Overview

overview

10

Static

static

10

672dd0c0b8...8b.exe

windows7-x64

10

672dd0c0b8...8b.exe

windows10-2004-x64

10

$PLUGINSDIR/Ping.dll

windows7-x64

3

$PLUGINSDIR/Ping.dll

windows10-2004-x64

3

$PLUGINSDI...ry.dll

windows7-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

Installer.exe

windows7-x64

8

Installer.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2024 21:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    672dd0c0b851ef59e073ba4aa2a5211c9546679b22788d1d117339b28b8d528b.exe

  • Size

    8.8MB

  • MD5

    823389e6b696377bca1922f6eff200ad

  • SHA1

    e292a7ecb3156e12dcacde7afb810b84afff6007

  • SHA256

    672dd0c0b851ef59e073ba4aa2a5211c9546679b22788d1d117339b28b8d528b

  • SHA512

    f5c4e9f09faa18e5bef6d3d0dc19ad6ceaaf47f842f3f52399c796153da1695ff94e69d5d54d6e18b1fda54a72b740c6e48e29148fc523f6a978b53c1529d30b

  • SSDEEP

    196608:T1oRCm5gjvpKv1gJzwgs/vvZNijq97g00QCOsNjz0uHFtdMaKDk:T1oRCIg1Kvozwl/73vYrWaKI

Score
10/10
pandastealeradwarediscoveryevasionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Panda Stealer payload 1 IoCs
  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer
  • Pandastealer family
    pandastealer
  • Blocklisted process makes network request 12 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\672dd0c0b851ef59e073ba4aa2a5211c9546679b22788d1d117339b28b8d528b.exe
    "C:\Users\Admin\AppData\Local\Temp\672dd0c0b851ef59e073ba4aa2a5211c9546679b22788d1d117339b28b8d528b.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Users\Admin\AppData\Local\Temp\Installer.exe
      C:\Users\Admin\AppData\Local\Temp\Installer.exe /quiet ARGS=HP:1;DS:1;NT:1;DOWNLOADPROVIDER:ShoppingHelper;PUBLISHER:ShoppingHelper;ROT:ALL;ROSP:1;CSH:1;SHOW_UNINSTALL:1;VISIBLE_IN:FF,IE
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3472
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /F /IM msiexec.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4940
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\smartbar\Installer.msi /quiet /quiet ARGS=HP:1;DS:1;NT:1;DOWNLOADPROVIDER:ShoppingHelper;PUBLISHER:ShoppingHelper;ROT:ALL;ROSP:1;CSH:1;SHOW_UNINSTALL:1;VISIBLE_IN:FF,IE;INSTALLATION_ID:5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4036
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3448
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 73E6E02004F7B9E1082366A99F56D70C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4832
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIB565.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240629359 2 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationStart
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3676
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vbkklkzk.cmdline"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1340
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB9FA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB9F9.tmp"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3096
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x3u9v7r5.cmdline"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3740
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBCAA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBCA9.tmp"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1452
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIC313.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240632609 6 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationRemoveFiles
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2372
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSID4A8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240637156 73 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationComplete
        3⤵
        • Blocklisted process makes network request
        • Checks computer location settings
        • Checks whether UAC is enabled
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4836
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m83l2zay.cmdline"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1188
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD756.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD755.tmp"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3500
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yuvqhqva.cmdline"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:552
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD821.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD820.tmp"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4064
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:3928
        • C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
          "C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"
          4⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:4724
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"
          4⤵
          • Installs/modifies Browser Helper Object
          • System Location Discovery: System Language Discovery
          PID:1840
        • C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
          "C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"
          4⤵
          • Installs/modifies Browser Helper Object
          • Modifies registry class
          PID:5052
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Microsoft.mshtml.dll"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3616
        • C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
          "C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Microsoft.mshtml.dll"
          4⤵
          • Modifies registry class
          PID:1436
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2268
        • C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
          "C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll"
          4⤵
          • Modifies registry class
          PID:1312
        • C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe
          "C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe"
          4⤵
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Enumerates connected drives
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          PID:3104
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hxax0dti.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2404
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES914.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC913.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4144
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kepcaij1.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1120
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9DF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9DE.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1012
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2qch2g3_.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2236
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA8B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA8A.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4536
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mgi-0b2m.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3928
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB76.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB75.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:952
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hm15y3e6.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3908
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDD6.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4576
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mfn22udf.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4964
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF1F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF1E.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2888
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b-jyyiog.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3584
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFCB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFCA.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2972
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\crioyg3l.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2192
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1103.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1102.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2684
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gy4xzo6q.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2440
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1317.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1316.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1816
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vdot2ee0.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4496
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1597.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1596.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2904
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f13zo1ca.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3200
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1847.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1846.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3440
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ltc9fojn.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4888
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1B16.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1B15.tmp"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2220
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=sc&installDate=01/12/2024
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:684
          • C:\Program Files\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=sc&installDate=01/12/2024
            5⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            PID:4572
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4572 CREDAT:17410 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:4388
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cp3lwybo.cmdline"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1212
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB66.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB65.tmp"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Browser Extensions

