Overview

overview

10

Static

static

10

202dcd0657...dN.exe

windows7-x64

10

202dcd0657...dN.exe

windows10-2004-x64

10

$PLUGINSDIR/Ping.dll

windows7-x64

3

$PLUGINSDIR/Ping.dll

windows10-2004-x64

3

$PLUGINSDI...ry.dll

windows7-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

Installer.exe

windows7-x64

8

Installer.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2024 04:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe

  • Size

    8.8MB

  • MD5

    aea459bd4a96c0440c4435bfe39aaf40

  • SHA1

    4bddc9c5e363f94a71610c5720ab188593be11d1

  • SHA256

    202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410ad

  • SHA512

    7a6a144118bbea7835e035e6bd0d3a87363dd92f2186ba9911eb41d2e0a45530757a9c8348e8171027eb90814497da49b225b7a9a606d3bb2872d53086ae4f19

  • SSDEEP

    196608:T1oRCm5gjvpKv1gJzwgs/vvZNijq97g00QCOsNjz0uHFtdMaKDk:T1oRCIg1Kvozwl/73vYrWaKI

Score
10/10
pandastealeradwarediscoveryevasionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Panda Stealer payload 1 IoCs
  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer
  • Pandastealer family
    pandastealer
  • Blocklisted process makes network request 12 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe
    "C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1496
    • C:\Users\Admin\AppData\Local\Temp\Installer.exe
      C:\Users\Admin\AppData\Local\Temp\Installer.exe /quiet ARGS=HP:1;DS:1;NT:1;DOWNLOADPROVIDER:ShoppingHelper;PUBLISHER:ShoppingHelper;ROT:ALL;ROSP:1;CSH:1;SHOW_UNINSTALL:1;VISIBLE_IN:FF,IE
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4816
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /F /IM msiexec.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3300
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\smartbar\Installer.msi /quiet /quiet ARGS=HP:1;DS:1;NT:1;DOWNLOADPROVIDER:ShoppingHelper;PUBLISHER:ShoppingHelper;ROT:ALL;ROSP:1;CSH:1;SHOW_UNINSTALL:1;VISIBLE_IN:FF,IE;INSTALLATION_ID:5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3696
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D9057301560173116C9A8254200335D0
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI94AE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240620781 2 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationStart
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4404
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1h3yx8st.cmdline"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1568
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9943.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9942.tmp"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2528
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wph_5oi6.cmdline"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4408
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B76.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9B75.tmp"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3204
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI9F11.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240623390 6 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationRemoveFiles
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2220
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIBF1D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240631625 73 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationComplete
        3⤵
        • Blocklisted process makes network request
        • Checks computer location settings
        • Checks whether UAC is enabled
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1416
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ieog8ci3.cmdline"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4724
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1F9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC1F8.tmp"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2952
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z39_zsf4.cmdline"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4820
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2E3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC2E2.tmp"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5096
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:3580
        • C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
          "C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"
          4⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:3000
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"
          4⤵
          • Installs/modifies Browser Helper Object
          • System Location Discovery: System Language Discovery
          PID:684
        • C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
          "C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"
          4⤵
          • Installs/modifies Browser Helper Object
          PID:4508
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Microsoft.mshtml.dll"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3104
        • C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
          "C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Microsoft.mshtml.dll"
          4⤵
          • Modifies registry class
          PID:2792
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3448
        • C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
          "C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll"
          4⤵
            PID:1516
          • C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe
            "C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe"
            4⤵
            • Executes dropped EXE
            • Drops desktop.ini file(s)
            • Enumerates connected drives
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            PID:2640
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ds4mcpmp.cmdline"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1272
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7CE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF7BE.tmp"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:712
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jcmgfmf8.cmdline"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2108
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF8F7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF8F6.tmp"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2084
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uk-yekej.cmdline"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4368
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF9F1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF9F0.tmp"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1032
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y041cerb.cmdline"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3740
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFAAD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFAAC.tmp"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4376
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\apdaahsq.cmdline"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3588
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFBB6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFBB5.tmp"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:5092
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ujkqdd9e.cmdline"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4700
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD4D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFD4C.tmp"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4728
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8y6h4hxg.cmdline"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2816
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE37.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFE36.tmp"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2500
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ouyrq4d8.cmdline"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4944
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF8F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFF8E.tmp"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1608
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oi6dmwls.cmdline"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2452
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES106.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC105.tmp"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1032
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4afc7wb1.cmdline"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1728
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                6⤵
                  PID:5092
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3F3.tmp"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3568
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rzrhjalh.cmdline"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2092
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES694.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC693.tmp"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:4504
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xghfualj.cmdline"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:632
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  6⤵
                    PID:2452
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAAA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAA9.tmp"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:392
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=sc&installDate=02/12/2024
                4⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:1860
                • C:\Program Files\Internet Explorer\IEXPLORE.EXE
                  "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=sc&installDate=02/12/2024
                  5⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Modifies Internet Explorer settings
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  PID:832
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:17410 /prefetch:2
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies Internet Explorer settings
                    • Suspicious use of SetWindowsHookEx
                    PID:2964
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7ywxroil.cmdline"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2924
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF425.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF424.tmp"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2844

