Malware Analysis Report

2025-01-02 15:32

Sample ID 241202-e59qvazmc1
Target 202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe
SHA256 202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410ad
Tags
discovery pandastealer adware evasion persistence privilege_escalation spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410ad

Threat Level: Known bad

The file 202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe was found to be: Known bad.

Malicious Activity Summary

discovery pandastealer adware evasion persistence privilege_escalation spyware stealer trojan

Pandastealer family

Panda Stealer payload

PandaStealer

Blocklisted process makes network request

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Enumerates connected drives

Checks whether UAC is enabled

Drops desktop.ini file(s)

Adds Run key to start application

Installs/modifies Browser Helper Object

Checks installed software on the system

Drops file in Windows directory

Program crash

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

NSIS installer

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Kills process with taskkill

Modifies Internet Explorer settings

Modifies system certificate store

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer start page

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-02 04:32

Signatures

Panda Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A

Pandastealer family

pandastealer

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-12-02 04:32

Reported

2024-12-02 04:34

Platform

win7-20240903-en

Max time kernel

15s

Max time network

16s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Ping.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Ping.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Ping.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 220

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-12-02 04:32

Reported

2024-12-02 04:34

Platform

win10v2004-20241007-en

Max time kernel

95s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Registry.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 384 wrote to memory of 3976 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 384 wrote to memory of 3976 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 384 wrote to memory of 3976 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Registry.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Registry.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3976 -ip 3976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-02 04:32

Reported

2024-12-02 04:34

Platform

win7-20241023-en

Max time kernel

119s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe"

Signatures

Panda Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A

PandaStealer

stealer pandastealer

Pandastealer family

pandastealer

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Browser Infrastructure Helper = "C:\\Users\\Admin\\AppData\\Local\\Smartbar\\Application\\Smartbar.exe startup" C:\Windows\system32\msiexec.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\SysWOW64\rundll32.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}\NoExplorer = "1" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0} C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}\NoExplorer = "1" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\Smartbar.Resources.Translations.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9ABA.tmp-\srprl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9ABA.tmp-\CustomAction.config C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\spusm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9ABA.tmp-\Smartbar.Resources.SocialNetsSharer.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\MACTrackBarLib.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\spsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\spbl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.XmlSerializers.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9ABA.tmp-\sppsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\srbs.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\sismlp.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\assembly\tmp\42237BJA\Microsoft.VisualStudio.OLE.Interop.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\Microsoft.Practices.EnterpriseLibrary.Common.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\CustomAction.config C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\sppsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\MACTrackBarLib.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\Microsoft.Practices.ObjectBuilder.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9ABA.tmp-\srbhu.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9ABA.tmp-\srus.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\Microsoft.Deployment.WindowsInstaller.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\srut.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\srpdm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\CustomAction.config C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9ABA.tmp-\Newtonsoft.Json.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\spsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\assembly\tmp\LTEZKJBI\Interop.SHDocVw.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.XmlSerializers.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\Interop.NetFwTypeLib.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\Smartbar.Infrastructure.BusinessEntities.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\Smartbar.GUI.Docking.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9ABA.tmp-\Smartbar.Resources.Translations.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9ABA.tmp-\Smartbar.Infrastructure.BusinessEntities.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\srsbs.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Installer\f76801b.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI9ABA.tmp-\spusm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\Smartbar.Resources.LanguageSettings.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\Smartbar.GUI.Docking.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\f768018.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI9ABA.tmp-\sipb.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\Smartbar.Resources.LanguageSettings.resources.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\Smartbar.GUI.Controls.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\Smartbar.Resources.SocialNetsSharer.XmlSerializers.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9ABA.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\Smartbar.Infrastructure.Utilities.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\srpdm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9ABA.tmp-\MACTrackBarLib.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\Newtonsoft.Json.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\sismlp.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9A9A.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f76801d.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\spusm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\Smartbar.Resources.LanguageSettings.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\assembly\tmp\42237BJA\__AssemblyInfo__.ini C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI84F7.tmp-\Smartbar.Resources.LanguageSettings.resources.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9ABA.tmp-\Smartbar.GUI.Controls.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA873.tmp-\Microsoft.Practices.EnterpriseLibrary.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msiexec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MAO Settings C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchUrl\Default = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Use Search Asst = "yes" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchUrl C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchUrl\Default = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\ShowTabsWelcome = "0" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\UseHomepageForNewTab = "1" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{AE07101B-46D4-4A98-AF68-0333EA26E113} C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\SuggestionsURL_JSON = "http://suggestqueries.google.com/complete/search?output=firefox&client=firefox&qu={searchTerms}" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\SuggestionsURL_JSON = "http://suggestqueries.google.com/complete/search?output=firefox&client=firefox&qu={searchTerms}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchUrl\Default = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=GB&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=ds&q={searchTerms}&installDate={installDate}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MAO Settings\AddonLoadTimeThreshold = "10000" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{006ee092-9658-4fd6-bd8e-a21a348e59f5}" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Use Search Asst = "yes" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{ae07101b-46d4-4a98-af68-0333ea26e113} = "Smartbar" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\URL = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Smartbar.exe = "9999" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Search\SearchAssistant = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{006ee092-9658-4fd6-bd8e-a21a348e59f5}" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Search C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\DisplayName = "Web Search" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Search\Default_Search_URL = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=GB&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=ds&q={searchTerms}&installDate={installDate}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5} C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\DisplayName = "Web Search" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\URL = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=GB&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=ds&q={searchTerms}&installDate={installDate}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=GB&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=ds&q={searchTerms}&installDate={installDate}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\USER PREFERENCES C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\UseHomepageForNewTab = "1" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5} C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=GB&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=ds&q={searchTerms}&installDate={installDate}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\ShowTabsWelcome = "0" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\SuggestionsURL_JSON = "http://suggestqueries.google.com/complete/search?output=firefox&client=firefox&qu={searchTerms}" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\URL = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Search\SearchAssistant = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=GB&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=ds&q={searchTerms}&installDate={installDate}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{006ee092-9658-4fd6-bd8e-a21a348e59f5}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{ae07101b-46d4-4a98-af68-0333ea26e113} = "Smartbar" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Search\Default_Search_URL = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\DisplayName = "Web Search" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\rundll32.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=GB&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=hp&installDate={installDate}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=d13811c3-be3c-f963-4eca-e759baed3971&searchtype=hp&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{656130CD-753E-3DDC-893C-D6975C1EEED9}\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F3F5-98B4-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLSpanElementClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F249-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6D55083F-D6FF-3028-A8A3-95DE56BB6EDF}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F630-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{C77B0461-C344-345F-B41F-C1352A3E2B36}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F245-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F284-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B3E55904-F89A-3F14-ADE9-32CE53681F86}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F4CC-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A66A524B-DE26-335C-BBCD-86250806FAD3}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F38F-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLImageElementFactoryClass" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F6C8-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F281-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F4CB-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}\InprocServer32\ = "mscoree.dll" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{425E7597-03A2-338D-B72A-0E51FFE77A7E}\1.0.0.0\Class = "IESmartBar.POINT" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IESmartBar.BHO C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F3E8-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F6C8-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLDefaultsClass" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F402-98B5-11CF-BB82-00AA00BDCE0B} C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{34B4F646-3FC3-3CA2-AF86-BDAA6F9167D8}\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9CBDDE76-4C5D-3B59-A31F-45B59186510A}\7.0.3300.0\Class = "mshtml._styleTextLineThroughStyle" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4DBA43D6-92EF-365A-A8F6-164C0BECAA03}\7.0.3300.0\Class = "mshtml._htmlZOrder" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F245-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F276-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}\InprocServer32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}\InprocServer32\ = "mscoree.dll" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F251-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F4CB-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLElementCollectionClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F24D-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F2B9-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32 C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}\ProgId\ = "IESmartBar.BHO" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A2CCE3E1-31E1-3A80-9E94-3F818328FB20} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{C77B0461-C344-345F-B41F-C1352A3E2B36}\7.0.3300.0\Class = "mshtml._bodyScroll" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A5C76C0B-A22F-3565-BA14-863844C9570C}\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F281-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{26D3A9D0-70E0-3905-838B-67B7AEAD16F0}\7.0.3300.0\Class = "mshtml._styleNormal" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}\InProcServer32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6D55083F-D6FF-3028-A8A3-95DE56BB6EDF}\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9CBDDE76-4C5D-3B59-A31F-45B59186510A}\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F9D1FACE-EF58-3A60-BD92-95DA3D29A3A2}\7.0.3300.0\Class = "mshtml._htmlRules" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F314-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F282-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLBaseFontElementClass" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IESmartBar.BandObjectAttribute\ = "IESmartBar.BandObjectAttribute" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F580-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F27A-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F38D-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{EDC20047-2388-3184-B6DD-B543825CA72A}\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F6AA-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLRenderStyleClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F2E4-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLStyleSheetClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9C468E69-AED4-3E79-9CC5-4EDF700A52E5}\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1A7B7923-55BB-3079-B47E-AC73CBEDCE77}\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9778FF5E-CBCB-3A8E-AA0C-69F4540870C0}\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F4FE-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTCEventBehaviorClass" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209} C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{5E8433C3-CEE5-399A-883B-0FBB33FA9689} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{ADCDA984-74EE-399A-B8C7-F16E1D96115F} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F24D-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F493-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B3E55904-F89A-3F14-ADE9-32CE53681F86}\7.0.3300.0\Class = "mshtml.__MIDL_IWinTypes_0007" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F24D-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{EDC20047-2388-3184-B6DD-B543825CA72A}\7.0.3300.0\Class = "mshtml._htmlMarqueeBehavior" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46 C:\Windows\SysWOW64\rundll32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c90f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1800 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe C:\Users\Admin\AppData\Local\Temp\Installer.exe
PID 1800 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe C:\Users\Admin\AppData\Local\Temp\Installer.exe
PID 1800 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe C:\Users\Admin\AppData\Local\Temp\Installer.exe
PID 1800 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe C:\Users\Admin\AppData\Local\Temp\Installer.exe
PID 1800 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe C:\Users\Admin\AppData\Local\Temp\Installer.exe
PID 1800 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe C:\Users\Admin\AppData\Local\Temp\Installer.exe
PID 1800 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe C:\Users\Admin\AppData\Local\Temp\Installer.exe
PID 920 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\taskkill.exe
PID 920 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\taskkill.exe
PID 920 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\taskkill.exe
PID 920 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\taskkill.exe
PID 920 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 920 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 920 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 920 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 920 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 920 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 920 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 3052 wrote to memory of 1388 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3052 wrote to memory of 1388 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3052 wrote to memory of 1388 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3052 wrote to memory of 1388 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3052 wrote to memory of 1388 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3052 wrote to memory of 1388 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3052 wrote to memory of 1388 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1388 wrote to memory of 484 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 484 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 484 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 484 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 484 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 484 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 484 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 484 wrote to memory of 1692 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 484 wrote to memory of 1692 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 484 wrote to memory of 1692 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 484 wrote to memory of 1692 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1692 wrote to memory of 2380 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1692 wrote to memory of 2380 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1692 wrote to memory of 2380 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1692 wrote to memory of 2380 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 484 wrote to memory of 884 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 484 wrote to memory of 884 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 484 wrote to memory of 884 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 484 wrote to memory of 884 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 884 wrote to memory of 1604 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 884 wrote to memory of 1604 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 884 wrote to memory of 1604 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 884 wrote to memory of 1604 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1388 wrote to memory of 684 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 684 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 684 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 684 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 684 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 684 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 684 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 2168 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 2168 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 2168 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 2168 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 2168 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 2168 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1388 wrote to memory of 2168 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 2168 wrote to memory of 2480 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2168 wrote to memory of 2480 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe

"C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe"

C:\Users\Admin\AppData\Local\Temp\Installer.exe

C:\Users\Admin\AppData\Local\Temp\Installer.exe /quiet ARGS=HP:1;DS:1;NT:1;DOWNLOADPROVIDER:ShoppingHelper;PUBLISHER:ShoppingHelper;ROT:ALL;ROSP:1;CSH:1;SHOW_UNINSTALL:1;VISIBLE_IN:FF,IE

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM msiexec.exe

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\smartbar\Installer.msi /quiet /quiet ARGS=HP:1;DS:1;NT:1;DOWNLOADPROVIDER:ShoppingHelper;PUBLISHER:ShoppingHelper;ROT:ALL;ROSP:1;CSH:1;SHOW_UNINSTALL:1;VISIBLE_IN:FF,IE;INSTALLATION_ID:d13811c3-be3c-f963-4eca-e759baed3971

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 858EC0A0D9FC5E0E332ED400E991F59F

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSI84F7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259425684 1 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationStart

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eohimm1g.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A94.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8A93.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3r1bybgz.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E0E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8E0D.tmp"

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSI9ABA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259431129 5 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationRemoveFiles

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSIA873.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259434639 9 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationComplete

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fht3xqes.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA9F6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA9F5.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p1zulpah.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA73.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAA72.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Microsoft.mshtml.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Microsoft.mshtml.dll"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll"

C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe

"C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ffkb-xbh.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCDDB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCDDA.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3ufmf6xb.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF03.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCF02.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dfrw4oxl.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCFED.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCFEC.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hkwf3_-a.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD144.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD143.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6bt_knnw.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD2CA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD2C9.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a-1hfm23.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD338.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD337.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tuwvywud.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD376.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD375.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ji8gq4ry.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD431.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD430.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nj2rsjlo.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y--mixcx.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD4CD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD4CC.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD4DD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD4DC.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lcau3b0o.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE31F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE31E.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0ng87dtd.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE5AF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE5AE.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\os4qqrt_.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE8F9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE8F8.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 cloud-search.linkury.com udp
US 167.71.184.143:80 cloud-search.linkury.com tcp
US 8.8.8.8:53 ws-cloud.snapdoapp.com udp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.80:80 crl.microsoft.com tcp
US 8.8.8.8:53 cloud-search.snapdoapp.com udp
US 8.8.8.8:53 ws-cloud.snapdoapp.com udp
US 8.8.8.8:53 feed.snapdo.com udp
US 172.232.25.148:80 feed.snapdo.com tcp
US 8.8.8.8:53 ww99.snapdo.com udp
US 69.16.230.227:80 ww99.snapdo.com tcp
US 8.8.8.8:53 ww7.snapdo.com udp
US 199.59.243.227:80 ww7.snapdo.com tcp
US 8.8.8.8:53 pool.ntp.org udp
US 8.8.8.8:53 csc3-2010-crl.verisign.com udp
SE 192.229.221.95:80 csc3-2010-crl.verisign.com tcp
US 8.8.8.8:53 google.com udp
GB 142.250.187.238:80 google.com tcp
US 8.8.8.8:53 install.outbrowse.com udp
US 13.248.169.48:80 install.outbrowse.com tcp
US 8.8.8.8:53 az412542.vo.msecnd.net udp
US 8.8.8.8:53 az412542.vo.msecnd.net udp
US 152.199.19.161:80 az412542.vo.msecnd.net tcp
US 152.199.19.161:80 az412542.vo.msecnd.net tcp
US 8.8.8.8:53 www.microsoft.com udp
US 23.192.22.93:80 www.microsoft.com tcp
US 8.8.8.8:53 au.snapdoapp.com udp

Files

\Users\Admin\AppData\Local\Temp\nsj7476.tmp\Registry.dll

MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

\Users\Admin\AppData\Local\Temp\Installer.exe

MD5 564e47a3604ced3b7c18e43250226cd7
SHA1 a3eef8fac3617d048fb9fce2201937297e3920f1
SHA256 12ae00fe728b441221acd10483eeb1197884738e9bd6eb715ceadeea058c6c83
SHA512 e925e2a5b60c7257ac6b57b3fc12675d2cc490070c456a8e794f54c6732cc34981c0d88a5acfb2214fd316194f24eae83e8151cfab101daa2f1b59f2d621cdbf

\Users\Admin\AppData\Local\Temp\smartbar\HistoryWrapperService.dll

MD5 3cf46bae7e872a661721b0894bc076e2
SHA1 eaaa0a35e284908dd21cf245a38efe9d2e4c7532
SHA256 7ca73cfb8d0502b14b657216b8735394cbd08aa8e4266fb9e86ad84ae159b043
SHA512 47065a1cb81b41cab7c98488609470b308c708ba73c0e11c3f06901fde008b280f3b75ee825c12e4681aefbd8a43840e0319b43bbab7fe68b24c30926d0ce9f2

memory/920-27-0x00000000028A0000-0x00000000028E0000-memory.dmp

memory/920-28-0x0000000074951000-0x0000000074952000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\smartbar\GuidCreator.dll

MD5 4876414d51fe01bd8525df2f8acd35d6
SHA1 f9435c39e3029276e71a971e48f68d3f0298fe11
SHA256 4bda5a964065b918ce70a27914056b17a95e3f8002028b394ecf8ff2d7cebf3d
SHA512 d18afa3d806fd056836beb5a0822156402afe3455567d41f9b27d578980d5ae341273cadf5dff3175a799e791822e07eede03e3c0c143604f980f7876cd2fc0a

memory/920-32-0x0000000074950000-0x0000000074EFB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\smartbar\Installer.msi

MD5 e5314db579a141f6a5204f70e7073de0
SHA1 3d2e28be7594fd754213e3ea19b4f900f6634c91
SHA256 84263b76687ff69f306579fb3f05f3a0528db029cf0f2f60eddc22549545408d
SHA512 f18c446d8e388759c12527ca970dea3c24af954d199c39027eae4ad8c97df7c902f24845ab0ee0ffd9ad9ee6768c43169b11fec47bd3246cd2e9c7e8da44993a

C:\Users\Admin\AppData\Local\Temp\Cab8104.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar8117.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Windows\Installer\MSI84F7.tmp

MD5 44c66c7febaf067ac2f96e3bb643a5b3
SHA1 bc83eb57ebb44206b467c4147a7f82d52662e9b5
SHA256 641fae557b683029787befda2a2ed5251b19a4c11fc19e3dbf2cd97459e7e383
SHA512 41ce527bd09ae6b3126947197c94169121dcffe79b9db624a17a3a45d4e25a2f53dde0a686b4329b9e2d5c33bbbc6d6b9cc840b97731eac38ae31254dfd3364b

\Windows\Installer\MSI84F7.tmp-\Microsoft.Deployment.WindowsInstaller.dll

MD5 34d4a23cab5f23c300e965aa56ad3843
SHA1 68c62a2834f9d8c59ff395ec4ef405678d564ade
SHA256 27cf8a37f749692ab4c7a834f14b52a6e0b92102e34b85ffcb2c4ee323df6b9c
SHA512 7853f1bc1e40c67808da736e30011b3f8a5c19ddf4c6e29b3e0eb458bea2e056fe0b12023ceac7145c948a6635395e466e47bdd6f0cfa1bd7f6a840e31e4694c

\Windows\Installer\MSI84F7.tmp-\Smartbar.Installer.CustomActions.dll

MD5 2120dbb0481374885af660346f503b9b
SHA1 0dad9f77c93325cbe2499efac70ebbbfd8e1a4b3
SHA256 ef0e1d3a5f58e797c47d1ca2999e6ab1e94520c3816a8264874920c26c9ae474
SHA512 46966d2eec899fbd48b8aaf5e72555cec3b2f1bc2481c2eb014d98078aa6b6e825144718fbe2aa7b23d816462645186abbfc2ebdc7a4f331d5087999f21ca68a

\Windows\Installer\MSI84F7.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.dll

MD5 5dc8a7062040e05ad36bd83246954b05
SHA1 f6807be0413724076c8c384576ad9a5bc1413e8c
SHA256 d00f229036a6ea19e05c9838f2827fdb22b3003af4c7c97b37abf2ea36236dfc
SHA512 43cda9b7a57ae292b71df7a8f02c359b486a82162f92e2d8a7449f2b9c835a7ba44177477a7e0763a5698a4b2d9a025f8786c054950db3fab017edfdf4c17f12

\Windows\Installer\MSI84F7.tmp-\srbs.dll

MD5 7ec601a05f97c73fc2180e8c57efc9af
SHA1 7c99dcdcec211459b1d9d429e2ada2839876f492
SHA256 982d12314935e25a016da0bec644bc4c8bd02b0984eb70b76e081b3562a6adf8
SHA512 119e216313540f0fac30c1a8e531909dbdc8022735a9fb73b80c8bbbb2ff0548cdf911e640cd19827acff703c95b1d8db0ddf3ed61d056e9e4d4f437b8c88e7b

