Examples of ToolKit Offers Installer include:
Example 1
File Information
- Size
- 1.3M
- SHA-1
- a19eb0f9d241aa1b98af97846b28dbad05a852ef
- MD5
- f1639bdc1b6dbdb03885c8c4965a6461
- CRC-32
- 9a2cbcf9
- File type
- application/x-ms-dos-executable
- First seen
- 2013-01-02
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Local Settings\Temp\dealply_largo.bmp
- Size
- 27K
- SHA-1
- 40c679cd1ce8c158c46b6147be25bc8e28a2c9a3
- MD5
- 132e8d8c56dd6b23d49892ba742f18de
- CRC-32
- c364c23f
- File type
- image/x-bmp
- First seen
- 2013-01-02
- c:\Documents and Settings\test user\Local Settings\Temp\sweetim_logo.bmp
- Size
- 11K
- SHA-1
- f910b1db742f255a7f024beb649b4e8aeecf0599
- MD5
- dfd847705a3a7bc89a3e5ebfc13898f9
- CRC-32
- 46caaad5
- File type
- image/x-bmp
- First seen
- 2013-01-02
- c:\Documents and Settings\test user\Local Settings\Temp\square_lollipop.bmp
- Size
- 2.4K
- SHA-1
- ce4e0b61c3b08b984e22244a75cdbd2fb4e08584
- MD5
- 11d93cc535227b3351a70a3c8d8dfeb1
- CRC-32
- d6090d85
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-08-15
- c:\Documents and Settings\test user\Local Settings\Application Data\temp\f83fheader.bmp
- Size
- 26K
- SHA-1
- 5baf9f5a047ee7b453afcbba6587b6ae31472883
- MD5
- cd3abc8a25711b82c00b5e3264f7e24b
- CRC-32
- 1602a47e
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-01-24
- c:\Documents and Settings\test user\Local Settings\Temp\config.xml
- Size
- 682
- SHA-1
- 71e31172d0623b6c1d97e88093a157a18ec03647
- MD5
- 940a5b7d13402d45da64b355e91ff13a
- CRC-32
- d87b83b1
- File type
- application/octet-stream
- First seen
- 2013-01-02
- c:\Documents and Settings\test user\Local Settings\Temp\ajax_loader.gif
- Size
- 3.2K
- SHA-1
- 25e7652b0ec4960afbb84adf52fd97d8a4e0048b
- MD5
- 60d1f98dbb5a6ea9ac747c3e46c0c628
- CRC-32
- ecd3d1c2
- File type
- Graphic interchange format
- First seen
- 2012-03-02
- c:\Documents and Settings\test user\Local Settings\Temp\moreinfo_iminent.bmp
- Size
- 129K
- SHA-1
- 69392311433059916575929e71e633df430cac27
- MD5
- 7667a6ee69a9c1d6354dff68b799f8c8
- CRC-32
- 5220f68f
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-04-10
- c:\Documents and Settings\test user\Local Settings\Temp\lollipop_moreinfo.bmp
- Size
- 77K
- SHA-1
- 9a20e384fa699e8267d87ea8b3eef4c9db3c472a
- MD5
- 874f46f1ea1d02461878d06952e0c46b
- CRC-32
- 1a87a4b8
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-12-14
- c:\Documents and Settings\test user\Local Settings\Temp\nsx3.tmp\ToolkitOffers.dll
- Size
- 245K
- SHA-1
- 4df69fe59c10f2cd6de472e5fc05eed5a489998b
- MD5
- 3c6a9490f32cf8aca12252188874dade
- CRC-32
- bb1cf4b8
- File type
- application/x-ms-dos-executable
- First seen
- 2013-01-02
- c:\Documents and Settings\test user\Local Settings\Temp\toolbar_sweetim_fb.bmp
- Size
- 108K
- SHA-1
- c58c38a8be5223560a91862e2e0eb79549f9cacb
- MD5
- d195b628f091ce6044af420b38fd6469
- CRC-32
- 97a567db
- File type
- image/x-bmp
- First seen
- 2013-01-02
- c:\Documents and Settings\test user\Local Settings\Temp\nsx3.tmp\ButtonEvent.dll
- Size
- 4.5K
- SHA-1
- d64e05c1879a92d5a8f9ff2fd2f1a53e1a53ae96
- MD5
- 55788069d3fa4e1daf80f3339fa86fe2
- CRC-32
- 3886619a
- File type
- Windows executable
- First seen
- 2012-01-20
- c:\Documents and Settings\test user\Local Settings\Application Data\temp\f83fInstaller.INI
- Size
- 299
- SHA-1
- 5f6c29f0a3e257e22fd025a929fc9385a3d782a1
