Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
594s -
max time network
609s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
05/11/2023, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
GoogleDesktopSetup.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
GoogleDesktopSetup.exe
Resource
win10v2004-20231023-en
General
-
Target
GoogleDesktopSetup.exe
-
Size
1.9MB
-
MD5
91f67571db8e365e848f78ab4d6580ea
-
SHA1
a185b4a309497851603ff060a2de20b4d1560133
-
SHA256
7e7a371a7f563dc181cbe70a684880cbf036a2540b322ab56916b3671ace7df3
-
SHA512
9fe1e6ade453c7c80025ba3d0105c6124929fbe5cdebbba3564aa77270cff22ac0b1ce0e557d596c46271f7c5863fe72ba7b8dd705769a92acb94dbb91d327ac
-
SSDEEP
49152:sfSMWuHHwY6XSls25HoWCbFNFuVXIvRvp3tfNAvWik+:5Mpnz6XG+bFKVXIzUvWD+
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation GoogleDesktopSetup.exe Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation GoogleDesktop.exe Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation GoogleDesktop.exe -
Executes dropped EXE 10 IoCs
pid Process 4188 GoogleDesktopSetupHelper.exe 5004 GoogleDesktop.exe 2412 GoogleDesktop.exe 2460 GoogleDesktop.exe 4356 GoogleDesktop.exe 2324 GoogleDesktop64BitLaunch.exe 1036 GoogleDesktop.exe 1700 GoogleDesktop.exe 4572 GoogleDesktop.exe 1396 GoogleDesktop.exe -
Loads dropped DLL 64 IoCs
pid Process 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 4188 GoogleDesktopSetupHelper.exe 4188 GoogleDesktopSetupHelper.exe 4188 GoogleDesktopSetupHelper.exe 5004 GoogleDesktop.exe 5004 GoogleDesktop.exe 5004 GoogleDesktop.exe 2412 GoogleDesktop.exe 2412 GoogleDesktop.exe 2412 GoogleDesktop.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 2460 GoogleDesktop.exe 2460 GoogleDesktop.exe 2460 GoogleDesktop.exe 2460 GoogleDesktop.exe 2460 GoogleDesktop.exe 4356 GoogleDesktop.exe 4356 GoogleDesktop.exe 4356 GoogleDesktop.exe 4356 GoogleDesktop.exe 2324 GoogleDesktop64BitLaunch.exe 3380 Explorer.EXE 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1700 GoogleDesktop.exe 1700 GoogleDesktop.exe 1700 GoogleDesktop.exe 1700 GoogleDesktop.exe 1700 GoogleDesktop.exe 4572 GoogleDesktop.exe 4572 GoogleDesktop.exe 4572 GoogleDesktop.exe 4572 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1752 rundll32.exe 1752 rundll32.exe 1752 rundll32.exe 1752 rundll32.exe 1752 rundll32.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Google Desktop Search = "\"C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup" GoogleDesktopSetup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: GoogleDesktop.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt GoogleDesktop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll GoogleDesktop.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak GoogleDesktop.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt GoogleDesktop.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png GoogleDesktop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll GoogleDesktop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe GoogleDesktop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe GoogleDesktop.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jni.h GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui GoogleDesktop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui GoogleDesktop.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui GoogleDesktop.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak GoogleDesktop.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt GoogleDesktop.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll GoogleDesktop.exe File opened for modification C:\Program Files (x86)\Google\Google Desktop Search\ac ### files - your system GoogleDesktopSetup.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak GoogleDesktop.exe File opened for modification C:\Program Files (x86)\Google\Google Desktop Search\ GoogleDesktopSetup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\System\ado\msadox28.tlb GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll GoogleDesktop.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe GoogleDesktop.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt GoogleDesktop.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak GoogleDesktop.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak GoogleDesktop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc GoogleDesktop.exe File created C:\Program Files (x86)\Google\Google Desktop Search\_NEW_GoogleDesktopNetwork3.dll GoogleDesktopSetup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll GoogleDesktop.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui GoogleDesktop.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak GoogleDesktop.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui GoogleDesktop.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt GoogleDesktop.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt GoogleDesktop.exe File opened for modification C:\Program Files\Internet Explorer\SIGNUP\install.ins GoogleDesktop.exe File created C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopSetup.exe GoogleDesktopSetup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui GoogleDesktop.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe GoogleDesktop.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoogleDesktop.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz GoogleDesktop.