\Windows\Installer\MSI84F7.tmp-\spusm.dll

MD5 e28c8d2fd64ba27d9b992fc325f26a9d
SHA1 d9ed413265967b6ede8787aa8c5e5734a4ea1358
SHA256 82d96714ac65e6e18e3da619cfd1367416bba5ed6d08db7bf312f8937f95f2ab
SHA512 e2fcc5972c48fa1d26d2df0b2c5ed4e34d15d7f08eb35510989441b4083f30d19f6d5fc2652ac42d11a3877f333ad4408c0cb547ecf7b948e1f324f719cfc739

\Windows\Installer\MSI84F7.tmp-\srbhu.dll

MD5 fcbe6dec3d2da2ac9fd2754cc9cf6ad9
SHA1 7954bdf16f99bf843c5c8053a078813d87c94254
SHA256 71688a7955124b644cb05833d8285b876c7ff336eb4478ce01e1f80b07f7b76e
SHA512 5975297ac6aaa7d85842079809f9be2ad57959da2687de4bb7aa0764bc16dd878c482a92d7c4a4ed484aa7683f60c90b870757165f79d7ae481b7f7897e94c39

\Windows\Installer\MSI84F7.tmp-\sppsm.dll

MD5 787104ad9dea702d115883c489be54cb
SHA1 b24680d170c610203df5e3d1d52b2b04f938dd56
SHA256 934230fc9da4c6eac4b1f916baec075ac5faf1a70af14dcdb62d3d06ca878cd3
SHA512 861147b8ed484a25a5ca9af8b7488896ee41dfd4eb57dafd4bb33455b03936c8fd930224fd9a1a0e8dcddf0fc33bc7adfc3ac48ca3ff430122f3ce18952fe312

\Windows\Installer\MSI84F7.tmp-\Smartbar.Personalization.Common.dll

MD5 347b0b5d32b1a85b5450b08cfb6d2e75
SHA1 7bfe1857974a6c6c3e882624d820311c1e3bf670
SHA256 76a9f22039731c1fb3871876dd8c55d4ab75635367daa811ced5ed70eed950ac
SHA512 d79edc2546249f71a19faa1ee4aebdfd2faa8b6b56615740c93023255c81716de6c4af484bde506f7dcd80b607d8804313589e58b05dd2448d5c1fca3cd39e92

\Windows\Installer\MSI84F7.tmp-\srut.dll

MD5 feba43763a9b7fe1c94d681055d10167
SHA1 49d30dedf868accf07e6895e1699a4d751235fd0
SHA256 0634fa964eba9baed92e2a935aef925fdaa921a35424b6ae9bfaaace932dc49d
SHA512 680116cfe66472c4d6ae9c94d74cd3fe8cef1c9beade27c19e58369c2c6f238f9e63019d7ea2b8b35689b7c0e812f2ee49d26a56e6972d3e21dc5f7312cf81ef

\Windows\Installer\MSI84F7.tmp-\Smartbar.Infrastructure.Utilities.dll

MD5 562ac9921d990126990c2f0bdce7081a
SHA1 f395458d8e328cf4809385fef3e225d01f8a8fc0
SHA256 ef84e1ad9cf174a9ab0bba648b56f2ffd17f4cb4421902b61559b544d812e738
SHA512 f52a9a62ca7d810804289ffe0300919eea529f2e0d4d07709309e101087809a5a004437184f3a3518fcd286db18947d78ce00bafbcbbe7b62a8aca4cf8295208

\??\c:\Users\Admin\AppData\Local\Temp\eohimm1g.cmdline

MD5 b77bd029efc00d3474a6fc9098aa91a2
SHA1 4bd90f4d0b3c120ada374fb71daa21d663c80dc6
SHA256 f5bb5f42bccda40f8e4d84244efb7e50f891e656e08051ecb3bd1adecbc3697f
SHA512 493195a6bb33630e80c8cfab2ddaa723cd50bf83771156f241e39d840dbc004359f05eac923b797360ba5a03e6e369ab69a168ea59fe309645de3c1ef8dfc8a7

\??\c:\Users\Admin\AppData\Local\Temp\eohimm1g.0.cs

MD5 6f8e0c3c3b1b9a297b8ee6bfbb9c2a2c
SHA1 1dbab29ad6fb169fad90e963dd0c5290f27272fc
SHA256 e0514048fd6f4169c41896332a243cf014a719e5fe217c5743fc3c7149db578a
SHA512 193fc4f01b6afb2a858f006eb7c5dfd6106d88b0b0e0f12b4c8c103a8bae270ff0d583886ec5af910ce4d50cb1ccfb54a14d27fd517b847a624d9ba79f688640

\??\c:\Users\Admin\AppData\Local\Temp\CSC8A93.tmp

MD5 dc84a49019ed4681bb6c4f95b85733a7
SHA1 e05470e80b641d7c5a580fa6597fa8ffa541b3be
SHA256 4b3af2f33ea58a5e97eca643a40327828a3dadec3bdacb6b51791f49c158c64f
SHA512 4dca941f1e158f22bce44b48f6c0169241a9b949316803fcb239dc8f8f03de9ac6fda26fd5cd87a22f0a62e22a4edc269ab2c11fb65267530e304ead8de4764b

C:\Users\Admin\AppData\Local\Temp\RES8A94.tmp

MD5 1a8f409e9a78c85e4f3d360ebca02dc2
SHA1 0ee02924149e25e2c7a774a2982d6ec4c01c6d81
SHA256 09cd676f88ce1e128ca08326a51ec515a2db1cc3021959f447eaf41bff127c95
SHA512 85ceb6b1ba5dc98cce981b5548ac4b133ddcac29de5d324d1a4c7907d06ed1cfb362da4abf92b69eae48f5b98c5c358f4f58496a3299801421b66f74d2fb1785

C:\Users\Admin\AppData\Local\Temp\eohimm1g.dll

MD5 add8f6eeeafbb898383fc88148c9f88a
SHA1 7f8f844495879340040a31f98518975af876edde
SHA256 30b75ef89c5d9944e7d072c555f172c492b9b180d48d607535918b8e0134edaf
SHA512 dac9d8d411d4604c32e5fcbc8a5e58e61663d0050e10d8aef44cca975e6e4c6ff63c142115cf325278256a2c9e03fa3b26ed2caef3841b59056dd06357b0df9a

\Windows\Installer\MSI84F7.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll

MD5 7868ed46c34a1b36bea10560f453598f
SHA1 72330dac6f8aed0b8fde9d7f58f04192a0303d6b
SHA256 5c17864f1572acec1f93cf6355cfd362c1e96236dcba790234985a3f108d8176
SHA512 0cc913337e3334ff0653bc1fad044d9df60a8728c233dcc2c7f6139f14608740b70b57c25a9d2d895cbc4d59508779f342a72406e623d30365ae89fb2a3607ba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9f8f4397a2743ba9ac9abe177f72c6b8
SHA1 5c2d959f347f8ed2827e84b802312e1dad64d063
SHA256 dddbcc969ef7e81789d9ad6b5f988c6584d2e56a2d10eddf30e2e928775052ee
SHA512 c8b98dd86ddb757ee30c1bc5f3a08a2eb668a0cd526c0f5c95147acebe807e7d80b943bb58fe5b895047aa9b901b16e79d178bc1c4df6857eba895346a11995a

\Windows\Installer\MSI84F7.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.XmlSerializers.dll

MD5 adb53ee43f74f430368449b98b2f6f86
SHA1 fb882d80da9ccf79c6817a492fbd686d4759bb41
SHA256 b7837a68ede7781286057de0b59b7bb9c7c29ff9e9ded32c7175cafe9de3b5ff
SHA512 8fc2cd5a585c8247274fbe8d53ac27faa1f2b0407d27e5e78d6917cfa94947ace2aa20ca670a5b87e3d7a939360691102ed9c7530ec997af1057064bcb9c085a

\??\c:\Users\Admin\AppData\Local\Temp\3r1bybgz.cmdline

MD5 992b80bb49d4f5b80c4ef8909436b2e9
SHA1 a7f26f7615d3bc1d5342fb3f81d9be569259ce6e
SHA256 5d52d9b0269c470a856060de3d02ee93255e28a0eb724628debe59c62c5f4764
SHA512 da49e675403a8a9140a2484d7248b8c3a06341eff8ecea58e845b2dfdee2cf06f7e806c26b268a8aa2ce440da65cb752d2ab7a135c601d85effbcf854012c615

\??\c:\Users\Admin\AppData\Local\Temp\3r1bybgz.0.cs

MD5 14ac60821b7e9508914fdf584ef23f46
SHA1 9bc6cb0f7ea31050962fe56398213a48c5097ffa
SHA256 ed564c34b04178601638c4c2a9ac3c21ac83d4031976fbd467c42d8e1a7c7c1c
SHA512 b3faf1282b570436807b403ebd7aead6e86dbcb61dd64cfba0bc25023ddfe2017434e7f2ba34c0e69974b6f28587d75448f6b9567814d93130e9c7c3b8d01cd5

C:\Users\Admin\AppData\Local\Temp\RES8E0E.tmp

MD5 f9bb4c8818c68978550813fa4e5b7329
SHA1 709c440f7136aa98588482f28f628df841a03773
SHA256 90a9dfd1c19ce9f7351aeb6eb3ba52abb08dfe454ab412e5e5037616f3a6b1ea
SHA512 915228abd883c9cb2e636694332d416b42f8cda6f17fda5f2a0bc0de7662d8af7e091b5ffb9268e2904a7435d5cf9d747fc1051adf376999f8af044a57fa4ab8

\??\c:\Users\Admin\AppData\Local\Temp\CSC8E0D.tmp

MD5 dbbf10b9dedd0f535f39c2fda5001654
SHA1 484af7953ebdd869c4910d37cd350a8cacbe56a4
SHA256 8ffc35c91359a74ae3cd123c6e99062a8f61be443cc71a2c05c23036a888bd37
SHA512 e44914f4e40517cbb245c236753e7a8eb1a5d7347da4e7834c465db8ab906eb1468c67878658aee7542bf8e83a0488119e6abfb3f4e57c0183c1368d9d20bf69

C:\Users\Admin\AppData\Local\Temp\3r1bybgz.dll

MD5 60296f8425ca0879a1763b9827a9b203
SHA1 f503f9ed42fad6ff1f7f68c5897b9ab15c11c448
SHA256 ec0865a327716123109cee9f4a762d1fd12fe9c8e40aa28f00a0774526c6617d
SHA512 32fda6d3194eea7296fa016a41e333b167fca49f10a9ef5fb6fccc84b5885e71b96dbaaf8a16914935fdcb1e5544280c6defe1c1a95d224af35d3b9c59d17751

memory/920-260-0x00000000028A0000-0x00000000028E0000-memory.dmp

C:\Windows\Installer\MSI9ABA.tmp-\CustomAction.config

MD5 796621b6895449a5f70ca6b78e62f318
SHA1 2423c3e71fe5fa55fd71c00ae4e42063f4476bca
SHA256 09be5df7a85545fd93d9fd3cd1d6c04c6bfe6e233c68da6f81c49e7a35fcbb84
SHA512 081cf1dadb3a0e50f0a31ab03e2b08e80298c06070cd6f9b2806c08d400c07134623f7229a6c99910c6243dfa53c6e2c05d09a497aae1e701bc34b660cf9e4c9

C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch

MD5 5866f672b991742bdbaeb171602456d7
SHA1 dd2fd509375891d2fa4a88bf85731811c621c5b8
SHA256 e9d925165832440d93639cbcaeff0c3c516b5b6115218a2993b6c981f2433269
SHA512 563fdc93ae1026802f5ecca77a7f642a30ec6b942940a31a965d16445014ec91d1e17f81a5fd15d98695c5e277140a3e99c1df2694033823dbdecb7d243c6b06

C:\Users\Admin\AppData\Local\Smartbar\Common\icons\30DFF8F0-BA79-4360-A3EA-51B6D006133CPress.png

MD5 5719ee7f6521ae142f0557f0706cded1
SHA1 a1d5694197827967aea5b3ccc88e2f91d465c283
SHA256 0a2ae8f3e9aa552748cfeadaec055778487602e7f6d4a6c2a221fe1fd496bfaf
SHA512 cde76dada9e798a746d7ae23ee189940a6b7660805267a9221501c5c911a89b298005f111622fae7c886e810e23f83b77d47fa75793d19441246eb775a2f2bf6

memory/920-567-0x0000000074950000-0x0000000074EFB000-memory.dmp

C:\Users\Admin\AppData\Local\Smartbar\Common\icons\3C610B86-19DE-4757-B46A-871C9C27FF0APress.png

MD5 2768222689e3585d609b5a2afc1ba52c
SHA1 ee522df6b2e365857bf6be58ac7150cbc71cfc9c
SHA256 21ee471e79b0a646735e132bc1f0c48f464677127b105426e00b160a554de6b0
SHA512 56527749dca471af92eb4166b2bb6f1ca4cbf07c8d7e1a201378467f1d08efe5fd913715bb995d35c7d511b2cbdc9469d79baae7ee4bab619e4e11753c3505e4

C:\Users\Admin\AppData\Local\Smartbar\Common\icons\B1BEF453-913F-4EC4-B057-A2BB21C09DCBpress.png

MD5 e6ab030a2d47b1306ad071cb3e011c1d
SHA1 ed5f9a6503c39832e8b1339d5b16464c5d5a3f03
SHA256 054e94c94e34cef7c2fad7a0f3129c4666d07f439bfec39523dca7441a49bd7c
SHA512 4cbb002cc2d593bafd2e804cb6f1379187a9cae7d6cc45068fda6d178746420cc90bcd72ba40fc5b8b744170e64df2b296f2a45c8640819aa8b3c775e6120163

memory/3052-1158-0x0000000000700000-0x0000000000726000-memory.dmp

memory/3052-1185-0x0000000000730000-0x0000000000750000-memory.dmp

memory/3052-1282-0x0000000003390000-0x0000000003473000-memory.dmp

C:\Windows\assembly\tmp\W3KT41NF\System.Data.SQLite.dll

MD5 c2e38bfe933c5bce36910fe1fb1d5067
SHA1 aac5ed2724e2f88c7af1a3bf56d73180ae709bb7
SHA256 49a51063aaccc22a28590575417bdff40a67a06e6f2a67217b37af1b49fa6286
SHA512 281225b5e7193270b27811224c70475fc9af47c5d05a7e98f6856ad6abccff084302d0ddb72868d6872eef2efaf2989645af5e596083bfb995f214182aa4184d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

MD5 df8e117ce4028bc21de6c5468988d6f8
SHA1 938d7daa1db687560d5af9c58ef2ed33609ff9f3
SHA256 585065e9e0fff2884c9e33dd1325e4bcf07bf202327cb09743df9ae443fc1652
SHA512 d682725ec420a42ecb791feac1d41be8206fe6e9f5f2cf6ea8048653eaaf1b52e9d7dc7d00ad3a7703ee974e4d42bc80386dca88923d0b37a185d84aa50a7aab

C:\Windows\assembly\tmp\LTEZKJBI\Interop.SHDocVw.dll

MD5 030a99f9594434ea83d27b33a95c4d5a
SHA1 230882058a1d50e4e8f7fa4bb3144dec506c5967
SHA256 0fdc72a06cc54771f1b07293d2e914cded985d84833ed4bf952a665eb107b5a3
SHA512 529d14374df0b455db055027f42ccf731ddf4b7bef8fc27bffa2ff5a46463dc6b3cacf75fd6356e325f075d7fb70ad0f8abd85feb75d00befd1c86aec857d7ee

C:\Windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll

MD5 459ff9c6762b7fdd91c156ff3e096478
SHA1 7179debce9a271450b1241e7435a999aea1ddd05
SHA256 93865c89e1507409fbbeb9433542a303cdd2fd5acda3d51fecd83e4a8fb8072c
SHA512 8b95330d364413122427604af1c0e848694975eb8c541b911aeb0d50fbb5cd15a60863f68593f1088b26f83500f400f52292a2891511223f796be750c6a7583a

C:\Config.Msi\f76801c.rbs

MD5 ff15bc69b6e82a14ef7a5669580585de
SHA1 6cbab7b5baeef6bd44fd418ff8d7a60ed5069715
SHA256 a831f728132eaa83521e033477f29a4e0ad0d667dcdcf68be4f923ffff5f5646
SHA512 e0a0955536e237d96b47ce072f6146ab19afd36ed03754687572422c17b113d8bcbde365b00141d262365ec9135953bcdb935cdac4e3f9e299dd27211f93fbaf

C:\Windows\Installer\MSIA873.tmp-\srprl.dll

MD5 d8fa7df1f2cd92ad701bc23f86d89b54
SHA1 72160fd5ad639c5a9c44305b06c98eb637399d18
SHA256 475a2c225258c571ae66c0178a83177bd5a59f4ce1be1f867e14e75614ad43e4
SHA512 a4d11c7f66325199f5c3a41cc37f32cf6ee828d790add1a6b77b9127e65243bb17dcc10b1cb2cbaac4e543bc329bd30e64919ffc0af3fd6088a672e08e10e992

C:\Users\Admin\AppData\Local\Smartbar\Application\97ouxpto.newcfg

MD5 51417498b55cf9dd3d2b06acca131f8d
SHA1 e29cf97632afc31c3f33e92ec11aba4ab6af279f
SHA256 09c4cf7783aaaf4d783a20d5d424e5d778dfa985cf24d9adab6a8615e5942ea9
SHA512 2190da7f78ed76aed06ffabfdcfdff6f248ba7a1990bb80a4949a101626013c87048d5464487bcd0679c50d5019a26379f4f8691d0100ca08f7dfdd709417836

C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml

MD5 935646a2b0379aae4de2270ecb98124e
SHA1 4af3e38202534bbcc7ac3ab5de462cd025301f7a
SHA256 a35991863f12285cf385edcca8762a8a2a98fc69a578192238359f9173760879
SHA512 95919341f7239984a756f9affa4cc5d4f8fb1b4b812db9b7e35a723530f32f81d4e2ef6e4e98b0ee97866127ecb1bc301c32d2a13c5812a9c9887d6a057c139e

memory/2952-1537-0x0000000000890000-0x00000000008A8000-memory.dmp

memory/2952-1538-0x0000000000890000-0x00000000008A8000-memory.dmp

memory/2164-1592-0x00000000008F0000-0x0000000000916000-memory.dmp

memory/2164-1591-0x00000000008F0000-0x0000000000916000-memory.dmp

memory/1992-1619-0x000000001C330000-0x000000001CAD6000-memory.dmp

memory/1992-1620-0x000000001D290000-0x000000001DA36000-memory.dmp

memory/2728-1647-0x0000000000980000-0x00000000009A6000-memory.dmp

memory/2728-1648-0x0000000001090000-0x00000000010B6000-memory.dmp

C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml

MD5 59c234b0786624d1d395adc5bbb169a9
SHA1 160b30d3214e1676d9932402ad6f07b06c8bef94
SHA256 e1ded6460a1736c6478451b1137343d2aabf91f16ac537b308cf7e3bbd0fc8d0
SHA512 9847c63d622c1bb08c1fd43a828841c09394c2163b7a398ec95c98261c1fc1ead3e0e3ed772ea3dd0101fd290cf9d408a49235f4dee95cbf1a38814801276b2b

C:\Windows\Installer\MSIA873.tmp-\Newtonsoft.Json.dll

MD5 0e32f5229d5ee7d288b6b3969a51fcbc
SHA1 54c09f07930525786fcf08b9c7aca24185a68fc1
SHA256 e1ca33208030c858254249b2c9aa6d8541c2e875343b2997f2b2f9e4993c96f8
SHA512 64e8499e668ea44397ed5ea009e3692b623d2ac01bdd43e460624fe0282a3398025e4e53282e0f0905062b60400f4c16a64933ed7667de942f1588dd936aebcb

C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml

MD5 d1122dd4556ef907e1fa2da6123f3b75
SHA1 ebcc5a83a287b07a444f4fc085f845791ebb7381
SHA256 4755392eda466a1bd4394e9a57b506b86a140b4fa929e9bde8b2a3eee8d1b010
SHA512 2ba45a982c1e560c1be16e680de2f6f01dd9111f4294772442f2a76eec96aa8d3add78ecf139524aa36af2db27ce2610450e9138f074ef23317ac45c54aafeb0