1
T1176

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

5
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e57aa5c.rbs
    Filesize

    144KB

    MD5

    a3c4f7721e3c92b697ad263068871292

    SHA1

    81bc224c7cfdd9e17113e86d72d25d01e1419789

    SHA256

    6904d6e4c0364d4e4a94784be7d27d2595c1ae35ecbd6180c07e1e7c399abadb

    SHA512

    edc00a6e1345406ffb16c6eb0e817622c3a12158e9d1647f3c4d446c2133ead92e1afd3db13c0f482e94f9cd3acf9f84079270122c8937bd3529b35105b70a70

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0
    Filesize

    5B

    MD5

    5bfa51f3a417b98e7443eca90fc94703

    SHA1

    8c015d80b8a23f780bdd215dc842b0f5551f63bd

    SHA256

    bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

    SHA512

    4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0
    Filesize

    398B

    MD5

    1d3a09e5afeeb520728e7102f1fa5320

    SHA1

    d47dbee68eda8c7ca94f0784ef1805cec4d96c16

    SHA256

    d406cc5d234547938ccf915393842210c913fe0ba30d9ae0ae60cbc99cbb8429

    SHA512

    878286eb62b1add66668dd61ca48b73a6c0c7af76156b888b4cc8de1bf8ff2f0f8d12e2de8aef559de3fe794cd4f0231f65104dc3f13a45f1b6a5f5bcb4b2539

    Download Submit

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data.temp
    Filesize

    114KB

    MD5

    2ba42ee03f1c6909ca8a6575bd08257a

    SHA1

    88b18450a4d9cc88e5f27c8d11c0323f475d1ae6

    SHA256

    a14fb57193e6930fa9e410d9c55dfe98e3ae5e69b22356e621edc73683a581bd

    SHA512

    a1f32c22f0d78cba95c04c432e2a58ea47fb34942e70bfdceffcc2ac1e91b87a3da2cd9f93793427ee09a623c7da700e1c16977d41a44286317e8fc20502f035

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
    Filesize

    9KB

    MD5

    7050d5ae8acfbe560fa11073fef8185d

    SHA1

    5bc38e77ff06785fe0aec5a345c4ccd15752560e

    SHA256

    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

    SHA512

    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGDWJGSY\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

  • C:\Users\Admin\AppData\Local\Smartbar\Application\gj1cx02o.newcfg
    Filesize

    12KB

    MD5

    ec3f05ac2148162ddb052f23299b8ecb

    SHA1

    6ce68e94fb7df83ae34094a85abfefce8a3b8d79

    SHA256

    449ab9dae5f16f9dc9e70e37930aeb4c78e057debbb8fe25fb5460a9666ec016

    SHA512

    d166cb06e095281a4a26bdb78e7752d8f9d0e408aa3048eea2294222aa0b7e901364ba377cfc353ada392693b15736c96267697dcabc745f2e4b3d539599b70a

    Download Submit

  • C:\Users\Admin\AppData\Local\Smartbar\Common\icons\30DFF8F0-BA79-4360-A3EA-51B6D006133CPress.png
    Filesize

    4KB

    MD5

    5719ee7f6521ae142f0557f0706cded1

    SHA1

    a1d5694197827967aea5b3ccc88e2f91d465c283

    SHA256

    0a2ae8f3e9aa552748cfeadaec055778487602e7f6d4a6c2a221fe1fd496bfaf

    SHA512

    cde76dada9e798a746d7ae23ee189940a6b7660805267a9221501c5c911a89b298005f111622fae7c886e810e23f83b77d47fa75793d19441246eb775a2f2bf6

    Download Submit

  • C:\Users\Admin\AppData\Local\Smartbar\Common\icons\3C610B86-19DE-4757-B46A-871C9C27FF0APress.png
    Filesize

    4KB

    MD5

    2768222689e3585d609b5a2afc1ba52c

    SHA1

    ee522df6b2e365857bf6be58ac7150cbc71cfc9c

    SHA256

    21ee471e79b0a646735e132bc1f0c48f464677127b105426e00b160a554de6b0

    SHA512

    56527749dca471af92eb4166b2bb6f1ca4cbf07c8d7e1a201378467f1d08efe5fd913715bb995d35c7d511b2cbdc9469d79baae7ee4bab619e4e11753c3505e4