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use Search Asst = "no" GoogleDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://www.google.com/ie" GoogleDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\DisplayName = "Google" GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{5D80A6D1-B500-47DA-82B8-EB9875F85B4D} GoogleDesktopSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" GoogleDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\URL = "http://www.google.com/search?q={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7" GoogleDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com" GoogleDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}\URL = "http://127.0.0.1:4664/search&s=lrxTpYBIXro_Z40vc09m-9uvDNo?q={searchTerms}" GoogleDesktop.exe Key created \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Internet Explorer\SearchScopes\ GoogleDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\URL = "http://www.google.com/search?q={searchTerms}&rlz=1I7GGLD_en&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7" GoogleDesktop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{5D80A6D1-B500-47DA-82B8-EB9875F85B4D}\Compatibility Flags = "1024" GoogleDesktopSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}\FaviconPath = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\favicon.ico" GoogleDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}\DisplayName = "Google Desktop" GoogleDesktop.exe Key created \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} GoogleDesktop.exe Key created \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Internet Explorer\Main GoogleDesktop.exe Key created \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E} GoogleDesktop.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com/" GoogleDesktop.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7C0BEB7-446B-43BF-83E3-5EC37A9DBCC8} GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BA6059E-03F3-4931-9BC0-375B694CAE3F}\TypeLib GoogleDesktopSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B41F373F-04FE-4D69-A972-DEB002444278}\ProxyStubClsid32 GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECCB4495-7F5B-4B4E-A887-7A66BE948AC1}\InprocServer32 GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E467448-EC21-4A24-BFCD-2DF951214F00}\ProxyStubClsid32 GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A27060E0-6921-4C82-8C15-935620B73ED3}\InprocServer32\ThreadingModel = "Both" GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktop.MICF\ GoogleDesktopSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50EDABE0-140C-406D-A8B9-32652145560A}\Programmable GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{634E2122-6BB7-430F-B452-CF04C8722C47}\InprocServer32\ThreadingModel = "Apartment" GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5006908-0C7A-49E2-85DA-C2675E554F91}\TypeLib GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6D8FE80-712E-4F30-9CD2-F7FEF473BA44}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktopAPI2.dll" GoogleDesktopSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleGadgetManifest\shell GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.doc GoogleDesktopSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5751ACAA-4710-4160-999F-A2AD6FEA3484} GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E72293F-05C2-4C1A-8E4E-3158EC3D8574}\ProxyStubClsid32 GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{75CCC48F-8C8A-4E21-896E-AB408D3592D0}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleServices.DLL" GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{163BDD74-7164-4940-84B3-575898032CF9}\InprocServer32\ThreadingModel = "Apartment" GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2BF1B7EE-DC5C-4F05-8DFA-273D6C199567}\ = "IGoogleDesktopDisplayContentItemHandler" GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4853C4B-43EB-41DE-A0B1-B5B97C31CB0A}\ProxyStubClsid32 GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktop.EventPublisher.1\CLSID\ = "{2C6F11D4-CF22-4E1F-A271-2A4A0393ADAC}" GoogleDesktopSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED90C79B-B01D-4A4F-B3D6-CE736B57645C} GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66F9F427-03C9-462F-85AF-88F362620FB0}\ = "IGoogleDesktopStockPanelDetailsView" GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1CEB927-5FCD-4777-91D1-90031D643382}\Description\ GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FEF88129-AF9F-4FC3-9B28-772CF06F8C7E}\InprocServer32\ThreadingModel = "Both" GoogleDesktopSetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\app/gg\Extension = ".gg" GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6D8FE80-712E-4F30-9CD2-F7FEF473BA44}\ProgID\ = "GoogleDesktop.RankableItem.1" GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{84AB752D-6BBB-490C-8BF8-4D459F775B13} GoogleDesktopSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FEF88129-AF9F-4FC3-9B28-772CF06F8C7E} GoogleDesktopSetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CBE5894-03B1-48C9-922A-CE5C886252F3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GoogleDesktopSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3534261-9E76-435C-8AD7-C1406B5E1C83}\ProxyStubClsid32 GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AD5597A-2B0F-4479-97B6-C514DEC41EA1}\VersionIndependentProgID GoogleDesktop.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1CEB927-5FCD-4777-91D1-90031D643382}\Programmable GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E37FB82-3FC3-4464-A7AE-D3B9E90E11A7}\TypeLib GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86EB2E81-9323-4F83-A3EC-EF1800F3D9D5}\TypeLib GoogleDesktopSetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81ACBD30-3750-4C4E-BDA1-173FB509D475}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktopAPI2.dll" GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CB93C531-A7EE-4396-A026-17A44D384B65}\ProxyStubClsid32 GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8F549279-DE9A-4250-A985-4D9B7ECD48B6}\ = "IGoogleDesktopDisplaySite3" GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BC18CC8F-D1D6-485D-BF12-7C705BEAAF51}\ProxyStubClsid32 GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A734302-566D-4C1C-B805-4643F6A95565}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktopAPI2.dll" GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2D71E8B-D85F-4B7A-9315-41EF8443D1D5}\InprocServer32\ThreadingModel = "Both" GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2BBF60B4-E292-4E69-91C8-2FA3F0D55997}\TypeLib\ = "{ACD1A266-C77B-4691-B96A-AF712B83A364}" GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleDesktopSearch.EventFactory.1\CLSID\ = "{579822B3-44CD-4786-83E0-AE32BCB9E6B1}" GoogleDesktopSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2D71E8B-D85F-4B7A-9315-41EF8443D1D5}\Programmable GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleTalk.TalkFriend GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ACD1A266-C77B-4691-B96A-AF712B83A364}\3.0\FLAGS\ = "0" GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4052D303-74C5-49EA-BC6B-66099C8D4007} GoogleDesktop.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA34768-CE6C-425E-B443-3661CE14FF8F}\ProgID GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B60D50-19AB-4A32-A8B1-A09113AB2BA4}\2.1\0\win32\ = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleServices.DLL" GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86EB2E81-9323-4F83-A3EC-EF1800F3D9D5}\TypeLib\ = "{777C9CEC-FBBC-4294-8C7C-A231F89382E3}" GoogleDesktopSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{634E2122-6BB7-430F-B452-CF04C8722C47}\Programmable GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECCB4495-7F5B-4B4E-A887-7A66BE948AC1}\ = "@C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleDesktopResources_en.dll,-9034;News" GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{507102D5-CBEF-43E6-936C-2E6FD3DE8603} GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B62A832-2CA2-4843-86CA-45450D35EADA}\VersionIndependentProgID GoogleDesktopSetup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AD5597A-2B0F-4479-97B6-C514DEC41EA1}\ProgID GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4516155C-B94E-4334-8D26-D4BF0932581C}\Description GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F549279-DE9A-4250-A985-4D9B7ECD48B6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C92D45D1-9956-4B69-8B1C-3CF5CD109908}\VersionIndependentProgID GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{54648593-C279-476D-82AF-9CFCB45313B4}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Google Desktop Search\\GoogleServices.DLL" GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55EED705-AEF7-4F13-8030-371A89A1340B}\ = "GoogleDesktopRankingEngine Class" GoogleDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F11D7457-2381-4337-977F-4090C75EBC23}\Programmable GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82F11EB2-19AF-415D-816E-05FBA034A616}\TypeLib\ = "{ACD1A266-C77B-4691-B96A-AF712B83A364}" GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C942271F-CEFF-4CF6-8597-050CE76A65B1}\TypeLib\Version = "2.1" GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AD5597A-2B0F-4479-97B6-C514DEC41EA1}\ProgID\ = "GoogleDesktop.TalkPlugin.1" GoogleDesktop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C3173C82-8B78-4F08-B19A-A65B7F48630A}\ = "IGoogleDesktopRegisterCustomAction" GoogleDesktopSetup.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2 GoogleDesktop.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5c0000000100000004000000000400007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64 GoogleDesktop.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 3740 GoogleDesktopSetup.exe 3740 GoogleDesktopSetup.exe 1752 rundll32.exe 1752 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 4300 rundll32.exe 4300 rundll32.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 3380 Explorer.EXE 1036 GoogleDesktop.exe 1396 GoogleDesktop.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3740 GoogleDesktopSetup.exe Token: 33 1036 GoogleDesktop.exe Token: SeIncBasePriorityPrivilege 1036 GoogleDesktop.exe Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: 33 1036 GoogleDesktop.exe Token: SeIncBasePriorityPrivilege 1036 GoogleDesktop.exe Token: 33 1036 GoogleDesktop.exe Token: SeIncBasePriorityPrivilege 1036 GoogleDesktop.exe Token: 33 1036 GoogleDesktop.exe Token: SeIncBasePriorityPrivilege 1036 GoogleDesktop.exe Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: 33 1036 GoogleDesktop.exe Token: SeIncBasePriorityPrivilege 1036 GoogleDesktop.exe Token: 33 1036 GoogleDesktop.exe Token: SeIncBasePriorityPrivilege 1036 GoogleDesktop.exe Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: 33 1036 GoogleDesktop.exe Token: SeIncBasePriorityPrivilege 1036 GoogleDesktop.exe Token: 33 1036 GoogleDesktop.exe Token: SeIncBasePriorityPrivilege 1036 GoogleDesktop.exe Token: 33 1036 GoogleDesktop.exe Token: SeIncBasePriorityPrivilege 1036 GoogleDesktop.exe Token: 33 1036 GoogleDesktop.exe Token: SeIncBasePriorityPrivilege 1036 GoogleDesktop.exe Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: 33 1396 GoogleDesktop.exe Token: SeIncBasePriorityPrivilege 1396 GoogleDesktop.exe Token: 33 1036 GoogleDesktop.exe Token: SeIncBasePriorityPrivilege 1036 GoogleDesktop.exe Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: 33 1036 GoogleDesktop.exe Token: SeIncBasePriorityPrivilege 1036 GoogleDesktop.exe Token: 33 1396 GoogleDesktop.exe Token: SeIncBasePriorityPrivilege 1396 GoogleDesktop.exe Token: 33 1396 GoogleDesktop.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 3380 Explorer.EXE 3380 Explorer.EXE 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1036 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1036 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 3380 Explorer.EXE 3380 Explorer.EXE 1396 GoogleDesktop.exe 3380 Explorer.EXE 3380 Explorer.EXE 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 3380 Explorer.EXE 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1396 GoogleDesktop.exe 1036 GoogleDesktop.exe 3380 Explorer.EXE 3380 Explorer.EXE 3380 Explorer.EXE 3380 Explorer.EXE 3380 Explorer.EXE 3380 Explorer.EXE 3380 Explorer.EXE 3380 Explorer.EXE 3380 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1036 GoogleDesktop.exe 3380 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3380 Explorer.EXE -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 3740 wrote to memory of 4188 3740 GoogleDesktopSetup.exe 93 PID 3740 wrote to memory of 4188 3740 GoogleDesktopSetup.exe 93 PID 3740 wrote to memory of 4188 3740 GoogleDesktopSetup.exe 93 PID 3740 wrote to memory of 5004 3740 GoogleDesktopSetup.exe 96 PID 3740 wrote to memory of 5004 3740 GoogleDesktopSetup.exe 96 PID 3740 wrote to memory of 5004 3740 GoogleDesktopSetup.exe 96 PID 3740 wrote to memory of 2412 3740 GoogleDesktopSetup.exe 98 PID 3740 wrote to memory of 2412 3740 GoogleDesktopSetup.exe 98 PID 3740 wrote to memory of 2412 3740 GoogleDesktopSetup.exe 98 PID 3740 wrote to memory of 2460 3740 GoogleDesktopSetup.exe 102 PID 3740 wrote to memory of 2460 3740 GoogleDesktopSetup.exe 102 PID 3740 wrote to memory of 2460 3740 GoogleDesktopSetup.exe 102 PID 3740 wrote to memory of 4356 3740 GoogleDesktopSetup.exe 108 PID 3740 wrote to memory of 4356 3740 GoogleDesktopSetup.exe 108 PID 3740 wrote to memory of 4356 3740 GoogleDesktopSetup.exe 108 PID 3740 wrote to memory of 2324 3740 GoogleDesktopSetup.exe 109 PID 3740 wrote to memory of 2324 3740 GoogleDesktopSetup.exe 109 PID 2324 wrote to memory of 3380 2324 GoogleDesktop64BitLaunch.exe 52 PID 2324 wrote to memory of 3380 2324 GoogleDesktop64BitLaunch.exe 52 PID 3380 wrote to memory of 1036 3380 Explorer.EXE 110 PID 3380 wrote to memory of 1036 3380 Explorer.EXE 110 PID 3380 wrote to memory of 1036 3380 Explorer.EXE 110 PID 1036 wrote to memory of 1700 1036 GoogleDesktop.exe 112 PID 1036 wrote to memory of 1700 1036 GoogleDesktop.exe 112 PID 1036 wrote to memory of 1700 1036 GoogleDesktop.exe 112 PID 1036 wrote to memory of 1752 1036 GoogleDesktop.exe 122 PID 1036 wrote to memory of 1752 1036 GoogleDesktop.exe 122 PID 1036 wrote to memory of 1752 1036 GoogleDesktop.exe 122 PID 1036 wrote to memory of 1396 1036 GoogleDesktop.exe 123 PID 1036 wrote to memory of 1396 1036 GoogleDesktop.exe 123 PID 1036 wrote to memory of 1396 1036 GoogleDesktop.exe 123 PID 1036 wrote to memory of 2572 1036 GoogleDesktop.exe 128 PID 1036 wrote to memory of 2572 1036 GoogleDesktop.exe 128 PID 1036 wrote to memory of 2572 1036 GoogleDesktop.exe 128 PID 1036 wrote to memory of 3368 1036 GoogleDesktop.exe 129 PID 1036 wrote to memory of 3368 1036 GoogleDesktop.exe 129 PID 1036 wrote to memory of 3368 1036 GoogleDesktop.exe 129 PID 1036 wrote to memory of 4300 1036 GoogleDesktop.exe 131 PID 1036 wrote to memory of 4300 1036 GoogleDesktop.exe 131 PID 1036 wrote to memory of 4300 1036 GoogleDesktop.exe 131 PID 1036 wrote to memory of 1276 1036 GoogleDesktop.exe 133 PID 1036 wrote to memory of 1276 1036 GoogleDesktop.exe 133 PID 1036 wrote to memory of 1276 1036 GoogleDesktop.exe 133
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\GoogleDesktopSetup.exe"C:\Users\Admin\AppData\Local\Temp\GoogleDesktopSetup.exe"2⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopSetupHelper.exe"C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktopSetupHelper.exe" /mdo3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4188
-
-
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe"C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /system /regserver /quit3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5004
-
-
C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktop.exe"C:\Program Files (x86)\Google\Google Desktop Search\gcdtmp1\GoogleDesktop.exe" /manager /service /path "C:\Program Files (x86)\Google\Google Desktop Search\"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2412
-
-
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe"C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /display /regserver /quit3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2460
-
-
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe"C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /system /gdupdate /quit /system3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4356
-
-
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop64BitLaunch.exe"C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop64BitLaunch.exe" 00430072006500610074006500500072006F0063006500730073 00000D34 0043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C0047006F006F0067006C0065005C0047006F006F0067006C00650020004400650073006B0074006F00700020005300650061007200630068005C0047006F006F0067006C0065004400650073006B0074006F0070002E006500780065 002F0069006E007300740061006C006C0020 00003⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324
-
-
-
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe/install2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe"C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /display /userreg /quit3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.dll",OutOfProcMetadataMain3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1752
-
-
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe"GoogleDesktop.exe" /display3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:1396
