hxxps://smadav[.]net/

Analysis

max time kernel
125s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
04/05/2024, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://smadav.net/

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
4684	smadav2023rev1510.exe
3008	smadav2023rev1510.tmp
1996	SMΔRTP.exe
4556	SmadavProtect64.exe
2328	Process not Found
4832	SMΔRTP.exe
1604	unins000.exe
3748	_iu14D2N.tmp

Loads dropped DLL 18 IoCs

pid	Process
3008	smadav2023rev1510.tmp
3008	smadav2023rev1510.tmp
3584	regsvr32.exe
1996	SMΔRTP.exe
4556	SmadavProtect64.exe
3312	Process not Found
2684	msedge.exe
4832	SMΔRTP.exe
1012	regsvr32.exe
3732	regsvr32.exe
1432	msedge.exe
3896	Process not Found
1472	Process not Found
4628	Process not Found
4860	explorer.exe
4536	Process not Found
2896	regsvr32.exe
4300	regsvr32.exe

Registers COM server for autorun 1 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32\ = "C:\\Program Files (x86)\\Smadav\\SmadExtc64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32\ = "C:\\Program Files (x86)\\SMADAV\\SmadExtMenu64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMΔRT-Protection = "C:\\Program Files (x86)\\Smadav\\SMΔRTP.exe rts"	SMΔRTP.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SMΔRTP.exe
File opened (read-only)	\??\Z:	SMΔRTP.exe
File opened (read-only)	\??\O:	SMΔRTP.exe
File opened (read-only)	\??\S:	SMΔRTP.exe
File opened (read-only)	\??\V:	SMΔRTP.exe
File opened (read-only)	\??\G:	SMΔRTP.exe
File opened (read-only)	\??\S:	SMΔRTP.exe
File opened (read-only)	\??\U:	SMΔRTP.exe
File opened (read-only)	\??\H:	SMΔRTP.exe
File opened (read-only)	\??\L:	SMΔRTP.exe
File opened (read-only)	\??\Q:	SMΔRTP.exe
File opened (read-only)	\??\X:	SMΔRTP.exe
File opened (read-only)	\??\Y:	SMΔRTP.exe
File opened (read-only)	\??\E:	SMΔRTP.exe
File opened (read-only)	\??\W:	SMΔRTP.exe
File opened (read-only)	\??\E:	SMΔRTP.exe
File opened (read-only)	\??\M:	SMΔRTP.exe
File opened (read-only)	\??\R:	SMΔRTP.exe
File opened (read-only)	\??\T:	SMΔRTP.exe
File opened (read-only)	\??\H:	SMΔRTP.exe
File opened (read-only)	\??\N:	SMΔRTP.exe
File opened (read-only)	\??\P:	SMΔRTP.exe
File opened (read-only)	\??\U:	SMΔRTP.exe
File opened (read-only)	\??\B:	SMΔRTP.exe
File opened (read-only)	\??\G:	SMΔRTP.exe
File opened (read-only)	\??\A:	SMΔRTP.exe
File opened (read-only)	\??\I:	SMΔRTP.exe
File opened (read-only)	\??\J:	SMΔRTP.exe
File opened (read-only)	\??\T:	SMΔRTP.exe
File opened (read-only)	\??\X:	SMΔRTP.exe
File opened (read-only)	\??\Y:	SMΔRTP.exe
File opened (read-only)	\??\J:	SMΔRTP.exe
File opened (read-only)	\??\N:	SMΔRTP.exe
File opened (read-only)	\??\P:	SMΔRTP.exe
File opened (read-only)	\??\M:	SMΔRTP.exe
File opened (read-only)	\??\A:	SMΔRTP.exe
File opened (read-only)	\??\L:	SMΔRTP.exe
File opened (read-only)	\??\O:	SMΔRTP.exe
File opened (read-only)	\??\I:	SMΔRTP.exe
File opened (read-only)	\??\Z:	SMΔRTP.exe
File opened (read-only)	\??\B:	SMΔRTP.exe
File opened (read-only)	\??\Q:	SMΔRTP.exe
File opened (read-only)	\??\R:	SMΔRTP.exe
File opened (read-only)	\??\V:	SMΔRTP.exe
File opened (read-only)	\??\K:	SMΔRTP.exe
File opened (read-only)	\??\W:	SMΔRTP.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\backgroundTaskHost.exe	SMΔRTP.exe
File opened for modification	C:\Windows\SysWOW64\regsvr32.exe	SMΔRTP.exe
File opened for modification	C:\Windows\SysWOW64\dllhost.exe	SMΔRTP.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SMADAV\is-APBCN.tmp	smadav2023rev1510.tmp
File created	C:\Program Files (x86)\SMADAV\is-P3570.tmp	smadav2023rev1510.tmp
File created	C:\Program Files (x86)\SMADAV\is-TIDS7.tmp	smadav2023rev1510.tmp
File created	C:\Program Files (x86)\SMADAV\is-4KKTD.tmp	smadav2023rev1510.tmp
File opened for modification	C:\Program Files (x86)\SMADAV\unins000.dat	smadav2023rev1510.tmp
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	SMΔRTP.exe
File opened for modification	C:\Program Files (x86)\SMADAV\unins000.exe	SMΔRTP.exe
File created	C:\Program Files (x86)\SMADAV\unins000.dat	smadav2023rev1510.tmp
File created	C:\Program Files (x86)\SMADAV\is-4B5FG.tmp	smadav2023rev1510.tmp
File created	C:\Program Files (x86)\SMADAV\is-9GDMV.tmp	smadav2023rev1510.tmp
File created	C:\Program Files (x86)\SMADAV\is-K9AUV.tmp	smadav2023rev1510.tmp
File created	C:\Program Files (x86)\SMADAV\is-KN30A.tmp	smadav2023rev1510.tmp
File created	C:\Program Files (x86)\SMADAV\is-ALQOK.tmp	smadav2023rev1510.tmp
File created	C:\Program Files (x86)\SMADAV\is-97TV1.tmp	smadav2023rev1510.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	SMΔRTP.exe
File created	C:\Program Files (x86)\SMADAV\is-JDE62.tmp	smadav2023rev1510.tmp
File created	C:\Program Files (x86)\SMADAV\is-TOIL3.tmp	smadav2023rev1510.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe	SMΔRTP.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	SMΔRTP.exe
File opened for modification	C:\Program Files (x86)\SMADAV\unins000.dat	_iu14D2N.tmp
File created	C:\Program Files (x86)\SMADAV\is-UJ057.tmp	smadav2023rev1510.tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sysmon.exe	SMΔRTP.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe	SMΔRTP.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	SMΔRTP.exe
File opened for modification	C:\Windows\explorer.exe	SMΔRTP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1472	schtasks.exe
4192	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32\ = "C:\\Program Files (x86)\\SMADAV\\SmadExtMenu64.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SmadExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\ = "SmadExt Class"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32\ = "C:\\Program Files (x86)\\Smadav\\SmadExtc64.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\SmadExt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\SmadExt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SmadExt\ = "{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	_iu14D2N.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\ = "SmadExt Class"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\SmadExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\SmadExt\ = "{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\SmadExt\ = "{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SmadExt	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SmadExt	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SmadExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SmadExt\ = "{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\SmadExt	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 430877.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\smadav2023rev1510.exe:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4860	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
2684	msedge.exe
2684	msedge.exe
3712	identity_helper.exe
3712	identity_helper.exe
4480	msedge.exe
4480	msedge.exe
3384	msedge.exe
3384	msedge.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4832	SMΔRTP.exe
4860	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1996	SMΔRTP.exe
Token: SeDebugPrivilege	1996	SMΔRTP.exe
Token: SeShutdownPrivilege	4832	SMΔRTP.exe
Token: SeDebugPrivilege	4832	SMΔRTP.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
3008	smadav2023rev1510.tmp
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
4860	explorer.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
3748	_iu14D2N.tmp

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe
1996	SMΔRTP.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1996	SMΔRTP.exe
1996	SMΔRTP.exe
4556	SmadavProtect64.exe
4832	SMΔRTP.exe
4832	SMΔRTP.exe
1604	unins000.exe
3748	_iu14D2N.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 1432	2684	msedge.exe	79
PID 2684 wrote to memory of 1432	2684	msedge.exe	79
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 4204	2684	msedge.exe	80
PID 2684 wrote to memory of 1928	2684	msedge.exe	81
PID 2684 wrote to memory of 1928	2684	msedge.exe	81
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82
PID 2684 wrote to memory of 1088	2684	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://smadav.net/
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff60fe3cb8,0x7fff60fe3cc8,0x7fff60fe3cd8
  2⤵
  - Loads dropped DLL
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- C:\Users\Admin\Downloads\smadav2023rev1510.exe
  "C:\Users\Admin\Downloads\smadav2023rev1510.exe"
  2⤵
  - Executes dropped EXE
  PID:4684
- - C:\Users\Admin\AppData\Local\Temp\is-56T7N.tmp\smadav2023rev1510.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-56T7N.tmp\smadav2023rev1510.tmp" /SL5="$A0214,1370899,133120,C:\Users\Admin\Downloads\smadav2023rev1510.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of FindShellTrayWindow
    PID:3008
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\SMADAV\SmadExtMenu64.dll"
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:3584
  - - C:\Program Files (x86)\SMADAV\SMΔRTP.exe
      "C:\Program Files (x86)\SMADAV\SMΔRTP.exe" rtc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Enumerates connected drives
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:1996
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn "smadav" /xml "C:\Users\Admin\AppData\Roaming\Smadav\smadav.xml"
        5⤵
        Creates scheduled task(s)
        
        PID:1472
    - - C:\Program Files (x86)\Smadav\SmadavProtect64.exe
        
        "C:\Program Files (x86)\Smadav\SmadavProtect64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:4556
    - - C:\Program Files (x86)\Smadav\SMΔRTP.exe
        
        "C:\Program Files (x86)\Smadav\SMΔRTP.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4832
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Smadav\SmadExtc64.dll"
        5⤵
        Loads dropped DLL
        
        PID:1012
      - C:\Windows\system32\regsvr32.exe
        
        /s "C:\Program Files (x86)\Smadav\SmadExtc64.dll"
        6⤵
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:3732
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn "SmadavSecondaryUpdater" /xml "C:\Users\Admin\AppData\Roaming\Smadav\SmadavSecondaryUpdater.xml"
        5⤵
        Creates scheduled task(s)
        
        PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,9384503530776020367,5667388448206543374,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6700 /prefetch:2
  2⤵
  PID:764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4260

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4192

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4860

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}
1⤵
PID:4824
- C:\Program Files (x86)\SMADAV\unins000.exe
  "C:\Program Files (x86)\SMADAV\unins000.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1604
- - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
    "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Program Files (x86)\SMADAV\unins000.exe" /FIRSTPHASEWND=$20468
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3748
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /u /s "C:\Program Files (x86)\SMADAV\SmadExtc64.dll"
      4⤵
      Loads dropped DLL
      PID:2896
    - - C:\Windows\system32\regsvr32.exe
        
        /u /s "C:\Program Files (x86)\SMADAV\SmadExtc64.dll"
        5⤵
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4300
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files (x86)\SMADAV\SmadExtMenu64.dll"
      4⤵
      PID:4220
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn smadav /f
      4⤵
      PID:4004
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /tn SmadavSecondaryUpdater /f
      4⤵
      PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\SMADAV\Readme.txt