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Browser Extensions

        1
        T1176

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Defense Evasion

        Modify Registry

        5
        T1112

        Subvert Trust Controls

        1
        T1553

        Install Root Certificate

        1
        T1553.004

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        3
        T1012

        System Information Discovery

        4
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Config.Msi\e578fb0.rbs
          Filesize

          144KB

          MD5

          7084d0951ff09edbfed4971169d50f7b

          SHA1

          0901128edac9e3ca6322292f66ec46d1c16d9ffd

          SHA256

          aa89f118175d6491d1a622126dd5a923384aa3180b77fdbacbaeb64c0f9f5ba4

          SHA512

          929ae21104aeed2b29e5f596df1daca9ac3562ed922f982ffd9f5e5aa0ff03913b8e2f77cacde05e563fa15afdb42b0280457de48af123f9d23c9a29e6195bde

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0
          Filesize

          5B

          MD5

          5bfa51f3a417b98e7443eca90fc94703

          SHA1

          8c015d80b8a23f780bdd215dc842b0f5551f63bd

          SHA256

          bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

          SHA512

          4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0
          Filesize

          398B

          MD5

          ab5f4265a14a6f04db3ec3bc2d7fcc58

          SHA1

          b5c4d0a3ae7b2cdb9806b7db7e5aab35a0edef2a

          SHA256

          fb2f3a255ebaa3c693c89222117e4e6cd38df81db35f7e4ab2eb718acbaf818b

          SHA512

          a859cecf985616c20fcdf7f5619fb9e3ad8cf2697ce13fc4524fa730f6599eccba5347889ce91a41d0847ae1d5775d678e4dd1b3ecc56d9258dd992cb7223fec

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
          Filesize

          9KB

          MD5

          7050d5ae8acfbe560fa11073fef8185d

          SHA1

          5bc38e77ff06785fe0aec5a345c4ccd15752560e

          SHA256

          cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

          SHA512

          a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YB8IB6GH\suggestions[1].en-US
          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          Download Submit

        • C:\Users\Admin\AppData\Local\Smartbar\Application\jxbwpzxd.newcfg
          Filesize

          12KB

          MD5

          ec3f05ac2148162ddb052f23299b8ecb

          SHA1

          6ce68e94fb7df83ae34094a85abfefce8a3b8d79

          SHA256

          449ab9dae5f16f9dc9e70e37930aeb4c78e057debbb8fe25fb5460a9666ec016

          SHA512

          d166cb06e095281a4a26bdb78e7752d8f9d0e408aa3048eea2294222aa0b7e901364ba377cfc353ada392693b15736c96267697dcabc745f2e4b3d539599b70a

          Download Submit

        • C:\Users\Admin\AppData\Local\Smartbar\Common\icons\30DFF8F0-BA79-4360-A3EA-51B6D006133CPress.png
          Filesize

          4KB

          MD5

          5719ee7f6521ae142f0557f0706cded1

          SHA1

          a1d5694197827967aea5b3ccc88e2f91d465c283

          SHA256

          0a2ae8f3e9aa552748cfeadaec055778487602e7f6d4a6c2a221fe1fd496bfaf

          SHA512

          cde76dada9e798a746d7ae23ee189940a6b7660805267a9221501c5c911a89b298005f111622fae7c886e810e23f83b77d47fa75793d19441246eb775a2f2bf6

          Download Submit

        • C:\Users\Admin\AppData\Local\Smartbar\Common\icons\3C610B86-19DE-4757-B46A-871C9C27FF0APress.png
          Filesize

          4KB

          MD5

          2768222689e3585d609b5a2afc1ba52c

          SHA1

          ee522df6b2e365857bf6be58ac7150cbc71cfc9c

          SHA256

          21ee471e79b0a646735e132bc1f0c48f464677127b105426e00b160a554de6b0

          SHA512

          56527749dca471af92eb4166b2bb6f1ca4cbf07c8d7e1a201378467f1d08efe5fd913715bb995d35c7d511b2cbdc9469d79baae7ee4bab619e4e11753c3505e4

          Download Submit

        • C:\Users\Admin\AppData\Local\Smartbar\Common\icons\B1BEF453-913F-4EC4-B057-A2BB21C09DCBpress.png
          Filesize

          4KB

          MD5

          e6ab030a2d47b1306ad071cb3e011c1d

          SHA1

          ed5f9a6503c39832e8b1339d5b16464c5d5a3f03

          SHA256

          054e94c94e34cef7c2fad7a0f3129c4666d07f439bfec39523dca7441a49bd7c

          SHA512

          4cbb002cc2d593bafd2e804cb6f1379187a9cae7d6cc45068fda6d178746420cc90bcd72ba40fc5b8b744170e64df2b296f2a45c8640819aa8b3c775e6120163

          Download Submit

        • C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml
          Filesize

          3KB

          MD5

          9da01afb28f32f4e3e8c599517af60ea

          SHA1

          c4f975d163f1748af8e262f229b3d894d8bb33b6

          SHA256

          ff7d87103ddd5770bde09c509ddffc23aaceb6239b616b5389a59ce07a99bc8d

          SHA512

          a86d91562225e8a704331f2cf85cf814eeac81dcdb49e4c6e49733cb45b748d28a8e3d28a55ab13fa24324ef976166ba13f9a709d59ef56f8317c335fee93818

          Download Submit

        • C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml
          Filesize

          3KB

          MD5

          45fcd9971da1484b35627e861674f5ac

          SHA1

          68d87f0466399a3c17c3d38e67204ef7c43193b8

          SHA256

          7924bc277ba0b569a71383e55d5ca9dccdec03352cc93441871f25794ae16fdb

          SHA512

          cd5d645f1498b61a3c5423a45b31046380f5086f265f945be15605fc85c5754542f14be7c1cbf677974d420e260c8cfe8468a91360e1530b4fd0208d2725c048

          Download Submit

        • C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml
          Filesize

          3KB

          MD5

          c8593992a34d9ad32891402362e3aafb

          SHA1

          60bb3638457495a0b446a35890f7eb2dbb31bc73

          SHA256

          b05e96da6973d7c5b445d48e215617cfb7d213c568f43b3883250458f7c461de

          SHA512

          71bfd98bddb2c007cf68e0ea9333d8197a2b9bfb3c133963fbe9abce14fcf45d2ae15cfcb711524c95b92b4699d37aa92066608eb43b7429a0222f75ebd72aba

          Download Submit

        • C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml
          Filesize

          3KB

          MD5

          aabb4aa2e705c3afd5511be396907aea

          SHA1

          f8765ecc6b536503b28ce2812521718225b8a3bb

          SHA256

          8959cb8bea98199cf1accd341d92be7cee6bc5b16d9311e4b029405ff6e4d225

          SHA512

          f86c9810fe67f13c4cb4105233c21e89bb728070a0436b4d59ca268d9041a0b07e4a30e7cdbc0d83a9239911c5cf792db30d2a41a3840fb191c2cf9d01834e97

          Download Submit

        • C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\6oifwxuq.newcfg
          Filesize

          600B

          MD5

          cf688451f76998a0b64a3186bc7b5d24

          SHA1

          00cb59cc83e0ef90c149a5f88d4d1f78cdf0b4f5

          SHA256

          3c37e2bcd519ec968c23aaec9f26fc8307ba0b0868815362ede77bf5808b61c9

          SHA512

          25e287a3ab86a768733d1006d8e73d3e661bcaf448e7696549bacf4576c834723067b7ede2a4a00c531cc1cc5ae99cef45138c6a6d097af737815c70c5d83f1d

          Download Submit

        • C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\user.config
          Filesize

          471B

          MD5

          be5aa2d35be2e095aad44b9a33ab0b6e

          SHA1

          0e7b69f233e3955fa267de2dc01a982836b51c39

          SHA256

          3ff9ac017a89229a9d5675015d7fa73d7df4d3c0ce269c147d738be6759d1563

          SHA512

          681850479644bdb20fdee8d2ece7342fa08505c51d3888fe424916532755046d891bc95e4fc01f22ab38aa0d0bc94b020ad2c70a0413f8e98caac8f332356d45

          Download Submit

        • C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\yzcahma6.newcfg
          Filesize

          535B

          MD5

          f5dd6d6495416d24c3036082119d7a60

          SHA1

          11511085ba8c043c64736f879a7b6a6de66e944a

          SHA256

          3ad35f87428ec051431167d3833620c4489caded46330a6c4dffdc3496a20ca0

          SHA512

          e9f7dba5a973acda94122cbbdf06ea426d52a9b019acc49dd50682819a59decc20dcca18045a1c2282bf86ea31ef66d699d813f2419fe8a453134f3689df1e52

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1h3yx8st.dll
          Filesize

          72KB

          MD5

          359438854ecbfa5626c4b516e2eeb89d

          SHA1

          d2ca5be87d62d3473ed90d26ed0c4e7e64d9ef37

          SHA256

          84160ac68a08b62c5768487383906c33ab56f63ba7d0cb872784f703997ec890

          SHA512

          32cc7220c280acf0845840bc972b324a5f44db944fa12b501af988c0c6a6d46a190768544f75c84c1f3ebf217d58541fbfe306455e3b8461fd735f38bd998156

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Installer.exe
          Filesize

          10.2MB

          MD5

          564e47a3604ced3b7c18e43250226cd7

          SHA1

          a3eef8fac3617d048fb9fce2201937297e3920f1

          SHA256

          12ae00fe728b441221acd10483eeb1197884738e9bd6eb715ceadeea058c6c83

          SHA512

          e925e2a5b60c7257ac6b57b3fc12675d2cc490070c456a8e794f54c6732cc34981c0d88a5acfb2214fd316194f24eae83e8151cfab101daa2f1b59f2d621cdbf

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\RES9943.tmp
          Filesize

          1KB

          MD5

          5eb45834abbb2ad38d388a304f73e276

          SHA1

          e54465410f161c39e4da6e03ae15df1c2bea74d5

          SHA256

          82ca5278bc2abeb4c78a362d47c7b007785927b40a2cb590fefbf0207b04f73f

          SHA512

          b2bc3aa6b3614c8e9404537c69edefbc8c05bf3344923900dd390f9eb05fd29167ca3205325a50d657a2d2d5b55ef2dcd183dffefd77de625677e3876887b530

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsz84F0.tmp\Ping.dll
          Filesize

          64KB

          MD5

          b0e9ba9dab60cb7a9fd886dcf440cac3

          SHA1

          c416f6e9ba379feb9008c775d8456514444b66da

          SHA256

          52d52e5a1e1cec3e2db08555a8b2651f636cf76c6a24e32aa446595365cf193f

          SHA512

          90de38a7c57f59e8deb17c2473a215e2f052aee909a47ef37a88fefcfaeb5e6b54d462a39bcac4d0f1aa88d1806ba9e1237d0eeba98f7a0479bd6825e841f043

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsz84F0.tmp\Registry.dll
          Filesize

          24KB

          MD5

          2b7007ed0262ca02ef69d8990815cbeb

          SHA1

          2eabe4f755213666dbbbde024a5235ddde02b47f

          SHA256

          0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

          SHA512

          aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\smartbar\GuidCreator.dll
          Filesize

          7KB

          MD5

          4876414d51fe01bd8525df2f8acd35d6

          SHA1

          f9435c39e3029276e71a971e48f68d3f0298fe11

          SHA256

          4bda5a964065b918ce70a27914056b17a95e3f8002028b394ecf8ff2d7cebf3d

          SHA512

          d18afa3d806fd056836beb5a0822156402afe3455567d41f9b27d578980d5ae341273cadf5dff3175a799e791822e07eede03e3c0c143604f980f7876cd2fc0a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\smartbar\HistoryWrapperService.dll
          Filesize

          383KB

          MD5

          3cf46bae7e872a661721b0894bc076e2

          SHA1

          eaaa0a35e284908dd21cf245a38efe9d2e4c7532

          SHA256

          7ca73cfb8d0502b14b657216b8735394cbd08aa8e4266fb9e86ad84ae159b043

          SHA512

          47065a1cb81b41cab7c98488609470b308c708ba73c0e11c3f06901fde008b280f3b75ee825c12e4681aefbd8a43840e0319b43bbab7fe68b24c30926d0ce9f2

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\smartbar\Installer.msi
          Filesize

          9.1MB

          MD5

          e5314db579a141f6a5204f70e7073de0

          SHA1

          3d2e28be7594fd754213e3ea19b4f900f6634c91

          SHA256

          84263b76687ff69f306579fb3f05f3a0528db029cf0f2f60eddc22549545408d

          SHA512

          f18c446d8e388759c12527ca970dea3c24af954d199c39027eae4ad8c97df7c902f24845ab0ee0ffd9ad9ee6768c43169b11fec47bd3246cd2e9c7e8da44993a