C:\Windows\Installer\MSIA873.tmp-\srsl.dll

MD5 6fc50184e3aad7f4df0231da697a9da8
SHA1 fef8608d31e8e1c16ca7db402fa352ee7231585b
SHA256 58e698c208cd6ad94d2da3511447a975605e2b49bbdb7b572863f318aaffe0cf
SHA512 626b0a4031571ca906311937583f646aebdc7aacd5afb5ddf66c2d45dbc335e026d337d4f5803c38ddd022b9e64c79b4dd30d094d5d01a669e99d6c6829650b4

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

MD5 5f632053ee6c38ddad11738a586eaff5
SHA1 a783b044f531537977e8cfc67ba4fe946e1a14bc
SHA256 6ede4a9ea9b681e76bd56f735d3d4ee3a169af3b29c80d4a49c713650570732b
SHA512 7b613b26d6b8e2ff55cc254d6d6cf4541dc4862b79cf56c36477e0dcded21a01cc9163ec90e29f887d33690408aea73ab25742e3750834b329a10914a4e4781b

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini

MD5 988ea61855eab89ff1f69e884a6bee04
SHA1 5d4792d34fe3939301eefa968ab5b5e8d415aec1
SHA256 010436597702c768cd6f56b169a523c69a64459e5ef04fefbeaaa1bd087a6fe1
SHA512 eb8df971b4dfacb0772571147e32a191161848464d24ab3be690f7308378004259c03375618ffbb332316b8bf21f637ce7fe694322590d9b56af65695e3d3b9f

C:\Windows\Installer\MSIA873.tmp-\Interop.NetFwTypeLib.dll

MD5 a084b0c082ec6c9525336b131aeba39a
SHA1 45db1f5cc54a033e5df460b93edaa5d23a39ced9
SHA256 7cba99a0f2a5b233e341f691c2aa6cb4ca10065425fc478b56fa468d6b0af54d
SHA512 297ba29e1ee4300f1a11620d475e67a9747fd9affabeee5fb5151b07c931c8f5c5af12b956e2ab7bd7dc6ebb1dbc298f5d56fa419f5fe2e3646053c0e515e29b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b873ae16b9a278c05eb394b1c3e6f01e
SHA1 b1bfdd48fc22397b0ba1e3af5383c3aa91e12b04
SHA256 bf62877934da4c50c179981de5036ac54de60e217b6a79ed92ed7aeffbeaf83b
SHA512 09f17634f9ad2a1ba751be87aab97039633c919097eba03b0c3a72548ec7d1bdfd771207ada5e856b11eb3c8697f6ed12c03b2462cc55ceb7ceafc490264753b

C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\ijazl8r1.newcfg

MD5 e63124182b01866613f45b98be84b02f
SHA1 85477c23bd25ca417da6036509d280e6b03efc80
SHA256 2ec7efadfa1c06ca2ce420e2e131084ee1caf7c05aa4ae329b0563ec7a912fe1
SHA512 e476a210845afe4d6200dddadb658197a65967d697118b21ca0ced1bc4676a6552517f604cf53ff8cbe2f5e0577f191248300d794289a906a01593096745423e

C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\user.config

MD5 f6c794fa77efaae9d846d2c32a29f332
SHA1 a200a170eab06675674878df80aa5dd9e9c1261e
SHA256 c843b20c6ae6ba3ce2aa193ecde0e8ab32dc22aac1c81680cba82ca3e2e226fb
SHA512 79d76bdd81f966558e72b3e3ad4760246474352a59444d7476ed71cd5750f8e7b81ce973d942f9df3366551fe75ae3e8b1f013255f638f6065359a6aab6d0208

C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml

MD5 5c2f9f2351f859194601f0afaa02413c
SHA1 7448ea0605d01703b4d021f5aec53e0be4a56b74
SHA256 92a0fa11c844dfad68674dc01e5d6bc2142295a2d10c77671a57f4314289a664
SHA512 1140ea9a5177341e1a81d2f0449e028da00cae8c21941fef5b0fad4e3834cf27c4bb3cb20aaa22044e00c4ce68a0b1465faeef49cfc6881fc0bfad48a478b7f2

C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\larpkm0v.newcfg

MD5 f374e85371765e34fe886c324e8c98c8
SHA1 b43d6a67f8cf7f146ec0be23b3d070d491e5b7ad
SHA256 77a6a5cab92b9891a1d2f78cd45403354ec8da979516431ab3835762653b71ce
SHA512 a703bd2a61aff4d7a1a25452d878bb689c57fd84ae24df3e3d0c8e1ec036489f4ada37ea3d0990de3a4acbd4199ee118dd17f001a59b95822a0dd5ee1425d695

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data.temp

MD5 444dfcb62fb09ad8de699a5d55d95b79
SHA1 f1cef14842b4791879318c31aa79d38d01a7290e
SHA256 c0a07d63b5dce56a498bdae1c6729182d736f2592151232d8df3ce7162f865a7
SHA512 8dc97ff55ae760728afd046a2ec0fe7947ffc59ded6830f0f8aa2ec4cadb063843b3eefabef4e29dbf7986a5caffc003373ad4abee6fcc47f12e51223696999e

memory/920-2606-0x0000000074950000-0x0000000074EFB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsj7476.tmp\Ping.dll

MD5 b0e9ba9dab60cb7a9fd886dcf440cac3
SHA1 c416f6e9ba379feb9008c775d8456514444b66da
SHA256 52d52e5a1e1cec3e2db08555a8b2651f636cf76c6a24e32aa446595365cf193f
SHA512 90de38a7c57f59e8deb17c2473a215e2f052aee909a47ef37a88fefcfaeb5e6b54d462a39bcac4d0f1aa88d1806ba9e1237d0eeba98f7a0479bd6825e841f043

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-02 04:32

Reported

2024-12-02 04:34

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

97s

Command Line

"C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe"

Signatures

Panda Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A

PandaStealer

stealer pandastealer

Pandastealer family

pandastealer

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\rundll32.exe N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Browser Infrastructure Helper = "C:\\Users\\Admin\\AppData\\Local\\Smartbar\\Application\\Smartbar.exe startup" C:\Windows\system32\msiexec.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\SysWOW64\rundll32.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}\NoExplorer = "1" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0} C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}\NoExplorer = "1" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly\tmp\BE16P5P8\__AssemblyInfo__.ini C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\spusm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Resources.SocialNetsSharer.XmlSerializers.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp-\RegAsm.exe C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\assembly\tmp\99V4AADE\Interop.SHDocVw.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\srut.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\Interop.NetFwTypeLib.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.XmlSerializers.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp-\Smartbar.Personalization.Common.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp-\spusm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\Microsoft.Practices.EnterpriseLibrary.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\Smartbar.GUI.Controls.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\sismlp.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\srpu.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp-\sppsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp-\Newtonsoft.Json.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\Smartbar.Installer.CustomActions.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp-\srpdm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\Smartbar.Resources.Translations.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\spsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Installer.CustomActions.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp-\spbl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp-\srpu.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\Microsoft.Practices.EnterpriseLibrary.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Resources.LanguageSettings.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Installer\e578fb1.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\Smartbar.Resources.LanguageSettings.resources.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\srns.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\sismlp.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\Newtonsoft.Json.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\srprl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Installer\SourceHash{9726F9E3-EE13-4601-B2AF-81B1413BD8AF} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp-\Microsoft.Practices.EnterpriseLibrary.Common.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\spsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\Smartbar.Personalization.Common.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\srbhu.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp-\Smartbar.GUI.Controls.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\sppsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9E73.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp-\sipb.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp-\CustomAction.config C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\spusm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\spbl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\srbs.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\Microsoft.Practices.ObjectBuilder.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Resources.LanguageSettings.resources.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\srpu.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp-\srbhu.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI94AE.tmp-\srus.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI9F11.tmp-\Smartbar.GUI.Docking.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\srsl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\srbs.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIBF1D.tmp-\sipb.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msiexec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1576044581" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439878966" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\URL = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000013f787289f1be14e87be8dc204ff715d00000000020000000000106600000001000020000000dc9e83e93f3edf0f49363e298a3b9203d8c53901cadad69d8372992c1324c353000000000e80000000020000200000006d96d467db57ef79d344edbcb3255ca07efc6ecf747ec1e9c24c7d49ca2acdf120000000424e8c34cc6019bf84473c817c7b08500d283de87490f8a1e18cea42bb13ff4140000000f0d02be4dc373e42152049b5dd002d405f85db8e82962790ea58f340f89e4cf3817a721f6bf2ce44169e4c92594a5f1ac39fd40f4b117b593d4aa593adf6d2fe C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=GB&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=ds&q={searchTerms}&installDate={installDate}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\DisplayName = "Web Search" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31147123" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1576044581" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use Search Asst = "yes" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\USER PREFERENCES C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{AE07101B-46D4-4A98-AF68-0333EA26E113} C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{ae07101b-46d4-4a98-af68-0333ea26e113} = "Smartbar" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\URL = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\DisplayName = "Web Search" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\SearchUrl C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use Search Asst = "yes" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\Default = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\URL = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=GB&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=ds&q={searchTerms}&installDate={installDate}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{006ee092-9658-4fd6-bd8e-a21a348e59f5}" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Smartbar.exe = "9999" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8973E9DB-B066-11EF-B319-D6A59BC41F9D} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\ShowTabsWelcome = "0" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\UseHomepageForNewTab = "1" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\Default = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=GB&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=ds&q={searchTerms}&installDate={installDate}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\UseHomepageForNewTab = "1" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchUrl\Default = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000013f787289f1be14e87be8dc204ff715d000000000200000000001066000000010000200000001d0cd17502deb87b7c34819a3cfe55a40e4957d1498f5c673db6fabe9443b190000000000e8000000002000020000000d4e3cf73e73ab8df7c59d85abd3f4ecbc180aba1a45ede35e8143ef42413779b5000000054aa1488d1f1d7cffdab7424b9576142bd77d44084e93871c19df4789bc4a1baf947909e4893a8301904ca6d907315f3a9b1e6f39ea593a050bce9d9c0e97ce63d906b22a89d17659114e07d09fdc84b40000000410209f727341aa3c63a2ab7cda14f49a1024287c483e42feb1898006fa6034b2e976ac6cf9a4266303106f8875d38e791970636fbd7c7aefc99d4f74f0d904f C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\MAO Settings C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Search\Default_Search_URL = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=ds&q={searchTerms}&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\SuggestionsURL_JSON = "http://suggestqueries.google.com/complete/search?output=firefox&client=firefox&qu={searchTerms}" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\SuggestionsURL_JSON = "http://suggestqueries.google.com/complete/search?output=firefox&client=firefox&qu={searchTerms}" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1582451223" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{006ee092-9658-4fd6-bd8e-a21a348e59f5}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\MAO Settings\AddonLoadTimeThreshold = "10000" C:\Windows\SysWOW64\rundll32.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=GB&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=hp&installDate={installDate}" C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=hp&installDate=02/12/2024" C:\Windows\SysWOW64\rundll32.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{BDB01BD4-F243-3D0D-A89F-0D7CEE94AC21}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F6AA-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F281-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{2009AF2F-5786-3067-8799-B97F7832FDD6} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}\InprocServer32\ThreadingModel = "Both" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}\MenuText = "Shopping Helper Smartbar" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}\Implemented Categories C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A2CCE3E1-31E1-3A80-9E94-3F818328FB20}\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F4CA-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLAreasCollectionClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{18414891-2AC1-3457-B4A1-248A55912A51}\7.0.3300.0\Class = "mshtml._DISPLAY_BREAK" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F24D-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32 C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A4C7AE7E-D238-3AA8-BFB3-04E2C443959B}\1.1.0.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8B475115-532C-3483-8333-FA1CB6A620D7}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{47A03182-4FA3-306E-AF15-902E10310178}\7.0.3300.0\Class = "mshtml._htmlUnit" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F279-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F3FE-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8A507758-725A-3C67-9324-D93FD68ECC5A}\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8482A40D-9454-3073-B93B-3ACF16C38DD6}\7.0.3300.0\Class = "mshtml._styleTextJustifyTrim" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F32B-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F273-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLLIElementClass" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{06FEA59A-AEB1-3597-8826-61ED753ADC44}\7.0.3300.0\Class = "mshtml._styleRubyPosition" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F245-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F275-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F5CB-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLAppBehaviorClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9B96EBC2-1B7F-33DF-AF55-9C2AD6BC551F}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F275-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLMetaElementClass" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F276-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLBaseElementClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F3F5-98B4-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F3E8-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLFieldSetElementClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F4B8-98B5-11CF-BB82-00AA00BDCE0B} C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{34A226E0-DF30-11CF-89A9-00A0C9054129} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}\InprocServer32\1.0.0.0\RuntimeVersion = "v2.0.50727" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6E7B0F28-0DDC-3AFF-A175-CD28A181C7EC} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{FCA45B37-4187-3803-BE3C-6CD2A95783AD}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F80E-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32 C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F26A-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F27D-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F4CB-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F48A-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.CEventObjClass" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{E7FBBFBE-95EB-389E-A557-C804CDCE4358}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F268-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLUnknownElementClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{163BB1E1-6E00-11CF-837A-48DC04C10000}\InprocServer32\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{163BB1E1-6E00-11CF-837A-48DC04C10000}\InprocServer32\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F285-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F630-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0 C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F26A-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6D55083F-D6FF-3028-A8A3-95DE56BB6EDF}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F4B2-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLDOMAttributeClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{12A025D4-7210-3AE7-B626-DAFACADC256B}\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{163BB1E1-6E00-11CF-837A-48DC04C10000}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{25E1210D-EE4F-33C9-9D14-5A619A077233}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{FB2E65F4-5687-33EF-9BBF-4E3C9C98D3B9}\1.0.0.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B272899F-EB7C-3093-A531-BA9F69B31CEE}\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Local/Smartbar/Application/SmartbarInternetExplorerExtension.DLL" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{3FB5C8C6-11BF-32E3-9F5E-6F95AFA8D553}\7.0.3300.0\Class = "mshtml._POINTER_GRAVITY" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F4941A96-874B-3701-980D-464748D7920F}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9778FF5E-CBCB-3A8E-AA0C-69F4540870C0}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F280-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLBRElementClass" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F26D-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{06FEA59A-AEB1-3597-8826-61ED753ADC44}\7.0.3300.0\Class = "mshtml._styleRubyPosition" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F3D0-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0 C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F38F-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{7716A370-38CA-11D0-A48B-00A0C90A8F39}\1.1.0.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 C:\Windows\SysWOW64\rundll32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186819000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 C:\Windows\SysWOW64\rundll32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c00000001000000040000000008000019000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b0400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 C:\Windows\SysWOW64\rundll32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1496 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe C:\Users\Admin\AppData\Local\Temp\Installer.exe
PID 1496 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe C:\Users\Admin\AppData\Local\Temp\Installer.exe
PID 1496 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe C:\Users\Admin\AppData\Local\Temp\Installer.exe
PID 4816 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\taskkill.exe
PID 4816 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\taskkill.exe
PID 4816 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\taskkill.exe
PID 4816 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 4816 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 4816 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 2604 wrote to memory of 2396 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2604 wrote to memory of 2396 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2604 wrote to memory of 2396 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2396 wrote to memory of 4404 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 2396 wrote to memory of 4404 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 2396 wrote to memory of 4404 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 4404 wrote to memory of 1568 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4404 wrote to memory of 1568 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4404 wrote to memory of 1568 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1568 wrote to memory of 2528 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1568 wrote to memory of 2528 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1568 wrote to memory of 2528 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4404 wrote to memory of 4408 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4404 wrote to memory of 4408 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4404 wrote to memory of 4408 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4408 wrote to memory of 3204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4408 wrote to memory of 3204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4408 wrote to memory of 3204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2396 wrote to memory of 2220 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 2396 wrote to memory of 2220 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 2396 wrote to memory of 2220 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 2396 wrote to memory of 1416 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 2396 wrote to memory of 1416 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 2396 wrote to memory of 1416 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1416 wrote to memory of 4724 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1416 wrote to memory of 4724 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1416 wrote to memory of 4724 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4724 wrote to memory of 2952 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4724 wrote to memory of 2952 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4724 wrote to memory of 2952 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1416 wrote to memory of 4820 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1416 wrote to memory of 4820 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1416 wrote to memory of 4820 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4820 wrote to memory of 5096 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4820 wrote to memory of 5096 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4820 wrote to memory of 5096 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1416 wrote to memory of 3580 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 3580 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 3580 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 3000 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 3000 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 684 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 684 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 684 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 4508 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 4508 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 3104 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 3104 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 3104 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 2792 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 2792 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 3448 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 3448 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 3448 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1416 wrote to memory of 1516 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe

"C:\Users\Admin\AppData\Local\Temp\202dcd065752d8e3d74ac43b70ef3267fd5c10d892fc9655a094575cdba410adN.exe"

C:\Users\Admin\AppData\Local\Temp\Installer.exe

C:\Users\Admin\AppData\Local\Temp\Installer.exe /quiet ARGS=HP:1;DS:1;NT:1;DOWNLOADPROVIDER:ShoppingHelper;PUBLISHER:ShoppingHelper;ROT:ALL;ROSP:1;CSH:1;SHOW_UNINSTALL:1;VISIBLE_IN:FF,IE

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM msiexec.exe

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\smartbar\Installer.msi /quiet /quiet ARGS=HP:1;DS:1;NT:1;DOWNLOADPROVIDER:ShoppingHelper;PUBLISHER:ShoppingHelper;ROT:ALL;ROSP:1;CSH:1;SHOW_UNINSTALL:1;VISIBLE_IN:FF,IE;INSTALLATION_ID:5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding D9057301560173116C9A8254200335D0

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSI94AE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240620781 2 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationStart

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1h3yx8st.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9943.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9942.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wph_5oi6.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B76.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9B75.tmp"

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSI9F11.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240623390 6 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationRemoveFiles

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSIBF1D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240631625 73 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationComplete

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ieog8ci3.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1F9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC1F8.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z39_zsf4.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2E3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC2E2.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Microsoft.mshtml.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Microsoft.mshtml.dll"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll"

C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe

"C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=sc&installDate=02/12/2024

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://feed.snapdo.com/?publisher=ShoppingHelper&dpid=ShoppingHelper&co=TJ&userid=5f91d3d2-c1ee-ded0-9d50-3d4a869ecfb4&searchtype=sc&installDate=02/12/2024

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7ywxroil.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF425.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF424.tmp"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:17410 /prefetch:2

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ds4mcpmp.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7CE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF7BE.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jcmgfmf8.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF8F7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF8F6.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uk-yekej.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF9F1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF9F0.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y041cerb.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFAAD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFAAC.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\apdaahsq.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFBB6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFBB5.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ujkqdd9e.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD4D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFD4C.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8y6h4hxg.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE37.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFE36.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ouyrq4d8.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF8F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFF8E.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oi6dmwls.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES106.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC105.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4afc7wb1.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3F3.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rzrhjalh.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES694.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC693.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xghfualj.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAAA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAA9.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 cloud-search.linkury.com udp
US 167.71.184.143:80 cloud-search.linkury.com tcp
US 8.8.8.8:53 ws-cloud.snapdoapp.com udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 143.184.71.167.in-addr.arpa udp
US 8.8.8.8:53 crl.usertrust.com udp
US 104.18.38.233:80 crl.usertrust.com tcp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 crl.comodoca.com udp
US 172.64.149.23:80 crl.comodoca.com tcp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 cloud-search.snapdoapp.com udp
US 8.8.8.8:53 ws-cloud.snapdoapp.com udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 104.18.38.233:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 8.8.8.8:53 feed.snapdo.com udp
US 172.232.4.213:80 feed.snapdo.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 8.8.8.8:53 ww99.snapdo.com udp
US 69.16.230.227:80 ww99.snapdo.com tcp
US 8.8.8.8:53 213.4.232.172.in-addr.arpa udp
US 8.8.8.8:53 ww7.snapdo.com udp
US 199.59.243.227:80 ww7.snapdo.com tcp
US 8.8.8.8:53 227.230.16.69.in-addr.arpa udp
US 8.8.8.8:53 227.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 ws-cloud.snapdoapp.com udp
US 172.232.4.213:80 feed.snapdo.com tcp
US 172.232.4.213:80 feed.snapdo.com tcp
US 69.16.230.227:80 ww99.snapdo.com tcp
US 69.16.230.227:80 ww99.snapdo.com tcp
US 199.59.243.227:80 ww7.snapdo.com tcp
US 199.59.243.227:80 ww7.snapdo.com tcp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 cloud-search.snapdoapp.com udp
US 8.8.8.8:53 pool.ntp.org udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 123.200.159.162.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
GB 142.250.187.238:80 google.com tcp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 74.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 csc3-2010-crl.verisign.com udp
SE 192.229.221.95:80 csc3-2010-crl.verisign.com tcp
US 8.8.8.8:53 az412542.vo.msecnd.net udp
US 152.199.19.161:80 az412542.vo.msecnd.net tcp
US 152.199.19.161:80 az412542.vo.msecnd.net tcp
US 8.8.8.8:53 ws-cloud.snapdoapp.com udp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 install.outbrowse.com udp
US 13.248.169.48:80 install.outbrowse.com tcp
US 8.8.8.8:53 48.169.248.13.in-addr.arpa udp
SE 192.229.221.95:80 csc3-2010-crl.verisign.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 au.snapdoapp.com udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsz84F0.tmp\Registry.dll

MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

C:\Users\Admin\AppData\Local\Temp\Installer.exe

MD5 564e47a3604ced3b7c18e43250226cd7
SHA1 a3eef8fac3617d048fb9fce2201937297e3920f1
SHA256 12ae00fe728b441221acd10483eeb1197884738e9bd6eb715ceadeea058c6c83
SHA512 e925e2a5b60c7257ac6b57b3fc12675d2cc490070c456a8e794f54c6732cc34981c0d88a5acfb2214fd316194f24eae83e8151cfab101daa2f1b59f2d621cdbf

C:\Users\Admin\AppData\Local\Temp\smartbar\HistoryWrapperService.dll

MD5 3cf46bae7e872a661721b0894bc076e2
SHA1 eaaa0a35e284908dd21cf245a38efe9d2e4c7532
SHA256 7ca73cfb8d0502b14b657216b8735394cbd08aa8e4266fb9e86ad84ae159b043
SHA512 47065a1cb81b41cab7c98488609470b308c708ba73c0e11c3f06901fde008b280f3b75ee825c12e4681aefbd8a43840e0319b43bbab7fe68b24c30926d0ce9f2

C:\Users\Admin\AppData\Local\Temp\smartbar\GuidCreator.dll

MD5 4876414d51fe01bd8525df2f8acd35d6
SHA1 f9435c39e3029276e71a971e48f68d3f0298fe11
SHA256 4bda5a964065b918ce70a27914056b17a95e3f8002028b394ecf8ff2d7cebf3d
SHA512 d18afa3d806fd056836beb5a0822156402afe3455567d41f9b27d578980d5ae341273cadf5dff3175a799e791822e07eede03e3c0c143604f980f7876cd2fc0a

memory/4816-27-0x0000000003000000-0x0000000003010000-memory.dmp

memory/4816-28-0x0000000074172000-0x0000000074173000-memory.dmp

memory/4816-32-0x0000000074170000-0x0000000074721000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\smartbar\Installer.msi

MD5 e5314db579a141f6a5204f70e7073de0
SHA1 3d2e28be7594fd754213e3ea19b4f900f6634c91
SHA256 84263b76687ff69f306579fb3f05f3a0528db029cf0f2f60eddc22549545408d
SHA512 f18c446d8e388759c12527ca970dea3c24af954d199c39027eae4ad8c97df7c902f24845ab0ee0ffd9ad9ee6768c43169b11fec47bd3246cd2e9c7e8da44993a

C:\Windows\Installer\MSI94AE.tmp

MD5 44c66c7febaf067ac2f96e3bb643a5b3
SHA1 bc83eb57ebb44206b467c4147a7f82d52662e9b5
SHA256 641fae557b683029787befda2a2ed5251b19a4c11fc19e3dbf2cd97459e7e383
SHA512 41ce527bd09ae6b3126947197c94169121dcffe79b9db624a17a3a45d4e25a2f53dde0a686b4329b9e2d5c33bbbc6d6b9cc840b97731eac38ae31254dfd3364b

C:\Windows\Installer\MSI94AE.tmp-\Microsoft.Deployment.WindowsInstaller.dll

MD5 34d4a23cab5f23c300e965aa56ad3843
SHA1 68c62a2834f9d8c59ff395ec4ef405678d564ade
SHA256 27cf8a37f749692ab4c7a834f14b52a6e0b92102e34b85ffcb2c4ee323df6b9c
SHA512 7853f1bc1e40c67808da736e30011b3f8a5c19ddf4c6e29b3e0eb458bea2e056fe0b12023ceac7145c948a6635395e466e47bdd6f0cfa1bd7f6a840e31e4694c

C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Installer.CustomActions.dll

MD5 2120dbb0481374885af660346f503b9b
SHA1 0dad9f77c93325cbe2499efac70ebbbfd8e1a4b3
SHA256 ef0e1d3a5f58e797c47d1ca2999e6ab1e94520c3816a8264874920c26c9ae474
SHA512 46966d2eec899fbd48b8aaf5e72555cec3b2f1bc2481c2eb014d98078aa6b6e825144718fbe2aa7b23d816462645186abbfc2ebdc7a4f331d5087999f21ca68a

C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.dll

MD5 5dc8a7062040e05ad36bd83246954b05
SHA1 f6807be0413724076c8c384576ad9a5bc1413e8c
SHA256 d00f229036a6ea19e05c9838f2827fdb22b3003af4c7c97b37abf2ea36236dfc
SHA512 43cda9b7a57ae292b71df7a8f02c359b486a82162f92e2d8a7449f2b9c835a7ba44177477a7e0763a5698a4b2d9a025f8786c054950db3fab017edfdf4c17f12

C:\Windows\Installer\MSI94AE.tmp-\srbs.dll

MD5 7ec601a05f97c73fc2180e8c57efc9af
SHA1 7c99dcdcec211459b1d9d429e2ada2839876f492
SHA256 982d12314935e25a016da0bec644bc4c8bd02b0984eb70b76e081b3562a6adf8
SHA512 119e216313540f0fac30c1a8e531909dbdc8022735a9fb73b80c8bbbb2ff0548cdf911e640cd19827acff703c95b1d8db0ddf3ed61d056e9e4d4f437b8c88e7b

C:\Windows\Installer\MSI94AE.tmp-\srbhu.dll

MD5 fcbe6dec3d2da2ac9fd2754cc9cf6ad9
SHA1 7954bdf16f99bf843c5c8053a078813d87c94254
SHA256 71688a7955124b644cb05833d8285b876c7ff336eb4478ce01e1f80b07f7b76e
SHA512 5975297ac6aaa7d85842079809f9be2ad57959da2687de4bb7aa0764bc16dd878c482a92d7c4a4ed484aa7683f60c90b870757165f79d7ae481b7f7897e94c39

C:\Windows\Installer\MSI94AE.tmp-\spusm.dll

MD5 e28c8d2fd64ba27d9b992fc325f26a9d
SHA1 d9ed413265967b6ede8787aa8c5e5734a4ea1358
SHA256 82d96714ac65e6e18e3da619cfd1367416bba5ed6d08db7bf312f8937f95f2ab
SHA512 e2fcc5972c48fa1d26d2df0b2c5ed4e34d15d7f08eb35510989441b4083f30d19f6d5fc2652ac42d11a3877f333ad4408c0cb547ecf7b948e1f324f719cfc739

C:\Windows\Installer\MSI94AE.tmp-\sppsm.dll

MD5 787104ad9dea702d115883c489be54cb
SHA1 b24680d170c610203df5e3d1d52b2b04f938dd56
SHA256 934230fc9da4c6eac4b1f916baec075ac5faf1a70af14dcdb62d3d06ca878cd3
SHA512 861147b8ed484a25a5ca9af8b7488896ee41dfd4eb57dafd4bb33455b03936c8fd930224fd9a1a0e8dcddf0fc33bc7adfc3ac48ca3ff430122f3ce18952fe312

C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Personalization.Common.dll

MD5 347b0b5d32b1a85b5450b08cfb6d2e75
SHA1 7bfe1857974a6c6c3e882624d820311c1e3bf670
SHA256 76a9f22039731c1fb3871876dd8c55d4ab75635367daa811ced5ed70eed950ac
SHA512 d79edc2546249f71a19faa1ee4aebdfd2faa8b6b56615740c93023255c81716de6c4af484bde506f7dcd80b607d8804313589e58b05dd2448d5c1fca3cd39e92

C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Infrastructure.Utilities.dll

MD5 562ac9921d990126990c2f0bdce7081a
SHA1 f395458d8e328cf4809385fef3e225d01f8a8fc0
SHA256 ef84e1ad9cf174a9ab0bba648b56f2ffd17f4cb4421902b61559b544d812e738
SHA512 f52a9a62ca7d810804289ffe0300919eea529f2e0d4d07709309e101087809a5a004437184f3a3518fcd286db18947d78ce00bafbcbbe7b62a8aca4cf8295208

C:\Windows\Installer\MSI94AE.tmp-\srut.dll

MD5 feba43763a9b7fe1c94d681055d10167
SHA1 49d30dedf868accf07e6895e1699a4d751235fd0
SHA256 0634fa964eba9baed92e2a935aef925fdaa921a35424b6ae9bfaaace932dc49d
SHA512 680116cfe66472c4d6ae9c94d74cd3fe8cef1c9beade27c19e58369c2c6f238f9e63019d7ea2b8b35689b7c0e812f2ee49d26a56e6972d3e21dc5f7312cf81ef

\??\c:\Users\Admin\AppData\Local\Temp\1h3yx8st.0.cs

MD5 6f8e0c3c3b1b9a297b8ee6bfbb9c2a2c
SHA1 1dbab29ad6fb169fad90e963dd0c5290f27272fc
SHA256 e0514048fd6f4169c41896332a243cf014a719e5fe217c5743fc3c7149db578a
SHA512 193fc4f01b6afb2a858f006eb7c5dfd6106d88b0b0e0f12b4c8c103a8bae270ff0d583886ec5af910ce4d50cb1ccfb54a14d27fd517b847a624d9ba79f688640

\??\c:\Users\Admin\AppData\Local\Temp\1h3yx8st.cmdline

MD5 33490b4dd64dec2b90492ef6a521a799
SHA1 d3e1fa01c9d0af19b8394547e84bc3a99590bbdf
SHA256 17204f4523e42de9c380493c16918a27f61821afaac37de80881ae38f1086102
SHA512 aa47310d975525c6ec6937df145f95eb36de1d5df848d47e5b6cd0e5fac665641007c5093ff8d0b05bf549b7e0b7cd842abe81aca04b86522d18059e7fa5f51d

\??\c:\Users\Admin\AppData\Local\Temp\CSC9942.tmp

MD5 556544a56d00ce1f661f9ffeae4cab46
SHA1 a4f0c914d7fb515f24e28ae3beee98f0abc2f7e0
SHA256 2f0240a89ca575de8e0602dd741b5df071574170cb2aab587f5dbb38a9a37a4a
SHA512 2de8d170220a85a67a3c37ed528c6de942efc2f58c262df78bc0bf258cd9d9f396bee99a8b8645e8570c1f3915cf3dab2e1935fe96f7ff05d5c0bb0203739b67

C:\Users\Admin\AppData\Local\Temp\1h3yx8st.dll

MD5 359438854ecbfa5626c4b516e2eeb89d
SHA1 d2ca5be87d62d3473ed90d26ed0c4e7e64d9ef37
SHA256 84160ac68a08b62c5768487383906c33ab56f63ba7d0cb872784f703997ec890
SHA512 32cc7220c280acf0845840bc972b324a5f44db944fa12b501af988c0c6a6d46a190768544f75c84c1f3ebf217d58541fbfe306455e3b8461fd735f38bd998156

C:\Users\Admin\AppData\Local\Temp\RES9943.tmp

MD5 5eb45834abbb2ad38d388a304f73e276
SHA1 e54465410f161c39e4da6e03ae15df1c2bea74d5
SHA256 82ca5278bc2abeb4c78a362d47c7b007785927b40a2cb590fefbf0207b04f73f
SHA512 b2bc3aa6b3614c8e9404537c69edefbc8c05bf3344923900dd390f9eb05fd29167ca3205325a50d657a2d2d5b55ef2dcd183dffefd77de625677e3876887b530

C:\Windows\Installer\MSI94AE.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll

MD5 7868ed46c34a1b36bea10560f453598f
SHA1 72330dac6f8aed0b8fde9d7f58f04192a0303d6b
SHA256 5c17864f1572acec1f93cf6355cfd362c1e96236dcba790234985a3f108d8176
SHA512 0cc913337e3334ff0653bc1fad044d9df60a8728c233dcc2c7f6139f14608740b70b57c25a9d2d895cbc4d59508779f342a72406e623d30365ae89fb2a3607ba

C:\Windows\Installer\MSI94AE.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.XmlSerializers.dll

MD5 adb53ee43f74f430368449b98b2f6f86
SHA1 fb882d80da9ccf79c6817a492fbd686d4759bb41
SHA256 b7837a68ede7781286057de0b59b7bb9c7c29ff9e9ded32c7175cafe9de3b5ff
SHA512 8fc2cd5a585c8247274fbe8d53ac27faa1f2b0407d27e5e78d6917cfa94947ace2aa20ca670a5b87e3d7a939360691102ed9c7530ec997af1057064bcb9c085a

\??\c:\Users\Admin\AppData\Local\Temp\wph_5oi6.cmdline

MD5 cbe98f67f29230a91c5256cc2571dc74
SHA1 347fbd7713e5d3dcdae735361dcc9232d5c9269d
SHA256 f2ae13b38fb7774b6b825b7d1e97c27364279703ea6d5e9be5a64e24f91842f4
SHA512 b7b05377076c01427f3d0bc001aa3cc44de7cb9ec6c4c419827c2543975a74bb85b4d06a80a6bd624bd57e260124a42aebb77b895a038889f93fee6e74f4eabb

C:\Windows\Installer\MSI9F11.tmp-\CustomAction.config

MD5 796621b6895449a5f70ca6b78e62f318
SHA1 2423c3e71fe5fa55fd71c00ae4e42063f4476bca
SHA256 09be5df7a85545fd93d9fd3cd1d6c04c6bfe6e233c68da6f81c49e7a35fcbb84
SHA512 081cf1dadb3a0e50f0a31ab03e2b08e80298c06070cd6f9b2806c08d400c07134623f7229a6c99910c6243dfa53c6e2c05d09a497aae1e701bc34b660cf9e4c9

memory/4816-376-0x0000000003000000-0x0000000003010000-memory.dmp

memory/4816-377-0x0000000074172000-0x0000000074173000-memory.dmp

memory/4816-379-0x0000000074170000-0x0000000074721000-memory.dmp

C:\Users\Admin\AppData\Local\Smartbar\Common\icons\30DFF8F0-BA79-4360-A3EA-51B6D006133CPress.png

MD5 5719ee7f6521ae142f0557f0706cded1
SHA1 a1d5694197827967aea5b3ccc88e2f91d465c283
SHA256 0a2ae8f3e9aa552748cfeadaec055778487602e7f6d4a6c2a221fe1fd496bfaf
SHA512 cde76dada9e798a746d7ae23ee189940a6b7660805267a9221501c5c911a89b298005f111622fae7c886e810e23f83b77d47fa75793d19441246eb775a2f2bf6

C:\Users\Admin\AppData\Local\Smartbar\Common\icons\3C610B86-19DE-4757-B46A-871C9C27FF0APress.png

MD5 2768222689e3585d609b5a2afc1ba52c
SHA1 ee522df6b2e365857bf6be58ac7150cbc71cfc9c
SHA256 21ee471e79b0a646735e132bc1f0c48f464677127b105426e00b160a554de6b0
SHA512 56527749dca471af92eb4166b2bb6f1ca4cbf07c8d7e1a201378467f1d08efe5fd913715bb995d35c7d511b2cbdc9469d79baae7ee4bab619e4e11753c3505e4

C:\Users\Admin\AppData\Local\Smartbar\Common\icons\B1BEF453-913F-4EC4-B057-A2BB21C09DCBpress.png

MD5 e6ab030a2d47b1306ad071cb3e011c1d
SHA1 ed5f9a6503c39832e8b1339d5b16464c5d5a3f03
SHA256 054e94c94e34cef7c2fad7a0f3129c4666d07f439bfec39523dca7441a49bd7c
SHA512 4cbb002cc2d593bafd2e804cb6f1379187a9cae7d6cc45068fda6d178746420cc90bcd72ba40fc5b8b744170e64df2b296f2a45c8640819aa8b3c775e6120163

memory/2604-1113-0x000002559B270000-0x000002559B296000-memory.dmp

memory/2604-1140-0x000002559B240000-0x000002559B260000-memory.dmp

memory/2604-1237-0x0000000000910000-0x00000000009F3000-memory.dmp

C:\Windows\assembly\tmp\QFK6B650\System.Data.SQLite.dll

MD5 c2e38bfe933c5bce36910fe1fb1d5067
SHA1 aac5ed2724e2f88c7af1a3bf56d73180ae709bb7
SHA256 49a51063aaccc22a28590575417bdff40a67a06e6f2a67217b37af1b49fa6286
SHA512 281225b5e7193270b27811224c70475fc9af47c5d05a7e98f6856ad6abccff084302d0ddb72868d6872eef2efaf2989645af5e596083bfb995f214182aa4184d

C:\Windows\assembly\tmp\99V4AADE\Interop.SHDocVw.dll

MD5 030a99f9594434ea83d27b33a95c4d5a
SHA1 230882058a1d50e4e8f7fa4bb3144dec506c5967
SHA256 0fdc72a06cc54771f1b07293d2e914cded985d84833ed4bf952a665eb107b5a3
SHA512 529d14374df0b455db055027f42ccf731ddf4b7bef8fc27bffa2ff5a46463dc6b3cacf75fd6356e325f075d7fb70ad0f8abd85feb75d00befd1c86aec857d7ee

C:\Windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll

MD5 459ff9c6762b7fdd91c156ff3e096478
SHA1 7179debce9a271450b1241e7435a999aea1ddd05
SHA256 93865c89e1507409fbbeb9433542a303cdd2fd5acda3d51fecd83e4a8fb8072c
SHA512 8b95330d364413122427604af1c0e848694975eb8c541b911aeb0d50fbb5cd15a60863f68593f1088b26f83500f400f52292a2891511223f796be750c6a7583a

C:\Config.Msi\e578fb0.rbs

MD5 7084d0951ff09edbfed4971169d50f7b
SHA1 0901128edac9e3ca6322292f66ec46d1c16d9ffd
SHA256 aa89f118175d6491d1a622126dd5a923384aa3180b77fdbacbaeb64c0f9f5ba4
SHA512 929ae21104aeed2b29e5f596df1daca9ac3562ed922f982ffd9f5e5aa0ff03913b8e2f77cacde05e563fa15afdb42b0280457de48af123f9d23c9a29e6195bde

C:\Windows\Installer\MSIBF1D.tmp-\srprl.dll

MD5 d8fa7df1f2cd92ad701bc23f86d89b54
SHA1 72160fd5ad639c5a9c44305b06c98eb637399d18
SHA256 475a2c225258c571ae66c0178a83177bd5a59f4ce1be1f867e14e75614ad43e4
SHA512 a4d11c7f66325199f5c3a41cc37f32cf6ee828d790add1a6b77b9127e65243bb17dcc10b1cb2cbaac4e543bc329bd30e64919ffc0af3fd6088a672e08e10e992

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

C:\Users\Admin\AppData\Local\Smartbar\Application\jxbwpzxd.newcfg

MD5 ec3f05ac2148162ddb052f23299b8ecb
SHA1 6ce68e94fb7df83ae34094a85abfefce8a3b8d79
SHA256 449ab9dae5f16f9dc9e70e37930aeb4c78e057debbb8fe25fb5460a9666ec016
SHA512 d166cb06e095281a4a26bdb78e7752d8f9d0e408aa3048eea2294222aa0b7e901364ba377cfc353ada392693b15736c96267697dcabc745f2e4b3d539599b70a

memory/3000-1396-0x000000001CC00000-0x000000001CC18000-memory.dmp

memory/3000-1404-0x000000001F240000-0x000000001F70E000-memory.dmp

memory/3000-1405-0x000000001DE10000-0x000000001DEAC000-memory.dmp

memory/4508-1414-0x000000001CD80000-0x000000001CDA6000-memory.dmp

memory/2792-1422-0x000000001D160000-0x000000001D906000-memory.dmp

memory/2792-1423-0x000000001D910000-0x000000001E0B6000-memory.dmp

memory/1516-1431-0x000000001C9F0000-0x000000001CA16000-memory.dmp

C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml

MD5 9da01afb28f32f4e3e8c599517af60ea
SHA1 c4f975d163f1748af8e262f229b3d894d8bb33b6
SHA256 ff7d87103ddd5770bde09c509ddffc23aaceb6239b616b5389a59ce07a99bc8d
SHA512 a86d91562225e8a704331f2cf85cf814eeac81dcdb49e4c6e49733cb45b748d28a8e3d28a55ab13fa24324ef976166ba13f9a709d59ef56f8317c335fee93818

