ad68cfbbd2765be47b430cb0b3b527ade826e43c2ed6681ce6b9b5b44c8f18ff

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/GoogleToolbarInstaller_stub_signed.exe
Size 229KB
Sample260905-sm3fpstyfw
SHA256 ad68cfbbd2765be47b430cb0b3b527ade826e43c2ed6681ce6b9b5b44c8f18ff
MD5 39d998e29dc9277c8762070901e69a32
SHA1 ebd09f3ec33b4e56ebc3eccc0107689d4c5a2bca
SHA512 cec7b2dad52ea5015c1a7b819fc1c3287325711b43dee50827f90b9f890dd4d34acacfa1fb65e3f0e62835dfaf0b1c93cde84274c78caf76e1cded8e327d7834
SSDEEP 6144:M3wpq8sDsLLIb/TKVPXe8D0F8dT63VkiHFBGeWIY4AfJrrUZ:M3ssDsLkbiPenXkMNWIYzxrgZ
TLSH
T13F341264F6604715E9082FB85176E6DEDF319C4AAE9260D14132FD3E3EBA3747A08738
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_32_75E7DC5B4867B140.dll	GoogleToolbarInstaller_stub_signed.exe
File opened for modification	C:\Program Files (x86)\Google\Google Toolbar\Component\cmp82F3.tmp	GoogleToolbarInstaller_stub_signed.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbar.7.5.6710.2136.manifest.xml	GoogleToolbarInstaller_stub_signed.exe
File opened for modification	C:\Program Files (x86)\Google\Google Toolbar\Component\cmp8517.tmp	GoogleToolbarInstaller_stub_signed.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbar_32_09F85E3D9F025797.dll	GoogleToolbarInstaller_stub_signed.exe
File opened for modification	C:\Program Files (x86)\Google\Google Toolbar\Component\cmp2CE3.tmp	GoogleToolbarInstaller_stub_signed.exe
File created	C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbar_64_DA7B2809524A7AD4.dll	GoogleToolbarInstaller_stub_signed.exe
File opened for modification	C:\Program Files (x86)\Google\Google Toolbar\Component\cmp6A5B.tmp	GoogleToolbarInstaller_stub_signed.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleToolbarInstaller_stub_signed.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleToolbarInstaller_stub_signed.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleToolbarInstaller_stub_signed.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cmp2CE3.tmp

Path C:\Program Files (x86)\Google\Google Toolbar\Component\cmp2CE3.tmp
Size 250KB
SHA256 3a494bd83d0b06f12cfb63b066a48562f9c03152eed7149ee97ff07a0e31395d
MD5 638e3d612e5e2bbd4f77a3902a2c19e1
SHA1 e377b94c661fec61716210be4c06f97a229260cb
SHA512 f9ffa45c7e354074f4212cd44f5dc7348054ba73899644b54e9bf5547f84391a7c23fef770878331880c1e5ea4f278b6d73d387cac161128d043e95fdd81f57b
SSDEEP 6144:B2HfCkOe4cYCvgJPN+uBrsiqfWKgArvTB8KRtOqZuK:kZOe/vigrJWXavT6KRzL
TLSH
T182444B4972B44CB5EDB7D23ACD838A4AD6F178518760C3CF0670479A4E277E16A3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmp6A5B.tmp

Path C:\Program Files (x86)\Google\Google Toolbar\Component\cmp6A5B.tmp
Size 2.9MB
SHA256 37b27f119319fe09e24f5b123ca56884fae83af74ffffbadccafb07e7375cc15
MD5 e9b10d8a1ac18f5f90af61ab87a9b863
SHA1 8bc76179cc0f29186bf1a428e4a2e821dc70759e
SHA512 631b114eba7efaaf81538289b88307129adef8cca40bf0a54645850d29118bbabd2667cb36faeeecb2c5bce07f3ac7c12703c1f83f105022ce902475e8693c3b
SSDEEP 49152:VSItasM96MEoj9kOSHSgxJsOHhpchGGFZRtSIKnasTSO1gs07Y2TRPuxw:VPtj3oVZO8nKnJTS5jIw
TLSH
T1C7E59E133BD38079D1BB12B4DD24E314A6F9FEB10937CA5B2A54050FE92A987DA36713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmp8517.tmp

Path C:\Program Files (x86)\Google\Google Toolbar\Component\cmp8517.tmp
Size 189KB
SHA256 28839a5dfc07a7a6c866ecf63ce02f5ce493d0ae4d130f4c8727383b27c8b157
MD5 0c9482b13ca66d9f4a30bfbc730a35b8
SHA1 8cff8935def4fa03882bb2f7d7477c5753783372
SHA512 bfe418fd9f3d8ff9c46be47d44cc8ccf7f97a5c390d236b87590bf3bf079f7ac9e603b03ff16baa5bc6ef306c477c8800521758056941a5712e2461ae8946d05
SSDEEP 3072:sYbJ6WFbAbpeoqheZSACx0LvQlZhpTBfIo0RtayUQLmd2GKto6:fblb8pj26WHTBYRt/E6
TLSH
T175148D1232E0C176F36F017D4925D61666FBB8208AB5C7473FD18E8B6E65A46CF25B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gtm5E2.tmp

Path C:\Users\Admin\AppData\Local\Temp\Google Toolbar\gtm5E2.tmp
Size 16KB
SHA256 6334987095ba09d2868a22612bbe007574d089adc8b19632e297e8c577c81627
MD5 ab91439b02d6387149770b7a332c3f5a
SHA1 cdf2b3c9f1aad0563663b1740f3fd4f696d2e24d
SHA512 bc8b68ac30d13643f6187423b39331bc01e3a804269cc35021bdaeef3f1bad1eae4f9933e0bf670ed980dad6fc491554b628a52de46296c986fe7e882984800c
SSDEEP 192:vmZFr8NJ2MqaB0QW6VdR5aH/yeI86vHrBvGFV+Os8vdZYZ3:vmZR8NwMqaBBWGdR4HzYGlC
TLSH
T1E8723373A1FD5CA661310AA22F6C3C995F93A0D35DAB328CF59BF99007E7A04071B1B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3400-0-0x0000000000DF0000-0x0000000000E84000-memory.dmp

Download

memory/3400-1-0x0000000000CF0000-0x0000000000CF2000-memory.dmp

Download

memory/3400-2-0x0000000000D00000-0x0000000000D01000-memory.dmp

Download

memory/3400-3-0x0000000000DF0000-0x0000000000E84000-memory.dmp

Download

memory/3400-29-0x0000000000DF0000-0x0000000000E84000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads