940-84B3-575898032CF9}\InprocServer32	GoogleDesktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5751ACAA-4710-4160-999F-A2AD6FEA3484}\1.0\0	GoogleDesktop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E4FB3DDB-5CAD-42DA-8E22-DB9B04041350}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktopDeskbar2.dll"	GoogleDesktopSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1D15CE63-019C-4598-912A-3A50BF8EA735}\NumMethods\ = "31"	GoogleDesktop.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2	GoogleDesktop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5c0000000100000004000000000400007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64	GoogleDesktop.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
380	GoogleDesktopSetup.exe
380	GoogleDesktopSetup.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3168	Explorer.EXE
1784	GoogleDesktop.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	380	GoogleDesktopSetup.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: 33	1784	GoogleDesktop.exe
Token: SeIncBasePriorityPrivilege	1784	GoogleDesktop.exe
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: 33	1784	GoogleDesktop.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
3168	Explorer.EXE
3168	Explorer.EXE
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe
1784	GoogleDesktop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1784	GoogleDesktop.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3168	Explorer.EXE

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 3532	380	GoogleDesktopSetup.exe	84
PID 380 wrote to memory of 3532	380	GoogleDesktopSetup.exe	84
PID 380 wrote to memory of 3532	380	GoogleDesktopSetup.exe	84
PID 380 wrote to memory of 2224	380	GoogleDesktopSetup.exe	88
PID 380 wrote to memory of 2224	380	GoogleDesktopSetup.exe	88
PID 380 wrote to memory of 2224	380	GoogleDesktopSetup.exe	88
PID 380 wrote to memory of 1216	380	GoogleDesktopSetup.exe	89
PID 380 wrote to memory of 1216	380	GoogleDesktopSetup.exe	89
PID 380 wrote to memory of 1216	380	GoogleDesktopSetup.exe	89
PID 380 wrote to memory of 3624	380	GoogleDesktopSetup.exe	94
PID 380 wrote to memory of 3624	380	GoogleDesktopSetup.exe	94
PID 380 wrote to memory of 3624	380	GoogleDesktopSetup.exe	94
PID 380 wrote to memory of 3124	380	GoogleDesktopSetup.exe	95
PID 380 wrote to memory of 3124	380	GoogleDesktopSetup.exe	95
PID 380 wrote to memory of 3124	380	GoogleDesktopSetup.exe	95
PID 380 wrote to memory of 3952	380	GoogleDesktopSetup.exe	96
PID 380 wrote to memory of 3952	380	GoogleDesktopSetup.exe	96
PID 3952 wrote to memory of 3168	3952	GoogleDesktop64BitLaunch.exe	58
PID 3952 wrote to memory of 3168	3952	GoogleDesktop64BitLaunch.exe	58
PID 3168 wrote to memory of 1784	3168	Explorer.EXE	97
PID 3168 wrote to memory of 1784	3168	Explorer.EXE	97
PID 3168 wrote to memory of 1784	3168	Explorer.EXE	97
PID 1784 wrote to memory of 4820	1784	GoogleDesktop.exe	99
PID 1784 wrote to memory of 4820	1784	GoogleDesktop.exe	99
PID 1784 wrote to memory of 4820	1784	GoogleDesktop.exe	99

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\GoogleDesktopSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\GoogleDesktopSetup.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopSetupHelper.exe
    "C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopSetupHelper.exe" /mdo
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3532
- - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
    "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /system /regserver /quit
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:2224
- - C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktop.exe
    "C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktop.exe" /manager /service /path "C:\Program Files (x86)\Google\Google Desktop Search\"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:1216
- - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
    "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /display /regserver /quit
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:3624
- - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
    "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /system /gdupdate /quit /system
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3124
- - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop64BitLaunch.exe
    "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop64BitLaunch.exe" 00430072006500610074006500500072006F0063006500730073 00000C60 0043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C0047006F006F0067006C0065005C0047006F006F0067006C00650020004400650073006B0074006F00700020005300650061007200630068005C0047006F006F0067006C0065004400650073006B0074006F0070002E006500780065 002F0069006E007300740061006C006C0020 0000
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3952
- C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
  /install
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
    "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /display /userreg /quit
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4820

C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
"C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Google\GOOGLE~1\GO36F4~1.DLL