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.dll",OutOfProcMetadataMain3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046}" http://127.0.0.1:4664/status&s=4Dor41fqGE5xS5aJKoWYR9akrIw3⤵PID:3368
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.dll",OutOfProcMetadataMain3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4300
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Program Files (x86)\Google\Google Desktop Search\GoogleServices.dll",OutOfProcMetadataMain3⤵PID:1276
-
-
-
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe"C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4572
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD56434b5f02751b9140deecf4e4a3bab47
SHA10243c668a7889d0a5925c6accf8be07c375e8fdf
SHA2569166c41a962d6f445f9a399fd26c24819bc15b4eb2d5db2c5b948fbcdeceb272
SHA512e30b24a7c692ed576b2ae0a075aab622e32ea78ec41bb5f0fea5d5651c1a6c0c08574d1546ed4f40cfc50a8a7fa49a950a075fcfc7dc976b374fa13f8905b02d
-
Filesize
29KB
MD59f5f2f0fb0a7f5aa9f16b9a7b6dad89f
SHA1603f73160dcc49da297a10f0691cefe4dddd9772
SHA2566d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc
SHA512dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102
-
Filesize
29KB
MD59f5f2f0fb0a7f5aa9f16b9a7b6dad89f
SHA1603f73160dcc49da297a10f0691cefe4dddd9772
SHA2566d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc
SHA512dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102
-
Filesize
29KB
MD59f5f2f0fb0a7f5aa9f16b9a7b6dad89f
SHA1603f73160dcc49da297a10f0691cefe4dddd9772
SHA2566d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc
SHA512dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102
-
Filesize
29KB
MD59f5f2f0fb0a7f5aa9f16b9a7b6dad89f
SHA1603f73160dcc49da297a10f0691cefe4dddd9772
SHA2566d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc
SHA512dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102
-
Filesize
29KB
MD59f5f2f0fb0a7f5aa9f16b9a7b6dad89f
SHA1603f73160dcc49da297a10f0691cefe4dddd9772
SHA2566d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc
SHA512dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102
-
Filesize
29KB
MD59f5f2f0fb0a7f5aa9f16b9a7b6dad89f
SHA1603f73160dcc49da297a10f0691cefe4dddd9772
SHA2566d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc
SHA512dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102
-
Filesize
29KB
MD59f5f2f0fb0a7f5aa9f16b9a7b6dad89f
SHA1603f73160dcc49da297a10f0691cefe4dddd9772
SHA2566d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc
SHA512dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102
-
Filesize
86KB
MD5fdac632abecf6cb7c6b79fe2b9d191d0
SHA1e5fdd25263313fc83cf7fcc3241e919c10c5f735
SHA256a1e05fbb2bdb73c7ad64f5d26e5728e7a6001541b8bbdc16720b620d0cd94e08
SHA512cb1c0dcc37a50683b25a944785098824bc05e380d89e1863a5c97638c6a484dd0600122a432fcb6268f301705b82c720e9c1b5f6a3863f1e824a3f2ee8145a68
-
Filesize
86KB
MD5fdac632abecf6cb7c6b79fe2b9d191d0
SHA1e5fdd25263313fc83cf7fcc3241e919c10c5f735
SHA256a1e05fbb2bdb73c7ad64f5d26e5728e7a6001541b8bbdc16720b620d0cd94e08
SHA512cb1c0dcc37a50683b25a944785098824bc05e380d89e1863a5c97638c6a484dd0600122a432fcb6268f301705b82c720e9c1b5f6a3863f1e824a3f2ee8145a68
-
Filesize
86KB
MD5fdac632abecf6cb7c6b79fe2b9d191d0
SHA1e5fdd25263313fc83cf7fcc3241e919c10c5f735
SHA256a1e05fbb2bdb73c7ad64f5d26e5728e7a6001541b8bbdc16720b620d0cd94e08
SHA512cb1c0dcc37a50683b25a944785098824bc05e380d89e1863a5c97638c6a484dd0600122a432fcb6268f301705b82c720e9c1b5f6a3863f1e824a3f2ee8145a68
-
Filesize
4KB
MD5cfe24012488e1679c0c53fd599dbbe69
SHA1be1c64a4b003c4285ff7c1efbebbb42ba20f05a7
SHA2562264ce9037eeee6d1dfcb8acf20945de86f8e54dbd701147f0991d4e68665742
SHA5120df62e06fb579744e11423b7283c55d142991a2a09b000b8cb3f8749d734dda58d20f327d6ccf88276f3ba319824aad1a99c780ea8f7071df997ceef56a5af1e
-
Filesize
4KB
MD5cfe24012488e1679c0c53fd599dbbe69
SHA1be1c64a4b003c4285ff7c1efbebbb42ba20f05a7
SHA2562264ce9037eeee6d1dfcb8acf20945de86f8e54dbd701147f0991d4e68665742
SHA5120df62e06fb579744e11423b7283c55d142991a2a09b000b8cb3f8749d734dda58d20f327d6ccf88276f3ba319824aad1a99c780ea8f7071df997ceef56a5af1e
-
Filesize
469KB
MD5cca0000b5f9f73aca4b74d60d590ac48
SHA1654a790bbebe6a778f89e915004ce10802b255b8
SHA256479d437ea8964d5b1080e63b7823274e548fce841b03abc89a5fb33e3603abad
SHA512ddaaa283ff032016636012fad00fc430cfc6ecc19a13574a13a0fa1ca3b7b9db9fa45bbcc2d8faab3a05f06e29505d458129e616024743520f28c2f0b90f0a4f
-
Filesize
469KB
MD5cca0000b5f9f73aca4b74d60d590ac48
SHA1654a790bbebe6a778f89e915004ce10802b255b8
SHA256479d437ea8964d5b1080e63b7823274e548fce841b03abc89a5fb33e3603abad
SHA512ddaaa283ff032016636012fad00fc430cfc6ecc19a13574a13a0fa1ca3b7b9db9fa45bbcc2d8faab3a05f06e29505d458129e616024743520f28c2f0b90f0a4f
-
Filesize
469KB
MD5cca0000b5f9f73aca4b74d60d590ac48
SHA1654a790bbebe6a778f89e915004ce10802b255b8
SHA256479d437ea8964d5b1080e63b7823274e548fce841b03abc89a5fb33e3603abad
SHA512ddaaa283ff032016636012fad00fc430cfc6ecc19a13574a13a0fa1ca3b7b9db9fa45bbcc2d8faab3a05f06e29505d458129e616024743520f28c2f0b90f0a4f
-
Filesize
469KB
MD5cca0000b5f9f73aca4b74d60d590ac48
SHA1654a790bbebe6a778f89e915004ce10802b255b8
SHA256479d437ea8964d5b1080e63b7823274e548fce841b03abc89a5fb33e3603abad
SHA512ddaaa283ff032016636012fad00fc430cfc6ecc19a13574a13a0fa1ca3b7b9db9fa45bbcc2d8faab3a05f06e29505d458129e616024743520f28c2f0b90f0a4f
-
Filesize
469KB
MD5a22bfcc3b222f6fe4d527e69e9c43871
SHA170fe955fa1d3550cdae28362319ca2636b0834f2
SHA256ca71061c3ba096e08d8dfc943265609374957701944bd6b20b1f72823c0dcf28
SHA512448c99fcdbe63ba1e8f9513f451123463ca2db91ce0d6ba7b949ac70ca7578ce23f6f54c6a96cf8d8d7d5c6a02914a9e2a0c5aee6ad437cee3c757b1af7c3ff7
-
Filesize
267KB
MD5df5f4ecacf6df29a0738ccae7e322371
SHA198dc051e690c645b5aff8dcb2bcb77ecb5d92df5
SHA256d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502
SHA51201c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375
