29d7bcce549e42be131c7c3d39a46fe884925ceb742dc8cc1da7f6cae804f4cb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/dospop.exe
Size 437KB
Sample240620-2dgmbazfqa
SHA256 9240b45f226db49da56c7b12b7a347eaee578cfc0e4603019091a1fd81bfcafb
MD5 b2347a5c2350b6342cdabda956618759
SHA1 f6a779efafcf4bd6a9e1f8bf2c66af33f140622e
SHA512 76468bda8a4e0df0bf49efdf6cf96d3f45a85db73540e066cc156ca0481d676606d46f3b98774395914c4f357d752c9bbae6e41f9277bc362dd712bd430eda04
SSDEEP 12288:WGeC/oEjVcYKKrh/RfKum6YGBzz9QJWCqoRFf:8CNjVcNKrnVm6vBzBCqoH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2196	regsvr32.exe
2196	regsvr32.exe
2196	regsvr32.exe
2196	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{57F9FEF0-6EAE-4030-A68A-30FDC38B1B13}\ = "TBSB09293"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{57F9FEF0-6EAE-4030-A68A-30FDC38B1B13}	regsvr32.exe

Drops file in Program Files directory 29 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DosPop Toolbar\basis.xml	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\content.tmpl	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\icons.bmp	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\logo16.bmp	dospop.exe
File created	C:\Program Files (x86)\DosPop Toolbar\logo16.bmp	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\tbhelper.dll	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\RSSReader_plugin.dll	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\static_img.html	dospop.exe
File created	C:\Program Files (x86)\DosPop Toolbar\toolbar-logo-dospop.bmp	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\basis.xml	dospop.exe
File created	C:\Program Files (x86)\DosPop Toolbar\icons.bmp	dospop.exe
File created	C:\Program Files (x86)\DosPop Toolbar\options.html	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\rss.gif	dospop.exe
File created	C:\Program Files (x86)\DosPop Toolbar\RSSReader_plugin.dll	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\dospop.dll	dospop.exe
File created	C:\Program Files (x86)\DosPop Toolbar\channel.tmpl	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\options.html	dospop.exe
File created	C:\Program Files (x86)\DosPop Toolbar\tbhelper.dll	dospop.exe
File created	C:\Program Files (x86)\DosPop Toolbar\content.tmpl	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\marquee.tmpl	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\version.txt	dospop.exe
File created	C:\Program Files (x86)\DosPop Toolbar\marquee.tmpl	dospop.exe
File created	C:\Program Files (x86)\DosPop Toolbar\rss.gif	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\toolbar-logo-dospop.bmp	dospop.exe
File created	C:\Program Files (x86)\DosPop Toolbar\static_img.html	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\static_pub.html	dospop.exe
File created	C:\Program Files (x86)\DosPop Toolbar\version.txt	dospop.exe
File opened for modification	C:\Program Files (x86)\DosPop Toolbar\channel.tmpl	dospop.exe
File created	C:\Program Files (x86)\DosPop Toolbar\static_pub.html	dospop.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	dospop.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "0"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{BFB5F154-9212-46F3-B547-AC6106030A54} = 00	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	dospop.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{BFB5F154-9212-46F3-B547-AC6106030A54}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CD5C92AE-97B0-4BC3-BA65-BA0308D543BF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CD5C92AE-97B0-4BC3-BA65-BA0308D543BF}\ = "IPosBHO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\TypeLib\ = "{4509D3CC-B642-4745-B030-645B79522C6D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar3.TBSB09293\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9EBB289A-2D7B-465B-825F-1530B813E95A}\TypeLib\ = "{77AA25E8-6083-4949-A831-9CB11861DC10}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\TypeLib\ = "{4509D3CC-B642-4745-B030-645B79522C6D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB09293.TBSB09293\CLSID\ = "{BFB5F154-9212-46F3-B547-AC6106030A54}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFB5F154-9212-46F3-B547-AC6106030A54}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFB5F154-9212-46F3-B547-AC6106030A54}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFB5F154-9212-46F3-B547-AC6106030A54}\ProgID\ = "TBSB09293.TBSB09293.3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\ = "IToolbarURLSearchHook"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFB5F154-9212-46F3-B547-AC6106030A54}\InprocServer32\ = "C:\\PROGRA~2\\DOSPOP~1\\dospop.