Filesize
20KB

MD5
3e9a46005ef1fa49bebcebba2c7d914a

SHA1
2a044f01dd0a1da51690424fbb7681270240fb81

SHA256
2cb039dbabeac6d27a91eaada22ba0112c4b01574a4d7fe88f8f34c9ca813fe4

SHA512
68b1a585c5e3239babb109229f118269afb1b2f19d84ad756616d28980065c069da47d2d0868a967f90e8fb9ab666d022e606823fe407416ab79a5b46a83738c

Download Submit
C:\Program Files (x86)\SMADAV\SMΔRTP.exe

Filesize
1.8MB

MD5
3dcdc8336dc3826d6f2ecdd8cb5906fe

SHA1
c7fdbbe9a187ecb76b2c01ef5b7200399a2bca40

SHA256
5a07c26dc1e2d59548bfe9cf5f30a8d43b056149073f821431d866ae981da5df

SHA512
a38b0bd39054f9ade9678132b683f74d0a69d7da5bc05c2aadb393250b79aab0095aecedfa94bf63532bf344b52e8dfbcfd1fe7f460f60fea0296a5fec007165

Download Submit
C:\Program Files (x86)\SMADAV\SmadEngine.dll

Filesize
107KB

MD5
6d229cc2996157189e19b3a0f710f081

SHA1
378c66638828674799269074d9ad9aba6a3d5659

SHA256
9eba16fd8fb7505561e3d4a9e26dc4557dca0a9501ec45ebd7014188d5b0432a

SHA512
2782fb69b2c30c97fa05bb85c5e52e404f4f06be57e60015dca82b014719dc79906e3e79651679190c62c2cac1bb06735a1fd654dba463db3edb3712d1b8b24e

Download Submit
C:\Program Files (x86)\SMADAV\SmadExtMenu64.dll

Filesize
110KB

MD5
88b17c40fdcb541b1a3865f6e138f172

SHA1
1bdaf9a1a2fcbeb97ef1e0938507ee0e0bb95eae

SHA256
8ad35ed3589fda9737499b6a5cdef240a80f7aba50fbe3c92d562a00d16a0b77

SHA512
5129ae7142ed9569f88b0e5c5d83f5a30a671ae236f3a144a0799bc67226fb5be12f6ae006774f39271a63961206cfb30c738f28b91d8a75f96cb79d3f2368da

Download Submit
C:\Program Files (x86)\SMADAV\SmadHook32c.dll

Filesize
74KB

MD5
0559f6b65e0f9637c4feedc75a0d5e9c

SHA1
8b3e3a4501682ec4b1a69fef3aa91bf6fd9ad09c

SHA256
3b30456e6aa2ed946ac4c464a9885c944659f3650d7b50e17e2c2c7e9fb40504

SHA512
29631e7ccf5ca425c65b03239ec54b8b00aacb662b149ff2283348b68fe5cae9b6d357b394b4f187c5c2e8e1acdcddcbc46397e6c262fa513b21f75550adcb7c

Download Submit
C:\Program Files (x86)\SMADAV\SmadHook64c.dll

Filesize
79KB

MD5
a9f63ea781c1c6dee62178b90a47122b

SHA1
3e720fbb7f662686334a71975109b0d59d999572

SHA256
d0a178bfad1b8b08335e1bcdfb1c4dc6914c4b7d28962ceb83ca6f5d365400f4

SHA512
7da3e651cc68313cece1c238f0c7d2c44565cadca20baa6bac59975a3a85f4e1fc1ca6c01b1a6e0a07881ba820685e4fee43682de2a167c1f253e1b283d59a64

Download Submit
C:\Program Files (x86)\SMADAV\Smadav-Updater.exe

Filesize
98KB

MD5
475e182384826ae93ff6c6636da3dd8a

SHA1
851bc7c29b247600234380a38b9d2d5961adae60

SHA256
e45cbfd36777e8a2748cbc1adaccdf96b1353bd26eaefb61e7422571bafdd1eb

SHA512
284c9511275c7f55f63eae4cb2583db4923fb8e707b5b5fcea10ee04caaeeba3b26c087b4791bac5bc2d61411a8ddf9d7a2e590d532e400e684127ee4e3b396c

Download Submit
C:\Program Files (x86)\SMADAV\Smadav.loov

Filesize
486KB

MD5
0a6248ad25d0883022d04cec6cf65cb4

SHA1
57fd61c2514a4b4fd20cda3bc1e39e62e9d9508b

SHA256
765b1020669cb1bfda2a957787b4bdce33ef6be49313b454f462f0aa63575af4

SHA512
e0d0754e191834b44d2ac7391293ecbeb84bd2af6f407c2d209b27c11e3f3654fa4b3835fe7a46366b09a62b3edbedd6d28080f0b56420253289ec6b198fed6e

Download Submit
C:\Program Files (x86)\SMADAV\SmadavHelper.exe

Filesize
144KB

MD5
6285f0d78b318a432a332f5a7e3c5730

SHA1
6bd6528ee6c6b27f73d3b61ca74ce0ce4c015582

SHA256
107d918e272733ffab2a70c91898b5e5f4266a9a9390579f647208d7b0d8c4d6

SHA512
f4f6a045ac22b41f61087bc4ee3ec1d420157288a56d6d4444b6ba73e0954c77a56ca979d40cee1b40c1c7aadb749c9ffe3d8e48a58478dee673c13fec677754

Download Submit
C:\Program Files (x86)\SMADAV\SmadavProtect32.exe

Filesize
65KB

MD5
155de7d464125b8c35b22dae37428aba

SHA1
598a81402437a1a7844b9a7ab17f9d7a606aa4b9

SHA256
4f54a6555a7a3bec84e8193d2ff9ae75eb7f06110505e78337fa2f515790a562

SHA512
74fb67f791a28804891a324c626f847e41e54743049f31b8b033d11c2dc0357b9f440431552f1e690e3b381d9898b294d9a40ab4ce560773c03bfdfebf52fd5a

Download Submit
C:\Program Files (x86)\SMADAV\SmadavSecondaryUpdater.exe

Filesize
121KB

MD5
acebd999a27a7bda8ea4fd70aea604c1

SHA1
7a6de827852f78286ea16f8cd6be3ab73adf8de5

SHA256
d5c161a149cd0b94bc0fada5599d4bd50079a00ce6565604192337919f200fdf

SHA512
acef9089f58bbecb327626765fd6fdd8c9ad91b2c090386cbaca280897134205cdc3dc82775bb3644328c3f8daf4336d302180126e03fbdc7d613ecfb04f0283

Download Submit
C:\Program Files (x86)\SMADAV\unins000.dat

Filesize
25KB

MD5
0f02cb9c75873189d57f55c67a7488b3

SHA1
f359517c9a880ca487bc9beac2a09ccd04a0d070

SHA256
6ce495f7d3eec00f4b40d4cec28d2e7cb766525ca4fea4ca54bde44cbb38fcce

SHA512
22b2a71d053e91945ab05be5736d565d1cbdbe5b9b521897372c698de55170ddb1ce78c9219b469d0cf46993d7d2a7d4335690cdc860d84c24f8e3acffd10112

Download Submit
C:\Program Files (x86)\SMADAV\unins000.exe

Filesize
1.2MB

MD5
db9f24dc102272be9ef7f3f542d9a47b

SHA1
b79b628f6746ddc5a61c9059c4ee30df3e26b6af

SHA256
c18ab4cc27854f68f7e6c97fdd4a2fafa31a16d691ebb57ade401e028dafbd2c

SHA512
74afc69db6f630e2cac1c25d2d21afec827e4601def7273b2476b1c11d90569772b07cf7d0094fd7ec1b06c83249f254b2a0d6dcbd60b0b2c4d4c6a4dddb8fc1

