Crawler Toolbar

Por Domesticus em Programas potencialmente indesejados

Traduzir Para:

Cartão de pontuação de ameaças

Popularity Rank:	737
Nível da Ameaça:	50 % (Médio)
Computadores infectados:	23,074

Visto pela Primeira Vez:	August 31, 2010
Visto pela Última Vez:	March 30, 2026
SO (s) Afetados:	Windows

O Crawler Toolbar é uma barra de ferramentas que pode ser usada para ajudá-lo a pesquisar na Internet, quando intencionalmente instalada. O Crawler Toolbar tem uma política de privacidade ou um término de licença de uso (EULA) vagos e geralmente é instalado por um malware ou por outros programas maliciosos. Quando dentro de uma máquina, o Crawler Toolbar vai exibir um adware aborrecedor e, possivelmente, instalar um spyware ou outro malware. O Crawler Toolbar também deteriora o desempenho do sistema, enquanto recolhe informações relacionadas com a Internet, que depois envia para um servidor remoto de terceiros. Se não instalou intencionalmente o Crawler Toolbar, remova-o do seu sistema o mais rapidamente possível.

Outros Nomes

7 fornecedores de segurança sinalizaram este arquivo como malicioso.

Antivirus Vendor	Detecção
Prevx1	Heuristic: Suspicious Self Modifying File
Symantec	Suspicious.Insight
F-Prot	W32/HotBar.A.gen!Eldorado
McAfee+Artemis	Suspect-29!878E643FA7BA
Panda	Suspicious file
McAfee+Artemis	Suspect-29!C12B6F467570
Authentium	W32/Podnuha.B.gen!Eldorado

SpyHunter detecta e remove Crawler Toolbar

Detalhes Sobre os Arquivos do Sistema

Crawler Toolbar pode criar o(s) seguinte(s) arquivo(s):

Expandir todos | Recolher todos

#	Nome do arquivo	MD5	Detecções Detecções: O número de casos confirmados e suspeitos de uma determinada ameaça detectada nos computadores infectados conforme relatado pelo SpyHunter.
1.	PCRxTray.exe	2cfd05bae80678ca16a0bb0f2c1f1e43	119
Nome: PCRxTray.exe MD5: 2cfd05bae80678ca16a0bb0f2c1f1e43 Tamanho: 1.34 MB (1345840 bytes) Detecções: 119 Tipo: Executable File Caminho: %PROGRAMFILES(x86)%\PCRx Grupo: Arquivo de malware Ultima Atualização: December 6, 2016
2.	PCRx.exe	b05742ed2c53fb76e81c9a17401aa1b0	107
Nome: PCRx.exe MD5: b05742ed2c53fb76e81c9a17401aa1b0 Tamanho: 11.78 MB (11789104 bytes) Detecções: 107 Tipo: Executable File Caminho: %PROGRAMFILES%\PCRx Grupo: Arquivo de malware Ultima Atualização: July 18, 2019

Arquivos Adicionais

Detalhes sobre o Registro

Crawler Toolbar pode criar a seguinte entrada de registro ou entradas de registro:

CLSID

{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

{22C1406C-6350-4D3B-9F62-2A3F370AD9A7}

{2DC4F899-9C79-4462-863D-4EC61F3EFA52}

{38CF96AD-0ACC-49DF-91B7-5D7F640BF1B7}

{4545C96B-15D0-4E22-8DDE-6F2CAF531281}

{694AB2B2-6141-4567-9B66-B60FD06AD30F}

{7CC6C266-6155-4676-AE77-85164EAE29D9}

{9234F5E0-56CC-4F0B-AAE4-0D4BD5032180}

{BAA73D86-AFBD-4F73-8243-E7D193FA6C8B}

{C4D78C72-08DB-4A3F-9175-B265157283F3}

{EDDAFD4A-10D1-406A-8796-D13B54DB5E04}

{FA66632B-E294-4249-B007-64C07C7E0147}

File name without path

www.crawler[1].xml

HKEY..\..\..\..{RegistryKeys}

SOFTWARE\Classes\Crawler.AppServer

SOFTWARE\Classes\Crawler.CRT404

SOFTWARE\Classes\Crawler.JSServer

SOFTWARE\Classes\Crawler.Toolbar

Software\Crawler Toolbar

Software\Microsoft\Internet Explorer\Approved Extensions\{9234F5E0-56CC-4F0B-AAE4-0D4BD5032180}

Software\Microsoft\Internet Explorer\Approved Extensions\{C4D78C72-08DB-4A3F-9175-B265157283F3}

Software\Microsoft\Internet Explorer\DOMStorage\crawler.com

Software\Microsoft\Internet Explorer\DOMStorage\www.crawler.com

SOFTWARE\Microsoft\Internet Explorer\MenuExt\Crawler Search

Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

SOFTWARE\Microsoft\Internet Explorer\Toolbar\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}

SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9234F5E0-56CC-4F0B-AAE4-0D4BD5032180}

Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9234F5E0-56CC-4F0B-AAE4-0D4BD5032180}

Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C4D78C72-08DB-4A3F-9175-B265157283F3}

SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{22C1406C-6350-4D3B-9F62-2A3F370AD9A7}

SOFTWARE\Wow6432Node\Crawler Toolbar

SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAA73D86-AFBD-4F73-8243-E7D193FA6C8B}

SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C4D78C72-08DB-4A3F-9175-B265157283F3}

SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9234F5E0-56CC-4F0B-AAE4-0D4BD5032180}

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C4D78C72-08DB-4A3F-9175-B265157283F3}

HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}

{F13E61C0-917B-4AAD-96CD-7A5860E25A73}_is1

Diretórios

Crawler Toolbar pode criar o seguinte diretório ou diretórios:

%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Crawler Toolbar

%PROGRAMFILES%\Crawler Toolbar

%PROGRAMFILES%\Crawler\Toolbar

%PROGRAMFILES(x86)%\Crawler Toolbar

%PROGRAMFILES(x86)%\Crawler\Toolbar

%USERPROFILE%\AppData\LocalLow\Crawler Toolbar

URLs

Crawler Toolbar pode chamar os seguintes URLs:

crawler.com

Relatório de análise

Informação geral

Family Name:	Crawler Toolbar
Signature status:	Root Not Trusted

Known Samples

MD5: 68c9b7fdafcaa1e1664dcf3fca1d3e3e

SHA1: da6b9d8bd453a74f489d0c78df663ce15df0a574

SHA256: A99952D823173EAA1A403F0737DD3DC87AB5F1859525AFA9EA806F6625298ABE

Tamanho do Arquivo: 8.60 MB, 8604456 bytes

MD5: fd31c306bd8ec037753f32c5a34ca41b

SHA1: 6827ba65e0765ed8b83817f89b435508f0e30e75

SHA256: ACBD6FAC46D4E823E7D5E2ADE13EAD2DED6BAA32DE7976ACB960DBDD5FEF9A0B

Tamanho do Arquivo: 4.98 MB, 4979152 bytes

MD5: 20a9ef8a59603e8b4db1f1b10a516555

SHA1: 22367dbafabb0397cdb7ac925c1a8471a8628d8d

SHA256: 6DE730E732D91A94FC0C6A193EC2035E6B2E755753F9D8FFDC2A0A371A6D3BCE

Tamanho do Arquivo: 1.21 MB, 1211344 bytes

MD5: d659818120de412a8b66d9e22c944d76

SHA1: a6a27bd50d7f4c98a40aeac6a1349b988bb909bf

SHA256: 5FCE15F1D0ADA6064D7199A966EDF2ED52586D5FEC6C2BA450077906DD59DD97

Tamanho do Arquivo: 1.74 MB, 1741464 bytes

MD5: f04a816f3969f75f99cec8849b083610

SHA1: 44cce897d7207df337352ed91230e5803f73a302

SHA256: 973C681F216F65C6F5696E71D651C918C4AEC4FD833C151E849BD092AC08ED6A

Tamanho do Arquivo: 6.50 MB, 6499480 bytes

MD5: 9bec9bd815f344c4a8e38ee4ec5261ca

SHA1: 5855ce5f3d09acc35f73b8a39aa82fcadd8320b1

SHA256: DAF681014CE4668AF610D561F6457B0DDA789577107B53E593A11C8E73ADB56E

Tamanho do Arquivo: 4.81 MB, 4806672 bytes

MD5: e11b3cf8a702f47fc657b757b357e655

SHA1: 4140d5f27d5914edf81641530bbd29c9d2bf917f

SHA256: 84B27C5BEFA25BE6B21C05E05BCD662DABADE12813D53283917F66BA32F07843

Tamanho do Arquivo: 5.32 MB, 5323768 bytes

MD5: 21b7c4b8162785c698ec890456820d7f

SHA1: 9be0dd2f7790c0a8a910f1dd21c4b3200d8d13b8

SHA256: 81884343FCEA8179A4AE6221D1D66FA3D143170E467603183A1DCE1398FD2FB6

Tamanho do Arquivo: 646.90 KB, 646904 bytes

MD5: 2547230726e76dcd45c148a39681310a

SHA1: 3b5c0c96e4cb86690647b3409c219588ea62c52c

SHA256: 2D3F1E8898E31C462E92895FF5966DDFEA70BBB46AB431532A70F30DBD8420C8

Tamanho do Arquivo: 2.26 MB, 2260706 bytes

MD5: 9954a18711e71d06495ce57e35d10168

SHA1: 3874157c2c9281e8a47a3234e89fae645e1fca98

SHA256: 2687BF1B7F21AF93203CB4A1C87E6086870709C1C7CCE38F09D32A1C2E6D3C7F

Tamanho do Arquivo: 1.15 MB, 1148664 bytes

Windows Portable Executable Attributes

File doesn't have "Rich" header
File doesn't have debug information
File doesn't have exports table
File doesn't have relocations information
File doesn't have security information
File has exports table
File has TLS information
File is 32-bit executable
File is 64-bit executable
File is either console or GUI application

