400eea86fdf5670b9ac9b96606483fda8f33ba2863b37b506ed6ab1bf882c93b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
Size

10.8MB
MD5

61e8754e226176a4311b3bda2f7f5a4a
SHA1

ab7b9cc772640ae291f1e5310ed7e2424d499c84
SHA256

400eea86fdf5670b9ac9b96606483fda8f33ba2863b37b506ed6ab1bf882c93b
SHA512

093ab429daf7f07040b6c6facea781cac0852f1ac5a39d935c1483859f880cfbef5b70e75dc977ffc22de921b0f76559b3b7dfa21fe29c967ddc98a450c8ddcf
SSDEEP

196608:N8eM+zrUH3Z6+NWfpayWpHBFlnY+6NBg3fJzYcLlgFItURZWRLuGGHpMbdDUOzNt:NlM+zrUH3kWWRCFQBsh82lgqW8SZMbdf

Score

7^/10

adware discovery persistence privilege_escalation stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 10 IoCs

pid	Process
1820	GoogleToolbarManager_0E996B068B56FCA2.exe
2008	GoogleUpdaterService_5898FABCFA121C11.exe
4396	GoogleUpdaterService.exe
2464	SearchWithGoogleUpdate_C58171F2E8870EA4.exe
3244	GoogleToolbarNotifier.exe
3672	GoogleUpdaterService.exe
4712	GoogleToolbarNotifier.exe
2196	GoogleToolbarManager_0E996B068B56FCA2.exe
2356	GoogleToolbarManager_0E996B068B56FCA2.exe
4296	GoogleToolbarManager_0E996B068B56FCA2.exe