C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml

MD5 45fcd9971da1484b35627e861674f5ac
SHA1 68d87f0466399a3c17c3d38e67204ef7c43193b8
SHA256 7924bc277ba0b569a71383e55d5ca9dccdec03352cc93441871f25794ae16fdb
SHA512 cd5d645f1498b61a3c5423a45b31046380f5086f265f945be15605fc85c5754542f14be7c1cbf677974d420e260c8cfe8468a91360e1530b4fd0208d2725c048

C:\Windows\Installer\MSIBF1D.tmp-\Newtonsoft.Json.dll

MD5 0e32f5229d5ee7d288b6b3969a51fcbc
SHA1 54c09f07930525786fcf08b9c7aca24185a68fc1
SHA256 e1ca33208030c858254249b2c9aa6d8541c2e875343b2997f2b2f9e4993c96f8
SHA512 64e8499e668ea44397ed5ea009e3692b623d2ac01bdd43e460624fe0282a3398025e4e53282e0f0905062b60400f4c16a64933ed7667de942f1588dd936aebcb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

MD5 ab5f4265a14a6f04db3ec3bc2d7fcc58
SHA1 b5c4d0a3ae7b2cdb9806b7db7e5aab35a0edef2a
SHA256 fb2f3a255ebaa3c693c89222117e4e6cd38df81db35f7e4ab2eb718acbaf818b
SHA512 a859cecf985616c20fcdf7f5619fb9e3ad8cf2697ce13fc4524fa730f6599eccba5347889ce91a41d0847ae1d5775d678e4dd1b3ecc56d9258dd992cb7223fec

C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml

MD5 c8593992a34d9ad32891402362e3aafb
SHA1 60bb3638457495a0b446a35890f7eb2dbb31bc73
SHA256 b05e96da6973d7c5b445d48e215617cfb7d213c568f43b3883250458f7c461de
SHA512 71bfd98bddb2c007cf68e0ea9333d8197a2b9bfb3c133963fbe9abce14fcf45d2ae15cfcb711524c95b92b4699d37aa92066608eb43b7429a0222f75ebd72aba

C:\Windows\Installer\MSIBF1D.tmp-\srsl.dll

MD5 6fc50184e3aad7f4df0231da697a9da8
SHA1 fef8608d31e8e1c16ca7db402fa352ee7231585b
SHA256 58e698c208cd6ad94d2da3511447a975605e2b49bbdb7b572863f318aaffe0cf
SHA512 626b0a4031571ca906311937583f646aebdc7aacd5afb5ddf66c2d45dbc335e026d337d4f5803c38ddd022b9e64c79b4dd30d094d5d01a669e99d6c6829650b4

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

MD5 b37582419f45771f18a224ef9c6ae70b
SHA1 0f299dbd4b1bd3f777e9db30b94626798537acde
SHA256 e1a22997c5440f4ca344eabda8e842bce31f16728d052b2205557d9048d08292
SHA512 61e5814c02f6e93f8baae0fd6aba852a5745ed82977deab788ef15ff8bcf3317144d15eb67804457ca900259f8d4ce30606e6af87742d03c20dbb05971f40224

C:\Windows\Installer\MSIBF1D.tmp-\Interop.NetFwTypeLib.dll

MD5 a084b0c082ec6c9525336b131aeba39a
SHA1 45db1f5cc54a033e5df460b93edaa5d23a39ced9
SHA256 7cba99a0f2a5b233e341f691c2aa6cb4ca10065425fc478b56fa468d6b0af54d
SHA512 297ba29e1ee4300f1a11620d475e67a9747fd9affabeee5fb5151b07c931c8f5c5af12b956e2ab7bd7dc6ebb1dbc298f5d56fa419f5fe2e3646053c0e515e29b

C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\yzcahma6.newcfg

MD5 f5dd6d6495416d24c3036082119d7a60
SHA1 11511085ba8c043c64736f879a7b6a6de66e944a
SHA256 3ad35f87428ec051431167d3833620c4489caded46330a6c4dffdc3496a20ca0
SHA512 e9f7dba5a973acda94122cbbdf06ea426d52a9b019acc49dd50682819a59decc20dcca18045a1c2282bf86ea31ef66d699d813f2419fe8a453134f3689df1e52

C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\user.config

MD5 be5aa2d35be2e095aad44b9a33ab0b6e
SHA1 0e7b69f233e3955fa267de2dc01a982836b51c39
SHA256 3ff9ac017a89229a9d5675015d7fa73d7df4d3c0ce269c147d738be6759d1563
SHA512 681850479644bdb20fdee8d2ece7342fa08505c51d3888fe424916532755046d891bc95e4fc01f22ab38aa0d0bc94b020ad2c70a0413f8e98caac8f332356d45

C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\6oifwxuq.newcfg

MD5 cf688451f76998a0b64a3186bc7b5d24
SHA1 00cb59cc83e0ef90c149a5f88d4d1f78cdf0b4f5
SHA256 3c37e2bcd519ec968c23aaec9f26fc8307ba0b0868815362ede77bf5808b61c9
SHA512 25e287a3ab86a768733d1006d8e73d3e661bcaf448e7696549bacf4576c834723067b7ede2a4a00c531cc1cc5ae99cef45138c6a6d097af737815c70c5d83f1d

C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml

MD5 aabb4aa2e705c3afd5511be396907aea
SHA1 f8765ecc6b536503b28ce2812521718225b8a3bb
SHA256 8959cb8bea98199cf1accd341d92be7cee6bc5b16d9311e4b029405ff6e4d225
SHA512 f86c9810fe67f13c4cb4105233c21e89bb728070a0436b4d59ca268d9041a0b07e4a30e7cdbc0d83a9239911c5cf792db30d2a41a3840fb191c2cf9d01834e97

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/4816-1897-0x0000000074170000-0x0000000074721000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsz84F0.tmp\Ping.dll

MD5 b0e9ba9dab60cb7a9fd886dcf440cac3
SHA1 c416f6e9ba379feb9008c775d8456514444b66da
SHA256 52d52e5a1e1cec3e2db08555a8b2651f636cf76c6a24e32aa446595365cf193f
SHA512 90de38a7c57f59e8deb17c2473a215e2f052aee909a47ef37a88fefcfaeb5e6b54d462a39bcac4d0f1aa88d1806ba9e1237d0eeba98f7a0479bd6825e841f043

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YB8IB6GH\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Analysis: behavioral4

Detonation Overview

Submitted

2024-12-02 04:32

Reported

2024-12-02 04:34

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

94s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Ping.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1468 wrote to memory of 4064 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1468 wrote to memory of 4064 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1468 wrote to memory of 4064 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Ping.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Ping.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4064 -ip 4064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 608

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 102.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 99.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-12-02 04:32

Reported

2024-12-02 04:34

Platform

win7-20240708-en

Max time kernel

118s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Registry.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Registry.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Registry.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 224

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-12-02 04:32

Reported

2024-12-02 04:34

Platform

win7-20240903-en

Max time kernel

118s

Max time network

100s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Installer.exe"

Signatures

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Browser Infrastructure Helper = "C:\\Users\\Admin\\AppData\\Local\\Smartbar\\Application\\Smartbar.exe startup" C:\Windows\system32\msiexec.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}\NoExplorer = "1" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0} C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}\NoExplorer = "1" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSIE281.tmp-\Smartbar.Resources.SocialNetsSharer.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\spusm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\srpu.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\srus.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\Smartbar.Infrastructure.Utilities.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\Interop.NetFwTypeLib.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\sismlp.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\CustomAction.config C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\Smartbar.Resources.SocialNetsSharer.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\srsbs.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\srprl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\Microsoft.Practices.EnterpriseLibrary.Common.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\Microsoft.Practices.EnterpriseLibrary.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\srns.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\Smartbar.GUI.Controls.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\srsl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.XmlSerializers.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\Smartbar.Resources.LanguageSettings.resources.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\srns.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\Smartbar.Infrastructure.BusinessEntities.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\Smartbar.Resources.Translations.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Installer\f76dde6.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\CustomAction.config C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\sppsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\Smartbar.Infrastructure.BusinessEntities.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\srpu.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\Smartbar.Resources.LanguageSettings.resources.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\spbl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\Smartbar.Installer.CustomActions.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\srpdm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\spsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\srus.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\srns.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\spbl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\Smartbar.GUI.Docking.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\Smartbar.Personalization.Common.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\siem.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\Microsoft.Deployment.WindowsInstaller.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\srbhu.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\f76dde1.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\MACTrackBarLib.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\spsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\Microsoft.Practices.EnterpriseLibrary.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\spusm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\srprl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\srsbs.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\srus.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\Newtonsoft.Json.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE281.tmp-\Microsoft.Practices.ObjectBuilder.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\Smartbar.Resources.LanguageSettings.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\sipb.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\spbl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.XmlSerializers.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\Microsoft.Deployment.WindowsInstaller.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF95D.tmp-\Interop.NetFwTypeLib.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI938.tmp C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msiexec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{ae07101b-46d4-4a98-af68-0333ea26e113} = "Smartbar" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\MAO Settings\AddonLoadTimeThreshold = "10000" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Smartbar.exe = "9999" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{AE07101B-46D4-4A98-AF68-0333EA26E113} C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{ae07101b-46d4-4a98-af68-0333ea26e113} = "Smartbar" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\MAO Settings C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\rundll32.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{EDC20047-2388-3184-B6DD-B543825CA72A}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{2E0AF118-5C36-3140-85DC-29D137BE10D6}\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F4CC-98B5-11CF-BB82-00AA00BDCE0B} C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F580-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32 C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B272899F-EB7C-3093-A531-BA9F69B31CEE}\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F7EF-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F252-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F251-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F35D-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0 C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F276-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F80E-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLDOMImplementationClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F241-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F26F-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLParaElementClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F314-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLFrameElementClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D3AE66DB-BEAE-3AAB-8FDD-28E7E2469120}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F402-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F314-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLFrameElementClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{256E3D14-B9B8-3F90-99EC-66E072159ED8}\7.0.3300.0\Class = "mshtml._BEHAVIOR_EVENT_FLAGS" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{46B186E7-5F33-3B60-8B70-9D95A04C1A59}\7.0.3300.0\Class = "mshtml._styleBidi" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F5F5-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32 C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F280-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F268-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLUnknownElementClass" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F269-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLUListElementClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{EDC20047-2388-3184-B6DD-B543825CA72A}\7.0.3300.0\Class = "mshtml._htmlMarqueeBehavior" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F7F6-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.FramesCollectionClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F27F-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{5D8D6345-C2E4-3227-87B4-DFA5F0CB2485}\1.1.0.0\Class = "SHDocVw.OLECMDF" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{ED785CBD-B02D-3BFC-8FBF-4CDC702AF748} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F2E9-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLTableSectionClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D3D8E1F4-DA09-32EE-87E1-36C4EFBD899A}\7.0.3300.0\Class = "mshtml._htmlDesignMode" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F37F-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F277-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLLinkElementClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F24D-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F6B9-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLNamespaceCollectionClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1384875E-2884-3284-8992-AAAD8152B0FA} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IESmartBar.SmartbarMenuForm C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{79CD6E7C-63CA-39D8-B871-342E17329B46}\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F5DD-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTCDescBehaviorClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{DB4C7C07-9BD8-3532-90C0-9D526B971DB8}\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F32B-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32 C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F2B9-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8B475115-532C-3483-8333-FA1CB6A620D7}\7.0.3300.0\Class = "mshtml._htmlEffectAllowed" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}\InprocServer32\1.0.0.0\Class = "IESmartBar.DockingPanel" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{5F842F6B-AE40-34F2-90A3-29C9BA8C4AE4}\7.0.3300.0\Class = "mshtml._frameScrolling" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{13766CFA-3621-3B68-9709-6CBCAE6008A4}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4BAA75B0-E612-3B18-96D7-7B069AFFF5A9}\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9CA2452F-D24B-374F-A6AB-9334BE066F08}\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F280-98B5-11CF-BB82-00AA00BDCE0B} C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F2DF-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A2CCE3E1-31E1-3A80-9E94-3F818328FB20} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{26D3A9D0-70E0-3905-838B-67B7AEAD16F0}\7.0.3300.0\Class = "mshtml._styleNormal" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F4BA-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLDOMTextNodeClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{C933118E-0CB0-3BEC-9A1C-5172F7E233C1}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{FF6904B0-8485-3B35-B2DD-87E6EED62C7A}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{71F13D44-7694-3B7D-B713-6BBF9930501D}\7.0.3300.0\Class = "mshtml._htmlStart" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F270-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{34A226E0-DF30-11CF-89A9-00A0C9054129} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{2009AF2F-5786-3067-8799-B97F7832FDD6} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F2DF-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLRichtextElementClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6FA13C58-34B9-3C98-92D4-BBC0EEFE2D23} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F2B9-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{BD3026D1-A1C0-386F-B46F-71131FA56E4B}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F3D0-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0 C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F4FE-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46 C:\Windows\SysWOW64\rundll32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c90f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 C:\Windows\SysWOW64\rundll32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2572 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\taskkill.exe
PID 2572 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\taskkill.exe
PID 2572 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\taskkill.exe
PID 2572 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\taskkill.exe
PID 2572 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 2572 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 2572 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 2572 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 2572 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 2572 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 2572 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 2720 wrote to memory of 1960 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2720 wrote to memory of 1960 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2720 wrote to memory of 1960 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2720 wrote to memory of 1960 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2720 wrote to memory of 1960 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2720 wrote to memory of 1960 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2720 wrote to memory of 1960 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1960 wrote to memory of 1932 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 1932 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 1932 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 1932 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 1932 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 1932 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 1932 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1932 wrote to memory of 2272 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1932 wrote to memory of 2272 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1932 wrote to memory of 2272 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1932 wrote to memory of 2272 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2272 wrote to memory of 560 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2272 wrote to memory of 560 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2272 wrote to memory of 560 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2272 wrote to memory of 560 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1932 wrote to memory of 2216 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1932 wrote to memory of 2216 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1932 wrote to memory of 2216 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1932 wrote to memory of 2216 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2216 wrote to memory of 1588 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2216 wrote to memory of 1588 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2216 wrote to memory of 1588 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2216 wrote to memory of 1588 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1960 wrote to memory of 1116 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 1116 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 1116 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 1116 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 1116 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 1116 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 1116 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 2308 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 2308 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 2308 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 2308 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 2308 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 2308 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 2308 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 2308 wrote to memory of 2476 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2308 wrote to memory of 2476 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2308 wrote to memory of 2476 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2308 wrote to memory of 2476 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2476 wrote to memory of 2652 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2476 wrote to memory of 2652 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2476 wrote to memory of 2652 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2476 wrote to memory of 2652 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2308 wrote to memory of 2796 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Installer.exe

"C:\Users\Admin\AppData\Local\Temp\Installer.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM msiexec.exe

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\smartbar\Installer.msi /quiet

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding F329A44DC0CE4324C0DCB2B2C1181532

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSIE281.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259449599 1 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationStart

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wv08kwh4.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEA8F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEA8E.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gmwg_1ix.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESED0E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCED0D.tmp"

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSIF95D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259455356 5 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationRemoveFiles

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSI938.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259459396 9 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationComplete

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wbogfnbk.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA9C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA8C.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5fe4ihwj.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB19.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB18.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Microsoft.mshtml.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Microsoft.mshtml.dll"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll"

C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe

"C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ma2uqnmf.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES367C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC367B.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dmlwxdc8.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3766.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3765.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oxfsqq6e.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES37C4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC37C3.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m_vv64un.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3821.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3820.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2mytfnkq.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES390B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC390A.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\9ymg32ks.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\prq-a0ha.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3969.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3968.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3979.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3978.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\54zm4f7w.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES39F5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC39F4.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jf1wmh5a.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3AB1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3AB0.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o2h2h-zx.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3CD3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3CD2.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wr2tyxmk.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D95.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4D94.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bz-hk493.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5033.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5032.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wubhsuyn.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES51E8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC51E7.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 cloud-search.linkury.com udp
US 167.71.184.143:80 cloud-search.linkury.com tcp
US 8.8.8.8:53 ws-cloud.snapdoapp.com udp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.80:80 crl.microsoft.com tcp
US 8.8.8.8:53 cloud-search.snapdoapp.com udp
US 8.8.8.8:53 ws-cloud.snapdoapp.com udp
US 8.8.8.8:53 feed.snapdo.com udp
US 172.232.31.180:80 feed.snapdo.com tcp
US 8.8.8.8:53 ww99.snapdo.com udp
US 69.16.230.227:80 ww99.snapdo.com tcp
US 8.8.8.8:53 ww7.snapdo.com udp
US 199.59.243.227:80 ww7.snapdo.com tcp
US 8.8.8.8:53 csc3-2010-crl.verisign.com udp
SE 192.229.221.95:80 csc3-2010-crl.verisign.com tcp
US 8.8.8.8:53 pool.ntp.org udp
US 8.8.8.8:53 google.com udp
GB 142.250.187.238:80 google.com tcp
US 8.8.8.8:53 az412542.vo.msecnd.net udp
US 8.8.8.8:53 az412542.vo.msecnd.net udp
US 152.199.19.161:80 az412542.vo.msecnd.net tcp
US 152.199.19.161:80 az412542.vo.msecnd.net tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.80:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 23.192.22.93:80 www.microsoft.com tcp
US 8.8.8.8:53 au.snapdoapp.com udp

Files

\Users\Admin\AppData\Local\Temp\smartbar\HistoryWrapperService.dll

MD5 3cf46bae7e872a661721b0894bc076e2
SHA1 eaaa0a35e284908dd21cf245a38efe9d2e4c7532
SHA256 7ca73cfb8d0502b14b657216b8735394cbd08aa8e4266fb9e86ad84ae159b043
SHA512 47065a1cb81b41cab7c98488609470b308c708ba73c0e11c3f06901fde008b280f3b75ee825c12e4681aefbd8a43840e0319b43bbab7fe68b24c30926d0ce9f2

\Users\Admin\AppData\Local\Temp\smartbar\GuidCreator.dll

MD5 4876414d51fe01bd8525df2f8acd35d6
SHA1 f9435c39e3029276e71a971e48f68d3f0298fe11
SHA256 4bda5a964065b918ce70a27914056b17a95e3f8002028b394ecf8ff2d7cebf3d
SHA512 d18afa3d806fd056836beb5a0822156402afe3455567d41f9b27d578980d5ae341273cadf5dff3175a799e791822e07eede03e3c0c143604f980f7876cd2fc0a

memory/2572-16-0x0000000002C30000-0x0000000002C70000-memory.dmp

memory/2572-17-0x0000000074B41000-0x0000000074B42000-memory.dmp

memory/2572-21-0x0000000074B40000-0x00000000750EB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\smartbar\Installer.msi

MD5 e5314db579a141f6a5204f70e7073de0
SHA1 3d2e28be7594fd754213e3ea19b4f900f6634c91
SHA256 84263b76687ff69f306579fb3f05f3a0528db029cf0f2f60eddc22549545408d
SHA512 f18c446d8e388759c12527ca970dea3c24af954d199c39027eae4ad8c97df7c902f24845ab0ee0ffd9ad9ee6768c43169b11fec47bd3246cd2e9c7e8da44993a

C:\Users\Admin\AppData\Local\Temp\CabDF69.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarDF9B.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Windows\Installer\MSIE281.tmp

MD5 44c66c7febaf067ac2f96e3bb643a5b3
SHA1 bc83eb57ebb44206b467c4147a7f82d52662e9b5
SHA256 641fae557b683029787befda2a2ed5251b19a4c11fc19e3dbf2cd97459e7e383
SHA512 41ce527bd09ae6b3126947197c94169121dcffe79b9db624a17a3a45d4e25a2f53dde0a686b4329b9e2d5c33bbbc6d6b9cc840b97731eac38ae31254dfd3364b

\Windows\Installer\MSIE281.tmp-\Microsoft.Deployment.WindowsInstaller.dll

MD5 34d4a23cab5f23c300e965aa56ad3843
SHA1 68c62a2834f9d8c59ff395ec4ef405678d564ade
SHA256 27cf8a37f749692ab4c7a834f14b52a6e0b92102e34b85ffcb2c4ee323df6b9c
SHA512 7853f1bc1e40c67808da736e30011b3f8a5c19ddf4c6e29b3e0eb458bea2e056fe0b12023ceac7145c948a6635395e466e47bdd6f0cfa1bd7f6a840e31e4694c

\Windows\Installer\MSIE281.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.dll

MD5 5dc8a7062040e05ad36bd83246954b05
SHA1 f6807be0413724076c8c384576ad9a5bc1413e8c
SHA256 d00f229036a6ea19e05c9838f2827fdb22b3003af4c7c97b37abf2ea36236dfc
SHA512 43cda9b7a57ae292b71df7a8f02c359b486a82162f92e2d8a7449f2b9c835a7ba44177477a7e0763a5698a4b2d9a025f8786c054950db3fab017edfdf4c17f12

\Windows\Installer\MSIE281.tmp-\Smartbar.Installer.CustomActions.dll

MD5 2120dbb0481374885af660346f503b9b
SHA1 0dad9f77c93325cbe2499efac70ebbbfd8e1a4b3
SHA256 ef0e1d3a5f58e797c47d1ca2999e6ab1e94520c3816a8264874920c26c9ae474
SHA512 46966d2eec899fbd48b8aaf5e72555cec3b2f1bc2481c2eb014d98078aa6b6e825144718fbe2aa7b23d816462645186abbfc2ebdc7a4f331d5087999f21ca68a

\Windows\Installer\MSIE281.tmp-\srbs.dll

MD5 7ec601a05f97c73fc2180e8c57efc9af
SHA1 7c99dcdcec211459b1d9d429e2ada2839876f492
SHA256 982d12314935e25a016da0bec644bc4c8bd02b0984eb70b76e081b3562a6adf8
SHA512 119e216313540f0fac30c1a8e531909dbdc8022735a9fb73b80c8bbbb2ff0548cdf911e640cd19827acff703c95b1d8db0ddf3ed61d056e9e4d4f437b8c88e7b

\Windows\Installer\MSIE281.tmp-\spusm.dll

MD5 e28c8d2fd64ba27d9b992fc325f26a9d
SHA1 d9ed413265967b6ede8787aa8c5e5734a4ea1358
SHA256 82d96714ac65e6e18e3da619cfd1367416bba5ed6d08db7bf312f8937f95f2ab
SHA512 e2fcc5972c48fa1d26d2df0b2c5ed4e34d15d7f08eb35510989441b4083f30d19f6d5fc2652ac42d11a3877f333ad4408c0cb547ecf7b948e1f324f719cfc739

\Windows\Installer\MSIE281.tmp-\srbhu.dll

MD5 fcbe6dec3d2da2ac9fd2754cc9cf6ad9
SHA1 7954bdf16f99bf843c5c8053a078813d87c94254
SHA256 71688a7955124b644cb05833d8285b876c7ff336eb4478ce01e1f80b07f7b76e
SHA512 5975297ac6aaa7d85842079809f9be2ad57959da2687de4bb7aa0764bc16dd878c482a92d7c4a4ed484aa7683f60c90b870757165f79d7ae481b7f7897e94c39

\Windows\Installer\MSIE281.tmp-\sppsm.dll

MD5 787104ad9dea702d115883c489be54cb
SHA1 b24680d170c610203df5e3d1d52b2b04f938dd56
SHA256 934230fc9da4c6eac4b1f916baec075ac5faf1a70af14dcdb62d3d06ca878cd3
SHA512 861147b8ed484a25a5ca9af8b7488896ee41dfd4eb57dafd4bb33455b03936c8fd930224fd9a1a0e8dcddf0fc33bc7adfc3ac48ca3ff430122f3ce18952fe312

\Windows\Installer\MSIE281.tmp-\Smartbar.Personalization.Common.dll

MD5 347b0b5d32b1a85b5450b08cfb6d2e75
SHA1 7bfe1857974a6c6c3e882624d820311c1e3bf670
SHA256 76a9f22039731c1fb3871876dd8c55d4ab75635367daa811ced5ed70eed950ac
SHA512 d79edc2546249f71a19faa1ee4aebdfd2faa8b6b56615740c93023255c81716de6c4af484bde506f7dcd80b607d8804313589e58b05dd2448d5c1fca3cd39e92

\Windows\Installer\MSIE281.tmp-\srut.dll

MD5 feba43763a9b7fe1c94d681055d10167
SHA1 49d30dedf868accf07e6895e1699a4d751235fd0
SHA256 0634fa964eba9baed92e2a935aef925fdaa921a35424b6ae9bfaaace932dc49d
SHA512 680116cfe66472c4d6ae9c94d74cd3fe8cef1c9beade27c19e58369c2c6f238f9e63019d7ea2b8b35689b7c0e812f2ee49d26a56e6972d3e21dc5f7312cf81ef

\Windows\Installer\MSIE281.tmp-\Smartbar.Infrastructure.Utilities.dll

MD5 562ac9921d990126990c2f0bdce7081a
SHA1 f395458d8e328cf4809385fef3e225d01f8a8fc0
SHA256 ef84e1ad9cf174a9ab0bba648b56f2ffd17f4cb4421902b61559b544d812e738
SHA512 f52a9a62ca7d810804289ffe0300919eea529f2e0d4d07709309e101087809a5a004437184f3a3518fcd286db18947d78ce00bafbcbbe7b62a8aca4cf8295208

\??\c:\Users\Admin\AppData\Local\Temp\wv08kwh4.cmdline

MD5 8bed3fcd462699b5f55c27b35c47a1eb
SHA1 7f57bce1fbc80728deb536faa32ac5acd9fdfdc1
SHA256 f7e099ec47ecb40055d2873a69cdc4adcf3b5dcfef2eb0af02f4c320b0baa211
SHA512 dcb040e7250a1a68a5f9d1c343160efc2f69c46ca3dbb7dba9c578b7c6862ce7fc0d69273a2682b71d52ec3bfe1c3d9407a963b9c343ccc6d02176f11419cc7c

\??\c:\Users\Admin\AppData\Local\Temp\wv08kwh4.0.cs

MD5 6f8e0c3c3b1b9a297b8ee6bfbb9c2a2c
SHA1 1dbab29ad6fb169fad90e963dd0c5290f27272fc
SHA256 e0514048fd6f4169c41896332a243cf014a719e5fe217c5743fc3c7149db578a
SHA512 193fc4f01b6afb2a858f006eb7c5dfd6106d88b0b0e0f12b4c8c103a8bae270ff0d583886ec5af910ce4d50cb1ccfb54a14d27fd517b847a624d9ba79f688640

\??\c:\Users\Admin\AppData\Local\Temp\CSCEA8E.tmp

MD5 d67feb6f28e8f430451456f1c94889fc
SHA1 25853c3336b57e57119f3471330e1c04df63347f
SHA256 99e1e75e27b2c6e9a990e722c072365ea87af4f5b74b32374034a7efee26cfe2
SHA512 e231940de96e62930efd88314986c387b667c7c67f0804cffb8e47b1614b70a7b7448bdc35090cc4a37557a642ceb353c0a9df40e523beb08ea5459d356bd3cb

C:\Users\Admin\AppData\Local\Temp\RESEA8F.tmp

MD5 e2b6a8de74c829f6a8ab1b0535ef4af4
SHA1 f3e6e665fdc20bf0708a2738ebd92e94c3538bd5
SHA256 ee3b636e5185f5a2efee4c0a784546b40fd6fc3c5313d1b2fdefc3c546d9764c
SHA512 f5d4688d38e24a6c9e69a60a8a63f5c90dd881cf7123b73e223173c3c376577fd1a10eb383d6a3c4f67f3c187f6841a5394f39029f18c6008eea757b30fe9f91

C:\Users\Admin\AppData\Local\Temp\wv08kwh4.dll

MD5 608fdb2d0da25c3f59166a88cdf0fbbe
SHA1 44e2e569de1545ad8760c5025e7ade54c64ed143
SHA256 b21341a6e53d1afa4b0b5eb0be2c5a8c62c8a86f39c611f61a720190ae108a59
SHA512 0c1405826d171063088bdf304b32ed87354a0a51f9a85d66382308369dcd195ed5b94c3300a7b19ad2af5b876a23439a402da48ebf824f52044ef188a3f3f489

\Windows\Installer\MSIE281.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll

MD5 7868ed46c34a1b36bea10560f453598f
SHA1 72330dac6f8aed0b8fde9d7f58f04192a0303d6b
SHA256 5c17864f1572acec1f93cf6355cfd362c1e96236dcba790234985a3f108d8176
SHA512 0cc913337e3334ff0653bc1fad044d9df60a8728c233dcc2c7f6139f14608740b70b57c25a9d2d895cbc4d59508779f342a72406e623d30365ae89fb2a3607ba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f49d695fb8fe51cb80e69b27e54f02db
SHA1 828b456099ca1057eb7f7bb109b053652415c4a2
SHA256 adc987f042b13da7fb9352e6ebeb6b4870f808deab029ec8180fe7b48b33dcca
SHA512 9492431cb63ea05c7f9f911a9d989e0b5abec9540c568b31eae8e53f06df64888c5f82a1c03b2fe0e6c6466c7c8ef4e1a6b3891c57085d45dfce7b1fb5d8ffe5

\Windows\Installer\MSIE281.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.XmlSerializers.dll

MD5 adb53ee43f74f430368449b98b2f6f86
SHA1 fb882d80da9ccf79c6817a492fbd686d4759bb41
SHA256 b7837a68ede7781286057de0b59b7bb9c7c29ff9e9ded32c7175cafe9de3b5ff
SHA512 8fc2cd5a585c8247274fbe8d53ac27faa1f2b0407d27e5e78d6917cfa94947ace2aa20ca670a5b87e3d7a939360691102ed9c7530ec997af1057064bcb9c085a

\??\c:\Users\Admin\AppData\Local\Temp\gmwg_1ix.cmdline

MD5 448fe555f4ac11a61f17c43d81ab088f
SHA1 933e433d3771c88a5369e4e5bc3620b049748138
SHA256 ca552eb9ab414bf87ea65da821ff1f2bc126e164bd444bad1416eb7c3d27d2cf
SHA512 a897213fe28900fff75804523b7db05a8e8024d4b55aa453bb15d3604ae7ee93c11fac6cc16aab92027dc9e1bb0225063199665b590c0aa31721a71470fc39aa

\??\c:\Users\Admin\AppData\Local\Temp\gmwg_1ix.0.cs

MD5 14ac60821b7e9508914fdf584ef23f46
SHA1 9bc6cb0f7ea31050962fe56398213a48c5097ffa
SHA256 ed564c34b04178601638c4c2a9ac3c21ac83d4031976fbd467c42d8e1a7c7c1c
SHA512 b3faf1282b570436807b403ebd7aead6e86dbcb61dd64cfba0bc25023ddfe2017434e7f2ba34c0e69974b6f28587d75448f6b9567814d93130e9c7c3b8d01cd5

C:\Users\Admin\AppData\Local\Temp\gmwg_1ix.dll

MD5 f6300d01d8a162590a114362ea480ceb
SHA1 04ab3bc0df614adfc2ae354523e505a3d1438f37
SHA256 de4ed8113f8e3748428bbf65071a5d2cc25efcf004d93c5de51e6eaccb05da02
SHA512 2fabaa2eeea4aadb7a8985fbd3f5bc29124f6b4cc5a642858375b00fd6eee62101b6aa356575af478280b36611cf65629ff9534d7911342f43bb9ff57526c73b

C:\Users\Admin\AppData\Local\Temp\RESED0E.tmp

MD5 28871103c88de3839877b1965a7ecd8e
SHA1 487313f6b2a85a92b57de5ab3f21f0f5ed284609
SHA256 0239b2918c260f0f169b88f81f9a701baf75ef44db378707821ac845ab8e09aa
SHA512 e396d0c2eeedba17a9b26d96b61d70e78f2d28feb4c45ddc2840f9e937489656083daf8c4fcf2304271e12d6c4f901c21405a1c59916387732b319ed65e03806

\??\c:\Users\Admin\AppData\Local\Temp\CSCED0D.tmp

MD5 34a6688763e1478620c59b43d4776deb
SHA1 98efe8f02223feef047a0f142cc2f86877dc2282
SHA256 f6d153be9d7b2eb789c6516cd482b786d15c9f3d3622343c524770aeded02459
SHA512 f04918ae91981986ae86cb53f0e359c5dd5c7c723e75808136ee1f32d11419d9087e3c1f5e2087eb9598023d5337c71181c9a874a3652caf0f9c0aea34e8f1bf

memory/2572-249-0x0000000002C30000-0x0000000002C70000-memory.dmp

memory/2572-310-0x0000000074B40000-0x00000000750EB000-memory.dmp

C:\Windows\Installer\MSIF95D.tmp-\CustomAction.config

MD5 796621b6895449a5f70ca6b78e62f318
SHA1 2423c3e71fe5fa55fd71c00ae4e42063f4476bca
SHA256 09be5df7a85545fd93d9fd3cd1d6c04c6bfe6e233c68da6f81c49e7a35fcbb84
SHA512 081cf1dadb3a0e50f0a31ab03e2b08e80298c06070cd6f9b2806c08d400c07134623f7229a6c99910c6243dfa53c6e2c05d09a497aae1e701bc34b660cf9e4c9

C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch

MD5 59c30d5f0ec77ade7df0caef40b7efe2
SHA1 3a9d72d4a0163aeff1b775013aadcffeeda9cbbb
SHA256 d7de8d471be7cae89cafdb1bc224dd3d15145b266805963a2e4b13235cff3b1b
SHA512 ae978fa73c36e9dd600becee20a881a253a22e748981af5f41e88ff3cd423dfa2ea4d16738f05ca16cc40e165fa396eb6ff4098e90fa5b45e36749db76806783

C:\Users\Admin\AppData\Local\Smartbar\Common\icons\30DFF8F0-BA79-4360-A3EA-51B6D006133CPress.png

MD5 5719ee7f6521ae142f0557f0706cded1
SHA1 a1d5694197827967aea5b3ccc88e2f91d465c283
SHA256 0a2ae8f3e9aa552748cfeadaec055778487602e7f6d4a6c2a221fe1fd496bfaf
SHA512 cde76dada9e798a746d7ae23ee189940a6b7660805267a9221501c5c911a89b298005f111622fae7c886e810e23f83b77d47fa75793d19441246eb775a2f2bf6

C:\Users\Admin\AppData\Local\Smartbar\Common\icons\3C610B86-19DE-4757-B46A-871C9C27FF0APress.png

MD5 2768222689e3585d609b5a2afc1ba52c
SHA1 ee522df6b2e365857bf6be58ac7150cbc71cfc9c
SHA256 21ee471e79b0a646735e132bc1f0c48f464677127b105426e00b160a554de6b0
SHA512 56527749dca471af92eb4166b2bb6f1ca4cbf07c8d7e1a201378467f1d08efe5fd913715bb995d35c7d511b2cbdc9469d79baae7ee4bab619e4e11753c3505e4

C:\Users\Admin\AppData\Local\Smartbar\Common\icons\B1BEF453-913F-4EC4-B057-A2BB21C09DCBpress.png

MD5 e6ab030a2d47b1306ad071cb3e011c1d
SHA1 ed5f9a6503c39832e8b1339d5b16464c5d5a3f03
SHA256 054e94c94e34cef7c2fad7a0f3129c4666d07f439bfec39523dca7441a49bd7c
SHA512 4cbb002cc2d593bafd2e804cb6f1379187a9cae7d6cc45068fda6d178746420cc90bcd72ba40fc5b8b744170e64df2b296f2a45c8640819aa8b3c775e6120163

memory/2720-1151-0x0000000000AB0000-0x0000000000AD6000-memory.dmp

memory/2720-1178-0x0000000000AE0000-0x0000000000B00000-memory.dmp

memory/2720-1275-0x0000000003090000-0x0000000003173000-memory.dmp

C:\Windows\assembly\tmp\Y8OWK7D1\System.Data.SQLite.dll

MD5 c2e38bfe933c5bce36910fe1fb1d5067
SHA1 aac5ed2724e2f88c7af1a3bf56d73180ae709bb7
SHA256 49a51063aaccc22a28590575417bdff40a67a06e6f2a67217b37af1b49fa6286
SHA512 281225b5e7193270b27811224c70475fc9af47c5d05a7e98f6856ad6abccff084302d0ddb72868d6872eef2efaf2989645af5e596083bfb995f214182aa4184d

C:\Windows\assembly\tmp\YD8VYVJW\Interop.SHDocVw.dll

MD5 030a99f9594434ea83d27b33a95c4d5a
SHA1 230882058a1d50e4e8f7fa4bb3144dec506c5967
SHA256 0fdc72a06cc54771f1b07293d2e914cded985d84833ed4bf952a665eb107b5a3
SHA512 529d14374df0b455db055027f42ccf731ddf4b7bef8fc27bffa2ff5a46463dc6b3cacf75fd6356e325f075d7fb70ad0f8abd85feb75d00befd1c86aec857d7ee

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

MD5 3b1e2237092c6db407b9f0a69b11a3ea
SHA1 65fc845a6c0e30708de6a01fc71d09332e909812
SHA256 521e66b267437d7f1e69c7e7a860a3d7df73daf9680f47f9497013c85d2137e8
SHA512 f3ff37aea20ec21bb0ec3efceab7dd9d50a5adc6d6578b5f4269c4617adda2e3d26b8c33a69d2c7cf17dd4e18778818eadec8c9ed020ce449cc9bddab1a1af3e

C:\Windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll

MD5 459ff9c6762b7fdd91c156ff3e096478
SHA1 7179debce9a271450b1241e7435a999aea1ddd05
SHA256 93865c89e1507409fbbeb9433542a303cdd2fd5acda3d51fecd83e4a8fb8072c
SHA512 8b95330d364413122427604af1c0e848694975eb8c541b911aeb0d50fbb5cd15a60863f68593f1088b26f83500f400f52292a2891511223f796be750c6a7583a

C:\Config.Msi\f76dde5.rbs

MD5 456ae8af40e9dde95e8aebc7c7959685
SHA1 9b7cdc9a784395b15215a6d938b311fea4007fca
SHA256 b799d2bb11d12aa493d7de07bea48c2023075058f704b0d5d7faf54f45c71bbf
SHA512 d89083ca1ff4e1e10a8bbd1cd76c6948daa1158b110cd960f875665ba05a6794aeeba615e3b60b4706ef7d58b724973ef3a2e43986bc4f7937d9a8d803960db8

C:\Windows\Installer\MSI938.tmp-\srprl.dll

MD5 d8fa7df1f2cd92ad701bc23f86d89b54
SHA1 72160fd5ad639c5a9c44305b06c98eb637399d18
SHA256 475a2c225258c571ae66c0178a83177bd5a59f4ce1be1f867e14e75614ad43e4
SHA512 a4d11c7f66325199f5c3a41cc37f32cf6ee828d790add1a6b77b9127e65243bb17dcc10b1cb2cbaac4e543bc329bd30e64919ffc0af3fd6088a672e08e10e992