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
          Filesize

          2KB

          MD5

          b37582419f45771f18a224ef9c6ae70b

          SHA1

          0f299dbd4b1bd3f777e9db30b94626798537acde

          SHA256

          e1a22997c5440f4ca344eabda8e842bce31f16728d052b2205557d9048d08292

          SHA512

          61e5814c02f6e93f8baae0fd6aba852a5745ed82977deab788ef15ff8bcf3317144d15eb67804457ca900259f8d4ce30606e6af87742d03c20dbb05971f40224

          Download Submit

        • C:\Windows\Installer\MSI94AE.tmp
          Filesize

          1.5MB

          MD5

          44c66c7febaf067ac2f96e3bb643a5b3

          SHA1

          bc83eb57ebb44206b467c4147a7f82d52662e9b5

          SHA256

          641fae557b683029787befda2a2ed5251b19a4c11fc19e3dbf2cd97459e7e383

          SHA512

          41ce527bd09ae6b3126947197c94169121dcffe79b9db624a17a3a45d4e25a2f53dde0a686b4329b9e2d5c33bbbc6d6b9cc840b97731eac38ae31254dfd3364b

          Download Submit

        • C:\Windows\Installer\MSI94AE.tmp-\Microsoft.Deployment.WindowsInstaller.dll
          Filesize

          172KB

          MD5

          34d4a23cab5f23c300e965aa56ad3843

          SHA1

          68c62a2834f9d8c59ff395ec4ef405678d564ade

          SHA256

          27cf8a37f749692ab4c7a834f14b52a6e0b92102e34b85ffcb2c4ee323df6b9c

          SHA512

          7853f1bc1e40c67808da736e30011b3f8a5c19ddf4c6e29b3e0eb458bea2e056fe0b12023ceac7145c948a6635395e466e47bdd6f0cfa1bd7f6a840e31e4694c

          Download Submit

        • C:\Windows\Installer\MSI94AE.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll
          Filesize

          77KB

          MD5

          7868ed46c34a1b36bea10560f453598f

          SHA1

          72330dac6f8aed0b8fde9d7f58f04192a0303d6b

          SHA256

          5c17864f1572acec1f93cf6355cfd362c1e96236dcba790234985a3f108d8176

          SHA512

          0cc913337e3334ff0653bc1fad044d9df60a8728c233dcc2c7f6139f14608740b70b57c25a9d2d895cbc4d59508779f342a72406e623d30365ae89fb2a3607ba

          Download Submit

        • C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Infrastructure.Utilities.dll
          Filesize

          140KB

          MD5

          562ac9921d990126990c2f0bdce7081a

          SHA1

          f395458d8e328cf4809385fef3e225d01f8a8fc0

          SHA256

          ef84e1ad9cf174a9ab0bba648b56f2ffd17f4cb4421902b61559b544d812e738

          SHA512

          f52a9a62ca7d810804289ffe0300919eea529f2e0d4d07709309e101087809a5a004437184f3a3518fcd286db18947d78ce00bafbcbbe7b62a8aca4cf8295208

          Download Submit

        • C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Installer.CustomActions.dll
          Filesize

          162KB

          MD5

          2120dbb0481374885af660346f503b9b

          SHA1

          0dad9f77c93325cbe2499efac70ebbbfd8e1a4b3

          SHA256

          ef0e1d3a5f58e797c47d1ca2999e6ab1e94520c3816a8264874920c26c9ae474

          SHA512

          46966d2eec899fbd48b8aaf5e72555cec3b2f1bc2481c2eb014d98078aa6b6e825144718fbe2aa7b23d816462645186abbfc2ebdc7a4f331d5087999f21ca68a

          Download Submit

        • C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Personalization.Common.dll
          Filesize

          10KB

          MD5

          347b0b5d32b1a85b5450b08cfb6d2e75

          SHA1

          7bfe1857974a6c6c3e882624d820311c1e3bf670

          SHA256

          76a9f22039731c1fb3871876dd8c55d4ab75635367daa811ced5ed70eed950ac

          SHA512

          d79edc2546249f71a19faa1ee4aebdfd2faa8b6b56615740c93023255c81716de6c4af484bde506f7dcd80b607d8804313589e58b05dd2448d5c1fca3cd39e92

          Download Submit

        • C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.XmlSerializers.dll
          Filesize