- MD5
- 13b56d097f48b2e9eabcff5312a1cabc
- CRC-32
- 6e96c304
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2013-01-02
- c:\Documents and Settings\test user\Local Settings\Temp\moreinfo_driverscanner.bmp
- Size
- 122K
- SHA-1
- e22458ac37733a12f567204163a53d7961183a2c
- MD5
- 0adb276553837fb44c195387ed557e89
- CRC-32
- 6a43dbc7
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-07-14
- c:\Documents and Settings\test user\Local Settings\Temp\nsx3.tmp\nsDialogs.dll
- c:\Documents and Settings\test user\Local Settings\Temp\moreinfo_speedupmypc.bmp
- Size
- 335K
- SHA-1
- cc0ffbcb17018740ec1bdc68380d3408c6855359
- MD5
- a7e12f7e5f64eb2eaf0977355353e61c
- CRC-32
- 37b12779
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-07-14
- c:\Documents and Settings\test user\Local Settings\Temp\nsx3.tmp\modern-header.bmp
- c:\Documents and Settings\test user\Local Settings\Temp\nsx3.tmp\version.dll
- c:\Documents and Settings\test user\Local Settings\Temp\iminentv2_terms.rtf
- Size
- 13K
- SHA-1
- ebf47cd3a1f8ff2c64a3cde76704c4e916fb4421
- MD5
- d418550bf8d866202dcb451ddf25ea3e
- CRC-32
- 6e60586d
- File type
- application/octet-stream
- First seen
- 2013-01-02
- c:\Documents and Settings\test user\Local Settings\Temp\toolbar_sweetim.bmp
- Size
- 59K
- SHA-1
- c837a569d952ffd0881ac78370afbf6dfd2894da
- MD5
- 613cf2ed9ad9c9edc85f4b4a2ff8dfc7
- CRC-32
- d7c3268b
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-02-19
- c:\Documents and Settings\test user\Local Settings\Temp\square_driverscanner.bmp
- Size
- 3.6K
- SHA-1
- f42070c73c82fe3a742e1884d124a7a9836b432f
- MD5
- 9bdd6a8ec4297cf7a00d77bc4ff93a36
- CRC-32
- 580b8f9f
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-07-14
- c:\Documents and Settings\test user\Local Settings\Temp\nsx3.tmp\modern-wizard.bmp
- c:\Documents and Settings\test user\Local Settings\Temp\square_dealply.bmp
- Size
- 1.7K
- SHA-1
- bbdd69633deb72b4f0d3a2d430abdd589325abb5
- MD5
- bf3af94325463cbdce55169d1380ab27
- CRC-32
- 272da954
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-03-16
- c:\Documents and Settings\test user\Local Settings\Temp\square_iminent.bmp
- Size
- 938
- SHA-1
- 90a8eff754e3fed5dc68f1d5a97af1ee2b284e4a
- MD5
- a80397149bf29ed2de35513a49a0e6a9
- CRC-32
- a54e7813
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-04-07
- c:\Documents and Settings\test user\Local Settings\Temp\square_sweetim.bmp
- Size
- 1.7K
- SHA-1
- 7f599f94c49da57738877abcb81664556069dbd9
- MD5
- 0d0bb5f85f2088d8a3bc8a597edf6adb
- CRC-32
- 50d8c4c2
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-03-16
- c:\Documents and Settings\test user\Local Settings\Temp\square_speedupmypc.bmp
- Size
- 2.4K
- SHA-1
- aa1c211c6b725b2170f44343e698091be62524e5
- MD5
- 9509b6e540749d71a1dad4714068c567
- CRC-32
- ff9e0dfa
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-07-13
- c:\Documents and Settings\test user\Local Settings\Temp\nsx3.tmp\System.dll
- c:\Documents and Settings\test user\Local Settings\Temp\toolbar_bbv3.bmp
- Size
- 35K
- SHA-1
- a023733430f8e74f40dd6f70e30e05e244bfb559
- MD5
- 1687c82f77a6e033890d7fba31f85697
- CRC-32
- 5a002fc1
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-01-24
- c:\Documents and Settings\test user\Local Settings\Temp\license.rtf
- Size
- 28K
- SHA-1
- d50a02c7a17a0e317292df82525cb9f77e146334
- MD5