Filesize
120KB

MD5
6434b5f02751b9140deecf4e4a3bab47

SHA1
0243c668a7889d0a5925c6accf8be07c375e8fdf

SHA256
9166c41a962d6f445f9a399fd26c24819bc15b4eb2d5db2c5b948fbcdeceb272

SHA512
e30b24a7c692ed576b2ae0a075aab622e32ea78ec41bb5f0fea5d5651c1a6c0c08574d1546ed4f40cfc50a8a7fa49a950a075fcfc7dc976b374fa13f8905b02d

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe

Filesize
29KB

MD5
9f5f2f0fb0a7f5aa9f16b9a7b6dad89f

SHA1
603f73160dcc49da297a10f0691cefe4dddd9772

SHA256
6d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc

SHA512
dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe

Filesize
29KB

MD5
9f5f2f0fb0a7f5aa9f16b9a7b6dad89f

SHA1
603f73160dcc49da297a10f0691cefe4dddd9772

SHA256
6d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc

SHA512
dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe

Filesize
29KB

MD5
9f5f2f0fb0a7f5aa9f16b9a7b6dad89f

SHA1
603f73160dcc49da297a10f0691cefe4dddd9772

SHA256
6d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc

SHA512
dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe

Filesize
29KB

MD5
9f5f2f0fb0a7f5aa9f16b9a7b6dad89f

SHA1
603f73160dcc49da297a10f0691cefe4dddd9772

SHA256
6d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc

SHA512
dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe

Filesize
29KB

MD5
9f5f2f0fb0a7f5aa9f16b9a7b6dad89f

SHA1
603f73160dcc49da297a10f0691cefe4dddd9772

SHA256
6d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc

SHA512
dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe

Filesize
29KB

MD5
9f5f2f0fb0a7f5aa9f16b9a7b6dad89f

SHA1
603f73160dcc49da297a10f0691cefe4dddd9772

SHA256
6d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc

SHA512
dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe

Filesize
29KB

MD5
9f5f2f0fb0a7f5aa9f16b9a7b6dad89f

SHA1
603f73160dcc49da297a10f0691cefe4dddd9772

SHA256
6d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc

SHA512
dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop64Bit.DLL

Filesize
86KB

MD5
fdac632abecf6cb7c6b79fe2b9d191d0

SHA1
e5fdd25263313fc83cf7fcc3241e919c10c5f735

SHA256
a1e05fbb2bdb73c7ad64f5d26e5728e7a6001541b8bbdc16720b620d0cd94e08

SHA512
cb1c0dcc37a50683b25a944785098824bc05e380d89e1863a5c97638c6a484dd0600122a432fcb6268f301705b82c720e9c1b5f6a3863f1e824a3f2ee8145a68

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop64Bit.dll

Filesize
86KB

MD5
fdac632abecf6cb7c6b79fe2b9d191d0

SHA1
e5fdd25263313fc83cf7fcc3241e919c10c5f735

SHA256
a1e05fbb2bdb73c7ad64f5d26e5728e7a6001541b8bbdc16720b620d0cd94e08

SHA512
cb1c0dcc37a50683b25a944785098824bc05e380d89e1863a5c97638c6a484dd0600122a432fcb6268f301705b82c720e9c1b5f6a3863f1e824a3f2ee8145a68

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop64Bit.dll

Filesize
86KB

MD5
fdac632abecf6cb7c6b79fe2b9d191d0

SHA1
e5fdd25263313fc83cf7fcc3241e919c10c5f735

SHA256
a1e05fbb2bdb73c7ad64f5d26e5728e7a6001541b8bbdc16720b620d0cd94e08

SHA512
cb1c0dcc37a50683b25a944785098824bc05e380d89e1863a5c97638c6a484dd0600122a432fcb6268f301705b82c720e9c1b5f6a3863f1e824a3f2ee8145a68

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop64BitLaunch.exe

Filesize
4KB

MD5
cfe24012488e1679c0c53fd599dbbe69

SHA1
be1c64a4b003c4285ff7c1efbebbb42ba20f05a7

SHA256
2264ce9037eeee6d1dfcb8acf20945de86f8e54dbd701147f0991d4e68665742

SHA512
0df62e06fb579744e11423b7283c55d142991a2a09b000b8cb3f8749d734dda58d20f327d6ccf88276f3ba319824aad1a99c780ea8f7071df997ceef56a5af1e