    Download Submit

  • C:\Users\Admin\AppData\Local\Smartbar\Common\icons\B1BEF453-913F-4EC4-B057-A2BB21C09DCBpress.png
    Filesize

    4KB

    MD5

    e6ab030a2d47b1306ad071cb3e011c1d

    SHA1

    ed5f9a6503c39832e8b1339d5b16464c5d5a3f03

    SHA256

    054e94c94e34cef7c2fad7a0f3129c4666d07f439bfec39523dca7441a49bd7c

    SHA512

    4cbb002cc2d593bafd2e804cb6f1379187a9cae7d6cc45068fda6d178746420cc90bcd72ba40fc5b8b744170e64df2b296f2a45c8640819aa8b3c775e6120163

    Download Submit

  • C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml
    Filesize

    3KB

    MD5

    1af25bd4eca4d2b89f9f670548534f8d

    SHA1

    821b200de53207c723d40943ab426e2facd6c812

    SHA256

    920f316807182172f3200057fbc933d9896a85a71d17586f6f6a160af1cdbd14

    SHA512

    e18859fe37e189ebb7ec0108857be9f501b1af6caf3e22aad6a7f6779a090437dffe42fcd9e498259541730f50e03d1493cde23737599b2a6cdfffe831b6406a

    Download Submit

  • C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml
    Filesize

    3KB

    MD5

    afa968029549ac47b14fa98b83245f64

    SHA1

    965f0ff140852f6fc51d79036af96d0fe222c4cf

    SHA256

    1194a6e34532de3659fc92e0badb87000362073efe95473efb0c60fb066bdd64

    SHA512

    4ee98d275a9ee4da3c188521997fd07c5d2e43947535655d6d0d408e3a77a92f2acaa0372c023fe0b707d23a8060a748b5fb3e6556220f40682ab982294d2612

    Download Submit

  • C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml
    Filesize

    3KB

    MD5

    9d7039357a9e8a8cae1cb2cb641228a3

    SHA1

    42e3497b93ebc5fd5a5d129f4313dd038e351e32

    SHA256

    90e027f942edecbf36fd8213bb3b7239babade85f5c0b3711d128413af059d96

    SHA512

    51c362c55be01cd8fb26814faae414a7602e7f32bbd7ff3ab1246eef00d25374c33b011d050e3e70a051882528730d7bdcadd9dfba961f85a7601a0352a8b5ea

    Download Submit

  • C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml
    Filesize

    3KB

    MD5

    71d676d78d56ccf902648fe35ac8812a

    SHA1

    bed07aa9ef6b8ca9148154b2129b4e52edd34526

    SHA256

    4f39c591477308791f5e5ec2933290b7bb3ea4434177983a38f9b783fee21e1b

    SHA512

    6f785b7db14657f8d9b149d7699e022b9254cef8af66c5de0021ada59d5cd81c9367fabc3b78989f7c955602599f84e8c9498c459d1acb569799c52519df8877

    Download Submit

  • C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\gnh4gpjl.newcfg
    Filesize

    535B

    MD5

    e187e9c2522ffaa68d4a7eb7aadc2932

    SHA1

    7df9ecf518ff31918936e154df67633a42f4de60

    SHA256

    8a9053399b418fa91c21a42777a52bd344961f79ee75ea6a7ad1b7edd7e214b3

    SHA512

    b29a6080237477366c176f1516a2471a50c058fa1525d5bb33576a06f92d5177bf8f04846b5de45112d6090c4d59222287480f0255c3f1609b7416564a5d5129

    Download Submit

  • C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\iiowqqm4.newcfg
    Filesize

    600B

    MD5

    c10e6db7760dc1d917c9212e6ad21aef

    SHA1

    60cf5a0e3dedd343a07160920fd3d3d92b6429b4

    SHA256

    7db2698ee8eae380b4e1fe518d94218a986c8f2c0f60ea32267503d5d7f0e723

    SHA512

    dbd82d8357a40547bcb2d5a49bde797e98746497c9f8ba8ec728698d1ede896929e72602d0c49f0c50c8d6c0c0c75467a97cef4d60774b265e3054446450f5e7

    Download Submit

  • C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\user.config
    Filesize

    471B

    MD5

    37a136c3a857169dd68c9173177cadbc

    SHA1

    9aa71d6c034eb9080af3a372db0bfa6ebc226d25

    SHA256

    e345c334be1fd3491acd03cd8c734b87cba038714cf83af3d801acc5df13bb4c

    SHA512

    9c39e8a1b0939b3e46b5ad9a0968d2676f9d5be0e569e4bc0829fd258f812062c0ee8a9214c73435b2b4065a9bade3f81da72fd62c34bb71d56867bb60f67ed4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Installer.exe
    Filesize

    10.2MB

    MD5

    564e47a3604ced3b7c18e43250226cd7

    SHA1

    a3eef8fac3617d048fb9fce2201937297e3920f1

    SHA256

    12ae00fe728b441221acd10483eeb1197884738e9bd6eb715ceadeea058c6c83

    SHA512

    e925e2a5b60c7257ac6b57b3fc12675d2cc490070c456a8e794f54c6732cc34981c0d88a5acfb2214fd316194f24eae83e8151cfab101daa2f1b59f2d621cdbf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RESB9FA.tmp
    Filesize

    1KB

    MD5

    cab474d7b2544769233d7ff71db51d3d

    SHA1

    d3ac16e9d47f2e9e93e0242d089edc4f7a7fb44a

    SHA256

    0e6bb6ab546b2a4303fb381b9e1538ec7553cdec612c13fa6e93feef964329a6

    SHA512

    8bdaa3edde3645e45715ca821bfcd3aab6f977face1de046ae25692bcd852ebfcefc84d3302607f446837ce1c0941eacc3d5ea8429986a9c979aea2c025f7394

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsp9386.tmp\Ping.dll
    Filesize

    64KB

    MD5

    b0e9ba9dab60cb7a9fd886dcf440cac3

    SHA1

    c416f6e9ba379feb9008c775d8456514444b66da

    SHA256

    52d52e5a1e1cec3e2db08555a8b2651f636cf76c6a24e32aa446595365cf193f

    SHA512

    90de38a7c57f59e8deb17c2473a215e2f052aee909a47ef37a88fefcfaeb5e6b54d462a39bcac4d0f1aa88d1806ba9e1237d0eeba98f7a0479bd6825e841f043

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsp9386.tmp\Registry.dll
    Filesize

    24KB

    MD5

    2b7007ed0262ca02ef69d8990815cbeb

    SHA1

    2eabe4f755213666dbbbde024a5235ddde02b47f

    SHA256

    0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

    SHA512

    aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\smartbar\GuidCreator.dll
    Filesize

    7KB

    MD5

    4876414d51fe01bd8525df2f8acd35d6

    SHA1

    f9435c39e3029276e71a971e48f68d3f0298fe11

    SHA256

    4bda5a964065b918ce70a27914056b17a95e3f8002028b394ecf8ff2d7cebf3d

    SHA512

    d18afa3d806fd056836beb5a0822156402afe3455567d41f9b27d578980d5ae341273cadf5dff3175a799e791822e07eede03e3c0c143604f980f7876cd2fc0a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\smartbar\HistoryWrapperService.dll
    Filesize

    383KB

    MD5

    3cf46bae7e872a661721b0894bc076e2

    SHA1

    eaaa0a35e284908dd21cf245a38efe9d2e4c7532

    SHA256

    7ca73cfb8d0502b14b657216b8735394cbd08aa8e4266fb9e86ad84ae159b043

    SHA512

    47065a1cb81b41cab7c98488609470b308c708ba73c0e11c3f06901fde008b280f3b75ee825c12e4681aefbd8a43840e0319b43bbab7fe68b24c30926d0ce9f2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\smartbar\Installer.msi
    Filesize

    9.1MB

    MD5

    e5314db579a141f6a5204f70e7073de0

    SHA1

    3d2e28be7594fd754213e3ea19b4f900f6634c91

    SHA256

    84263b76687ff69f306579fb3f05f3a0528db029cf0f2f60eddc22549545408d

    SHA512

    f18c446d8e388759c12527ca970dea3c24af954d199c39027eae4ad8c97df7c902f24845ab0ee0ffd9ad9ee6768c43169b11fec47bd3246cd2e9c7e8da44993a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbkklkzk.dll
    Filesize

    72KB

    MD5

    3b29bc3478b5e453cb292f23c7eaaee3

    SHA1

    c4860b3270124c6db77f1f1232e8da768ef6adbc

    SHA256

    20d9a238fd65d5584f699882f38af447438e95bca95b1972042508c7a3ec6d13

    SHA512

    b1d16404018e825ca54a6c4201d6c89d82f8520d2352aa740658faa66c20958a299ce81474e519e321e383690951563aec937adc75fdf2e56ebd91d5849f49fe