          88KB

          MD5

          adb53ee43f74f430368449b98b2f6f86

          SHA1

          fb882d80da9ccf79c6817a492fbd686d4759bb41

          SHA256

          b7837a68ede7781286057de0b59b7bb9c7c29ff9e9ded32c7175cafe9de3b5ff

          SHA512

          8fc2cd5a585c8247274fbe8d53ac27faa1f2b0407d27e5e78d6917cfa94947ace2aa20ca670a5b87e3d7a939360691102ed9c7530ec997af1057064bcb9c085a

          Download Submit

        • C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.dll
          Filesize

          102KB

          MD5

          5dc8a7062040e05ad36bd83246954b05

          SHA1

          f6807be0413724076c8c384576ad9a5bc1413e8c

          SHA256

          d00f229036a6ea19e05c9838f2827fdb22b3003af4c7c97b37abf2ea36236dfc

          SHA512

          43cda9b7a57ae292b71df7a8f02c359b486a82162f92e2d8a7449f2b9c835a7ba44177477a7e0763a5698a4b2d9a025f8786c054950db3fab017edfdf4c17f12

          Download Submit

        • C:\Windows\Installer\MSI94AE.tmp-\sppsm.dll
          Filesize

          40KB

          MD5

          787104ad9dea702d115883c489be54cb

          SHA1

          b24680d170c610203df5e3d1d52b2b04f938dd56

          SHA256

          934230fc9da4c6eac4b1f916baec075ac5faf1a70af14dcdb62d3d06ca878cd3

          SHA512

          861147b8ed484a25a5ca9af8b7488896ee41dfd4eb57dafd4bb33455b03936c8fd930224fd9a1a0e8dcddf0fc33bc7adfc3ac48ca3ff430122f3ce18952fe312

          Download Submit

        • C:\Windows\Installer\MSI94AE.tmp-\spusm.dll
          Filesize

          10KB

          MD5

          e28c8d2fd64ba27d9b992fc325f26a9d

          SHA1

          d9ed413265967b6ede8787aa8c5e5734a4ea1358

          SHA256

          82d96714ac65e6e18e3da619cfd1367416bba5ed6d08db7bf312f8937f95f2ab

          SHA512

          e2fcc5972c48fa1d26d2df0b2c5ed4e34d15d7f08eb35510989441b4083f30d19f6d5fc2652ac42d11a3877f333ad4408c0cb547ecf7b948e1f324f719cfc739

          Download Submit

        • C:\Windows\Installer\MSI94AE.tmp-\srbhu.dll
          Filesize

          7KB

          MD5

          fcbe6dec3d2da2ac9fd2754cc9cf6ad9

          SHA1

          7954bdf16f99bf843c5c8053a078813d87c94254

          SHA256

          71688a7955124b644cb05833d8285b876c7ff336eb4478ce01e1f80b07f7b76e

          SHA512

          5975297ac6aaa7d85842079809f9be2ad57959da2687de4bb7aa0764bc16dd878c482a92d7c4a4ed484aa7683f60c90b870757165f79d7ae481b7f7897e94c39

          Download Submit

        • C:\Windows\Installer\MSI94AE.tmp-\srbs.dll
          Filesize

          174KB

          MD5

          7ec601a05f97c73fc2180e8c57efc9af

          SHA1

          7c99dcdcec211459b1d9d429e2ada2839876f492

          SHA256

          982d12314935e25a016da0bec644bc4c8bd02b0984eb70b76e081b3562a6adf8

          SHA512

          119e216313540f0fac30c1a8e531909dbdc8022735a9fb73b80c8bbbb2ff0548cdf911e640cd19827acff703c95b1d8db0ddf3ed61d056e9e4d4f437b8c88e7b

          Download Submit

        • C:\Windows\Installer\MSI94AE.tmp-\srut.dll
          Filesize

          22KB

          MD5

          feba43763a9b7fe1c94d681055d10167

          SHA1

          49d30dedf868accf07e6895e1699a4d751235fd0

          SHA256

          0634fa964eba9baed92e2a935aef925fdaa921a35424b6ae9bfaaace932dc49d

          SHA512

          680116cfe66472c4d6ae9c94d74cd3fe8cef1c9beade27c19e58369c2c6f238f9e63019d7ea2b8b35689b7c0e812f2ee49d26a56e6972d3e21dc5f7312cf81ef

          Download Submit

        • C:\Windows\Installer\MSI9F11.tmp-\CustomAction.config
          Filesize

          806B

          MD5

          796621b6895449a5f70ca6b78e62f318

          SHA1

          2423c3e71fe5fa55fd71c00ae4e42063f4476bca

          SHA256

          09be5df7a85545fd93d9fd3cd1d6c04c6bfe6e233c68da6f81c49e7a35fcbb84

          SHA512

          081cf1dadb3a0e50f0a31ab03e2b08e80298c06070cd6f9b2806c08d400c07134623f7229a6c99910c6243dfa53c6e2c05d09a497aae1e701bc34b660cf9e4c9