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop64BitLaunch.exe

Filesize
4KB

MD5
cfe24012488e1679c0c53fd599dbbe69

SHA1
be1c64a4b003c4285ff7c1efbebbb42ba20f05a7

SHA256
2264ce9037eeee6d1dfcb8acf20945de86f8e54dbd701147f0991d4e68665742

SHA512
0df62e06fb579744e11423b7283c55d142991a2a09b000b8cb3f8749d734dda58d20f327d6ccf88276f3ba319824aad1a99c780ea8f7071df997ceef56a5af1e

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopAPI2.dll

Filesize
469KB

MD5
cca0000b5f9f73aca4b74d60d590ac48

SHA1
654a790bbebe6a778f89e915004ce10802b255b8

SHA256
479d437ea8964d5b1080e63b7823274e548fce841b03abc89a5fb33e3603abad

SHA512
ddaaa283ff032016636012fad00fc430cfc6ecc19a13574a13a0fa1ca3b7b9db9fa45bbcc2d8faab3a05f06e29505d458129e616024743520f28c2f0b90f0a4f

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopAPI2.dll

Filesize
469KB

MD5
cca0000b5f9f73aca4b74d60d590ac48

SHA1
654a790bbebe6a778f89e915004ce10802b255b8

SHA256
479d437ea8964d5b1080e63b7823274e548fce841b03abc89a5fb33e3603abad

SHA512
ddaaa283ff032016636012fad00fc430cfc6ecc19a13574a13a0fa1ca3b7b9db9fa45bbcc2d8faab3a05f06e29505d458129e616024743520f28c2f0b90f0a4f

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopAPI2.dll

Filesize
469KB

MD5
cca0000b5f9f73aca4b74d60d590ac48

SHA1
654a790bbebe6a778f89e915004ce10802b255b8

SHA256
479d437ea8964d5b1080e63b7823274e548fce841b03abc89a5fb33e3603abad

SHA512
ddaaa283ff032016636012fad00fc430cfc6ecc19a13574a13a0fa1ca3b7b9db9fa45bbcc2d8faab3a05f06e29505d458129e616024743520f28c2f0b90f0a4f

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopAPI2.dll

Filesize
469KB

MD5
cca0000b5f9f73aca4b74d60d590ac48

SHA1
654a790bbebe6a778f89e915004ce10802b255b8

SHA256
479d437ea8964d5b1080e63b7823274e548fce841b03abc89a5fb33e3603abad

SHA512
ddaaa283ff032016636012fad00fc430cfc6ecc19a13574a13a0fa1ca3b7b9db9fa45bbcc2d8faab3a05f06e29505d458129e616024743520f28c2f0b90f0a4f

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopAPI2.dll

Filesize
469KB

MD5
a22bfcc3b222f6fe4d527e69e9c43871

SHA1
70fe955fa1d3550cdae28362319ca2636b0834f2

SHA256
ca71061c3ba096e08d8dfc943265609374957701944bd6b20b1f72823c0dcf28

SHA512
448c99fcdbe63ba1e8f9513f451123463ca2db91ce0d6ba7b949ac70ca7578ce23f6f54c6a96cf8d8d7d5c6a02914a9e2a0c5aee6ad437cee3c757b1af7c3ff7

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopCommon.dll

Filesize
267KB

MD5
df5f4ecacf6df29a0738ccae7e322371

SHA1
98dc051e690c645b5aff8dcb2bcb77ecb5d92df5

SHA256
d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502

SHA512
01c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopCommon.dll

Filesize
267KB

MD5
b3d57647f931aa0b95349c585eb4e52c

SHA1
0432f288f61748141873945f1103bf03bf935e03

SHA256
d585bbd8931add61679a2200b2c35d1eefb8b265b8e1db6da29dbc337a228dfb

SHA512
afb0b90a2a492bbbfa28778c5bd628a6cef212905813cd68b620822c5c8ac725309e9a79bdbb1bfe6ddfaf1c0dc79ed208700b7325d4db7bf0e639dc4442e029