Loads dropped DLL 8 IoCs

pid	Process
3244	GoogleToolbarNotifier.exe
3244	GoogleToolbarNotifier.exe
3244	GoogleToolbarNotifier.exe
3168	regsvr32.exe
1820	GoogleToolbarManager_0E996B068B56FCA2.exe
4712	GoogleToolbarNotifier.exe
4712	GoogleToolbarNotifier.exe
4712	GoogleToolbarNotifier.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	2000	msiexec.exe
11	2000	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}	regsvr32.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\googledict_en2zh-TW_6DDBABBF3B6874E6.dat	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_fr_1ED0C811CCFD239E.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_pt-PT_F34FA25F2BF44973.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_sk_B8B6D4A4C43740C7.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe	SearchWithGoogleUpdate_C58171F2E8870EA4.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleCld_3F6C343113693CD9.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en-GB_2E6B851AC7DB9104.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_pt-BR_324E45F73759905B.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_sv_89495101F557E1B4.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_zh-TW_B777F94133C4F3E9.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbar_32_E857042E7D2E74E0.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_hu_9EC874874E27F782.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_vi_1E881DE518435F79.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe	GoogleUpdaterService_5898FABCFA121C11.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_sr_75CE59C5ADDC2844.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\SearchWithGoogleUpdate_C58171F2E8870EA4.exe	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarHelperPatch_signed.msp	GoogleToolbarManager_0E996B068B56FCA2.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll	GoogleToolbarManager_0E996B068B56FCA2.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll	GoogleToolbarManager_0E996B068B56FCA2.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.4.4525.1752\Readme.url	SearchWithGoogleUpdate_C58171F2E8870EA4.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\googledict_en2de_B9AAB95D6C6F4C36.dat	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\googledict_en2fr_A049D2572F766D62.dat	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\googledict_en2ja_BF3954DA2966B0D9.dat	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\googledict_en2ko_2E8A88975F586360.dat	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_nl_CD3A5AA3FC03E13F.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarHelper_signed.msi	GoogleToolbarManager_0E996B068B56FCA2.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleQuickSearchBoxSetup_9B6E2803C15DBFDA.exe	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_32_E0B3D00E06C2FA01.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_ro_4C4B00BFF35AB149.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_ru_5689398FE6A50FB0.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_zh-CN_436BC7D4665E8872.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbar_64_41D8280252A4200C.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_bg_8635E115DE437E76.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarUser_64_BCA4B64C7F249C8F.exe	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll	SearchWithGoogleUpdate_C58171F2E8870EA4.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\googledict_en2ru_45FC2F302159C0AC.dat	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_64_7B73A586FAD2C6CD.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_ko_DC5E79E55A71966A.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll	GoogleToolbarManager_0E996B068B56FCA2.exe
File created	C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.4.4525.1752\Readme.url	SearchWithGoogleUpdate_C58171F2E8870EA4.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\googledict_en2it_ADEFDA0A79F00730.dat	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_ext_zh-CN_64_9D6BB6457BFC027A.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_fil_920B5A4BF032B379.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_id_4619CC2AD5B266E0.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe	GoogleToolbarManager_0E996B068B56FCA2.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_et_0613A067625F9DE4.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarUser_32_AE9B99EC70822BD0.exe	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleUpdaterService_5898FABCFA121C11.exe	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\googledict_en2zh-CN_BD4EBFDF896BA244.dat	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_ext_zh-CN_32_A8478F8C9C51C437.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_da_C58C2E35EB91B164.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_ja_FB204AA216DF16F6.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_no_F029760748CFBDA5.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_el_81517A223F9C8420.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_pl_361A8BDF2EE56E1A.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_64.exe	GoogleToolbarManager_0E996B068B56FCA2.exe
File created	C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg64.dll	SearchWithGoogleUpdate_C58171F2E8870EA4.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_uk_DB2D30F1495B7766.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbar.6.3.1106.427.manifest.xml	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_de_D7CFBCF21E80E850.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_lv_633AD9DE9170726B.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_sl_97CA717F99EC9772.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_tr_D0EF39D3BE93D65E.dll	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57879f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{18455581-E099-4BA8-BC6B-F34B2F06600C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8AAC.tmp	msiexec.exe
File created	C:\Windows\Installer\e5787a3.msi	msiexec.exe
File created	C:\Windows\Installer\e57879f.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\Compatibility Flags = "1024"	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\AppName = "GoogleToolbarNotifier.exe"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\AppPath = "C:\\Program Files (x86)\\Google\\GoogleToolbarNotifier"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}\AppPath = "C:\\Program Files (x86)\\Google\\Google Toolbar"	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\AppName = "GoogleToolbarNotifier.exe"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Toolbar	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\MenuExt	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}\AppName = "GoogleToolbarUser_64.exe"	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}	GoogleToolbarNotifier.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}\Policy = "3"	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}\Policy = "3"	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\Compatibility Flags = "1024"	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\Policy = "3"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2318C2B1-4965-11d4-9B18-009027A5CD4F}	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{2318C2B1-4965-11d4-9B18-009027A5CD4F} = 00	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{2318C2B1-4965-11d4-9B18-009027A5CD4F} = 00	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Toolbar	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}\AppPath = "C:\\Program Files (x86)\\Google\\Google Toolbar"	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{2318C2B1-4965-11d4-9B18-009027A5CD4F}	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\AppPath = "C:\\Program Files (x86)\\Google\\GoogleToolbarNotifier"	GoogleToolbarNotifier.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\Policy = "3"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}\AppName = "GoogleToolbarUser_32.exe"	GoogleToolbarManager_0E996B068B56FCA2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GUSchedulerCtl.UpdaterScheduler\ = "Google Updater Scheduler class"	GoogleUpdaterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}\VersionIndependentProgID\ = "GUSchedulerCtl.UpdaterScheduler"	GoogleUpdaterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}\ = "IProtector6"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{480AD54B-C652-44B9-BCF6-746745055CD3}\TypeLib\ = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1}\TypeLib\ = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C8CE0B5-6DA0-49A1-B675-78FD03EA3224}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleUpdaterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}\ = "IProtector6"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}\ = "IProtector5"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00EF2092-6AC5-47c0-BD25-CF2D5D657FEB}	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\protector_dll.ProtectorLib.1	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\protector_dll.ProtectorLib\ = "ProtectorLib Class"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2212951C-1623-4095-906B-AC50B8F91016}\ = "IProtector2"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ProtectorExe.EXE\AppID = "{A97CA128-6998-4F8E-807E-8ED05FADAFB0}"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}\ = "protector_dll"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00EF2092-6AC5-47c0-BD25-CF2D5D657FEB}	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C07A89E4-82A3-4A29-9908-DFC9DEBF8267}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleUpdaterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\AppID = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2212951C-1623-4095-906B-AC50B8F91016}	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\protector_dll.ProtectorBho.1\CLSID\ = "{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\AppID = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GUSchedulerCtl.UpdaterScheduler\CurVer	GoogleUpdaterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5924C60B-6D7F-4AD6-8084-24A59431C967}\1.0\FLAGS\ = "0"	GoogleUpdaterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}\ = "IProtectorLib5"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C8CE0B5-6DA0-49A1-B675-78FD03EA3224}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleUpdaterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}\TypeLib\ = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Google Toolbar\\GoogleToolbar_32.dll"	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ProtectorExe.ProtectorHost\CLSID	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\protector_dll.ProtectorBho.1\CLSID	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2}\TypeLib\Version = "14.0"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}\TypeLib	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00EF2092-6AC5-47c0-BD25-CF2D5D657FEB}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Google Toolbar\\GoogleToolbar_64.dll"	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7CB459A-7261-4AE6-A87A-17041EE98A40}\14.0\FLAGS	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91959FBB-853A-4AC7-A082-2DDF787F4CA9}\TypeLib\Version = "14.0"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}\AppID = "{61E28BF8-C02B-499F-8E7A-34C1E4A1C649}"	GoogleUpdaterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00EF2092-6AC5-47c0-BD25-CF2D5D657FEB}\ = "Google Script Object"	GoogleToolbarManager_0E996B068B56FCA2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00EF2092-6AC5-47c0-BD25-CF2D5D657FEB}\InprocServer32	GoogleToolbarManager_0E996B068B56FCA2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C07A89E4-82A3-4A29-9908-DFC9DEBF8267}\ = "ISilentUpdater"	GoogleUpdaterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ProtectorExe.ProtectorHost.1\CLSID\ = "{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}\ProxyStubClsid32	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{61E28BF8-C02B-499F-8E7A-34C1E4A1C649}\LocalService = "gusvc"	GoogleUpdaterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\ProxyStubClsid32	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2351B346-00E8-4EAC-9B75-B138B465D659}	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}\TypeLib\ = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GUSchedulerCtl.UpdaterScheduler.1	GoogleUpdaterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91959FBB-853A-4AC7-A082-2DDF787F4CA9}\ProxyStubClsid32	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\ = "ProtectorLib Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C8CE0B5-6DA0-49A1-B675-78FD03EA3224}\TypeLib\Version = "1.0"	GoogleUpdaterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\ProgID\ = "ProtectorExe.ProtectorHost.1"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\LocalServer32	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9891812B-5820-4A77-827E-772B200239E1}\ = "IProtector4"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91F39C2A-95E7-497A-A539-0AC715DC66D2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2212951C-1623-4095-906B-AC50B8F91016}\TypeLib	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2351B346-00E8-4EAC-9B75-B138B465D659}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleToolbarNotifier.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5c0000000100000004000000000400007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2000	msiexec.exe
2000	msiexec.exe
1820	GoogleToolbarManager_0E996B068B56FCA2.exe
1820	GoogleToolbarManager_0E996B068B56FCA2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeIncreaseQuotaPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeSecurityPrivilege	2000	msiexec.exe
Token: SeCreateTokenPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeAssignPrimaryTokenPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeLockMemoryPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeIncreaseQuotaPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeMachineAccountPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeTcbPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeSecurityPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeTakeOwnershipPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeLoadDriverPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeSystemProfilePrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeSystemtimePrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeProfSingleProcessPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeIncBasePriorityPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeCreatePagefilePrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeCreatePermanentPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeBackupPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeRestorePrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeShutdownPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeDebugPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeAuditPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeSystemEnvironmentPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeChangeNotifyPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeRemoteShutdownPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeUndockPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeSyncAgentPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeEnableDelegationPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeManageVolumePrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeImpersonatePrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeCreateGlobalPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeShutdownPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeIncreaseQuotaPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeCreateTokenPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeAssignPrimaryTokenPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeLockMemoryPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeIncreaseQuotaPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeMachineAccountPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeTcbPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeSecurityPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeTakeOwnershipPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeLoadDriverPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeSystemProfilePrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeSystemtimePrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeProfSingleProcessPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeIncBasePriorityPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeCreatePagefilePrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeCreatePermanentPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeBackupPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeRestorePrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeShutdownPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeDebugPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeAuditPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeSystemEnvironmentPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeChangeNotifyPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeRemoteShutdownPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeUndockPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeSyncAgentPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeEnableDelegationPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeManageVolumePrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeImpersonatePrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeCreateGlobalPrivilege	1820	GoogleToolbarManager_0E996B068B56FCA2.exe
Token: SeRestorePrivilege	2000	msiexec.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1820	2972	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe	87
PID 2972 wrote to memory of 1820	2972	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe	87
PID 2972 wrote to memory of 1820	2972	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe	87
PID 1820 wrote to memory of 2008	1820	GoogleToolbarManager_0E996B068B56FCA2.exe	90
PID 1820 wrote to memory of 2008	1820	GoogleToolbarManager_0E996B068B56FCA2.exe	90
PID 1820 wrote to memory of 2008	1820	GoogleToolbarManager_0E996B068B56FCA2.exe	90
PID 2008 wrote to memory of 4396	2008	GoogleUpdaterService_5898FABCFA121C11.exe	91
PID 2008 wrote to memory of 4396	2008	GoogleUpdaterService_5898FABCFA121C11.exe	91
PID 2008 wrote to memory of 4396	2008	GoogleUpdaterService_5898FABCFA121C11.exe	91
PID 1820 wrote to memory of 2464	1820	GoogleToolbarManager_0E996B068B56FCA2.exe	92
PID 1820 wrote to memory of 2464	1820	GoogleToolbarManager_0E996B068B56FCA2.exe	92
PID 1820 wrote to memory of 2464	1820	GoogleToolbarManager_0E996B068B56FCA2.exe	92
PID 2464 wrote to memory of 3244	2464	SearchWithGoogleUpdate_C58171F2E8870EA4.exe	93
PID 2464 wrote to memory of 3244	2464	SearchWithGoogleUpdate_C58171F2E8870EA4.exe	93
PID 2464 wrote to memory of 3244	2464	SearchWithGoogleUpdate_C58171F2E8870EA4.exe	93
PID 3244 wrote to memory of 3168	3244	GoogleToolbarNotifier.exe	94
PID 3244 wrote to memory of 3168	3244	GoogleToolbarNotifier.exe	94
PID 2464 wrote to memory of 3672	2464	SearchWithGoogleUpdate_C58171F2E8870EA4.exe	95
PID 2464 wrote to memory of 3672	2464	SearchWithGoogleUpdate_C58171F2E8870EA4.exe	95
PID 2464 wrote to memory of 3672	2464	SearchWithGoogleUpdate_C58171F2E8870EA4.exe	95
PID 2972 wrote to memory of 2196	2972	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe	97
PID 2972 wrote to memory of 2196	2972	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe	97
PID 2972 wrote to memory of 2196	2972	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe	97
PID 2972 wrote to memory of 2356	2972	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe	98
PID 2972 wrote to memory of 2356	2972	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe	98
PID 2972 wrote to memory of 2356	2972	61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe	98