          Download Submit

        • C:\Windows\Installer\MSIBF1D.tmp-\Interop.NetFwTypeLib.dll
          Filesize

          32KB

          MD5

          a084b0c082ec6c9525336b131aeba39a

          SHA1

          45db1f5cc54a033e5df460b93edaa5d23a39ced9

          SHA256

          7cba99a0f2a5b233e341f691c2aa6cb4ca10065425fc478b56fa468d6b0af54d

          SHA512

          297ba29e1ee4300f1a11620d475e67a9747fd9affabeee5fb5151b07c931c8f5c5af12b956e2ab7bd7dc6ebb1dbc298f5d56fa419f5fe2e3646053c0e515e29b

          Download Submit

        • C:\Windows\Installer\MSIBF1D.tmp-\Newtonsoft.Json.dll
          Filesize

          418KB

          MD5

          0e32f5229d5ee7d288b6b3969a51fcbc

          SHA1

          54c09f07930525786fcf08b9c7aca24185a68fc1

          SHA256

          e1ca33208030c858254249b2c9aa6d8541c2e875343b2997f2b2f9e4993c96f8

          SHA512

          64e8499e668ea44397ed5ea009e3692b623d2ac01bdd43e460624fe0282a3398025e4e53282e0f0905062b60400f4c16a64933ed7667de942f1588dd936aebcb

          Download Submit

        • C:\Windows\Installer\MSIBF1D.tmp-\srprl.dll
          Filesize

          56KB

          MD5

          d8fa7df1f2cd92ad701bc23f86d89b54

          SHA1

          72160fd5ad639c5a9c44305b06c98eb637399d18

          SHA256

          475a2c225258c571ae66c0178a83177bd5a59f4ce1be1f867e14e75614ad43e4

          SHA512

          a4d11c7f66325199f5c3a41cc37f32cf6ee828d790add1a6b77b9127e65243bb17dcc10b1cb2cbaac4e543bc329bd30e64919ffc0af3fd6088a672e08e10e992

          Download Submit

        • C:\Windows\Installer\MSIBF1D.tmp-\srsl.dll
          Filesize

          21KB

          MD5

          6fc50184e3aad7f4df0231da697a9da8

          SHA1

          fef8608d31e8e1c16ca7db402fa352ee7231585b

          SHA256

          58e698c208cd6ad94d2da3511447a975605e2b49bbdb7b572863f318aaffe0cf

          SHA512

          626b0a4031571ca906311937583f646aebdc7aacd5afb5ddf66c2d45dbc335e026d337d4f5803c38ddd022b9e64c79b4dd30d094d5d01a669e99d6c6829650b4

          Download Submit

        • C:\Windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll
          Filesize

          116KB

          MD5

          459ff9c6762b7fdd91c156ff3e096478

          SHA1

          7179debce9a271450b1241e7435a999aea1ddd05

          SHA256

          93865c89e1507409fbbeb9433542a303cdd2fd5acda3d51fecd83e4a8fb8072c

          SHA512

          8b95330d364413122427604af1c0e848694975eb8c541b911aeb0d50fbb5cd15a60863f68593f1088b26f83500f400f52292a2891511223f796be750c6a7583a

          Download Submit

        • C:\Windows\assembly\tmp\99V4AADE\Interop.SHDocVw.dll
          Filesize

          143KB

          MD5

          030a99f9594434ea83d27b33a95c4d5a

          SHA1

          230882058a1d50e4e8f7fa4bb3144dec506c5967

          SHA256

          0fdc72a06cc54771f1b07293d2e914cded985d84833ed4bf952a665eb107b5a3

          SHA512

          529d14374df0b455db055027f42ccf731ddf4b7bef8fc27bffa2ff5a46463dc6b3cacf75fd6356e325f075d7fb70ad0f8abd85feb75d00befd1c86aec857d7ee

          Download Submit

        • C:\Windows\assembly\tmp\QFK6B650\System.Data.SQLite.dll
          Filesize

          889KB

          MD5

          c2e38bfe933c5bce36910fe1fb1d5067

          SHA1

          aac5ed2724e2f88c7af1a3bf56d73180ae709bb7

          SHA256

          49a51063aaccc22a28590575417bdff40a67a06e6f2a67217b37af1b49fa6286

          SHA512

          281225b5e7193270b27811224c70475fc9af47c5d05a7e98f6856ad6abccff084302d0ddb72868d6872eef2efaf2989645af5e596083bfb995f214182aa4184d