-
Filesize
267KB
MD5df5f4ecacf6df29a0738ccae7e322371
SHA198dc051e690c645b5aff8dcb2bcb77ecb5d92df5
SHA256d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502
SHA51201c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375
-
Filesize
267KB
MD5b3d57647f931aa0b95349c585eb4e52c
SHA10432f288f61748141873945f1103bf03bf935e03
SHA256d585bbd8931add61679a2200b2c35d1eefb8b265b8e1db6da29dbc337a228dfb
SHA512afb0b90a2a492bbbfa28778c5bd628a6cef212905813cd68b620822c5c8ac725309e9a79bdbb1bfe6ddfaf1c0dc79ed208700b7325d4db7bf0e639dc4442e029
-
Filesize
267KB
MD5b3d57647f931aa0b95349c585eb4e52c
SHA10432f288f61748141873945f1103bf03bf935e03
SHA256d585bbd8931add61679a2200b2c35d1eefb8b265b8e1db6da29dbc337a228dfb
SHA512afb0b90a2a492bbbfa28778c5bd628a6cef212905813cd68b620822c5c8ac725309e9a79bdbb1bfe6ddfaf1c0dc79ed208700b7325d4db7bf0e639dc4442e029
-
Filesize
267KB
MD5b3d57647f931aa0b95349c585eb4e52c
SHA10432f288f61748141873945f1103bf03bf935e03
SHA256d585bbd8931add61679a2200b2c35d1eefb8b265b8e1db6da29dbc337a228dfb
SHA512afb0b90a2a492bbbfa28778c5bd628a6cef212905813cd68b620822c5c8ac725309e9a79bdbb1bfe6ddfaf1c0dc79ed208700b7325d4db7bf0e639dc4442e029
-
Filesize
267KB
MD5df5f4ecacf6df29a0738ccae7e322371
SHA198dc051e690c645b5aff8dcb2bcb77ecb5d92df5
SHA256d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502
SHA51201c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375
-
Filesize
267KB
MD5df5f4ecacf6df29a0738ccae7e322371
SHA198dc051e690c645b5aff8dcb2bcb77ecb5d92df5
SHA256d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502
SHA51201c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375
-
Filesize
173KB
MD523dc791b6ba68b87a4f2aab271ede3b6
SHA148f1ed5b7576badee12b85d08c12131766f9eb13
SHA256077d1162e4cd76b50dad89801cf52de1f965c87294657d0b6b84d0cc15f3a2fb
SHA512aea486225d83c7e08a36214db030696cb26e51cfe97637c2dfd4b48d91e7312af0a72f7f6d8f59d121efdd562d5d214590f0b3fbe47c568854d4c1fa03735cf1
-
Filesize
173KB
MD523dc791b6ba68b87a4f2aab271ede3b6
SHA148f1ed5b7576badee12b85d08c12131766f9eb13
SHA256077d1162e4cd76b50dad89801cf52de1f965c87294657d0b6b84d0cc15f3a2fb
SHA512aea486225d83c7e08a36214db030696cb26e51cfe97637c2dfd4b48d91e7312af0a72f7f6d8f59d121efdd562d5d214590f0b3fbe47c568854d4c1fa03735cf1
-
Filesize
98KB
MD5e9c5d1b2464e24ebcf55614337977245
SHA1ec7131f7d74642c4ba2612d92d653e13a895d988
SHA256751f68d0825c60d911083af0857838c074c36765660d8e4f7763d3f097c5eb32
SHA512ae27da0c3390767cc3463f4ff29b8a0dc189efa94e2e8274af846d8fc45b317be102db143ce3b2ed4bd62dd64ad767bf83f2585e3b9851f52b55e7b1f8c3674f
-
Filesize
120KB
MD56434b5f02751b9140deecf4e4a3bab47
SHA10243c668a7889d0a5925c6accf8be07c375e8fdf
SHA2569166c41a962d6f445f9a399fd26c24819bc15b4eb2d5db2c5b948fbcdeceb272
SHA512e30b24a7c692ed576b2ae0a075aab622e32ea78ec41bb5f0fea5d5651c1a6c0c08574d1546ed4f40cfc50a8a7fa49a950a075fcfc7dc976b374fa13f8905b02d
-
Filesize
120KB
MD56434b5f02751b9140deecf4e4a3bab47
SHA10243c668a7889d0a5925c6accf8be07c375e8fdf
SHA2569166c41a962d6f445f9a399fd26c24819bc15b4eb2d5db2c5b948fbcdeceb272
SHA512e30b24a7c692ed576b2ae0a075aab622e32ea78ec41bb5f0fea5d5651c1a6c0c08574d1546ed4f40cfc50a8a7fa49a950a075fcfc7dc976b374fa13f8905b02d
-
Filesize
120KB
MD550de0755ad1212502e96d83b02d70541
SHA1da7751f459c6b145decf7887739d697fb422dc8a
SHA2569abed8becb379077239c0b01f917c1700b9493d0c16e3c4c9d8937ab8f863fe7
SHA512b0fadc1430f0307c3b7a19ba6afabaca63c07ffb7104cba04d15c8a32f86b228e6370d1a11067464b7603ae24246ea10d75975b67722b372a6e3306800aa0398
-
Filesize
120KB
MD550de0755ad1212502e96d83b02d70541
SHA1da7751f459c6b145decf7887739d697fb422dc8a
SHA2569abed8becb379077239c0b01f917c1700b9493d0c16e3c4c9d8937ab8f863fe7
SHA512b0fadc1430f0307c3b7a19ba6afabaca63c07ffb7104cba04d15c8a32f86b228e6370d1a11067464b7603ae24246ea10d75975b67722b372a6e3306800aa0398
-
Filesize
120KB
MD550de0755ad1212502e96d83b02d70541
SHA1da7751f459c6b145decf7887739d697fb422dc8a
SHA2569abed8becb379077239c0b01f917c1700b9493d0c16e3c4c9d8937ab8f863fe7
SHA512b0fadc1430f0307c3b7a19ba6afabaca63c07ffb7104cba04d15c8a32f86b228e6370d1a11067464b7603ae24246ea10d75975b67722b372a6e3306800aa0398
-
Filesize
209KB
MD5f05190a230841640c410bc0461173a8e
SHA198bd6646ac04f583ca128b41b9a614a5a1e9904c
SHA256b0fed381043070d2ed95dc2d08d449d526a99fa60e4eaa1dd04b84c53ddd0a45
SHA5124e237d310967bb1f710de5b764c4a3bf8647f1ba5f2533be6e0bfba087ee22a833be5bd6cbf9c41c574d59f2fd8ce992dd84c1b533f78186974a3e2d587da2c1
-
Filesize
209KB
MD5f05190a230841640c410bc0461173a8e
SHA198bd6646ac04f583ca128b41b9a614a5a1e9904c
SHA256b0fed381043070d2ed95dc2d08d449d526a99fa60e4eaa1dd04b84c53ddd0a45
SHA5124e237d310967bb1f710de5b764c4a3bf8647f1ba5f2533be6e0bfba087ee22a833be5bd6cbf9c41c574d59f2fd8ce992dd84c1b533f78186974a3e2d587da2c1
-
Filesize
209KB
MD571eb83834a475e5e04b45d3187e1c0dc
SHA11754f499f0407b72303c9a809ff0a4e34c948b18
SHA25608ee372c97b5d6edcb5f1219245ce44535a373c1827254f8c91493c3818ffae1
SHA51229258089742a064d42dcda6945fc12ccd43aee0ca9235798c0c0eb1d0c8769e6764339811295a4f52fb5b43b6a3df635188683f84e8576f71dd844ee95cc62ec
-
Filesize
209KB
MD571eb83834a475e5e04b45d3187e1c0dc
SHA11754f499f0407b72303c9a809ff0a4e34c948b18
SHA25608ee372c97b5d6edcb5f1219245ce44535a373c1827254f8c91493c3818ffae1
SHA51229258089742a064d42dcda6945fc12ccd43aee0ca9235798c0c0eb1d0c8769e6764339811295a4f52fb5b43b6a3df635188683f84e8576f71dd844ee95cc62ec
-
Filesize
561KB
MD5b3ccb67d0d6a3f653c43b840ff2ea324
SHA1e57a9ba7db49745f44b9b10a73296545eea52c64
SHA256026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469
SHA51203cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748
-
Filesize
561KB
MD5b3ccb67d0d6a3f653c43b840ff2ea324
SHA1e57a9ba7db49745f44b9b10a73296545eea52c64
SHA256026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469
SHA51203cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748