C:\Users\Admin\AppData\Local\Temp\61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\61e8754e226176a4311b3bda2f7f5a4a_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_0E996B068B56FCA2.exe
  "C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_0E996B068B56FCA2.exe" /install /sid:S-1-5-21-2636447293-1148739154-93880854-1000 /installwindow:524366
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleUpdaterService_5898FABCFA121C11.exe
    "C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleUpdaterService_5898FABCFA121C11.exe" /install /appid=tbie
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
      "C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe" /Service
      4⤵
      Executes dropped EXE
      Modifies registry class
      PID:4396
- - C:\Program Files (x86)\Google\Google Toolbar\Component\SearchWithGoogleUpdate_C58171F2E8870EA4.exe
    "C:\Program Files (x86)\Google\Google Toolbar\Component\SearchWithGoogleUpdate_C58171F2E8870EA4.exe" ietb GUEA
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" /RegServer "/dll=C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.4.4525.1752\gtn.dll" "/swg64=C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg64.dll"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3244
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe -s "C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg64.dll"
        5⤵
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Modifies registry class
        
        PID:3168
  - - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
      "C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe" /install /appid=swg
      4⤵
      Executes dropped EXE
      PID:3672
- C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_0E996B068B56FCA2.exe
  "C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_0E996B068B56FCA2.exe" /postinstall /sid:S-1-5-21-2636447293-1148739154-93880854-1000 /installwindow:524366
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_0E996B068B56FCA2.exe
  "C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_0E996B068B56FCA2.exe" /custombuttonsinstall
  2⤵
  - Executes dropped EXE
  PID:2356