File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
File is Native application (NOT .NET application)
File is not packed
IMAGE_FILE_DLL is not set inside PE header (Executable)
IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Nome	Valor
Comments	SpywareTerminator PORTABLE This installation was built with Inno Setup. This installation was built with Inno Setup: http://www.innosetup.com
Company Name	Crawler, LLC Crawler.com Crawler.com Crawler Group Crawler Inc. tugashare.net
File Description	24x7Help Crawler Parental Control Setup Crawler Toolbar Browser Object Spyware Terminator 2012 Realtime Shield Service Spyware Terminator 2012 Setup Spyware Terminator 2015 Setup SpywareTerminator PORTABLE Spyware Terminator Setup
File Version	5.1.0.177 3.0.1.107 3.0.0.74 3.0.0.69 3.0.0.34 3, 0, 0, 54 2.5.6.316 2.2.0.355 2.1.0.19 1.1.0.226
Internal Name	SpywareTerminator PORTABLE
Legal Copyright	copyright Crawler Copyright © 2006-2012 tugashare.net copyright © Crawler.com © Crawler, LLC © Crawler.com
Original Filename	App24x7Help.exe ctbr.dll SpywareTerminator.exe st_rsser.exe
Product Name	24x7Help Crawler Toolbar Spyware Terminator 2012 Spyware Terminator 2012 Spyware Terminator 2015 SpywareTerminator PORTABLE
Product Version	5.1.0.177 3.0.0.0 3.0.0.0 3, 0, 0, 54 2.1.0.0

Digital Signatures

Signer	Root	Status
Crawler, LLC	VeriSign Class 3 Code Signing 2004 CA	Root Not Trusted
Crawler, LLC	VeriSign Class 3 Public Primary Certification Authority - G5	Root Not Trusted

File Traits

Inno
InnoSetup Installer
Installer Manifest
Installer Version
x86

Block Information

Total Blocks:	2,735
Potentially Malicious Blocks:	0
Whitelisted Blocks:	2,735
Unknown Blocks:	0

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

... Data truncated

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-101cq.tmp\is-8rei7.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-22glm.tmp\6827ba65e0765ed8b83817f89b435508f0e30e75_0004979152.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-eqqlm.tmp\_isetup\_regdll.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-eqqlm.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-eqqlm.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-h39n5.tmp\da6b9d8bd453a74f489d0c78df663ce15df0a574_0008604456.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-h7i8f.tmp\_isetup\_regdll.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-h7i8f.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-h7i8f.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data

c:\users\user\appdata\roaming\24x7 help\skin\24x7_uploaderdark01.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\24x7_uploaderdark01.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7_uploaderdark01.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_left.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_left.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_left.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_right.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_right.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_right.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_x00.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_x00.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_x00.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_x01.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_x01.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_x01.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_x02.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_x02.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7bubble_x02.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark001_settingsactive.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark001_settingsactive.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark001_settingsactive.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark001_settingsback.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark001_settingsback.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark001_settingsback.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark001_settingshover.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark001_settingshover.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark001_settingshover.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark_notabs_back00.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark_notabs_back00.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark_notabs_back00.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark_notabs_phoneicon.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark_notabs_phoneicon.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7dark_notabs_phoneicon.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7logonew_dark01.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\24x7logonew_dark01.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7logonew_dark01.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7man_dark01.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\24x7man_dark01.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\24x7man_dark01.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\arrowsmall.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\arrowsmall.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\arrowsmall.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\arrowsmallhot.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\arrowsmallhot.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\arrowsmallhot.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\bubble.xml	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\bubble.xml	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\bubble.xml	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\hardware_icon.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\hardware_icon.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\hardware_icon.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\hotinactivetableft.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\hotinactivetableft.bmp	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\hotinactivetableft.bmp	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\hotinactivetabright.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\hotinactivetabright.bmp	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\hotinactivetabright.bmp	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\mainimg_settingsdark01.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\mainimg_settingsdark01.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\mainimg_settingsdark01.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\navigation_homeicon00_dark01.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\navigation_homeicon00_dark01.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\navigation_homeicon00_dark01.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\navigation_homeicon01_dark01.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\navigation_homeicon01_dark01.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\navigation_homeicon01_dark01.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\navigation_settingsicon00_dark01.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\navigation_settingsicon00_dark01.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\navigation_settingsicon00_dark01.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\navigation_settingsicon01_dark01.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\navigation_settingsicon01_dark01.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\navigation_settingsicon01_dark01.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\ok_icongreen01.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\ok_icongreen01.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\ok_icongreen01.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\phones_icon.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\phones_icon.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\phones_icon.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\pushedinactivetableft.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\pushedinactivetableft.bmp	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\pushedinactivetableft.bmp	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\pushedinactivetabright.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\pushedinactivetabright.bmp	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\pushedinactivetabright.bmp	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\security_icon.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\security_icon.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\security_icon.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\skin.xml	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\skin.xml	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\skin.xml	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\software_icon.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\software_icon.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\software_icon.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\supportcheck01_arrow00.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\supportcheck01_arrow00.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\supportcheck01_arrow00.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\supportcheck01_arrow01.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\supportcheck01_arrow01.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\supportcheck01_arrow01.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\warning_icon01.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\warning_icon01.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\warning_icon01.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\warning_iconorange01.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\warning_iconorange01.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\warning_iconorange01.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\warning_iconred01.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\warning_iconred01.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\warning_iconred01.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\whitetableft.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\whitetableft.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\whitetableft.png	Synchronize,Write Attributes
c:\users\user\appdata\roaming\24x7 help\skin\whitetabright.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\24x7 help\skin\whitetabright.png	Generic Write,Read Attributes
c:\users\user\appdata\roaming\24x7 help\skin\whitetabright.png	Synchronize,Write Attributes