-
Filesize
561KB
MD5b3ccb67d0d6a3f653c43b840ff2ea324
SHA1e57a9ba7db49745f44b9b10a73296545eea52c64
SHA256026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469
SHA51203cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748
-
Filesize
561KB
MD5b3ccb67d0d6a3f653c43b840ff2ea324
SHA1e57a9ba7db49745f44b9b10a73296545eea52c64
SHA256026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469
SHA51203cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748
-
Filesize
561KB
MD5b3ccb67d0d6a3f653c43b840ff2ea324
SHA1e57a9ba7db49745f44b9b10a73296545eea52c64
SHA256026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469
SHA51203cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748
-
Filesize
561KB
MD5b3ccb67d0d6a3f653c43b840ff2ea324
SHA1e57a9ba7db49745f44b9b10a73296545eea52c64
SHA256026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469
SHA51203cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748
-
Filesize
561KB
MD5b3ccb67d0d6a3f653c43b840ff2ea324
SHA1e57a9ba7db49745f44b9b10a73296545eea52c64
SHA256026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469
SHA51203cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748
-
Filesize
561KB
MD5a09baf152fd4f6466c9b6c37fd37f7e6
SHA14ca0969a4e103fdf0604b0d1dfd10022388e1003
SHA256a96536c21d942e2befc7df6d5e14fa6861cb7896840a726c17b51956f1ef8683
SHA512a233602ba864c8c18a750837eb88e6c90a684403c631b1183318a95b7d9174eff1cd6ef2e9d4f1dc4aa152896537767e980ea63b0bbf29e23635da6886a35706
-
Filesize
561KB
MD5a09baf152fd4f6466c9b6c37fd37f7e6
SHA14ca0969a4e103fdf0604b0d1dfd10022388e1003
SHA256a96536c21d942e2befc7df6d5e14fa6861cb7896840a726c17b51956f1ef8683
SHA512a233602ba864c8c18a750837eb88e6c90a684403c631b1183318a95b7d9174eff1cd6ef2e9d4f1dc4aa152896537767e980ea63b0bbf29e23635da6886a35706
-
Filesize
561KB
MD5a09baf152fd4f6466c9b6c37fd37f7e6
SHA14ca0969a4e103fdf0604b0d1dfd10022388e1003
SHA256a96536c21d942e2befc7df6d5e14fa6861cb7896840a726c17b51956f1ef8683
SHA512a233602ba864c8c18a750837eb88e6c90a684403c631b1183318a95b7d9174eff1cd6ef2e9d4f1dc4aa152896537767e980ea63b0bbf29e23635da6886a35706
-
Filesize
561KB
MD5b3ccb67d0d6a3f653c43b840ff2ea324
SHA1e57a9ba7db49745f44b9b10a73296545eea52c64
SHA256026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469
SHA51203cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748
-
Filesize
144KB
MD58db5d6844e3805da9fc0fba20888a34b
SHA10ac357e865f9b3d36ce975c4eca4d6b661fe5035
SHA25676bbcffbc15c6cf9648c25e341f818183e4ae3214e7054432511349c3c2d87a9
SHA5125c5119202fbeca554aede09848638e69b5e8347bb8297ca854544fe9f3f6c06d13ea8e256594fed66fbe843d12ff6418b4c22249b587a2aa974e2b672f028145
-
Filesize
144KB
MD58db5d6844e3805da9fc0fba20888a34b
SHA10ac357e865f9b3d36ce975c4eca4d6b661fe5035
SHA25676bbcffbc15c6cf9648c25e341f818183e4ae3214e7054432511349c3c2d87a9
SHA5125c5119202fbeca554aede09848638e69b5e8347bb8297ca854544fe9f3f6c06d13ea8e256594fed66fbe843d12ff6418b4c22249b587a2aa974e2b672f028145
-
Filesize
2.0MB
MD559dac066b544f434f3ef8fbe52bcf6cf
SHA1eebe8ab6bac0118fdf03f45a6453e03a42af7c69
SHA2564d96e6621d0378afe56d6e04343e427ffeb76439829e72f5c426025019c7b82d
SHA51213b3b6c1daa77562da18eb07766432a8a5347fa1e1c17437fd827b2d5a18a81d5477e8049479df62cbbcf03d71cf179e1ab203694885a5b7ab511c95bb798f63
-
Filesize
2.0MB
MD559dac066b544f434f3ef8fbe52bcf6cf
SHA1eebe8ab6bac0118fdf03f45a6453e03a42af7c69
SHA2564d96e6621d0378afe56d6e04343e427ffeb76439829e72f5c426025019c7b82d
SHA51213b3b6c1daa77562da18eb07766432a8a5347fa1e1c17437fd827b2d5a18a81d5477e8049479df62cbbcf03d71cf179e1ab203694885a5b7ab511c95bb798f63
-
Filesize
2.0MB
MD5d3e51e80903b6629f356b8d5d4577e8a
SHA1598de8e8164bd8d9425912260845de34ad3bf45d
SHA256d0f8554263168c58c08fe178eb011ff8615b51be4d3cbf57981601c93eff0458
SHA512e4cf7c5e3426ebb16453fbddd53a6089536543b2565ae71a342702e9ada59eea6c6c898f2e32baee756a9f81a1bc45a93fb9d10395d9af07ec80ed28b13f3620
-
Filesize
2.0MB
MD5d3e51e80903b6629f356b8d5d4577e8a
SHA1598de8e8164bd8d9425912260845de34ad3bf45d
SHA256d0f8554263168c58c08fe178eb011ff8615b51be4d3cbf57981601c93eff0458
SHA512e4cf7c5e3426ebb16453fbddd53a6089536543b2565ae71a342702e9ada59eea6c6c898f2e32baee756a9f81a1bc45a93fb9d10395d9af07ec80ed28b13f3620
-
Filesize
2.0MB
MD5d3e51e80903b6629f356b8d5d4577e8a
SHA1598de8e8164bd8d9425912260845de34ad3bf45d
SHA256d0f8554263168c58c08fe178eb011ff8615b51be4d3cbf57981601c93eff0458
SHA512e4cf7c5e3426ebb16453fbddd53a6089536543b2565ae71a342702e9ada59eea6c6c898f2e32baee756a9f81a1bc45a93fb9d10395d9af07ec80ed28b13f3620
-
Filesize
2.0MB
MD559dac066b544f434f3ef8fbe52bcf6cf
SHA1eebe8ab6bac0118fdf03f45a6453e03a42af7c69
SHA2564d96e6621d0378afe56d6e04343e427ffeb76439829e72f5c426025019c7b82d
SHA51213b3b6c1daa77562da18eb07766432a8a5347fa1e1c17437fd827b2d5a18a81d5477e8049479df62cbbcf03d71cf179e1ab203694885a5b7ab511c95bb798f63
-
Filesize
386B
MD5969aa477b2b854fc4305e0f45740b828
SHA16253cab5930f938e4487d20248b1b5f93e810248
SHA2566de03aefe35e6deffd1e91f696197ad5a3b4cde430b2a8992120e02ec9e62d4d
SHA512dd0a5aecadfb0a7eec450fdfabba745fe1cf1d7d00e198c6ba5b6fcf03d3339060fd555bd601f4fd7303bf92b9836d8515fd09c127a6899c83eabe585fda4b32
-
Filesize
29KB
MD59f5f2f0fb0a7f5aa9f16b9a7b6dad89f
SHA1603f73160dcc49da297a10f0691cefe4dddd9772
SHA2566d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc
SHA512dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102
-
Filesize
29KB
MD59f5f2f0fb0a7f5aa9f16b9a7b6dad89f
SHA1603f73160dcc49da297a10f0691cefe4dddd9772
SHA2566d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc
SHA512dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102
-
Filesize
267KB
MD5df5f4ecacf6df29a0738ccae7e322371
SHA198dc051e690c645b5aff8dcb2bcb77ecb5d92df5
SHA256d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502
SHA51201c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375
-
Filesize
267KB