          Download Submit

        • \??\c:\Users\Admin\AppData\Local\Temp\1h3yx8st.0.cs
          Filesize

          150KB

          MD5

          6f8e0c3c3b1b9a297b8ee6bfbb9c2a2c

          SHA1

          1dbab29ad6fb169fad90e963dd0c5290f27272fc

          SHA256

          e0514048fd6f4169c41896332a243cf014a719e5fe217c5743fc3c7149db578a

          SHA512

          193fc4f01b6afb2a858f006eb7c5dfd6106d88b0b0e0f12b4c8c103a8bae270ff0d583886ec5af910ce4d50cb1ccfb54a14d27fd517b847a624d9ba79f688640

          Download Submit

        • \??\c:\Users\Admin\AppData\Local\Temp\1h3yx8st.cmdline
          Filesize

          396B

          MD5

          33490b4dd64dec2b90492ef6a521a799

          SHA1

          d3e1fa01c9d0af19b8394547e84bc3a99590bbdf

          SHA256

          17204f4523e42de9c380493c16918a27f61821afaac37de80881ae38f1086102

          SHA512

          aa47310d975525c6ec6937df145f95eb36de1d5df848d47e5b6cd0e5fac665641007c5093ff8d0b05bf549b7e0b7cd842abe81aca04b86522d18059e7fa5f51d

          Download Submit

        • \??\c:\Users\Admin\AppData\Local\Temp\CSC9942.tmp
          Filesize

          652B

          MD5

          556544a56d00ce1f661f9ffeae4cab46

          SHA1

          a4f0c914d7fb515f24e28ae3beee98f0abc2f7e0

          SHA256

          2f0240a89ca575de8e0602dd741b5df071574170cb2aab587f5dbb38a9a37a4a

          SHA512

          2de8d170220a85a67a3c37ed528c6de942efc2f58c262df78bc0bf258cd9d9f396bee99a8b8645e8570c1f3915cf3dab2e1935fe96f7ff05d5c0bb0203739b67

          Download Submit

        • \??\c:\Users\Admin\AppData\Local\Temp\wph_5oi6.cmdline
          Filesize

          614B

          MD5

          cbe98f67f29230a91c5256cc2571dc74

          SHA1

          347fbd7713e5d3dcdae735361dcc9232d5c9269d

          SHA256

          f2ae13b38fb7774b6b825b7d1e97c27364279703ea6d5e9be5a64e24f91842f4

          SHA512

          b7b05377076c01427f3d0bc001aa3cc44de7cb9ec6c4c419827c2543975a74bb85b4d06a80a6bd624bd57e260124a42aebb77b895a038889f93fee6e74f4eabb

          Download Submit

        • memory/1516-1431-0x000000001C9F0000-0x000000001CA16000-memory.dmp

          Filesize

          152KB

          Download

        • memory/2604-1113-0x000002559B270000-0x000002559B296000-memory.dmp

          Filesize

          152KB

          Download

        • memory/2604-1237-0x0000000000910000-0x00000000009F3000-memory.dmp

          Filesize

          908KB

          Download

        • memory/2604-1140-0x000002559B240000-0x000002559B260000-memory.dmp

          Filesize

          128KB

          Download

        • memory/2792-1423-0x000000001D910000-0x000000001E0B6000-memory.dmp

          Filesize

          7.6MB

          Download

        • memory/2792-1422-0x000000001D160000-0x000000001D906000-memory.dmp

          Filesize

          7.6MB

          Download

        • memory/3000-1405-0x000000001DE10000-0x000000001DEAC000-memory.dmp

          Filesize

          624KB

          Download

        • memory/3000-1404-0x000000001F240000-0x000000001F70E000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/3000-1396-0x000000001CC00000-0x000000001CC18000-memory.dmp

          Filesize

          96KB

          Download

        • memory/4508-1414-0x000000001CD80000-0x000000001CDA6000-memory.dmp

          Filesize

          152KB

          Download

        • memory/4816-379-0x0000000074170000-0x0000000074721000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/4816-376-0x0000000003000000-0x0000000003010000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4816-377-0x0000000074172000-0x0000000074173000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4816-32-0x0000000074170000-0x0000000074721000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/4816-1897-0x0000000074170000-0x0000000074721000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/4816-28-0x0000000074172000-0x0000000074173000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4816-27-0x0000000003000000-0x0000000003010000-memory.dmp

          Filesize

          64KB

          Download