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopCommon.dll

Filesize
267KB

MD5
b3d57647f931aa0b95349c585eb4e52c

SHA1
0432f288f61748141873945f1103bf03bf935e03

SHA256
d585bbd8931add61679a2200b2c35d1eefb8b265b8e1db6da29dbc337a228dfb

SHA512
afb0b90a2a492bbbfa28778c5bd628a6cef212905813cd68b620822c5c8ac725309e9a79bdbb1bfe6ddfaf1c0dc79ed208700b7325d4db7bf0e639dc4442e029

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopCommon.dll

Filesize
267KB

MD5
b3d57647f931aa0b95349c585eb4e52c

SHA1
0432f288f61748141873945f1103bf03bf935e03

SHA256
d585bbd8931add61679a2200b2c35d1eefb8b265b8e1db6da29dbc337a228dfb

SHA512
afb0b90a2a492bbbfa28778c5bd628a6cef212905813cd68b620822c5c8ac725309e9a79bdbb1bfe6ddfaf1c0dc79ed208700b7325d4db7bf0e639dc4442e029

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopCommon.dll

Filesize
267KB

MD5
df5f4ecacf6df29a0738ccae7e322371

SHA1
98dc051e690c645b5aff8dcb2bcb77ecb5d92df5

SHA256
d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502

SHA512
01c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopCommon.dll

Filesize
267KB

MD5
df5f4ecacf6df29a0738ccae7e322371

SHA1
98dc051e690c645b5aff8dcb2bcb77ecb5d92df5

SHA256
d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502

SHA512
01c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopCommon.dll

Filesize
267KB

MD5
df5f4ecacf6df29a0738ccae7e322371

SHA1
98dc051e690c645b5aff8dcb2bcb77ecb5d92df5

SHA256
d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502

SHA512
01c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopDeskbar2.dll

Filesize
173KB

MD5
23dc791b6ba68b87a4f2aab271ede3b6

SHA1
48f1ed5b7576badee12b85d08c12131766f9eb13

SHA256
077d1162e4cd76b50dad89801cf52de1f965c87294657d0b6b84d0cc15f3a2fb

SHA512
aea486225d83c7e08a36214db030696cb26e51cfe97637c2dfd4b48d91e7312af0a72f7f6d8f59d121efdd562d5d214590f0b3fbe47c568854d4c1fa03735cf1

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopDeskbar2.dll

Filesize
173KB

MD5
23dc791b6ba68b87a4f2aab271ede3b6

SHA1
48f1ed5b7576badee12b85d08c12131766f9eb13

SHA256
077d1162e4cd76b50dad89801cf52de1f965c87294657d0b6b84d0cc15f3a2fb

SHA512
aea486225d83c7e08a36214db030696cb26e51cfe97637c2dfd4b48d91e7312af0a72f7f6d8f59d121efdd562d5d214590f0b3fbe47c568854d4c1fa03735cf1

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopIE.dll

Filesize
98KB

MD5
e9c5d1b2464e24ebcf55614337977245

SHA1
ec7131f7d74642c4ba2612d92d653e13a895d988

SHA256
751f68d0825c60d911083af0857838c074c36765660d8e4f7763d3f097c5eb32

SHA512
ae27da0c3390767cc3463f4ff29b8a0dc189efa94e2e8274af846d8fc45b317be102db143ce3b2ed4bd62dd64ad767bf83f2585e3b9851f52b55e7b1f8c3674f

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll

Filesize
120KB

MD5
6434b5f02751b9140deecf4e4a3bab47

SHA1
0243c668a7889d0a5925c6accf8be07c375e8fdf

SHA256
9166c41a962d6f445f9a399fd26c24819bc15b4eb2d5db2c5b948fbcdeceb272

SHA512
e30b24a7c692ed576b2ae0a075aab622e32ea78ec41bb5f0fea5d5651c1a6c0c08574d1546ed4f40cfc50a8a7fa49a950a075fcfc7dc976b374fa13f8905b02d

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll

Filesize
120KB

MD5
6434b5f02751b9140deecf4e4a3bab47

SHA1
0243c668a7889d0a5925c6accf8be07c375e8fdf

SHA256
9166c41a962d6f445f9a399fd26c24819bc15b4eb2d5db2c5b948fbcdeceb272

SHA512
e30b24a7c692ed576b2ae0a075aab622e32ea78ec41bb5f0fea5d5651c1a6c0c08574d1546ed4f40cfc50a8a7fa49a950a075fcfc7dc976b374fa13f8905b02d

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll

Filesize
120KB

MD5
50de0755ad1212502e96d83b02d70541

SHA1
da7751f459c6b145decf7887739d697fb422dc8a

SHA256
9abed8becb379077239c0b01f917c1700b9493d0c16e3c4c9d8937ab8f863fe7

SHA512
b0fadc1430f0307c3b7a19ba6afabaca63c07ffb7104cba04d15c8a32f86b228e6370d1a11067464b7603ae24246ea10d75975b67722b372a6e3306800aa0398

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll

Filesize
120KB

MD5
50de0755ad1212502e96d83b02d70541

SHA1
da7751f459c6b145decf7887739d697fb422dc8a

SHA256
9abed8becb379077239c0b01f917c1700b9493d0c16e3c4c9d8937ab8f863fe7

SHA512
b0fadc1430f0307c3b7a19ba6afabaca63c07ffb7104cba04d15c8a32f86b228e6370d1a11067464b7603ae24246ea10d75975b67722b372a6e3306800aa0398

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll

Filesize
120KB

MD5
50de0755ad1212502e96d83b02d70541

SHA1
da7751f459c6b145decf7887739d697fb422dc8a

SHA256
9abed8becb379077239c0b01f917c1700b9493d0c16e3c4c9d8937ab8f863fe7

SHA512
b0fadc1430f0307c3b7a19ba6afabaca63c07ffb7104cba04d15c8a32f86b228e6370d1a11067464b7603ae24246ea10d75975b67722b372a6e3306800aa0398

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopOffice.dll

Filesize
209KB

MD5
f05190a230841640c410bc0461173a8e

SHA1
98bd6646ac04f583ca128b41b9a614a5a1e9904c

SHA256
b0fed381043070d2ed95dc2d08d449d526a99fa60e4eaa1dd04b84c53ddd0a45

SHA512
4e237d310967bb1f710de5b764c4a3bf8647f1ba5f2533be6e0bfba087ee22a833be5bd6cbf9c41c574d59f2fd8ce992dd84c1b533f78186974a3e2d587da2c1

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopOffice.dll

Filesize
209KB

MD5
f05190a230841640c410bc0461173a8e

SHA1
98bd6646ac04f583ca128b41b9a614a5a1e9904c

SHA256
b0fed381043070d2ed95dc2d08d449d526a99fa60e4eaa1dd04b84c53ddd0a45

SHA512
4e237d310967bb1f710de5b764c4a3bf8647f1ba5f2533be6e0bfba087ee22a833be5bd6cbf9c41c574d59f2fd8ce992dd84c1b533f78186974a3e2d587da2c1

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopOffice.dll

Filesize
209KB

MD5
71eb83834a475e5e04b45d3187e1c0dc

SHA1
1754f499f0407b72303c9a809ff0a4e34c948b18

SHA256
08ee372c97b5d6edcb5f1219245ce44535a373c1827254f8c91493c3818ffae1

SHA512
29258089742a064d42dcda6945fc12ccd43aee0ca9235798c0c0eb1d0c8769e6764339811295a4f52fb5b43b6a3df635188683f84e8576f71dd844ee95cc62ec

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopOffice.dll

Filesize
209KB

MD5
71eb83834a475e5e04b45d3187e1c0dc

SHA1
1754f499f0407b72303c9a809ff0a4e34c948b18

SHA256
08ee372c97b5d6edcb5f1219245ce44535a373c1827254f8c91493c3818ffae1

SHA512
29258089742a064d42dcda6945fc12ccd43aee0ca9235798c0c0eb1d0c8769e6764339811295a4f52fb5b43b6a3df635188683f84e8576f71dd844ee95cc62ec

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
b3ccb67d0d6a3f653c43b840ff2ea324

SHA1
e57a9ba7db49745f44b9b10a73296545eea52c64

SHA256
026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469

SHA512
03cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
b3ccb67d0d6a3f653c43b840ff2ea324

SHA1
e57a9ba7db49745f44b9b10a73296545eea52c64

SHA256
026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469

SHA512
03cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
b3ccb67d0d6a3f653c43b840ff2ea324

SHA1
e57a9ba7db49745f44b9b10a73296545eea52c64

SHA256
026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469

SHA512
03cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
b3ccb67d0d6a3f653c43b840ff2ea324