MD5df5f4ecacf6df29a0738ccae7e322371
SHA198dc051e690c645b5aff8dcb2bcb77ecb5d92df5
SHA256d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502
SHA51201c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375
-
Filesize
267KB
MD5df5f4ecacf6df29a0738ccae7e322371
SHA198dc051e690c645b5aff8dcb2bcb77ecb5d92df5
SHA256d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502
SHA51201c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375
-
Filesize
267KB
MD5df5f4ecacf6df29a0738ccae7e322371
SHA198dc051e690c645b5aff8dcb2bcb77ecb5d92df5
SHA256d34d9773d0aaecb170a97f57d1531d8e7ea7312c80d3b0fadbd8df0a03e72502
SHA51201c6d10f6558b54bf99e42be019d56bac9508bb3690bd047af432b9ace45b78728d0b55f801774057af66d5ad3ebc63da7f418a190c78c15ebc04f86ff22e375
-
Filesize
561KB
MD5b3ccb67d0d6a3f653c43b840ff2ea324
SHA1e57a9ba7db49745f44b9b10a73296545eea52c64
SHA256026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469
SHA51203cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748
-
Filesize
561KB
MD5b3ccb67d0d6a3f653c43b840ff2ea324
SHA1e57a9ba7db49745f44b9b10a73296545eea52c64
SHA256026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469
SHA51203cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748
-
Filesize
561KB
MD5b3ccb67d0d6a3f653c43b840ff2ea324
SHA1e57a9ba7db49745f44b9b10a73296545eea52c64
SHA256026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469
SHA51203cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748
-
Filesize
561KB
MD5b3ccb67d0d6a3f653c43b840ff2ea324
SHA1e57a9ba7db49745f44b9b10a73296545eea52c64
SHA256026abb76b9d6832e9302b565306fcde4c00173d0a252f0fce5265a019d9b5469
SHA51203cb58ab3929a3eefc6123af343fe179ebede15412c620b44eebfc35f62c6d7b647563b99644d75480e67054e2f57ef0aaa3d2f61706579786964bbd7342b748
-
Filesize
29KB
MD59f5f2f0fb0a7f5aa9f16b9a7b6dad89f
SHA1603f73160dcc49da297a10f0691cefe4dddd9772
SHA2566d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc
SHA512dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102
-
Filesize
29KB
MD59f5f2f0fb0a7f5aa9f16b9a7b6dad89f
SHA1603f73160dcc49da297a10f0691cefe4dddd9772
SHA2566d2b301e77839fff1c74425b37d02c3f3837ce50e856c21ae4cf7ababb04addc
SHA512dba4cf345969b2aec7040f03885021ec8838c3c2dc044d6244998977a6997532f1d6425335dcb2a5edd41dd1a5d7b56198715f9997f22452c757d56c24355102
-
Filesize
2.0MB
MD559dac066b544f434f3ef8fbe52bcf6cf
SHA1eebe8ab6bac0118fdf03f45a6453e03a42af7c69
SHA2564d96e6621d0378afe56d6e04343e427ffeb76439829e72f5c426025019c7b82d
SHA51213b3b6c1daa77562da18eb07766432a8a5347fa1e1c17437fd827b2d5a18a81d5477e8049479df62cbbcf03d71cf179e1ab203694885a5b7ab511c95bb798f63
-
Filesize
2.0MB
MD559dac066b544f434f3ef8fbe52bcf6cf
SHA1eebe8ab6bac0118fdf03f45a6453e03a42af7c69
SHA2564d96e6621d0378afe56d6e04343e427ffeb76439829e72f5c426025019c7b82d
SHA51213b3b6c1daa77562da18eb07766432a8a5347fa1e1c17437fd827b2d5a18a81d5477e8049479df62cbbcf03d71cf179e1ab203694885a5b7ab511c95bb798f63
-
Filesize
2.0MB
MD559dac066b544f434f3ef8fbe52bcf6cf
SHA1eebe8ab6bac0118fdf03f45a6453e03a42af7c69
SHA2564d96e6621d0378afe56d6e04343e427ffeb76439829e72f5c426025019c7b82d
SHA51213b3b6c1daa77562da18eb07766432a8a5347fa1e1c17437fd827b2d5a18a81d5477e8049479df62cbbcf03d71cf179e1ab203694885a5b7ab511c95bb798f63
-
C:\Users\Admin\AppData\Local\Temp\Google Gadget Cache\{9BD021C4-6EE3-65ED-D470-C30D57277B43}\en\strings.xml
Filesize1KB
MD5394204b1ce57950d3b79ea875b22961e
SHA1c94fb4097be696b7622062a7fdfd88c31c1824cf
SHA256a3d80c94b7aed9425c577e7bc78469baa73c04e890f59350d604d3c0c1dfa012
SHA51289eb88e5ad7ca77a59d660c817ba0f32aba7a3ba875962a176c4d2176b83403d743c84d85ae7fa0723456c0b60d377bdc1732478c14cc0c008f9e5d06809d176
-
C:\Users\Admin\AppData\Local\Temp\Google Gadget Cache\{9BD021C4-6EE3-65ED-D470-C30D57277B43}\gadget.gmanifest
Filesize569B
MD583b4625f09ee8c87e9f5077e0c67a2b0
SHA1bf4f6b7eecae93864a50a0ddfa0e4fd5fd02caad
SHA2562bb52d1ae18baafa898b2be8ea8be36eb4d022a82d4b3be8b94001403447ad0a
SHA51291ce6d43514663c6fa8f346057aaf96573cfad9ff89057dddaac61b5f4b8bf8a055f60253ac1eea1e74ae0d5594a8cda86928122e73ecf1dd71a6fe1926f9c70
-
C:\Users\Admin\AppData\Local\Temp\Google Gadget Cache\{BE319A7B-BF16-11F6-25CD-F055F59C785D}\en\strings.xml
Filesize444B
MD5d16f39afa498b30e8ed107415e946e83
SHA1ca90bf15ef3a6aadec9fc4b4c3106513c9456c2b
SHA256f9ae8133746081b39beee351d00174a743543f5ac4c40e129451d7279e9d5c1e
SHA51292b2afa6eb442844596b1f859f9a87bb0e19bc9e9816d8352a7e932150b150e498bbb557942036165ffcfc7c10720d7f6c2a7b26fb93479f8a0c94cbf2008ed8
-
C:\Users\Admin\AppData\Local\Temp\Google Gadget Cache\{BE319A7B-BF16-11F6-25CD-F055F59C785D}\gadget.gmanifest
Filesize570B
MD5d2217cd9171ed67cbb23a9a58348a393
SHA1d42d81449bda5dc757c0c92328d1ef20ca0a329f
SHA25656f0efa3e2c998ca24dfca482765c6e73f10b5d4d76cdd0dd87f9b9da0fb0bc1
SHA512035541e6c7b76d83e0f1d707ca9ece5369ce7cf72630d0d05bfabe85fe3b15e1c57ff408c76a355d320a48e75c6dcf84ae8fafeb1275f6c974dc84e5d337b18d
-
Filesize
7KB
MD5dcacb91f02b33cf28e972f4f3e5709e9
SHA141b5bcf0e8acb39c9f3212243fa98597d8437cfe
SHA25666687ea5e61a42f9c7ce49fad603d2bc8beb713c645bdb7af8759059ece9ea44
SHA512a1ca94ada08004e3aea69ead2dc39cc171425d5ecce5e326d7dbd19aa800ae66bdb2ad97049c2853271744ea040f7e8ad9b36bf5132bfc73f6d8d1036e4d1991
-
Filesize
11KB
MD5bdcf724b64c5adec9a4358a6cd30c2f7
SHA1cf70529886815fefb560323242e642576599fae6
SHA25648362e6ec65a4db675a6bb7b9e611413e696ef456dbb1119be9affbc2a901484
SHA512472572a08c5eb9f30f6381c50adacb5f3d5a60e5dfa8d95ea41a594c663220905eb795dc4358bb488f2af0543669bf37e19b9203a72e239ba40989e0c3487510
-
Filesize
114KB
MD52ff2a64a91ea30927c354076397288b6
SHA156b48977b6316ea70265ac1ebf417ab466febc61
SHA2565f37819d57a2890c16fff4d5b0a16164f949c377b207d92663ecba8cfc3957cc
SHA5125a2fdb84179a032dedefd2075f601fa0d9e88cdbc9c79abc6a9c588741fbed3ff6bae58f099a859afcd20e51dc698942263fd6b2d2cafef11c0649f520724782