- d191abcfe5417dabe824049dfca076e7
- CRC-32
- 3bb68aff
- File type
- application/octet-stream
- First seen
- 2013-01-02
- c:\Documents and Settings\test user\Local Settings\Temp\iminent_toolbar.bmp
- Size
- 58K
- SHA-1
- c5c8267c297a7c9fc03e1e14102e97a6fa9504e6
- MD5
- 7f7d6c9202490c534c303ffda02743c1
- CRC-32
- 436f64db
- File type
- image/x-bmp
- First seen
- 2013-01-02
- c:\Documents and Settings\test user\Local Settings\Application Data\temp\f83fInstaller.exe
- Size
- 868K
- SHA-1
- ddbf17ad1b3777a24216a3329f9f01131ed953eb
- MD5
- 4b700aba2a4fc7a41522e0bd397af97a
- CRC-32
- f2f404c6
- File type
- Windows executable
- First seen
- 2013-01-02
- c:\Documents and Settings\test user\Local Settings\Temp\square_offerbox.bmp
- Size
- 2.4K
- SHA-1
- 0f6c158124dfe2a0cf5e7e80cf720e961d3ff9fc
- MD5
- 7d3d4791f8efec9b26277661cf5363b6
- CRC-32
- 24732665
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-04-03
- c:\Documents and Settings\test user\Local Settings\Temp\instloffer.exe
- Size
- 170K
- SHA-1
- 70d27c2943919e4ed7136084c197af1f780945e3
- MD5
- bd86eed6ad7bbb6145ac18453af151df
- CRC-32
- 6aa37aea
- File type
- Windows executable
- First seen
- 2013-01-02
- c:\Documents and Settings\test user\Local Settings\Temp\moreinfo_offerbox.bmp
- Size
- 213K
- SHA-1
- 30c4cf892019c5036f5c660899cce8f37fdeaa11
- MD5
- 21c143f0059afcc60cdf9b8577260be1
- CRC-32
- 4bd0703f
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-04-04
- c:\Documents and Settings\test user\Local Settings\Temp\toolbar_sweetim2.bmp
- Size
- 37K
- SHA-1
- 2278908b2686634da79b924b8cc82c2208deddfc
- MD5
- 5d32ddc73852c8581be0702af6d6bec3
- CRC-32
- 9b8de351
- File type
- image/x-bmp
- First seen
- 2013-01-02
- c:\Documents and Settings\test user\Local Settings\Temp\nsx3.tmp\nsArray.dll
- Size
- 6.0K
- SHA-1
- 7e9a518e15b7490245d2bef11a73f209c8d8d59b
- MD5
- f8462e9d1d7fd39789afca89ab6d6046
- CRC-32
- 43e92e18
- File type
- Windows executable
- First seen
- 2012-05-02
- c:\Documents and Settings\test user\Local Settings\Temp\square_babylonv3.bmp
- Size
- 1.7K
- SHA-1
- 900ea5e4da8c46c2f1a52f39eaa3b791b43c41eb
- MD5
- 811296be3855dbe1b72546ec798f0d00
- CRC-32
- aef3bcf7
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2012-03-16
- c:\Documents and Settings\test user\Local Settings\Application Data\temp\f83ffondo.bmp
- Size
- 206K
- SHA-1
- 0faaf28271776b721db8dcf59960383eff3ed53e
- MD5
- 0db5f3efaf6ef6f3ee97f6221bb0408e
- CRC-32
- fbb1358b
- File type
- Device-independent bitmap (DIB) file
- First seen
- 2013-01-02
Registry Keys Created
- HKLM\SOFTWARE\Vittalia\AxtanInstaller
- enduser_id
- 16667018
Processes Created
- c:\Documents and Settings\test user\local settings\application data\temp\f83finstaller.exe
HTTP Requests
- http://xmlinstcp.ddbbvt.eu/cmd/api.php
- http://xmlinstcp.ddbbvt.eu/cmd/geo.php
- http://xmlinstcp.ddbbvt.eu/cmd/report.php
DNS Requests
Example 2
File Information
- Size
- 868K
- SHA-1
- ddbf17ad1b3777a24216a3329f9f01131ed953eb
- MD5
- 4b700aba2a4fc7a41522e0bd397af97a
- CRC-32
- f2f404c6
- File type
- Windows executable
- First seen
- 2013-01-02
Runtime Analysis
Registry Keys Created
- HKLM\SOFTWARE\Vittalia\AxtanInstaller
- enduser_id
- 16698071
HTTP Requests
- http://xmlinstcp.ddbbvt.eu/cmd/api.php
- http://xmlinstcp.ddbbvt.eu/cmd/geo.php
- http://xmlinstcp.ddbbvt.eu/cmd/report.php
DNS Requests