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
"C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4712

C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_0E996B068B56FCA2.exe
"C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_0E996B068B56FCA2.exe" /service
1⤵
- Executes dropped EXE
PID:4296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5787a2.rbs

Filesize
7KB

MD5
4e5b728ad6cd76e1fb58f3412657d4da

SHA1
20cffe9b25be9a6036592b0b76f925654bea4b55

SHA256
1224f98dcb3785169b86136e328a71e7182055b509b022dec26e9cad4fdf3e8c

SHA512
f99bfb00677dd1a2625592ee558a3d2f795574daaf94012b6da713801e2cda6dd558724280de6e4b4f065ed6c02e5962f9bd89b1cf6bcbe87dbf930e8d8b1a42

Download Submit
C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

Filesize
178KB

MD5
cc839e8d766cc31a7710c9f38cf3e375

SHA1
a20fe767ae667638fc2ed43563bd436542ca7ad4

SHA256
327d57f18b4a2d1cb06c5682d3364097ecd3cf40c2719aa1f41d0b49a26003e4

SHA512
45114b19655bb5de4707470cb4422b283d976fb296c85e9d23a044513c0103b265a1f5de00f90e7086f035d495338cb708b103767909a0f99bca08d4a7813b8d

Download Submit
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbar.6.3.1106.427.manifest.xml

Filesize
21KB

MD5
cf3bfd796723cdbf3604c936c2a74ae5

SHA1
e301400f2262a87eb8708c86f4d2fff9af48d6dd

SHA256
d21f7bd2a4aa941d6420c2debf97c46b127bd3c27457fe942b76ec1329646a31

SHA512
00a417462b5aa12316583b64c00c57c0cf3ac2b3ac88886254dd24a326c0cd96754e8d12e0387978bcaec753da0ca7481dfc80631471b67debd07cc062853bf3

Download Submit
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll

Filesize
633KB

MD5
b741ac5a4f8a27677753a7e3febfd2c1

SHA1
7e5f85236774ef164e47d03b6c8995387e634188

SHA256
2f5b347ed57b8923603f44bb8b8b0528a2069956c603a0a33c93b29adf143507

SHA512
87b64592c1c71c439e78259a6dd5caf99bfde4049052ff48aef609393d24fe861b263fa185bad68558d1faf3e831f0b97748fad35ce43ebbab6cfaec2f148ed1

Download Submit
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_0E996B068B56FCA2.exe

Filesize
978KB

MD5
8f6cfdd445e930a8cf96dd9667febaa7

SHA1
66895cb58cc6c2e83f4bbe59214d7dad5fb1d0d5

SHA256
e98a014a81ee873c49aee34d461ab267f3c67ec0ad3e67934c622a45fe82a1c7

SHA512
5c0269c7fa16d91b6acffa0fb1a23d4b7023c81e3b3af0745e555c272636c2c4354e295852c345020801fcff2397e0ae5d1a1d6d97fb2c66ef8b01eeab6d530c

Download Submit
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarUser_32_AE9B99EC70822BD0.exe

Filesize
278KB

MD5
41a133ad4531511ad0df53b9eae977e2

SHA1
f5580b13d91a319f670c56d354056a901bfbad0c

SHA256
e576924e6b5e1ae15232a7c52a51dc81c6c4decfa9e49005102f3f5ec87b8035

SHA512
4a6c93b140939ead354183d9bfbf9e7f5ec577eba008b48d8ff617f4350cb7065a1246416ba6a8913f928953bad6a122ee369e344a2ebcc794cdca39f1005429

Download Submit
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarUser_64_BCA4B64C7F249C8F.exe

Filesize
365KB

MD5
c93210a4bdb39e79b286eb5ea61b838a

SHA1
f57c932e62fb417863a15c52e66a8d9fec4e8fdf

SHA256
8f556e2ba24dd26f7c36a9f2182311f68ff29f3420a8024862024824c4af2ae2

SHA512
fc104d9fa814d3d9c0b7fecd9432d5747280ce164e61494443c7de07b09fbb98b1650244ba6ec81aa352719e5385ec18cc01708a19e4ca6474e45f0efedf0591

Download Submit
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbar_32_E857042E7D2E74E0.dll

Filesize
257KB

MD5
88a099bacf2377ffb514188a9481fc83

SHA1
878e6164968418db4745d4d0e494504594cfd840

SHA256
163874fb054cf333de0a08fb26484db0c33e2441d66041992ef1ef0e6d4f9d29

SHA512
d7ae3a36ec39beca70a516399bf163adc98830b04c749ce5f77aced18b6a167cafa9a2c87a89a8615c8db88e79fc20459bc48bb69f5bc8f8363212203731100b

Download Submit
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbar_64_41D8280252A4200C.dll

Filesize
348KB

MD5
786dda81f24996ff71fb69194a376a83

SHA1
5e59cad3f302be988b7e5a28ece4cac2ea98a9b1

SHA256
180de7db6b8c010feee5fc4de662b63057632aa694294cb52d42028e709cfc35

SHA512
2ada517874e469b9ef8d010ce61fdbeaa458185e0237b5629ee0b68c1bced99c6cadbcc16a265a0348d797e0a6bef611f325be7da1f88366afca1049869a10d7

Download Submit
C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleUpdaterService_5898FABCFA121C11.exe

Filesize
178KB

MD5
1c50ab911b3524356d0c58d8d669f09e

SHA1
8196bf79d278f064feaa77f3353410273f8611e6

SHA256
d9576a1a8dfabb5c47d7f98cb4dfdf5e36461e95a7e892dc724be30ea113e7df

SHA512
824135b636cfcd8c4a95aabfb7114462e083957de25d28f65f096fdb2040b3df9f5a0007673559c0b62649d6deac3dc7628d84e414e5e73b2306416d6af88a8c

Download Submit
C:\Program Files (x86)\Google\Google Toolbar\Component\SearchWithGoogleUpdate_C58171F2E8870EA4.exe

Filesize
1.4MB

MD5
d81e59ede6f186e449da1eb0c01d7eae

SHA1
156a90d84d3b0eab1fbe08b7625797ed3a8a6fd5

SHA256
78241a6286d4ce768ece3e19ab34d0ba053cbcd11ba77f52c3a7709ec8db6460

SHA512
807855c49f97de0142e7136099f7bd7423dc31dd19a23063d61cfef3a08f1aa49322815521b4bfcd3f2864d90a5592d464ef7b83621f01ce3d6bcf88f1fb96f2

Download Submit
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarHelper_signed.msi

Filesize
27KB

MD5
e667fbd5e5aefbaa3686c47bd5a869e3

SHA1
cf17b301e67c1b518cc865e55050e38c4c410361

SHA256
b70fd4d873e84e1eca0a8530bdb9031f98b644373d1c5c5d1b81b92c92953ebb

SHA512
c73b0256b07fdd7bd21b1717a0e6d73b0909831a9a07e9983f38568ce2134379df797163e16ac80ff26776abffed4b0bae30c0327ba43ab561bf04a90e6a17b3

Download Submit
C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.4.4525.1752\Readme.url

Filesize
133B

MD5
26459ca8c3e957b05d3a3c4e5bd6d1e4

SHA1
15a3b15568c850a788a9a3baa2f9f62309e79af6

SHA256
df0d1e1b039512207c1bf47e984faddc20a0fc6af405af276adc0613722aa530

SHA512
de1b46ae20904b62ac498286faef328b61817cb613e8dc495982b775d8612df6411cef57e2a028c4d363b63e674ae4adbb7169445cc9360d43b687ddb81c5b6d

Download Submit
C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.4.4525.1752\gtn.dll

Filesize
145KB

MD5
9c0cd5125cbee6fbe8c9c3eb7779448e

SHA1
ed4318be2275115f4075b484123b205d8326c3da

SHA256
9a7fe591775d4c42951936697c1b414a5fdcde03ed0b042fc6705f6151979083

SHA512
cdf035eda7f02e8bf3ba7d55b21a830eaae12c89eae25146ca6ddc6a04cf90adfbf22c869afd1b384a1efe6e406f5b9644ad06eb19ae592c7bfe03f41bdc8982

Download Submit
C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

Filesize
746KB

MD5
cd91e666b2446530583fbffcf537be4c

SHA1
7fbb6e6e571afae599f82c2125b501c189a3fdd1

SHA256
035b5626a829d5001cdf689f7e897ce03e43e0eb9795dfbe4eb354dfbc037c2d

SHA512
c9dc77f6e0a02f2e8e89bc5002187e86059ecf76deb2c61883ad8f38b730dda7d2e9a68dc892a02accca0f59999e9cc1dc9fee008fc8ef563f044276eed54849

Download Submit
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

Filesize
38KB

MD5
5d61be7db55b026a5d61a3eed09d0ead

SHA1
215950ce5d40907b041346f22b4e404ee591581d

SHA256
d32cc7b31a6f98c60abc313abc7d1143681f72de2bb2604711a0ba20710caaae

SHA512
b1dbb67867cbb36c322bd774bf01267f56e398e364ebce4bd6f67c225c330b0b1843b06397e55f7f04dcc8d75b039083ccf08313b0ed03ecff7eb00033b0a598

Download Submit
C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg64.dll

Filesize
311KB

MD5
c84d25a6a12ba1f100ef8607fb9ca012

SHA1
f2718832b9eb559ad993c09d864ba04f330e51bf

SHA256
de3055e2b3b77481abf99275df0dcc369bbde22e80ee1ded908814bb24972a89

SHA512
a056ca4dac11d186c73d49c505671dbd4625c59ace078e96ee109c9ebccc1220d78ae20b8c01d8bfc5d82792e06160c2216dea578750063ecf13000c985d7fe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C3948BE6E525B8A8CEE9FAC91C9E392_D5DDFAB42EFB0088195E950E60A6F50F

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5

Filesize
1KB

MD5
1ba25895dc793e6826cbe8d61ddd8293

SHA1
6387cc55cbe9f71ae41b2425192b900a1eb3a54f

SHA256
cc4c5c999ca59e5a62bc3ffe172a61f8cf13cc18c89fe48f628ff2a75bdc508a

SHA512
1ff9b34fdbeae98fa8b534ba12501eb6df983cc67ce4f8ffc4c1ff12631aa8ed36ff349c39a2186e0ac8d9809437106578a746eec3854b54fef38a3cc0adb957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C3948BE6E525B8A8CEE9FAC91C9E392_D5DDFAB42EFB0088195E950E60A6F50F

Filesize
416B

MD5
cc4d955dc214b4320fa41744634a3a6a

SHA1
c0adacdbb9e99e5b4cef410878361eb65d39ce52

SHA256
f0b22993d5b9b89dfaeb53f8a3c10006fa4d728d49d80ae124585179c1f8a507

SHA512
63a61537dc6afbda02c94cb2db7aa6ee620518f1c1d2cfdcfd4b87c87f7baa5ba3836c6d350d82cb7a663cfd425796dca0e82e77e72979ad2085230c0daa10a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5

Filesize
182B

MD5
daeb3b2946b426265d0bb19b429cb330

SHA1
e1fd50299547dd6461c8285ddbb59c44f98d1f65

SHA256
a5316d6819282ebedf41306ea555a08160e30b6e7476f588cddc0ee6bb60d74c

SHA512
e64f8548ae847cda6191d5a17c863cb0433972eba16255775b58b3deba25a0a8351c4f044f4d84b1249915736ff0c0c845e9293de82e6a9f8b943706cbc9fb4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\GoogleToolbarInstaller1.log

Filesize
4KB

MD5
f36068f7e6e21ee65bdcc43168af591f

SHA1
70128cabff4c178e37068d041abd86cc663dd730

SHA256
bf6cac214ca293663255ddd483f4e95553522de76b0d30e243f481306b33eb86

SHA512
0e8ee13badcce7bfe1904c4746206f6c67ddc211194d6ae9e3971d5b15d8e1210498bbc8d28a191c7a449b9db2322af795cc5e792967fd195d90109173bffe77

Download Submit
memory/2972-0-0x0000000000E30000-0x000000000315C000-memory.dmp

Filesize
35.2MB

Download
memory/2972-2-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/2972-1-0x00000000031F0000-0x00000000031F2000-memory.dmp

Filesize
8KB

Download
memory/2972-172-0x0000000000E30000-0x000000000315C000-memory.dmp

Filesize
35.2MB

Download
memory/3244-137-0x0000000002630000-0x00000000026F0000-memory.dmp

Filesize
768KB

Download
memory/4712-153-0x0000000002470000-0x0000000002530000-memory.dmp

Filesize
768KB

Download