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
    Filesize

    2KB

    MD5

    7987cd786f2ba1ec8a09b2ce8ae694c9

    SHA1

    c1b9dbb86c8e9c55374a130d8dbe7bb9cd119f96

    SHA256

    eb6583b8007410a1a162d2140c5c27a9d066d80b27b72d0e11c410d517c18d83

    SHA512

    3941b73f09e2fe5f0e6401bc23822577c8d86266ec0089032fe2fd2555616e8be7a3985308bbd64049b8a73737d9f12e3c9d4482a961b8f964de1fff417d32cb

    Download Submit

  • C:\Windows\Installer\MSIB565.tmp
    Filesize

    1.5MB

    MD5

    44c66c7febaf067ac2f96e3bb643a5b3

    SHA1

    bc83eb57ebb44206b467c4147a7f82d52662e9b5

    SHA256

    641fae557b683029787befda2a2ed5251b19a4c11fc19e3dbf2cd97459e7e383

    SHA512

    41ce527bd09ae6b3126947197c94169121dcffe79b9db624a17a3a45d4e25a2f53dde0a686b4329b9e2d5c33bbbc6d6b9cc840b97731eac38ae31254dfd3364b

    Download Submit

  • C:\Windows\Installer\MSIB565.tmp-\Microsoft.Deployment.WindowsInstaller.dll
    Filesize

    172KB

    MD5

    34d4a23cab5f23c300e965aa56ad3843

    SHA1

    68c62a2834f9d8c59ff395ec4ef405678d564ade

    SHA256

    27cf8a37f749692ab4c7a834f14b52a6e0b92102e34b85ffcb2c4ee323df6b9c

    SHA512

    7853f1bc1e40c67808da736e30011b3f8a5c19ddf4c6e29b3e0eb458bea2e056fe0b12023ceac7145c948a6635395e466e47bdd6f0cfa1bd7f6a840e31e4694c

    Download Submit

  • C:\Windows\Installer\MSIB565.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll
    Filesize

    77KB

    MD5

    7868ed46c34a1b36bea10560f453598f

    SHA1

    72330dac6f8aed0b8fde9d7f58f04192a0303d6b

    SHA256

    5c17864f1572acec1f93cf6355cfd362c1e96236dcba790234985a3f108d8176

    SHA512

    0cc913337e3334ff0653bc1fad044d9df60a8728c233dcc2c7f6139f14608740b70b57c25a9d2d895cbc4d59508779f342a72406e623d30365ae89fb2a3607ba

    Download Submit

  • C:\Windows\Installer\MSIB565.tmp-\Smartbar.Infrastructure.Utilities.dll
    Filesize

    140KB

    MD5

    562ac9921d990126990c2f0bdce7081a

    SHA1

    f395458d8e328cf4809385fef3e225d01f8a8fc0

    SHA256

    ef84e1ad9cf174a9ab0bba648b56f2ffd17f4cb4421902b61559b544d812e738

    SHA512

    f52a9a62ca7d810804289ffe0300919eea529f2e0d4d07709309e101087809a5a004437184f3a3518fcd286db18947d78ce00bafbcbbe7b62a8aca4cf8295208

    Download Submit

  • C:\Windows\Installer\MSIB565.tmp-\Smartbar.Installer.CustomActions.dll
    Filesize

    162KB

    MD5

    2120dbb0481374885af660346f503b9b

    SHA1

    0dad9f77c93325cbe2499efac70ebbbfd8e1a4b3

    SHA256

    ef0e1d3a5f58e797c47d1ca2999e6ab1e94520c3816a8264874920c26c9ae474

    SHA512

    46966d2eec899fbd48b8aaf5e72555cec3b2f1bc2481c2eb014d98078aa6b6e825144718fbe2aa7b23d816462645186abbfc2ebdc7a4f331d5087999f21ca68a

    Download Submit

  • C:\Windows\Installer\MSIB565.tmp-\Smartbar.Personalization.Common.dll
    Filesize

    10KB

    MD5

    347b0b5d32b1a85b5450b08cfb6d2e75

    SHA1

    7bfe1857974a6c6c3e882624d820311c1e3bf670

    SHA256

    76a9f22039731c1fb3871876dd8c55d4ab75635367daa811ced5ed70eed950ac

    SHA512

    d79edc2546249f71a19faa1ee4aebdfd2faa8b6b56615740c93023255c81716de6c4af484bde506f7dcd80b607d8804313589e58b05dd2448d5c1fca3cd39e92

    Download Submit

  • C:\Windows\Installer\MSIB565.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.XmlSerializers.dll
    Filesize