C:\Users\Admin\AppData\Local\Smartbar\Application\bhtyenag.newcfg

MD5 51417498b55cf9dd3d2b06acca131f8d
SHA1 e29cf97632afc31c3f33e92ec11aba4ab6af279f
SHA256 09c4cf7783aaaf4d783a20d5d424e5d778dfa985cf24d9adab6a8615e5942ea9
SHA512 2190da7f78ed76aed06ffabfdcfdff6f248ba7a1990bb80a4949a101626013c87048d5464487bcd0679c50d5019a26379f4f8691d0100ca08f7dfdd709417836

memory/2660-1485-0x0000000002430000-0x0000000002448000-memory.dmp

memory/2660-1486-0x0000000002430000-0x0000000002448000-memory.dmp

memory/2024-1539-0x0000000002320000-0x0000000002346000-memory.dmp

memory/2024-1540-0x0000000002320000-0x0000000002346000-memory.dmp

memory/2848-1567-0x000000001C540000-0x000000001CCE6000-memory.dmp

memory/2848-1568-0x000000001D4A0000-0x000000001DC46000-memory.dmp

memory/328-1595-0x0000000000A90000-0x0000000000AB6000-memory.dmp

memory/328-1596-0x000000001B330000-0x000000001B356000-memory.dmp

C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml

MD5 f9524afe44e9e2c19b26f63ee11c987e
SHA1 59eb855662ff35fd14e2617b9a9af35637325067
SHA256 371a131cbb9385b449d96d306f4ac5a7dad8f1d57651c57bee53aac345daffb7
SHA512 7739d3c08c9cb3877adc90bcc51bc14d8518bda0f5859fbed405a2d09c7bdb40f11272c564e54b09eec1cddf9120b8b0f65641a1226306fbd710dbae78db12ae

C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml

MD5 e0d9cbf4a74e80e178989a4ec855260f
SHA1 bb699925c8cca54fbb2d9c43957ed853ed7e569f
SHA256 1b5f45398579041d20a77c072d574d2fb36976af30afbeb02a963a5e92b020d5
SHA512 2dc020469dedc7c8699a5254ddc7ad59f4b9e5e9c77dce8731a04266a36bd065b777977d31786fc30a09535ce917e9cb525a90991b460cc4ff17cd8ed6d05f2d

C:\Windows\Installer\MSI938.tmp-\Newtonsoft.Json.dll

MD5 0e32f5229d5ee7d288b6b3969a51fcbc
SHA1 54c09f07930525786fcf08b9c7aca24185a68fc1
SHA256 e1ca33208030c858254249b2c9aa6d8541c2e875343b2997f2b2f9e4993c96f8
SHA512 64e8499e668ea44397ed5ea009e3692b623d2ac01bdd43e460624fe0282a3398025e4e53282e0f0905062b60400f4c16a64933ed7667de942f1588dd936aebcb

C:\Windows\Installer\MSI938.tmp-\Interop.NetFwTypeLib.dll

MD5 a084b0c082ec6c9525336b131aeba39a
SHA1 45db1f5cc54a033e5df460b93edaa5d23a39ced9
SHA256 7cba99a0f2a5b233e341f691c2aa6cb4ca10065425fc478b56fa468d6b0af54d
SHA512 297ba29e1ee4300f1a11620d475e67a9747fd9affabeee5fb5151b07c931c8f5c5af12b956e2ab7bd7dc6ebb1dbc298f5d56fa419f5fe2e3646053c0e515e29b

memory/2572-2308-0x0000000074B40000-0x00000000750EB000-memory.dmp

C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\user.config

MD5 2ca11a17fe72d8a5ead548a24b67c1c5
SHA1 02ba0e5a7131bbf82ca19b2b79b5346a8cb74cb3
SHA256 d7bb8d5ad31547a80c364d79ccf9971eb87fe412a0a626b392e683875c4d4ce9
SHA512 95cef6c7c5641051b36976a23ce2b276fa6dfb98c22cf7eac20c6851e6b0b27b93b8f3e8cfb6c5b286106048f22633d579bcc39de40cc7183ea8470dce8399c5

C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\user.config

MD5 10803d310dfbcbd72a757077e6f9343c
SHA1 d5fb3a5aaec392b46963ab608a67c8d3efc7941c
SHA256 d9cc3c8a27e33d7b5350146e69cba0c9753d41a00639eb812246b2d845d7d4a5
SHA512 fbf80c7a5884ac4bbb3add76941f9d0a4bb90ea9b9ce46ae12bef0f650a705bfadc8599867e48844c66f450120e70a27b0a7ef35e6f7c9489ac0cd2d535de21d

C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\ruueclsv.newcfg

MD5 704e07be7bfa6d4ced58d4512975096f
SHA1 25973bb99067a99899a6a86a9fe606ad6f121782
SHA256 8afc8b362c34b65f15500d4370b6c4e9d11c17f8851e3dcd3bc994694d4340e2
SHA512 cf2a86f3650a4b1d7b9a136b48a7ed961825ca550db61a33ab66dde973f37ca38997ce3a2ad6f803698470e9f47d9a6e4806f1596d91c633e798ee1dde75db87

Analysis: behavioral8

Detonation Overview

Submitted

2024-12-02 04:32

Reported

2024-12-02 04:34

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Installer.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\rundll32.exe N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Browser Infrastructure Helper = "C:\\Users\\Admin\\AppData\\Local\\Smartbar\\Application\\Smartbar.exe startup" C:\Windows\system32\msiexec.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\SysWOW64\rundll32.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0} C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}\NoExplorer = "1" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}\NoExplorer = "1" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\Smartbar.Resources.Translations.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\Newtonsoft.Json.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\Microsoft.Practices.EnterpriseLibrary.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.XmlSerializers.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\sppsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\Microsoft.Deployment.WindowsInstaller.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Installer\SourceHash{9726F9E3-EE13-4601-B2AF-81B1413BD8AF} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF974.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\Smartbar.Resources.Translations.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.XmlSerializers.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\Smartbar.Personalization.Common.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\srprl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\CustomAction.config C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\assembly\tmp\4JVGODEI\Interop.SHDocVw.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\spbl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\CustomAction.config C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\sipb.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\Interop.NetFwTypeLib.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\siem.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\Smartbar.Resources.LanguageSettings.resources.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\Smartbar.Personalization.Common.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\Microsoft.Practices.ObjectBuilder.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\Smartbar.Resources.Translations.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\srut.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\Smartbar.Installer.CustomActions.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\MACTrackBarLib.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\Smartbar.Resources.SocialNetsSharer.XmlSerializers.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\Microsoft.Deployment.WindowsInstaller.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\srbs.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\MACTrackBarLib.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\srsl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\Smartbar.Infrastructure.Utilities.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\Smartbar.Resources.SocialNetsSharer.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\sismlp.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\assembly\tmp\1AFHYXUV\System.Data.SQLite.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\srus.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Installer\e57e13c.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\Microsoft.Practices.EnterpriseLibrary.Common.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\spusm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\spbe.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\srprl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\RegAsm.exe C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\Smartbar.GUI.Controls.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\srns.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\spsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\Smartbar.Infrastructure.Utilities.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\Smartbar.Resources.LanguageSettings.resources.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\spsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\Smartbar.Personalization.Common.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\srsl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\spsm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\spbl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIF994.tmp-\srus.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\spusm.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\Smartbar.Resources.LanguageSettings.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIE8F8.tmp-\Microsoft.Practices.ObjectBuilder.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\sipb.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIEC3.tmp-\Interop.NetFwTypeLib.dll C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msiexec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\SearchUrl C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{AE07101B-46D4-4A98-AF68-0333EA26E113} C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{ae07101b-46d4-4a98-af68-0333ea26e113} = "Smartbar" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\MAO Settings C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\MAO Settings\AddonLoadTimeThreshold = "10000" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Smartbar.exe = "9999" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{ae07101b-46d4-4a98-af68-0333ea26e113} = "Smartbar" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F37F-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{3FC26130-C7E8-31A6-9887-70FEC71F5A46}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F279-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLNextIdElementClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{E1132F27-8818-3C98-81A4-C9B9B5F28E8C} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D605E460-59C4-3D0A-9116-608B63FE300A}\7.0.3300.0\Class = "mshtml._MARKUP_CONTEXT_TYPE" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{BBFE60AF-DC3D-3951-8F95-947198A0442A} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{FB2E65F4-5687-33EF-9BBF-4E3C9C98D3B9}\1.0.0.0\Class = "IESmartBar.DBIMF" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F580-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{34B4F646-3FC3-3CA2-AF86-BDAA6F9167D8}\7.0.3300.0\Class = "mshtml.__MIDL_IWinTypes_0009" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F3DC-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32 C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6E7B0F28-0DDC-3AFF-A175-CD28A181C7EC}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F27C-98B5-11CF-BB82-00AA00BDCE0B} C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F4CB-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32 C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F24D-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F4941A96-874B-3701-980D-464748D7920F}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F24D-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4E5C10BC-5FF5-35F5-A45C-078544CA9D7D}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F32B-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{11B2663E-7AE0-3DF6-9847-F53250984108}\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{87845C39-C387-384B-99ED-3E3701F86C1D}\7.0.3300.0\Class = "mshtml._styleLayoutGridLine" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9CBDDE76-4C5D-3B59-A31F-45B59186510A}\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F5F5-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTCAttachBehaviorClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F8420FF6-6A64-3241-8235-6901DC884B17}\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F172639F-F18B-3756-8450-06866584ADEF}\7.0.3300.0\Class = "mshtml._HTML_PAINT_XFORM" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F7EF-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A4C7AE7E-D238-3AA8-BFB3-04E2C443959B}\1.1.0.0\Class = "SHDocVw.tagREADYSTATE" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209} C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{AF1BFF0C-0614-337B-91D2-81B41AE16A73}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F5EB-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.ThreadDialogProcParamClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F7EF-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{E44B9A01-2579-38D0-83FC-BE0284A316E5}\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F276-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLBaseElementClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{3FB5C8C6-11BF-32E3-9F5E-6F95AFA8D553}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{328AAE04-2F14-3F34-91E5-03B5DB97E915} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F272-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0 C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}\InprocServer32\Class = "IESmartBar.BHO" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{656130CD-753E-3DDC-893C-D6975C1EEED9}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{E296BC2D-5A31-3831-BDAB-2F2D2F05CB8B}\7.0.3300.0\Class = "mshtml._styleFontStyle" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1A831E80-8858-3805-84C7-C9D0C3D12E92}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F27E-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLDivElementClass" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F245-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F248-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F2AB-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A0E61354-0A90-35E6-9484-5750A1C240D8}\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{12A025D4-7210-3AE7-B626-DAFACADC256B}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F2C6-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F3FF-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4DBA43D6-92EF-365A-A8F6-164C0BECAA03}\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F32B-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\RuntimeVersion = "v1.0.3705" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}\ProgId C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F3DC-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTMLCurrentStyleClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{41A45DAE-3C9F-3768-B837-B785DDC401F2}\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9778FF5E-CBCB-3A8E-AA0C-69F4540870C0} C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F38D-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1AE6EFA4-9B10-3CF9-822B-42F79B3EB595}\7.0.3300.0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{921CF445-C4D9-38EE-9798-D4AC152A6F48}\7.0.3300.0\Class = "mshtml._BEHAVIOR_LAYOUT_MODE" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B272899F-EB7C-3093-A531-BA9F69B31CEE}\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}\ = "Shopping Helper SmartbarEngine" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{226CBB7D-24E2-3F95-B762-A7EC52DAC005}\7.0.3300.0\Class = "mshtml._mediaType" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F3DC-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Class = "mshtml.HTMLCurrentStyleClass" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{BD3026D1-A1C0-386F-B46F-71131FA56E4B}\7.0.3300.0\Class = "mshtml._RemotableHandle" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050F27B-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\7.0.3300.0\Assembly = "Microsoft.mshtml, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F4FC-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\Class = "mshtml.HTCDefaultDispatchClass" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{0D873270-8F86-3AE0-8173-7A61008EBF07}\7.0.3300.0\Class = "mshtml._HTMLCaptionFlag" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 C:\Windows\SysWOW64\rundll32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Windows\SysWOW64\rundll32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 C:\Windows\SysWOW64\rundll32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186819000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 C:\Windows\SysWOW64\rundll32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c00000001000000040000000008000019000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b0400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3064 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 3064 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 3064 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\Installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 3172 wrote to memory of 796 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3172 wrote to memory of 796 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3172 wrote to memory of 796 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 796 wrote to memory of 4448 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 796 wrote to memory of 4448 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 796 wrote to memory of 4448 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 4448 wrote to memory of 1068 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4448 wrote to memory of 1068 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4448 wrote to memory of 1068 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1068 wrote to memory of 1036 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1068 wrote to memory of 1036 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1068 wrote to memory of 1036 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4448 wrote to memory of 3084 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4448 wrote to memory of 3084 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4448 wrote to memory of 3084 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 3084 wrote to memory of 1420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3084 wrote to memory of 1420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3084 wrote to memory of 1420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 796 wrote to memory of 4260 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 796 wrote to memory of 4260 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 796 wrote to memory of 4260 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 796 wrote to memory of 4212 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 796 wrote to memory of 4212 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 796 wrote to memory of 4212 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 4212 wrote to memory of 1316 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4212 wrote to memory of 1316 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4212 wrote to memory of 1316 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1316 wrote to memory of 4244 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1316 wrote to memory of 4244 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1316 wrote to memory of 4244 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4212 wrote to memory of 4868 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4212 wrote to memory of 4868 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4212 wrote to memory of 4868 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4868 wrote to memory of 3828 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4868 wrote to memory of 3828 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4868 wrote to memory of 3828 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4212 wrote to memory of 3084 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 3084 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 3084 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 2452 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 2452 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 2092 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 2092 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 2092 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 4568 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 4568 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 2864 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 2864 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 2864 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 1736 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 1736 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 3404 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 3404 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 3404 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 5024 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 5024 N/A C:\Windows\SysWOW64\rundll32.exe C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe
PID 4212 wrote to memory of 2232 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe
PID 4212 wrote to memory of 2232 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Installer.exe

"C:\Users\Admin\AppData\Local\Temp\Installer.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM msiexec.exe

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\smartbar\Installer.msi /quiet

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding F4A73F789ACF889BBDDDC8566514D6CF

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSIE8F8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240642734 2 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationStart

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\czeo59xu.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF398.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF397.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\owovvsbr.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF6B5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF6B4.tmp"

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSIF994.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240646562 6 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationRemoveFiles

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSIEC3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240651968 73 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationComplete

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y2omevv9.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1161.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1160.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qwxtnmsr.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES123C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC123B.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Microsoft.mshtml.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Microsoft.mshtml.dll"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll"

C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe

"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll"

C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe

"C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iispem94.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3EF9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3EF8.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iqkdmmkq.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES409F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC409E.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\icxamfh-.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4216.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4215.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gn0cjsap.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES43DB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC43DA.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eyxvcsny.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4571.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4570.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vihukasl.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES469A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC468A.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1z_oazvn.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4746.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4745.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ivmup_rn.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47F2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC47F1.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\-_xiwwys.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES490B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC490A.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z-y34nha.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4AD0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4ACF.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\smfgx6xm.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D70.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4D6F.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bfrr2wao.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES503F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC503E.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\brl2we0c.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES539A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5399.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 cloud-search.linkury.com udp
US 167.71.184.143:80 cloud-search.linkury.com tcp
US 8.8.8.8:53 ws-cloud.snapdoapp.com udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 143.184.71.167.in-addr.arpa udp
US 8.8.8.8:53 crl.usertrust.com udp
US 104.18.38.233:80 crl.usertrust.com tcp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 crl.comodoca.com udp
US 172.64.149.23:80 crl.comodoca.com tcp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 cloud-search.snapdoapp.com udp
US 8.8.8.8:53 ws-cloud.snapdoapp.com udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 172.64.149.23:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 172.64.149.23:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 172.64.149.23:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 172.64.149.23:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 172.64.149.23:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 172.64.149.23:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 172.64.149.23:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 8.8.8.8:53 feed.snapdo.com udp
US 172.232.4.213:80 feed.snapdo.com tcp
US 172.64.149.23:80 crl.comodoca.com tcp
US 104.18.38.233:80 crl.comodoca.com tcp
US 8.8.8.8:53 ww99.snapdo.com udp
US 69.16.230.227:80 ww99.snapdo.com tcp
US 8.8.8.8:53 ww7.snapdo.com udp
US 199.59.243.227:80 ww7.snapdo.com tcp
US 8.8.8.8:53 213.4.232.172.in-addr.arpa udp
US 8.8.8.8:53 227.230.16.69.in-addr.arpa udp
US 8.8.8.8:53 227.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 ws-cloud.snapdoapp.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 cloud-search.snapdoapp.com udp
US 8.8.8.8:53 pool.ntp.org udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 123.200.159.162.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
GB 142.250.187.238:80 google.com tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 csc3-2010-crl.verisign.com udp
SE 192.229.221.95:80 csc3-2010-crl.verisign.com tcp
US 8.8.8.8:53 az412542.vo.msecnd.net udp
US 152.199.19.161:80 az412542.vo.msecnd.net tcp
US 152.199.19.161:80 az412542.vo.msecnd.net tcp
US 8.8.8.8:53 74.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 ws-cloud.snapdoapp.com udp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 au.snapdoapp.com udp

Files

C:\Users\Admin\AppData\Local\Temp\smartbar\HistoryWrapperService.dll

MD5 3cf46bae7e872a661721b0894bc076e2
SHA1 eaaa0a35e284908dd21cf245a38efe9d2e4c7532
SHA256 7ca73cfb8d0502b14b657216b8735394cbd08aa8e4266fb9e86ad84ae159b043
SHA512 47065a1cb81b41cab7c98488609470b308c708ba73c0e11c3f06901fde008b280f3b75ee825c12e4681aefbd8a43840e0319b43bbab7fe68b24c30926d0ce9f2

C:\Users\Admin\AppData\Local\Temp\smartbar\GuidCreator.dll

MD5 4876414d51fe01bd8525df2f8acd35d6
SHA1 f9435c39e3029276e71a971e48f68d3f0298fe11
SHA256 4bda5a964065b918ce70a27914056b17a95e3f8002028b394ecf8ff2d7cebf3d
SHA512 d18afa3d806fd056836beb5a0822156402afe3455567d41f9b27d578980d5ae341273cadf5dff3175a799e791822e07eede03e3c0c143604f980f7876cd2fc0a

memory/3064-18-0x0000000003AD0000-0x0000000003AE0000-memory.dmp

memory/3064-19-0x0000000074A02000-0x0000000074A03000-memory.dmp

memory/3064-22-0x0000000074A00000-0x0000000074FB1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\smartbar\Installer.msi

MD5 e5314db579a141f6a5204f70e7073de0
SHA1 3d2e28be7594fd754213e3ea19b4f900f6634c91
SHA256 84263b76687ff69f306579fb3f05f3a0528db029cf0f2f60eddc22549545408d
SHA512 f18c446d8e388759c12527ca970dea3c24af954d199c39027eae4ad8c97df7c902f24845ab0ee0ffd9ad9ee6768c43169b11fec47bd3246cd2e9c7e8da44993a

C:\Windows\Installer\MSIE8F8.tmp

MD5 44c66c7febaf067ac2f96e3bb643a5b3
SHA1 bc83eb57ebb44206b467c4147a7f82d52662e9b5
SHA256 641fae557b683029787befda2a2ed5251b19a4c11fc19e3dbf2cd97459e7e383
SHA512 41ce527bd09ae6b3126947197c94169121dcffe79b9db624a17a3a45d4e25a2f53dde0a686b4329b9e2d5c33bbbc6d6b9cc840b97731eac38ae31254dfd3364b

C:\Windows\Installer\MSIE8F8.tmp-\Microsoft.Deployment.WindowsInstaller.dll

MD5 34d4a23cab5f23c300e965aa56ad3843
SHA1 68c62a2834f9d8c59ff395ec4ef405678d564ade
SHA256 27cf8a37f749692ab4c7a834f14b52a6e0b92102e34b85ffcb2c4ee323df6b9c
SHA512 7853f1bc1e40c67808da736e30011b3f8a5c19ddf4c6e29b3e0eb458bea2e056fe0b12023ceac7145c948a6635395e466e47bdd6f0cfa1bd7f6a840e31e4694c

C:\Windows\Installer\MSIE8F8.tmp-\Smartbar.Installer.CustomActions.dll

MD5 2120dbb0481374885af660346f503b9b
SHA1 0dad9f77c93325cbe2499efac70ebbbfd8e1a4b3
SHA256 ef0e1d3a5f58e797c47d1ca2999e6ab1e94520c3816a8264874920c26c9ae474
SHA512 46966d2eec899fbd48b8aaf5e72555cec3b2f1bc2481c2eb014d98078aa6b6e825144718fbe2aa7b23d816462645186abbfc2ebdc7a4f331d5087999f21ca68a

C:\Windows\Installer\MSIE8F8.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.dll