Registry Modifications

Key::Value	Dados	API Name
HKLM\software\wow6432node\ctoolbar::afa_done	0	RegNtPreCreateKey
HKCU\software\24x7help::lang_id	en	RegNtPreCreateKey
HKCU\software\24x7help::techsupport_text	Click here for instant access to technical support from the 24x7 Help	RegNtPreCreateKey
HKCU\software\24x7help::representative_icon	1	RegNtPreCreateKey
HKLM\software\wow6432node\24x7help::last_senddata	46003.328733044	RegNtPreCreateKey

Windows API Usage

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection ReadProcessMemory
Process Shell Execute	CreateProcess
User Data Access	GetUserObjectInformation
Syscall Use	ntdll.dll!NtAlpcConnectPortEx ntdll.dll!NtAlpcQueryInformation ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtAssociateWaitCompletionPacket ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateIoCompletion Show More ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtCreateTimer2 ntdll.dll!NtCreateWaitCompletionPacket ntdll.dll!NtCreateWorkerFactory ntdll.dll!NtDuplicateObject ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenDirectoryObject ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenSection ntdll.dll!NtOpenThreadToken ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReadFile ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetTimer2 ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWriteFile UNKNOWN
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
Other Suspicious	SetWindowsHookEx
Network Wininet	HttpOpenRequest HttpQueryInfo HttpSendRequest InternetConnect InternetOpen
Network Winhttp	WinHttpOpen
Service Control	StartServiceCtrlDispatcher

Shell Command Execution


							"C:\Users\Wojvgvpc\AppData\Local\Temp\is-H39N5.tmp\da6b9d8bd453a74f489d0c78df663ce15df0a574_0008604456.tmp" /SL5="$5020E,8103461,66048,c:\users\user\downloads\da6b9d8bd453a74f489d0c78df663ce15df0a574_0008604456"


							"C:\Users\Ldojtqam\AppData\Local\Temp\is-22GLM.tmp\6827ba65e0765ed8b83817f89b435508f0e30e75_0004979152.tmp" /SL5="$8034A,4298571,161792,c:\users\user\downloads\6827ba65e0765ed8b83817f89b435508f0e30e75_0004979152"


							C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\22367dbafabb0397cdb7ac925c1a8471a8628d8d_0001211344.,LiQMAxHB


							"C:\Users\Xocdxxto\AppData\Local\Temp\is-101CQ.tmp\is-8REI7.tmp" /SL4 $D0242 "c:\users\user\downloads\4140d5f27d5914edf81641530bbd29c9d2bf917f_0005323768" 4902226 65024

Crawler Toolbar

Cartão de pontuação de ameaças

EnigmaSoft Threat Scorecard

Outros Nomes

SpyHunter detecta e remove Crawler Toolbar

Detalhes Sobre os Arquivos do Sistema

Detalhes sobre o Registro

Diretórios

URLs

Relatório de análise

Informação geral

Known Samples

Known Samples

Windows Portable Executable Attributes

Windows Portable Executable Attributes

File Icons

File Icons

Windows PE Version Information

Windows PE Version Information

Digital Signatures

Digital Signatures

File Traits

Block Information

Block Information

Visual Map

Files Modified

Files Modified

Registry Modifications

Registry Modifications

Windows API Usage

Windows API Usage

Shell Command Execution

Shell Command Execution

Enviar o Comentário

Tendendo

Mais visto