    88KB

    MD5

    adb53ee43f74f430368449b98b2f6f86

    SHA1

    fb882d80da9ccf79c6817a492fbd686d4759bb41

    SHA256

    b7837a68ede7781286057de0b59b7bb9c7c29ff9e9ded32c7175cafe9de3b5ff

    SHA512

    8fc2cd5a585c8247274fbe8d53ac27faa1f2b0407d27e5e78d6917cfa94947ace2aa20ca670a5b87e3d7a939360691102ed9c7530ec997af1057064bcb9c085a

    Download Submit

  • C:\Windows\Installer\MSIB565.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.dll
    Filesize

    102KB

    MD5

    5dc8a7062040e05ad36bd83246954b05

    SHA1

    f6807be0413724076c8c384576ad9a5bc1413e8c

    SHA256

    d00f229036a6ea19e05c9838f2827fdb22b3003af4c7c97b37abf2ea36236dfc

    SHA512

    43cda9b7a57ae292b71df7a8f02c359b486a82162f92e2d8a7449f2b9c835a7ba44177477a7e0763a5698a4b2d9a025f8786c054950db3fab017edfdf4c17f12

    Download Submit

  • C:\Windows\Installer\MSIB565.tmp-\sppsm.dll
    Filesize

    40KB

    MD5

    787104ad9dea702d115883c489be54cb

    SHA1

    b24680d170c610203df5e3d1d52b2b04f938dd56

    SHA256

    934230fc9da4c6eac4b1f916baec075ac5faf1a70af14dcdb62d3d06ca878cd3

    SHA512

    861147b8ed484a25a5ca9af8b7488896ee41dfd4eb57dafd4bb33455b03936c8fd930224fd9a1a0e8dcddf0fc33bc7adfc3ac48ca3ff430122f3ce18952fe312

    Download Submit

  • C:\Windows\Installer\MSIB565.tmp-\spusm.dll
    Filesize

    10KB

    MD5

    e28c8d2fd64ba27d9b992fc325f26a9d

    SHA1

    d9ed413265967b6ede8787aa8c5e5734a4ea1358

    SHA256

    82d96714ac65e6e18e3da619cfd1367416bba5ed6d08db7bf312f8937f95f2ab

    SHA512

    e2fcc5972c48fa1d26d2df0b2c5ed4e34d15d7f08eb35510989441b4083f30d19f6d5fc2652ac42d11a3877f333ad4408c0cb547ecf7b948e1f324f719cfc739

    Download Submit

  • C:\Windows\Installer\MSIB565.tmp-\srbhu.dll
    Filesize

    7KB

    MD5

    fcbe6dec3d2da2ac9fd2754cc9cf6ad9

    SHA1

    7954bdf16f99bf843c5c8053a078813d87c94254

    SHA256

    71688a7955124b644cb05833d8285b876c7ff336eb4478ce01e1f80b07f7b76e

    SHA512

    5975297ac6aaa7d85842079809f9be2ad57959da2687de4bb7aa0764bc16dd878c482a92d7c4a4ed484aa7683f60c90b870757165f79d7ae481b7f7897e94c39

    Download Submit

  • C:\Windows\Installer\MSIB565.tmp-\srbs.dll
    Filesize

    174KB

    MD5

    7ec601a05f97c73fc2180e8c57efc9af

    SHA1

    7c99dcdcec211459b1d9d429e2ada2839876f492

    SHA256

    982d12314935e25a016da0bec644bc4c8bd02b0984eb70b76e081b3562a6adf8

    SHA512

    119e216313540f0fac30c1a8e531909dbdc8022735a9fb73b80c8bbbb2ff0548cdf911e640cd19827acff703c95b1d8db0ddf3ed61d056e9e4d4f437b8c88e7b

    Download Submit

  • C:\Windows\Installer\MSIB565.tmp-\srut.dll
    Filesize

    22KB

    MD5

    feba43763a9b7fe1c94d681055d10167

    SHA1

    49d30dedf868accf07e6895e1699a4d751235fd0

    SHA256

    0634fa964eba9baed92e2a935aef925fdaa921a35424b6ae9bfaaace932dc49d

    SHA512

    680116cfe66472c4d6ae9c94d74cd3fe8cef1c9beade27c19e58369c2c6f238f9e63019d7ea2b8b35689b7c0e812f2ee49d26a56e6972d3e21dc5f7312cf81ef