MD5 5dc8a7062040e05ad36bd83246954b05
SHA1 f6807be0413724076c8c384576ad9a5bc1413e8c
SHA256 d00f229036a6ea19e05c9838f2827fdb22b3003af4c7c97b37abf2ea36236dfc
SHA512 43cda9b7a57ae292b71df7a8f02c359b486a82162f92e2d8a7449f2b9c835a7ba44177477a7e0763a5698a4b2d9a025f8786c054950db3fab017edfdf4c17f12

C:\Windows\Installer\MSIE8F8.tmp-\srbs.dll

MD5 7ec601a05f97c73fc2180e8c57efc9af
SHA1 7c99dcdcec211459b1d9d429e2ada2839876f492
SHA256 982d12314935e25a016da0bec644bc4c8bd02b0984eb70b76e081b3562a6adf8
SHA512 119e216313540f0fac30c1a8e531909dbdc8022735a9fb73b80c8bbbb2ff0548cdf911e640cd19827acff703c95b1d8db0ddf3ed61d056e9e4d4f437b8c88e7b

C:\Windows\Installer\MSIE8F8.tmp-\spusm.dll

MD5 e28c8d2fd64ba27d9b992fc325f26a9d
SHA1 d9ed413265967b6ede8787aa8c5e5734a4ea1358
SHA256 82d96714ac65e6e18e3da619cfd1367416bba5ed6d08db7bf312f8937f95f2ab
SHA512 e2fcc5972c48fa1d26d2df0b2c5ed4e34d15d7f08eb35510989441b4083f30d19f6d5fc2652ac42d11a3877f333ad4408c0cb547ecf7b948e1f324f719cfc739

C:\Windows\Installer\MSIE8F8.tmp-\srbhu.dll

MD5 fcbe6dec3d2da2ac9fd2754cc9cf6ad9
SHA1 7954bdf16f99bf843c5c8053a078813d87c94254
SHA256 71688a7955124b644cb05833d8285b876c7ff336eb4478ce01e1f80b07f7b76e
SHA512 5975297ac6aaa7d85842079809f9be2ad57959da2687de4bb7aa0764bc16dd878c482a92d7c4a4ed484aa7683f60c90b870757165f79d7ae481b7f7897e94c39

C:\Windows\Installer\MSIE8F8.tmp-\sppsm.dll

MD5 787104ad9dea702d115883c489be54cb
SHA1 b24680d170c610203df5e3d1d52b2b04f938dd56
SHA256 934230fc9da4c6eac4b1f916baec075ac5faf1a70af14dcdb62d3d06ca878cd3
SHA512 861147b8ed484a25a5ca9af8b7488896ee41dfd4eb57dafd4bb33455b03936c8fd930224fd9a1a0e8dcddf0fc33bc7adfc3ac48ca3ff430122f3ce18952fe312

C:\Windows\Installer\MSIE8F8.tmp-\Smartbar.Personalization.Common.dll

MD5 347b0b5d32b1a85b5450b08cfb6d2e75
SHA1 7bfe1857974a6c6c3e882624d820311c1e3bf670
SHA256 76a9f22039731c1fb3871876dd8c55d4ab75635367daa811ced5ed70eed950ac
SHA512 d79edc2546249f71a19faa1ee4aebdfd2faa8b6b56615740c93023255c81716de6c4af484bde506f7dcd80b607d8804313589e58b05dd2448d5c1fca3cd39e92

C:\Windows\Installer\MSIE8F8.tmp-\srut.dll

MD5 feba43763a9b7fe1c94d681055d10167
SHA1 49d30dedf868accf07e6895e1699a4d751235fd0
SHA256 0634fa964eba9baed92e2a935aef925fdaa921a35424b6ae9bfaaace932dc49d
SHA512 680116cfe66472c4d6ae9c94d74cd3fe8cef1c9beade27c19e58369c2c6f238f9e63019d7ea2b8b35689b7c0e812f2ee49d26a56e6972d3e21dc5f7312cf81ef

C:\Windows\Installer\MSIE8F8.tmp-\Smartbar.Infrastructure.Utilities.dll

MD5 562ac9921d990126990c2f0bdce7081a
SHA1 f395458d8e328cf4809385fef3e225d01f8a8fc0
SHA256 ef84e1ad9cf174a9ab0bba648b56f2ffd17f4cb4421902b61559b544d812e738
SHA512 f52a9a62ca7d810804289ffe0300919eea529f2e0d4d07709309e101087809a5a004437184f3a3518fcd286db18947d78ce00bafbcbbe7b62a8aca4cf8295208

\??\c:\Users\Admin\AppData\Local\Temp\czeo59xu.cmdline

MD5 16cc1399d0d40647f2099c55a61c1b52
SHA1 45aafe4fbeb886eb3ef7b285b0c9489587a4b6db
SHA256 b3dfeed47f8fdd410b1da31c2ed1688908f7b5cbb164083af5521147f1e69b84
SHA512 05a885ff3fb0b5d09585d33b08a22f83de7472d2b3562c295c12b07b7522eb4a8d85c1fdf9d07abaa9c9cc2e426462e5193dc14c9d7fe7d0ad3506148e19c40f

\??\c:\Users\Admin\AppData\Local\Temp\czeo59xu.0.cs

MD5 6f8e0c3c3b1b9a297b8ee6bfbb9c2a2c
SHA1 1dbab29ad6fb169fad90e963dd0c5290f27272fc
SHA256 e0514048fd6f4169c41896332a243cf014a719e5fe217c5743fc3c7149db578a
SHA512 193fc4f01b6afb2a858f006eb7c5dfd6106d88b0b0e0f12b4c8c103a8bae270ff0d583886ec5af910ce4d50cb1ccfb54a14d27fd517b847a624d9ba79f688640

\??\c:\Users\Admin\AppData\Local\Temp\CSCF397.tmp

MD5 675c22906a5138a15de8d60a35d2ace8
SHA1 e6528377bd93d6e16d25d4c8ff6cb1544919321b
SHA256 30dfb757671d5d734d96160b099d6e52451418082c427e3e1c8ef4472ce22184
SHA512 20935a13eef394a6b1562627341c3ec739638f5a7bf193199b7b84e23c3574f4cb8a7020cf74ffc8937a8b821edbb5e9fceb9dcf4174509435266b20362253b4

C:\Users\Admin\AppData\Local\Temp\RESF398.tmp

MD5 7fc25ea2c33082cebae31c723e210995
SHA1 772f157fcc19b72a2211d086c00d6a733ba3396b
SHA256 ab7e642175486bf82098b18fa593081ff839f0e33dfe62fae276e9a384195526
SHA512 4388e86866f3a9dde2a18d26f1ddd545ac2eea504d108aa801607d980b50f5b10fa389d47ac06d770c70f15a37c4695eb47f33cb1abf39639161011806ddbb72

C:\Users\Admin\AppData\Local\Temp\czeo59xu.dll

MD5 8567c735156361a7d080da3b8acb8366
SHA1 8d77cc65fabb67b1f6f9114780eb9cd3f22d6b63
SHA256 d474b9238541db3f8d678363a677f2de505043fbb01ef2a84ff18c190aabeb1d
SHA512 7123a446c31818af9ac51a6a4fbc3c25f86705d25f5777f8aeb4b2f68501c9e640c181e624156de6fe2bd1fff6204bcfc824170dec3322ef68f2f90b965386d8

C:\Windows\Installer\MSIE8F8.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll

MD5 7868ed46c34a1b36bea10560f453598f
SHA1 72330dac6f8aed0b8fde9d7f58f04192a0303d6b
SHA256 5c17864f1572acec1f93cf6355cfd362c1e96236dcba790234985a3f108d8176
SHA512 0cc913337e3334ff0653bc1fad044d9df60a8728c233dcc2c7f6139f14608740b70b57c25a9d2d895cbc4d59508779f342a72406e623d30365ae89fb2a3607ba

C:\Windows\Installer\MSIE8F8.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.XmlSerializers.dll

MD5 adb53ee43f74f430368449b98b2f6f86
SHA1 fb882d80da9ccf79c6817a492fbd686d4759bb41
SHA256 b7837a68ede7781286057de0b59b7bb9c7c29ff9e9ded32c7175cafe9de3b5ff
SHA512 8fc2cd5a585c8247274fbe8d53ac27faa1f2b0407d27e5e78d6917cfa94947ace2aa20ca670a5b87e3d7a939360691102ed9c7530ec997af1057064bcb9c085a

\??\c:\Users\Admin\AppData\Local\Temp\owovvsbr.cmdline

MD5 81a968634003eaff407296100f5dd29f
SHA1 006311abd90edbca2880e7a6de1b7332092314e1
SHA256 dc3221200208cb29f85793e25e702b45586699a6d9e7d7c34c7966807f008d04
SHA512 126bbb4dbbaa7d58ad19931bd5666f1c93975335be1fa639a089641338dec57e0d9fb0866bd97ff15dbb647c8e63fc404e5a62eaa84114a89552cedbd576f6d5

\??\c:\Users\Admin\AppData\Local\Temp\owovvsbr.0.cs

MD5 14ac60821b7e9508914fdf584ef23f46
SHA1 9bc6cb0f7ea31050962fe56398213a48c5097ffa
SHA256 ed564c34b04178601638c4c2a9ac3c21ac83d4031976fbd467c42d8e1a7c7c1c
SHA512 b3faf1282b570436807b403ebd7aead6e86dbcb61dd64cfba0bc25023ddfe2017434e7f2ba34c0e69974b6f28587d75448f6b9567814d93130e9c7c3b8d01cd5

memory/3064-203-0x0000000003AD0000-0x0000000003AE0000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSCF6B4.tmp

MD5 dcbfa544743f8be91a0002cb8a425e83
SHA1 caab7968582302b78cfdc4ae9ef89daea7fcdf15
SHA256 fc96a3ed791fa1de1296dc73781437965574b0f69516f597da1312540c25a150
SHA512 d5da78411193ae1aff04e1d6b4d38a196bfdd2ca27c428d3c8599d2c452183c9d7e199b874f04698db4f40f61455277097583539dcfc0aefcded0169cabf27b6

C:\Windows\Installer\MSIF994.tmp-\CustomAction.config

MD5 796621b6895449a5f70ca6b78e62f318
SHA1 2423c3e71fe5fa55fd71c00ae4e42063f4476bca
SHA256 09be5df7a85545fd93d9fd3cd1d6c04c6bfe6e233c68da6f81c49e7a35fcbb84
SHA512 081cf1dadb3a0e50f0a31ab03e2b08e80298c06070cd6f9b2806c08d400c07134623f7229a6c99910c6243dfa53c6e2c05d09a497aae1e701bc34b660cf9e4c9

memory/3064-323-0x0000000074A02000-0x0000000074A03000-memory.dmp

memory/3064-372-0x0000000074A00000-0x0000000074FB1000-memory.dmp

C:\Users\Admin\AppData\Local\Smartbar\Common\icons\30DFF8F0-BA79-4360-A3EA-51B6D006133CPress.png

MD5 5719ee7f6521ae142f0557f0706cded1
SHA1 a1d5694197827967aea5b3ccc88e2f91d465c283
SHA256 0a2ae8f3e9aa552748cfeadaec055778487602e7f6d4a6c2a221fe1fd496bfaf
SHA512 cde76dada9e798a746d7ae23ee189940a6b7660805267a9221501c5c911a89b298005f111622fae7c886e810e23f83b77d47fa75793d19441246eb775a2f2bf6

C:\Users\Admin\AppData\Local\Smartbar\Common\icons\3C610B86-19DE-4757-B46A-871C9C27FF0APress.png

MD5 2768222689e3585d609b5a2afc1ba52c
SHA1 ee522df6b2e365857bf6be58ac7150cbc71cfc9c
SHA256 21ee471e79b0a646735e132bc1f0c48f464677127b105426e00b160a554de6b0
SHA512 56527749dca471af92eb4166b2bb6f1ca4cbf07c8d7e1a201378467f1d08efe5fd913715bb995d35c7d511b2cbdc9469d79baae7ee4bab619e4e11753c3505e4

C:\Users\Admin\AppData\Local\Smartbar\Common\icons\B1BEF453-913F-4EC4-B057-A2BB21C09DCBpress.png

MD5 e6ab030a2d47b1306ad071cb3e011c1d
SHA1 ed5f9a6503c39832e8b1339d5b16464c5d5a3f03
SHA256 054e94c94e34cef7c2fad7a0f3129c4666d07f439bfec39523dca7441a49bd7c
SHA512 4cbb002cc2d593bafd2e804cb6f1379187a9cae7d6cc45068fda6d178746420cc90bcd72ba40fc5b8b744170e64df2b296f2a45c8640819aa8b3c775e6120163

memory/3172-1107-0x0000022C2D2B0000-0x0000022C2D2D6000-memory.dmp

memory/3172-1134-0x0000022C2D280000-0x0000022C2D2A0000-memory.dmp

memory/3172-1231-0x0000000000790000-0x0000000000873000-memory.dmp

C:\Windows\assembly\tmp\1AFHYXUV\System.Data.SQLite.dll

MD5 c2e38bfe933c5bce36910fe1fb1d5067
SHA1 aac5ed2724e2f88c7af1a3bf56d73180ae709bb7
SHA256 49a51063aaccc22a28590575417bdff40a67a06e6f2a67217b37af1b49fa6286
SHA512 281225b5e7193270b27811224c70475fc9af47c5d05a7e98f6856ad6abccff084302d0ddb72868d6872eef2efaf2989645af5e596083bfb995f214182aa4184d

C:\Windows\assembly\tmp\4JVGODEI\Interop.SHDocVw.dll

MD5 030a99f9594434ea83d27b33a95c4d5a
SHA1 230882058a1d50e4e8f7fa4bb3144dec506c5967
SHA256 0fdc72a06cc54771f1b07293d2e914cded985d84833ed4bf952a665eb107b5a3
SHA512 529d14374df0b455db055027f42ccf731ddf4b7bef8fc27bffa2ff5a46463dc6b3cacf75fd6356e325f075d7fb70ad0f8abd85feb75d00befd1c86aec857d7ee

C:\Windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll

MD5 459ff9c6762b7fdd91c156ff3e096478
SHA1 7179debce9a271450b1241e7435a999aea1ddd05
SHA256 93865c89e1507409fbbeb9433542a303cdd2fd5acda3d51fecd83e4a8fb8072c
SHA512 8b95330d364413122427604af1c0e848694975eb8c541b911aeb0d50fbb5cd15a60863f68593f1088b26f83500f400f52292a2891511223f796be750c6a7583a

C:\Config.Msi\e57e13b.rbs

MD5 26e842a0c0377a477485175bf4ad6ad5
SHA1 88dc021fbb016aa09dbe5b17241f5ff0b09d5308
SHA256 d1dd86e72584773fb5c749e81bca7c37fe9cae27e10acaa83042be913766efef
SHA512 fe4c1ce30537f144f26510e63ea35977ec1e4d602089a6d9921990e9e0093cdd5a1c395fa026381a733e1a3964202db71cd2d7f8cccaf16c44606a3c621b0029

C:\Windows\Installer\MSIEC3.tmp-\srprl.dll

MD5 d8fa7df1f2cd92ad701bc23f86d89b54
SHA1 72160fd5ad639c5a9c44305b06c98eb637399d18
SHA256 475a2c225258c571ae66c0178a83177bd5a59f4ce1be1f867e14e75614ad43e4
SHA512 a4d11c7f66325199f5c3a41cc37f32cf6ee828d790add1a6b77b9127e65243bb17dcc10b1cb2cbaac4e543bc329bd30e64919ffc0af3fd6088a672e08e10e992

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

C:\Users\Admin\AppData\Local\Smartbar\Application\mc0f8py5.newcfg

MD5 ec3f05ac2148162ddb052f23299b8ecb
SHA1 6ce68e94fb7df83ae34094a85abfefce8a3b8d79
SHA256 449ab9dae5f16f9dc9e70e37930aeb4c78e057debbb8fe25fb5460a9666ec016
SHA512 d166cb06e095281a4a26bdb78e7752d8f9d0e408aa3048eea2294222aa0b7e901364ba377cfc353ada392693b15736c96267697dcabc745f2e4b3d539599b70a

memory/2452-1389-0x000000001CB10000-0x000000001CB28000-memory.dmp

memory/2452-1397-0x000000001F180000-0x000000001F64E000-memory.dmp

memory/2452-1398-0x000000001DD50000-0x000000001DDEC000-memory.dmp

memory/4568-1407-0x000000001C720000-0x000000001C746000-memory.dmp

memory/1736-1415-0x000000001DA50000-0x000000001E1F6000-memory.dmp

memory/1736-1416-0x000000001E200000-0x000000001E9A6000-memory.dmp

memory/5024-1424-0x000000001C9E0000-0x000000001CA06000-memory.dmp

C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Smartbar\DistributionFiles\Configs\UserSettings.xml

MD5 2269eab761de3f1de8eb2a51bd7df777
SHA1 f031ffefdbe0a668deaf29b7becaabb18154e36e
SHA256 3cb715542f445cc13b2578b982fc7188c2b9b93ca436aa82a8be6545b5750636
SHA512 508a388a3ff927b54a04ec26951b302165abace24073526892cc0567b0aa992219885800a6a3417e06df430bf9cbbd98ce23fa746bd2a37d225a7ac4aef78440

C:\Windows\Installer\MSIEC3.tmp-\Newtonsoft.Json.dll

MD5 0e32f5229d5ee7d288b6b3969a51fcbc
SHA1 54c09f07930525786fcf08b9c7aca24185a68fc1
SHA256 e1ca33208030c858254249b2c9aa6d8541c2e875343b2997f2b2f9e4993c96f8
SHA512 64e8499e668ea44397ed5ea009e3692b623d2ac01bdd43e460624fe0282a3398025e4e53282e0f0905062b60400f4c16a64933ed7667de942f1588dd936aebcb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

MD5 d228aba2f1c6bb5cf468582eccfaa93b
SHA1 47e51e6494d61d18ae46adafc5096b40c58a2fb3
SHA256 e9fc516b486e8ec7d453c491c97abc1bc210b89a1893608113c19ef5f53fb0af
SHA512 a091eafa9f47232512e7822633fd4f711a846c989d99f5a70885689b3be022d040213247d534ae258db68592a5b40600a3df193821763b5bb47bd00ec3cd3cae

C:\Windows\Installer\MSIEC3.tmp-\Interop.NetFwTypeLib.dll

MD5 a084b0c082ec6c9525336b131aeba39a
SHA1 45db1f5cc54a033e5df460b93edaa5d23a39ced9
SHA256 7cba99a0f2a5b233e341f691c2aa6cb4ca10065425fc478b56fa468d6b0af54d
SHA512 297ba29e1ee4300f1a11620d475e67a9747fd9affabeee5fb5151b07c931c8f5c5af12b956e2ab7bd7dc6ebb1dbc298f5d56fa419f5fe2e3646053c0e515e29b

C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\user.config

MD5 d03e8a77ebfa0e26a09c2a87a364f48d
SHA1 432e9dfa4a42339434f5d5d3814b2cc598eba833
SHA256 c45a277843d38bf658f999e8b317efe796f83297556c1c7a24dde3231d3ab5ac
SHA512 f5003ec757609d6a040fee5c1f2d539d602ec8fe6618902813da717bab7d568bfca2011cbd3cdf2afaf05b2850cc2e2fc224b15ce7a71162e9c114d3023fca11

C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\zfwdavkt.newcfg

MD5 632aa81941a1b6d021f8dc44e247316a
SHA1 dfa87fe4f16577bf082169c4c2e730720a4f8fd6
SHA256 9a35038c8998b897698aec0a7e3fd836f5fc9189224d91b21b275c08d8b8d682
SHA512 dcdfbab81e59e213ca9420b0ff727ac0ccff668ee0e658af729d1e45a66201f620517cd7039a8f7d906eb817e2de1ac3adda5d151cb9eb16493310378487a3a5

C:\Users\Admin\AppData\Local\Smartbar\Smartbar.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\1.153.63.12705\wdz8btca.newcfg

MD5 7b6012721e4dc519ad656ee54c38ab1f
SHA1 4dd69fc3f260cc681352a316b199edb954bb4ca3
SHA256 ddabd673ab40f85baaae8bd12a6004f56eddcc0f5946b96a53b3143a8f79bb2b
SHA512 7d4b064af0a3bcd4794c8e5bc81dab8a5110b3b1d3162e7e4f153ecabdb00aa9b9f1678a485f97df9eefd001c24efb302983498c7ec87d14f7c234909c47554b

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/3064-1851-0x0000000074A00000-0x0000000074FB1000-memory.dmp