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB09293.IEToolbar\CLSID\ = "{BFB5F154-9212-46F3-B547-AC6106030A54}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFB5F154-9212-46F3-B547-AC6106030A54}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar3.TBSB09293\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD5C92AE-97B0-4BC3-BA65-BA0308D543BF}\TypeLib\ = "{77AA25E8-6083-4949-A831-9CB11861DC10}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\InprocServer32\ = "C:\\PROGRA~2\\DOSPOP~1\\tbhelper.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFB5F154-9212-46F3-B547-AC6106030A54}\VersionIndependentProgID\ = "TBSB09293.TBSB09293"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB09293.IEToolbar.1\CLSID\ = "{BFB5F154-9212-46F3-B547-AC6106030A54}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB09293.IEToolbar\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EBB289A-2D7B-465B-825F-1530B813E95A}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD5C92AE-97B0-4BC3-BA65-BA0308D543BF}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook\CLSID\ = "{CA3EB689-8F09-4026-AA10-B9534C691CE0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\InprocServer32\ThreadingModel = "both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB09293.IEToolbar\CurVer\ = "TBSB09293.IEToolbar.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EBB289A-2D7B-465B-825F-1530B813E95A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD5C92AE-97B0-4BC3-BA65-BA0308D543BF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}\1.0\ = "URLSearchHook 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB09293.TBSB09293\ = "DosPop Toolbar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB09293.IEToolbar.1\ = "IE Toolbar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57F9FEF0-6EAE-4030-A68A-30FDC38B1B13}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB09293.TBSB09293	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57F9FEF0-6EAE-4030-A68A-30FDC38B1B13}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CD5C92AE-97B0-4BC3-BA65-BA0308D543BF}\TypeLib\ = "{77AA25E8-6083-4949-A831-9CB11861DC10}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD5C92AE-97B0-4BC3-BA65-BA0308D543BF}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook.1\ = "ToolbarURLSearchHook Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57F9FEF0-6EAE-4030-A68A-30FDC38B1B13}\ = "TBSB09293 Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFB5F154-9212-46F3-B547-AC6106030A54}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar3.TBSB09293\CurVer\ = "Toolbar3.TBSB09293.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\ = "Toolbar3 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB09293.TBSB09293\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFB5F154-9212-46F3-B547-AC6106030A54}\InprocServer32\ = "C:\\Program Files (x86)\\DosPop Toolbar\\dospop.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57F9FEF0-6EAE-4030-A68A-30FDC38B1B13}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57F9FEF0-6EAE-4030-A68A-30FDC38B1B13}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9EBB289A-2D7B-465B-825F-1530B813E95A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\ = "ToolbarURLSearchHook Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\TypeLib\ = "{4509D3CC-B642-4745-B030-645B79522C6D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB09293.IEToolbar	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFB5F154-9212-46F3-B547-AC6106030A54}\ = "Softomate Toolbar 3.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar3.TBSB09293.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar3.TBSB09293.1\CLSID	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2196	2784	dospop.exe	28
PID 2784 wrote to memory of 2196	2784	dospop.exe	28
PID 2784 wrote to memory of 2196	2784	dospop.exe	28
PID 2784 wrote to memory of 2196	2784	dospop.exe	28
PID 2784 wrote to memory of 2196	2784	dospop.exe	28
PID 2784 wrote to memory of 2196	2784	dospop.exe	28
PID 2784 wrote to memory of 2196	2784	dospop.exe	28

C:\Users\Admin\AppData\Local\Temp\$TEMP\dospop.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\dospop.exe"
1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32 /s "C:\Program Files (x86)\DosPop Toolbar\dospop.dll"
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RSSReader_plugin.dll