SHA1
e57a9ba7db49745f44b9b10a73296545eea52c64

SHA256
026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469

SHA512
03cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
b3ccb67d0d6a3f653c43b840ff2ea324

SHA1
e57a9ba7db49745f44b9b10a73296545eea52c64

SHA256
026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469

SHA512
03cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
a09baf152fd4f6466c9b6c37fd37f7e6

SHA1
4ca0969a4e103fdf0604b0d1dfd10022388e1003

SHA256
a96536c21d942e2befc7df6d5e14fa6861cb7896840a726c17b51956f1ef8683

SHA512
a233602ba864c8c18a750837eb88e6c90a684403c631b1183318a95b7d9174eff1cd6ef2e9d4f1dc4aa152896537767e980ea63b0bbf29e23635da6886a35706

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
a09baf152fd4f6466c9b6c37fd37f7e6

SHA1
4ca0969a4e103fdf0604b0d1dfd10022388e1003

SHA256
a96536c21d942e2befc7df6d5e14fa6861cb7896840a726c17b51956f1ef8683

SHA512
a233602ba864c8c18a750837eb88e6c90a684403c631b1183318a95b7d9174eff1cd6ef2e9d4f1dc4aa152896537767e980ea63b0bbf29e23635da6886a35706

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
a09baf152fd4f6466c9b6c37fd37f7e6

SHA1
4ca0969a4e103fdf0604b0d1dfd10022388e1003

SHA256
a96536c21d942e2befc7df6d5e14fa6861cb7896840a726c17b51956f1ef8683

SHA512
a233602ba864c8c18a750837eb88e6c90a684403c631b1183318a95b7d9174eff1cd6ef2e9d4f1dc4aa152896537767e980ea63b0bbf29e23635da6886a35706

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
b3ccb67d0d6a3f653c43b840ff2ea324

SHA1
e57a9ba7db49745f44b9b10a73296545eea52c64

SHA256
026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469

SHA512
03cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
b3ccb67d0d6a3f653c43b840ff2ea324

SHA1
e57a9ba7db49745f44b9b10a73296545eea52c64

SHA256
026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469

SHA512
03cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
b3ccb67d0d6a3f653c43b840ff2ea324

SHA1
e57a9ba7db49745f44b9b10a73296545eea52c64

SHA256
026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469

SHA512
03cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopSSD.dll

Filesize
144KB

MD5
8db5d6844e3805da9fc0fba20888a34b

SHA1
0ac357e865f9b3d36ce975c4eca4d6b661fe5035

SHA256
76bbcffbc15c6cf9648c25e341f818183e4ae3214e7054432511349c3c2d87a9

SHA512
5c5119202fbeca554aede09848638e69b5e8347bb8297ca854544fe9f3f6c06d13ea8e256594fed66fbe843d12ff6418b4c22249b587a2aa974e2b672f028145

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopSSD.dll

Filesize
144KB

MD5
8db5d6844e3805da9fc0fba20888a34b

SHA1
0ac357e865f9b3d36ce975c4eca4d6b661fe5035

SHA256
76bbcffbc15c6cf9648c25e341f818183e4ae3214e7054432511349c3c2d87a9

SHA512
5c5119202fbeca554aede09848638e69b5e8347bb8297ca854544fe9f3f6c06d13ea8e256594fed66fbe843d12ff6418b4c22249b587a2aa974e2b672f028145

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.DLL

Filesize
2.0MB

MD5
59dac066b544f434f3ef8fbe52bcf6cf

SHA1
eebe8ab6bac0118fdf03f45a6453e03a42af7c69

SHA256
4d96e6621d0378afe56d6e04343e427ffeb76439829e72f5c426025019c7b82d

SHA512
13b3b6c1daa77562da18eb07766432a8a5347fa1e1c17437fd827b2d5a18a81d5477e8049479df62cbbcf03d71cf179e1ab203694885a5b7ab511c95bb798f63

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.dll

Filesize
2.0MB

MD5
59dac066b544f434f3ef8fbe52bcf6cf

SHA1
eebe8ab6bac0118fdf03f45a6453e03a42af7c69

SHA256
4d96e6621d0378afe56d6e04343e427ffeb76439829e72f5c426025019c7b82d

SHA512
13b3b6c1daa77562da18eb07766432a8a5347fa1e1c17437fd827b2d5a18a81d5477e8049479df62cbbcf03d71cf179e1ab203694885a5b7ab511c95bb798f63