    Download Submit

  • C:\Windows\Installer\MSIC313.tmp-\CustomAction.config
    Filesize

    806B

    MD5

    796621b6895449a5f70ca6b78e62f318

    SHA1

    2423c3e71fe5fa55fd71c00ae4e42063f4476bca

    SHA256

    09be5df7a85545fd93d9fd3cd1d6c04c6bfe6e233c68da6f81c49e7a35fcbb84

    SHA512

    081cf1dadb3a0e50f0a31ab03e2b08e80298c06070cd6f9b2806c08d400c07134623f7229a6c99910c6243dfa53c6e2c05d09a497aae1e701bc34b660cf9e4c9

    Download Submit

  • C:\Windows\Installer\MSID4A8.tmp-\Interop.NetFwTypeLib.dll
    Filesize

    32KB

    MD5

    a084b0c082ec6c9525336b131aeba39a

    SHA1

    45db1f5cc54a033e5df460b93edaa5d23a39ced9

    SHA256

    7cba99a0f2a5b233e341f691c2aa6cb4ca10065425fc478b56fa468d6b0af54d

    SHA512

    297ba29e1ee4300f1a11620d475e67a9747fd9affabeee5fb5151b07c931c8f5c5af12b956e2ab7bd7dc6ebb1dbc298f5d56fa419f5fe2e3646053c0e515e29b

    Download Submit

  • C:\Windows\Installer\MSID4A8.tmp-\Newtonsoft.Json.dll
    Filesize

    418KB

    MD5

    0e32f5229d5ee7d288b6b3969a51fcbc

    SHA1

    54c09f07930525786fcf08b9c7aca24185a68fc1

    SHA256

    e1ca33208030c858254249b2c9aa6d8541c2e875343b2997f2b2f9e4993c96f8

    SHA512

    64e8499e668ea44397ed5ea009e3692b623d2ac01bdd43e460624fe0282a3398025e4e53282e0f0905062b60400f4c16a64933ed7667de942f1588dd936aebcb

    Download Submit

  • C:\Windows\Installer\MSID4A8.tmp-\srprl.dll
    Filesize

    56KB

    MD5

    d8fa7df1f2cd92ad701bc23f86d89b54

    SHA1

    72160fd5ad639c5a9c44305b06c98eb637399d18

    SHA256

    475a2c225258c571ae66c0178a83177bd5a59f4ce1be1f867e14e75614ad43e4

    SHA512

    a4d11c7f66325199f5c3a41cc37f32cf6ee828d790add1a6b77b9127e65243bb17dcc10b1cb2cbaac4e543bc329bd30e64919ffc0af3fd6088a672e08e10e992

    Download Submit

  • C:\Windows\Installer\MSID4A8.tmp-\srsl.dll
    Filesize

    21KB

    MD5

    6fc50184e3aad7f4df0231da697a9da8

    SHA1

    fef8608d31e8e1c16ca7db402fa352ee7231585b

    SHA256

    58e698c208cd6ad94d2da3511447a975605e2b49bbdb7b572863f318aaffe0cf

    SHA512

    626b0a4031571ca906311937583f646aebdc7aacd5afb5ddf66c2d45dbc335e026d337d4f5803c38ddd022b9e64c79b4dd30d094d5d01a669e99d6c6829650b4

    Download Submit

  • C:\Windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll
    Filesize

    116KB

    MD5

    459ff9c6762b7fdd91c156ff3e096478

    SHA1

    7179debce9a271450b1241e7435a999aea1ddd05

    SHA256

    93865c89e1507409fbbeb9433542a303cdd2fd5acda3d51fecd83e4a8fb8072c

    SHA512

    8b95330d364413122427604af1c0e848694975eb8c541b911aeb0d50fbb5cd15a60863f68593f1088b26f83500f400f52292a2891511223f796be750c6a7583a

    Download Submit

  • C:\Windows\assembly\tmp\QNJHDCPF\Interop.SHDocVw.dll
    Filesize

    143KB

    MD5

    030a99f9594434ea83d27b33a95c4d5a

    SHA1

    230882058a1d50e4e8f7fa4bb3144dec506c5967

    SHA256

    0fdc72a06cc54771f1b07293d2e914cded985d84833ed4bf952a665eb107b5a3

    SHA512

    529d14374df0b455db055027f42ccf731ddf4b7bef8fc27bffa2ff5a46463dc6b3cacf75fd6356e325f075d7fb70ad0f8abd85feb75d00befd1c86aec857d7ee

    Download Submit

  • C:\Windows\assembly\tmp\TZ1UP2ZH\System.Data.SQLite.dll
    Filesize

    889KB

    MD5

    c2e38bfe933c5bce36910fe1fb1d5067

    SHA1

    aac5ed2724e2f88c7af1a3bf56d73180ae709bb7

    SHA256

    49a51063aaccc22a28590575417bdff40a67a06e6f2a67217b37af1b49fa6286

    SHA512

    281225b5e7193270b27811224c70475fc9af47c5d05a7e98f6856ad6abccff084302d0ddb72868d6872eef2efaf2989645af5e596083bfb995f214182aa4184d

    Download Submit

  • \??\c:\Users\Admin\AppData\Local\Temp\CSCB9F9.tmp
    Filesize

    652B

    MD5

    aa029e74416c9d33c0a1ad742878ae8b

    SHA1

    a91595e219c8cf7ba6d8db182749518ac9500425

    SHA256

    38bc53d9e38ffd6b13155ab5b345fef2a84354ea7950587f3667657a977cb0e8

    SHA512

    08d95cbb952a3b9cdf598d994b993b24e198933221b0a09915a596fb222031e2b34a81a79235f1d83d67e8ce156a97048a484fbc9592a650f55e284c5a8e146a

    Download Submit

  • \??\c:\Users\Admin\AppData\Local\Temp\vbkklkzk.0.cs
    Filesize

    150KB

    MD5

    6f8e0c3c3b1b9a297b8ee6bfbb9c2a2c

    SHA1

    1dbab29ad6fb169fad90e963dd0c5290f27272fc

    SHA256

    e0514048fd6f4169c41896332a243cf014a719e5fe217c5743fc3c7149db578a

    SHA512

    193fc4f01b6afb2a858f006eb7c5dfd6106d88b0b0e0f12b4c8c103a8bae270ff0d583886ec5af910ce4d50cb1ccfb54a14d27fd517b847a624d9ba79f688640

    Download Submit

  • \??\c:\Users\Admin\AppData\Local\Temp\vbkklkzk.cmdline
    Filesize

    396B

    MD5

    4731e3af14c6e8a4c005b5be60adb176

    SHA1

    076d8242c2ff0312001b5f1a83c8e0b1991985b2

    SHA256

    e1cccf209e7b89d6cfd7a4c5a449447721a4186975400b5a568d6b9ff08c9590

    SHA512

    96b2d21608b08920691f3f1ad4c2499564dcc42731d984ee4a9232fe1c897489a53e2f48e31e0960dcc951498c2b239bd5c78432a65fb2c7e54f7cf26c421ad7

    Download Submit

  • \??\c:\Users\Admin\AppData\Local\Temp\x3u9v7r5.cmdline
    Filesize

    614B

    MD5

    2285a0772a117aee2abde155b9bb6310

    SHA1

    5b0a1f16c01b3a43ecd7cf3f6119e49175694394

    SHA256

    53e8da4458144dd4e0a7fc7386dd7a37105e45514f0ebdd3f935d0b2e47f4b7b

    SHA512

    37cba6b2eca9efe70e1e32ddd533b19e54d55f09ea27e50733672d1c04fa51d2f92d3d37d7ecf892af1dc3b765cc312d939acec035aeecefbca6d9b04ca23627

    Download Submit

  • memory/1312-1431-0x000000001CD30000-0x000000001CD56000-memory.dmp

    Filesize

    152KB

    Download

  • memory/1436-1422-0x000000001D7D0000-0x000000001DF76000-memory.dmp

    Filesize

    7.6MB

    Download

  • memory/1436-1423-0x000000001DF80000-0x000000001E726000-memory.dmp

    Filesize

    7.6MB

    Download

  • memory/3448-1237-0x0000000000710000-0x00000000007F3000-memory.dmp

    Filesize

    908KB

    Download

  • memory/3448-1113-0x000001F69C210000-0x000001F69C236000-memory.dmp

    Filesize

    152KB

    Download

  • memory/3448-1140-0x000001F69C240000-0x000001F69C260000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3472-32-0x0000000073C90000-0x0000000074241000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3472-215-0x0000000073C90000-0x0000000074241000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3472-184-0x0000000073C92000-0x0000000073C93000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3472-61-0x0000000003250000-0x0000000003260000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3472-1917-0x0000000073C90000-0x0000000074241000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3472-28-0x0000000073C92000-0x0000000073C93000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3472-27-0x0000000003250000-0x0000000003260000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4724-1396-0x000000001D260000-0x000000001D278000-memory.dmp

    Filesize

    96KB

    Download

  • memory/4724-1404-0x000000001F8C0000-0x000000001FD8E000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/4724-1405-0x000000001E490000-0x000000001E52C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/5052-1414-0x000000001CBF0000-0x000000001CC16000-memory.dmp

    Filesize

    152KB

    Download