Download Submit
C:\Program Files (x86)\Smadav\SmadavProtect64.exe

Filesize
68KB

MD5
e0860f86501ae7b6dc8b899baf990461

SHA1
fe6f25edbf107f2977dce2b274cadf8bb5718e37

SHA256
fae713e25b667f1c42ebbea239f7b1e13ba5dc99b225251a82e65608b3710be7

SHA512
a25319ba501d2e51029f0f93c2f7e6aa981ebc22dc0c374c7038ddd6323683dc7dfb8beece132e3e6207e8bbe7e3207e3ffaec94e5624ce3abe8b3a6a8366b8f

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SMADAV Antivirus\SMADAV.lnk

Filesize
1KB

MD5
d516f34345d2c322b7c40d21a8ded4ae

SHA1
215d583c1cd7fd4f549b3d938b4e2ec91db6d7db

SHA256
1948d73b010911a381bd7678aae05f4bdd72abd6e6e24183bd01020e259e85b3

SHA512
27b2c09705d87232154a19ac7f4d443ccf7074f2ceacea839793cc415eb39f79fc0168bc6d4978b890898af5c640a0403d8d1c562c8f49d885b6473ddc71fd90

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SMADAV Antivirus\Uninstall SMADAV.lnk

Filesize
1KB

MD5
5276de0e1da2e53277d5a488c3bde478

SHA1
4839f13146147666b2d58d1cf17af8ecff686d8f

SHA256
8f2167e6d696c43a213c1c2517b83b6734ff00004c42ccbf701de472b32b080b

SHA512
ca62b8353ecc11f8a4d02a2ed25d1215c70951f3036d727d9b22bcf1980e8c451175f53661d68cf6ced35ee3dd416bfd18662000008f92276cf26afb3498a73e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a85ad170d758e61ae5648c9402be224

SHA1
e6dfce354b5e9719bc4b28a24bb8241fc433e16f

SHA256
af0da8b5ad8127ae0ef7773bc9c4b145ed3fe7fbef4c48278649e1e3aa5ce617

SHA512
641414d91c993f74b6b71654522359d606c7f94ac0fcca6478d1bc33c30f4a9fdb9ce6f8e281c79a2f9b9670fda8a4ccdd80e7d64347c1f66d8c9ef024bcb09b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
22cececc69be16a1c696b62b4e66f90e

SHA1
b20b7f87f8bc64c1008b06a6528fc9c9da449c2f

SHA256
d940b85bc83f69e8370a801951eb6b8bb97efbb3aa427664105db76e44707258

SHA512
2b2e548f2c8f84d321ef2afdf31128065c3593b884ca8111b05800960b5378b99c7efa6165d02fba4c11e6e4b49b14e419d89f76d55ef574f4ac2b7d6ecb3d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d04216b181284a6fc8883d17d9b2f5c

SHA1
00e7a78924eaaf3d0dec2d8a1383303e1b2217d8

SHA256
69bc04dfa99f6a47977676a00f89d5441785a82f62d803335935d9ce94940d69

SHA512
7a841d9a54383ca775111ec954588c0402dbdef568cbf10a84b263a32756e3ad15c2d672936eded3a842acba55fa7aa094f143e964ca3388c94b8adabbcf735a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2d27e354e0be764025a33303585aef56

SHA1
334838f626ec6e0a92f64ee01097626f785e61e8

SHA256
19b5681dcacecd2e552b0d03f08057d60e3472d9dee50bde8a36fc03c79f80d4

SHA512
58af1594eb1bce55bc2145af41525caf1cba280bb2ae2cf7984c52c9911595ee6c1a986d228779e3ec4c2bd4c640876ed8f58a7dedca2c4971dd081e9ac9f95b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3dc1a0d858489bd5a04be06d21c44fb7

SHA1
f1054f00904c8a5218e6a417139db43848a83033

SHA256
aefc0b302d81a9848cdf5083af7496ca53dca1c98a5b1f58a6d971d3773fac4b

SHA512
2d0cb84b03c5b86d559dbbcab1a29c29dc4819013ddd48ef191e3dc09a682b35badcb305a96e410132fc6657ce0e2cf8d1942cc300c95a4f9ebeff41166522ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f2c606df24898cc81f81b6ab7336a4b3

SHA1
40966d69fdac4728d20f3773a1dfbc181633b2dc

SHA256
761aabe99698fd6d00d670e04d3003f5771594c35102eaae714d0493be606184

SHA512
b9acb9cf6909d6c81c95da0f57a6a0bab762659d24fdcaa50f6cc7c7da32a750cf44a838884a40ce63d2ed7fa67ca41d94c829f252ba1254cc3339d79062587a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-56T7N.tmp\smadav2023rev1510.tmp

Filesize
1.1MB

MD5
8976fcbfc98fa88fc2033c3f4e8bdc9a

SHA1
59b1f6260d49f11ae4298895d758e3b9922a701c

SHA256
aca42d3162b07b10f367c723833d19901f415afca6326db49af71520e97fc334

SHA512
af251750802cfac56ba486a1c3a47d59457da76ac7b53b969a7c6d843090ae7434e86bd324dc0eacf2df0f017420b3c8277ac1fe56d3272498d30eba0b79cbcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-99L3T.tmp\_isetup\_isdecmp.dll

Filesize
19KB

MD5
3adaa386b671c2df3bae5b39dc093008

SHA1
067cf95fbdb922d81db58432c46930f86d23dded

SHA256
71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

SHA512
bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BIU1O.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Roaming\Smadav\SmadavSecondaryUpdater.xml

Filesize
2KB

MD5
d68080c922cc461d30b5ecf9f10de9ab

SHA1
1fc5c09d5f3d8fba192add27cf6c9caccf4833d8

SHA256
cefe39c9b2673a8947927428aa125a07bac6b411f8e4665e0b3eb4e5ceced094

SHA512
294deb9de717b96c5da552014f3000447be0d141d21aaac76ee250bd89d99a70577787a21eea2b96a685b855561b521905b8b119be241433b6b690badcb20b1c

Download Submit
C:\Users\Admin\AppData\Roaming\Smadav\smadav.xml

Filesize
2KB

MD5
4d5d867e7af077e2a061f645561c69f5

SHA1
6102e907a4104b24a7b3b6a5d7af705272a763e7

SHA256
13637a1bf6e753bb35858157b2c308bf11aea522de6fdfd31dcee8177db8ac53

SHA512
230b247827f37db5abc3e8dbf616ffad229c020f5621f29efe2a90dd218a1dd418c4bd11368a917778337ba37649440e29836c0db7f0f18a00782f1462e739c5

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 430877.crdownload

Filesize
1.7MB

MD5
123a12bc81d45ef7cba03cc76d968a06

SHA1
e128bd28b650c6aa7ab878823649c7ca05d4ce71

SHA256
1521e64945863f345cd2bfbe8d0396ec6ab26468efc8397b5fa6609d705d64a9

SHA512
da75e82ca578f631181887ef0cc3576ed6bf6d7cea89587fe3fce74170a5209210f910bb48af5f1adbf1cbbdc02e678ef32f8ae3d6251e575b78140735fd0b66

Download Submit
C:\Users\Admin\Downloads\smadav2023rev1510.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Public\Desktop\SMADΔV.lnk

Filesize
1KB

MD5
3d435df23bdc711467a26de05539b599

SHA1
68844b9bc895aeaddb2989d2bda149c843c0cb17

SHA256
3d1b971eb84a24f1f38e865cc57d3f97eae4a1c7f5b0ba3871d29d9c57b389f9

SHA512
31c308b7c3691417daa43e581a2e4470c776061f3e4b86df1cc2150cb24f1daadd7301c9805202b571683d3ba88e0440daa47b64330395667365fc3e5a456b01

Download Submit
memory/1604-285-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/3008-180-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/3008-296-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/3748-288-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/4684-179-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4684-93-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4684-297-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download