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.dll

Filesize
2.0MB

MD5
d3e51e80903b6629f356b8d5d4577e8a

SHA1
598de8e8164bd8d9425912260845de34ad3bf45d

SHA256
d0f8554263168c58c08fe178eb011ff8615b51be4d3cbf57981601c93eff0458

SHA512
e4cf7c5e3426ebb16453fbddd53a6089536543b2565ae71a342702e9ada59eea6c6c898f2e32baee756a9f81a1bc45a93fb9d10395d9af07ec80ed28b13f3620

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.dll

Filesize
2.0MB

MD5
d3e51e80903b6629f356b8d5d4577e8a

SHA1
598de8e8164bd8d9425912260845de34ad3bf45d

SHA256
d0f8554263168c58c08fe178eb011ff8615b51be4d3cbf57981601c93eff0458

SHA512
e4cf7c5e3426ebb16453fbddd53a6089536543b2565ae71a342702e9ada59eea6c6c898f2e32baee756a9f81a1bc45a93fb9d10395d9af07ec80ed28b13f3620

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.dll

Filesize
2.0MB

MD5
d3e51e80903b6629f356b8d5d4577e8a

SHA1
598de8e8164bd8d9425912260845de34ad3bf45d

SHA256
d0f8554263168c58c08fe178eb011ff8615b51be4d3cbf57981601c93eff0458

SHA512
e4cf7c5e3426ebb16453fbddd53a6089536543b2565ae71a342702e9ada59eea6c6c898f2e32baee756a9f81a1bc45a93fb9d10395d9af07ec80ed28b13f3620

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.dll

Filesize
2.0MB

MD5
59dac066b544f434f3ef8fbe52bcf6cf

SHA1
eebe8ab6bac0118fdf03f45a6453e03a42af7c69

SHA256
4d96e6621d0378afe56d6e04343e427ffeb76439829e72f5c426025019c7b82d

SHA512
13b3b6c1daa77562da18eb07766432a8a5347fa1e1c17437fd827b2d5a18a81d5477e8049479df62cbbcf03d71cf179e1ab203694885a5b7ab511c95bb798f63

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\ae ###

Filesize
386B

MD5
969aa477b2b854fc4305e0f45740b828

SHA1
6253cab5930f938e4487d20248b1b5f93e810248

SHA256
6de03aefe35e6deffd1e91f696197ad5a3b4cde430b2a8992120e02ec9e62d4d

SHA512
dd0a5aecadfb0a7eec450fdfabba745fe1cf1d7d00e198c6ba5b6fcf03d3339060fd555bd601f4fd7303bf92b9836d8515fd09c127a6899c83eabe585fda4b32

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktop.exe

Filesize
29KB

MD5
9f5f2f0fb0a7f5aa9f16b9a7b6dad89f

SHA1
603f73160dcc49da297a10f0691cefe4dddd9772

SHA256
6d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc

SHA512
dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktop.exe

Filesize
29KB

MD5
9f5f2f0fb0a7f5aa9f16b9a7b6dad89f

SHA1
603f73160dcc49da297a10f0691cefe4dddd9772

SHA256
6d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc

SHA512
dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopCommon.dll

Filesize
267KB

MD5
df5f4ecacf6df29a0738ccae7e322371

SHA1
98dc051e690c645b5aff8dcb2bcb77ecb5d92df5

SHA256
d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502

SHA512
01c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopCommon.dll

Filesize
267KB

MD5
df5f4ecacf6df29a0738ccae7e322371

SHA1
98dc051e690c645b5aff8dcb2bcb77ecb5d92df5

SHA256
d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502

SHA512
01c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopCommon.dll

Filesize
267KB

MD5
df5f4ecacf6df29a0738ccae7e322371

SHA1
98dc051e690c645b5aff8dcb2bcb77ecb5d92df5

SHA256
d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502

SHA512
01c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopCommon.dll

Filesize
267KB

MD5
df5f4ecacf6df29a0738ccae7e322371

SHA1
98dc051e690c645b5aff8dcb2bcb77ecb5d92df5

SHA256
d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502

SHA512
01c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
b3ccb67d0d6a3f653c43b840ff2ea324

SHA1
e57a9ba7db49745f44b9b10a73296545eea52c64

SHA256
026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469

SHA512
03cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
b3ccb67d0d6a3f653c43b840ff2ea324

SHA1
e57a9ba7db49745f44b9b10a73296545eea52c64

SHA256
026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469

SHA512
03cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
b3ccb67d0d6a3f653c43b840ff2ea324

SHA1
e57a9ba7db49745f44b9b10a73296545eea52c64

SHA256
026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469

SHA512
03cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopResources_en.dll

Filesize
561KB

MD5
b3ccb67d0d6a3f653c43b840ff2ea324

SHA1
e57a9ba7db49745f44b9b10a73296545eea52c64

SHA256
026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469

SHA512
03cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopSetupHelper.exe

Filesize
29KB

MD5
9f5f2f0fb0a7f5aa9f16b9a7b6dad89f

SHA1
603f73160dcc49da297a10f0691cefe4dddd9772

SHA256
6d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc

SHA512
dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopSetupHelper.exe

Filesize
29KB

MD5
9f5f2f0fb0a7f5aa9f16b9a7b6dad89f

SHA1
603f73160dcc49da297a10f0691cefe4dddd9772

SHA256
6d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc

SHA512
dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleServices.DLL

Filesize
2.0MB

MD5
59dac066b544f434f3ef8fbe52bcf6cf

SHA1
eebe8ab6bac0118fdf03f45a6453e03a42af7c69

SHA256
4d96e6621d0378afe56d6e04343e427ffeb76439829e72f5c426025019c7b82d

SHA512
13b3b6c1daa77562da18eb07766432a8a5347fa1e1c17437fd827b2d5a18a81d5477e8049479df62cbbcf03d71cf179e1ab203694885a5b7ab511c95bb798f63

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleServices.dll

Filesize
2.0MB

MD5
59dac066b544f434f3ef8fbe52bcf6cf

SHA1
eebe8ab6bac0118fdf03f45a6453e03a42af7c69

SHA256
4d96e6621d0378afe56d6e04343e427ffeb76439829e72f5c426025019c7b82d

SHA512
13b3b6c1daa77562da18eb07766432a8a5347fa1e1c17437fd827b2d5a18a81d5477e8049479df62cbbcf03d71cf179e1ab203694885a5b7ab511c95bb798f63

Download Submit
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleServices.dll

Filesize
2.0MB

MD5
59dac066b544f434f3ef8fbe52bcf6cf

SHA1
eebe8ab6bac0118fdf03f45a6453e03a42af7c69

SHA256
4d96e6621d0378afe56d6e04343e427ffeb76439829e72f5c426025019c7b82d

SHA512
13b3b6c1daa77562da18eb07766432a8a5347fa1e1c17437fd827b2d5a18a81d5477e8049479df62cbbcf03d71cf179e1ab203694885a5b7ab511c95bb798f63

Download Submit
memory/380-0-0x00000000003B0000-0x0000000000958000-memory.dmp

Filesize
5.7MB

Download
memory/380-19-0x00000000037E0000-0x00000000037E1000-memory.dmp

Filesize
4KB

Download
memory/380-1-0x0000000001400000-0x0000000001402000-memory.dmp

Filesize
8KB

Download
memory/380-184-0x0000000001400000-0x0000000001402000-memory.dmp

Filesize
8KB

Download
memory/380-189-0x00000000003B0000-0x0000000000958000-memory.dmp

Filesize
5.7MB

Download
memory/380-203-0x00000000003B0000-0x0000000000958000-memory.dmp

Filesize
5.7MB

Download
memory/380-204-0x00000000003B0000-0x0000000000958000-memory.dmp

Filesize
5.7MB

Download
memory/380-205-0x00000000003B0000-0x0000000000958000-memory.dmp

Filesize
5.7MB

Download
memory/380-213-0x00000000003B0000-0x0000000000958000-memory.dmp

Filesize
5.7MB

Download
memory/1784-185-0x0000000003DC0000-0x0000000003DC1000-memory.dmp

Filesize
4KB

Download
memory/1784-202-0x0000000003DC0000-0x0000000003DC1000-memory.dmp

Filesize
4KB

Download
memory/3532-22-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download