Path C:\Program Files (x86)\DosPop Toolbar\RSSReader_plugin.dll
Size 260KB
SHA256 efb9b1707ca2447c63036b1074c402f8ff6a5f30441c03ea372d1f0ec8423bc5
MD5 131fa8aaa9f5e717477d6e16c6f8fb70
SHA1 17e50467e224d7461c46a456442f10a0da3cc7ec
SHA512 d87a6789aec7574c4888e4a6da3c7776e937b62ab481e2aa874752d71854b32a9ad2814321cb24da1f1b134e3b443be4474fbfb09335e06349862151beccd32e
SSDEEP 3072:OoqSEB35vhDI5+crn7CAjtjJ0voNZmDlny+sSy2EjJqP8InGnhIkIoRQc5ciab/W:dEB3QrCgOvSmD1TBEleGOkPWe
MD5 SHA1 SHA512 SSDEEP

Submit Download

basis.xml

Path C:\Program Files (x86)\DosPop Toolbar\basis.xml
Size 11KB
SHA256 e5e25d47c991d1b7582de5cb41427b4f58bbb72d67c208829dba6a52b40e9a27
MD5 5c2f5edec42b592cdf320560602566f9
SHA1 cf0725203afc620590ef0ba06b23f83895c2a9e1
SHA512 699f2982f9fa7afd3520c3afbde55bbda2e40b6d1043f325e9611db1639092fe2fa4df08f3735541409a17577e30af345ec0f5a73c6e868c9a02fcd9a71bcfda
SSDEEP 192:F0kDUvSIzLKoI2tO6HCn0JVcGZ2L38MWmHOHxCVUtzpw3:F0kepHugO6io3ZKMT+OH869w3
MD5 SHA1 SHA512 SSDEEP

Submit Download

dospop.dll

Path C:\Program Files (x86)\DosPop Toolbar\dospop.dll
Size 872KB
SHA256 7e333107d1b5d943b9ad2a52625b02d28d79be60734e2d77a8ed2c7335214632
MD5 c97179ba4ed0491d227335ffebdc856a
SHA1 6de5da7bf23ec5e519a9068817cd26890c1a8930
SHA512 bc2eb7c9c939907e7390530722b722aefc7e59a06d59187d9cbb9b9678d2209f484d53b0e3c22337026c4ae6b8c619a53ccd0505612f5ab6b456ec204a4b2265
SSDEEP 12288:JbJRJfYLE7U0n/y2xVlZcuKFAejQD48mCJon71dEMcSbLn3BghuL2OT31YzsPzXh:JVRJfCEw0nq2xVtKFApY5v3+19e
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbhelper.dll

Path C:\Program Files (x86)\DosPop Toolbar\tbhelper.dll
Size 180KB
SHA256 3f56aa185c36a69557a87633def1b291bc7e61064e4ee51483e7b6a2659bb51c
MD5 bd60d9ff3cfc8ce202063f75eb817780
SHA1 27f7e3d852ca84223f2a4b48a5a6f8fbca11dfbf
SHA512 2946d94e697d02c6d25e9daa7b7f18430a6ba597f9f0ce082296b57e28821d2199aab92ed14c58a95a2fa80824c800ab968fc88797d0f0cf1839befb04518155
SSDEEP 3072:063enkjfM0238ENyc0eePgN8MsSBTwMifOZUv+2jFoArAMsJg:0BiE02HePgCfswMiWZyl0Jg
MD5 SHA1 SHA512 SSDEEP

Submit Download

version.txt

Path C:\Program Files (x86)\DosPop Toolbar\version.txt
Size 49B
SHA256 0f85f776d85b5ee164a43c166dab525625655bd42b6c0503fa8d36fb702df666
MD5 f1610ba6a619c1703c4dd4ea1c8d71e5
SHA1 539d1b8b903d98bd9abaf232b4c2f370ac1e9e81
SHA512 de5058badc73c1e267e24d7cd18e2c1207337d78185bcd17c4e1ab1131e30f4df5c051cceb748966fd4a8a6b8b2f1d11e2ced29bf5c5ca8404e3f5da5d2d438e
MD5 SHA1 SHA512

Submit Download

memory/2196-21-0x0000000000230000-0x0000000000260000-memory.dmp

Download

memory/2196-26-0x00000000002A0000-0x00000000002E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads