DashlaneInst.exe
This report is generated from a file or URL submitted to this webservice on July 8th 2019 15:14:02 (UTC)
Guest System:
Windows 7 64 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by Falcon Sandbox © Hybrid Analysis
Incident Response
Risk Assessment
- Spyware
-
Contains ability to open the clipboard
Found a string that may be used as part of an injection method - Fingerprint
-
Queries kernel debugger information
Queries sensitive IE security settings
Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)
Reads the active computer name
Reads the cryptographic machine GUID - Evasive
-
Marks file for deletion
Possibly checks for the presence of an Antivirus engine
Possibly tries to implement anti-virtualization techniques - Network Behavior
- Contacts 7 domains and 8 hosts. View all details
MITRE ATT&CK™ Techniques Detection
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 6
-
External Systems
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 1/17 Antivirus vendors marked sample as malicious (5% detection rate)
- source
- External System
- relevance
- 8/10
-
Sample was identified as malicious by at least one Antivirus engine
-
General
-
The analysis extracted a file that was identified as malicious
- details
-
1/80 Antivirus vendors marked dropped file "api-ms-win-crt-heap-l1-1-0.dll" as malicious (classified as "No error" with 1% detection rate)
1/79 Antivirus vendors marked dropped file "api-ms-win-core-heap-l1-1-0.dll" as malicious (classified as "No error" with 1% detection rate)
1/79 Antivirus vendors marked dropped file "api-ms-win-core-file-l1-2-0.dll" as malicious (classified as "Process crashed" with 1% detection rate)
1/80 Antivirus vendors marked dropped file "api-ms-win-core-handle-l1-1-0.dll" as malicious (classified as "No error" with 1% detection rate)
1/82 Antivirus vendors marked dropped file "api-ms-win-crt-locale-l1-1-0.dll" as malicious (classified as "No error" with 1% detection rate)
1/82 Antivirus vendors marked dropped file "api-ms-win-core-rtlsupport-l1-1-0.dll" as malicious (classified as "Process crashed" with 1% detection rate)
1/81 Antivirus vendors marked dropped file "api-ms-win-core-libraryloader-l1-1-0.dll" as malicious (classified as "No error" with 1% detection rate)
1/82 Antivirus vendors marked dropped file "api-ms-win-core-processthreads-l1-1-0.dll" as malicious (classified as "No error" with 1% detection rate)
1/81 Antivirus vendors marked dropped file "api-ms-win-core-sysinfo-l1-1-0.dll" as malicious (classified as "No error" with 1% detection rate) - source
- Binary File
- relevance
- 10/10
-
The analysis extracted a file that was identified as malicious
-
Network Related
-
Found a reference to an external IP address lookup service
- details
-
"whatismyip.com,4" (Indicator: "whatismyip.com"; File: "domain_categories_w.csv")
"tracemyip.org,4" (Indicator: "tracemyip.org"; File: "domain_categories_t.csv") - source
- File/Memory
- relevance
- 6/10
-
Malicious artifacts seen in the context of a contacted host
- details
-
Found malicious artifacts related to "54.76.128.186": ...
URL: http://l.zombienewsapp.com/ldo?v=1 (AV positives: 2/65 scanned on 08/27/2017 05:03:12)
URL: http://l.getspeedbrowser.com/st?v=1 (AV positives: 1/65 scanned on 08/26/2017 06:13:34)
File SHA256: 206986190cdab29789bb11fa63d234b00a88d6e05c6917189028f4ac89f7a806 (AV positives: 1/72 scanned on 06/27/2019 15:01:45)
File SHA256: 04847f5c72a015b1eb565eb0be49b67e63c181bf313c3e36096083963eea2193 (AV positives: 58/72 scanned on 06/27/2019 14:30:45)
File SHA256: e176c193f3aa9608fc9c8aa32de0e03a6ef7c964def33f7de8d3695a29a755aa (Date: 05/22/2019 15:45:04)
File SHA256: 2068a9068cd237ea9596d4ff5fbe273cab28731469ac6358c1ea04dde7cd1f8b (AV positives: 48/64 scanned on 09/17/2017 13:12:48)
File SHA256: e5bec7008541c60a8b14904686a2cb48928d0a0e4e00670ff152951070c83ed8 (AV positives: 31/65 scanned on 08/29/2017 07:16:35) - source
- Network Traffic
- relevance
- 10/10
-
Uses network protocols on unusual ports
- details
- TCP traffic to 34.252.247.18 on port 49376
- source
- Network Traffic
- relevance
- 7/10
- ATT&CK ID
- T1065 (Show technique in the MITRE ATT&CK™ matrix)
-
Found a reference to an external IP address lookup service
-
Unusual Characteristics
-
Contains ability to reboot/shutdown the operating system
- details
-
ExitWindowsEx@USER32.DLL from DashlaneInst.exe (PID: 3992) (Show Stream)
ExitWindowsEx@USER32.DLL from DashlaneInst.exe (PID: 3992) (Show Stream)
ExitWindowsEx@USER32.DLL from DashlaneInst.exe (PID: 3992) (Show Stream)
ExitWindowsEx@USER32.DLL from DashlaneInst.exe (PID: 3992) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 5/10
-
Contains ability to reboot/shutdown the operating system
-
Suspicious Indicators 35
-
Anti-Reverse Engineering
-
PE file has unusual entropy sections
- details
- .rsrc with unusual entropies 7.81257961181
- source
- Static Parser
- relevance
- 10/10
-
PE file has unusual entropy sections
-
Environment Awareness
-
Possibly tries to implement anti-virtualization techniques
- details
- "tvboxnow.com,11" (Indicator: "vbox")
- source
- File/Memory
- relevance
- 4/10
-
Reads the cryptographic machine GUID
- details
- "DashlaneInst.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
- source
- Registry Access
- relevance
- 10/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Possibly tries to implement anti-virtualization techniques
-
General
-
Reads configuration files
- details
-
"DashlaneInst.exe" read file "%USERPROFILE%\Desktop\desktop.ini"
"DashlaneInst.exe" read file "C:\Users\desktop.ini" - source
- API Call
- relevance
- 4/10
-
Reads configuration files
-
Installation/Persistance
-
Drops executable files
- details
-
"api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-core-synch-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
"api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-crt-heap-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
"api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
"api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-core-memory-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
"api-ms-win-crt-private-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
"DashlanePlugin_new.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
"api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-crt-multibyte-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-crt-environment-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
"api-ms-win-crt-convert-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" - source
- Binary File
- relevance
- 10/10
-
The input sample dropped/contains a certificate file
- details
-
File "aftap0901.cat" is a certificate (Owner: CN=Microsoft Time-Stamp Service, OU=nCipher DSE ESN:843D-37F6-F104, OU=AOC, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Time-Stamp PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; SerialNumber: 33000000bea40ff5c9a50ee1300000000000be; Valid From: 09/07/2016 17:58:49; Until: 09/07/2018 17:58:49; Fingerprints: MD5=05:FE:C6:26:88:AB:15:B0:89:F0:CD:C3:12:1E:11:5A; SHA1=19:37:FC:BB:14:2C:D7:60:43:4B:CD:2F:87:F1:CC:31:BE:10:50:6D)
File "aftap0901.cat" is a certificate (Owner: CN=Microsoft Windows Hardware Compatibility Publisher, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Windows Hardware Compatibility PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; SerialNumber: 330000002a04b4165d018871e000010000002a; Valid From: 08/11/2017 20:36:23; Until: 07/25/2018 20:36:23; Fingerprints: MD5=A0:F3:E5:4F:F8:5A:F8:60:D4:3B:BC:8F:B0:74:AD:F4; SHA1=92:DF:5C:83:A6:73:47:97:FD:9D:AC:1B:80:F2:25:04:71:B3:47:54)
File "aftap0901.cat" is a certificate (Owner: CN=Microsoft Windows Hardware Compatibility PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com; SerialNumber: 33000000382e50e86a989d957f000000000038; Valid From: 06/04/2012 21:05:46; Until: 06/04/2020 21:15:46; Fingerprints: MD5=5F:38:BD:38:CC:79:E9:75:2A:38:AC:15:6B:85:2D:2D; SHA1=8D:42:41:9D:8B:21:E5:CF:9C:32:04:D0:06:0B:19:31:2B:96:EB:78)
File "aftap0901.cat" is a certificate (Owner: CN=Microsoft Time-Stamp PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com; SerialNumber: 6116683400000000001c; Valid From: 04/03/2007 12:53:09; Until: 04/03/2021 13:03:09; Fingerprints: MD5=41:1B:93:90:4E:0E:5F:59:3B:72:13:20:E9:7E:80:FF; SHA1=37:5F:CB:82:5C:3D:C3:75:2A:02:E3:4E:B7:09:93:B4:99:71:91:EF) - source
- Binary File
- relevance
- 10/10
-
Drops executable files
-
Network Related
-
Found potential IP address in binary/memory
- details
-
"4.1.1.4"
Heuristic match: "2019-07-08 17:17:07 Sending installer log 2.1.3.2"
Heuristic match: "2019-07-08 17:17:07 Sending installer log 2.1.3.3" - source
- File/Memory
- relevance
- 3/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
-
TCP traffic to 54.76.128.186 on port 443 is sent without HTTP header
TCP traffic to 99.84.32.150 on port 80 is sent without HTTP header
TCP traffic to 99.84.32.96 on port 80 is sent without HTTP header
TCP traffic to 99.84.32.149 on port 80 is sent without HTTP header
TCP traffic to 99.84.32.49 on port 80 is sent without HTTP header
TCP traffic to 34.252.83.153 on port 443 is sent without HTTP header
TCP traffic to 99.84.32.31 on port 443 is sent without HTTP header - source
- Network Traffic
- relevance
- 5/10
-
Found potential IP address in binary/memory
-
Ransomware/Banking
-
The input sample dropped very many files
- details
- The input sample dropped 2000 files (often an indicator for ransomware)
- source
- Binary File
- relevance
- 5/10
-
The input sample dropped very many files
-
Remote Access Related
-
Contains references to WMI/WMIC
- details
- "ROOT\CIMV2" (Indicator: "root\cimv2")
- source
- File/Memory
- relevance
- 10/10
- ATT&CK ID
- T1047 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains references to WMI/WMIC
-
Spyware/Information Retrieval
-
Contains ability to open the clipboard
- details
-
OpenClipboard@USER32.DLL from DashlaneInst.exe (PID: 3992) (Show Stream)
OpenClipboard@USER32.DLL from DashlaneInst.exe (PID: 3992) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 10/10
- ATT&CK ID
- T1115 (Show technique in the MITRE ATT&CK™ matrix)
-
Found an instant messenger related domain
- details
- details too long to display
- source
- File/Memory
- relevance
- 10/10
-
Contains ability to open the clipboard
-
System Destruction
-
Marks file for deletion
- details
-
"C:\DashlaneInst.exe" marked "%TEMP%\nswFB90.tmp" for deletion
"C:\DashlaneInst.exe" marked "%TEMP%\nsrFD47.tmp" for deletion - source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1107 (Show technique in the MITRE ATT&CK™ matrix)
-
Opens file with deletion access rights
- details
-
"DashlaneInst.exe" opened "%TEMP%\nswFB90.tmp" with delete access
"DashlaneInst.exe" opened "%TEMP%\nsrFD47.tmp" with delete access - source
- API Call
- relevance
- 7/10
-
Marks file for deletion
-
System Security
-
Modifies Software Policy Settings
- details
-
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")
"DashlaneInst.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") - source
- Registry Access
- relevance
- 10/10
- ATT&CK ID
- T1112 (Show technique in the MITRE ATT&CK™ matrix)
-
Modifies proxy settings
- details
-
"DashlaneInst.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000")
"DashlaneInst.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER")
"DashlaneInst.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")
"DashlaneInst.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
"DashlaneInst.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") - source
- Registry Access
- relevance
- 10/10
- ATT&CK ID
- T1112 (Show technique in the MITRE ATT&CK™ matrix)
-
Queries sensitive IE security settings
- details
- "DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")
- source
- Registry Access
- relevance
- 8/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Modifies Software Policy Settings
-
Unusual Characteristics
-
CRC value set in PE header does not match actual value
- details
-
"api-ms-win-crt-heap-l1-1-0.dll" claimed CRC 20061 while the actual is CRC 955076
"api-ms-win-core-heap-l1-1-0.dll" claimed CRC 47982 while the actual is CRC 20061
"api-ms-win-core-file-l1-2-0.dll" claimed CRC 42892 while the actual is CRC 47982
"api-ms-win-core-synch-l1-1-0.dll" claimed CRC 54289 while the actual is CRC 42892
"api-ms-win-core-handle-l1-1-0.dll" claimed CRC 34221 while the actual is CRC 54289
"api-ms-win-crt-locale-l1-1-0.dll" claimed CRC 46155 while the actual is CRC 34221
"api-ms-win-core-rtlsupport-l1-1-0.dll" claimed CRC 57878 while the actual is CRC 46155
"api-ms-win-core-libraryloader-l1-1-0.dll" claimed CRC 35779 while the actual is CRC 57878
"api-ms-win-crt-heap-l1-1-0.dll" claimed CRC 77910 while the actual is CRC 35779
"api-ms-win-crt-stdio-l1-1-0.dll" claimed CRC 35003 while the actual is CRC 77910
"api-ms-win-core-processthreads-l1-1-0.dll" claimed CRC 51918 while the actual is CRC 35003
"api-ms-win-core-sysinfo-l1-1-0.dll" claimed CRC 79812 while the actual is CRC 51918
"api-ms-win-core-memory-l1-1-0.dll" claimed CRC 35598 while the actual is CRC 79812
"api-ms-win-crt-private-l1-1-0.dll" claimed CRC 101707 while the actual is CRC 35598
"DashlanePlugin_new.exe" claimed CRC 444299 while the actual is CRC 101707
"api-ms-win-core-datetime-l1-1-0.dll" claimed CRC 63042 while the actual is CRC 444299
"api-ms-win-crt-multibyte-l1-1-0.dll" claimed CRC 29068 while the actual is CRC 63042
"api-ms-win-crt-environment-l1-1-0.dll" claimed CRC 69860 while the actual is CRC 29068
"api-ms-win-crt-convert-l1-1-0.dll" claimed CRC 59737 while the actual is CRC 69860
"api-ms-win-core-libraryloader-l1-1-0.dll" claimed CRC 65849 while the actual is CRC 59737 - source
- Static Parser
- relevance
- 10/10
-
Imports suspicious APIs
- details
-
RegDeleteKeyA
RegCloseKey
OpenProcessToken
RegDeleteValueA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyA
GetFileAttributesA
CopyFileA
GetModuleFileNameA
LoadLibraryExA
GetFileSize
CreateDirectoryA
DeleteFileA
GetCommandLineA
GetProcAddress
GetTempPathA
CreateThread
GetModuleHandleA
FindFirstFileA
WriteFile
GetTempFileNameA
FindNextFileA
CreateProcessA
Sleep
CreateFileA
GetTickCount
ShellExecuteExA
FindWindowExA
RegCreateKeyExW
RegOpenKeyExW
LoadLibraryW
IsDebuggerPresent
VirtualProtect
OpenProcess
UnhandledExceptionFilter
LoadLibraryExW
GetStartupInfoW
GetModuleHandleW
TerminateProcess
OutputDebugStringW
EnumProcesses
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyW
CreateToolhelp32Snapshot
GetModuleFileNameW
LockResource
FindResourceExW
FindResourceW
SetWindowsHookExW - source
- Static Parser
- relevance
- 1/10
-
Installs hooks/patches the running process
- details
-
"DashlaneInst.exe" wrote bytes "fe183277f854327757d13377f2183377852a3477221232773e18327768343277eb59327777493277451232772e583277dd16327726183277ff423277c011327700000000d894d1760000000008225976d1e4567600000000" to virtual address "0x10003000" (part of module "SYSTEM_2.DLL")
"DashlaneInst.exe" wrote bytes "b83012d373ffe0" to virtual address "0x76E11368" (part of module "WS2_32.DLL")
"DashlaneInst.exe" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM_2.DLL")
"DashlaneInst.exe" wrote bytes "b4360e75" to virtual address "0x750F0200" (part of module "SSPICLI.DLL")
"DashlaneInst.exe" wrote bytes "c0df84771cf98377ccf883770d64857700000000c011327700000000fc3e327700000000e0133277000000009457147525e08477c6e0847700000000bc6a137500000000cf3132770000000093191475000000002c32327700000000" to virtual address "0x75121000" (part of module "NSI.DLL")
"DashlaneInst.exe" wrote bytes "7d07887781ed8677ae868577c6e08477effd87772d16867760148877478d8577a8e284776089857700000000ad37e1768b2de176b641e17600000000" to virtual address "0x73921000" (part of module "WSHTCPIP.DLL")
"DashlaneInst.exe" wrote bytes "b4360e75" to virtual address "0x750F025C" (part of module "SSPICLI.DLL")
"DashlaneInst.exe" wrote bytes "b84013d373ffe0" to virtual address "0x750E3AD8" (part of module "SSPICLI.DLL")
"DashlaneInst.exe" wrote bytes "d83a0e75" to virtual address "0x750F0258" (part of module "SSPICLI.DLL")
"DashlaneInst.exe" wrote bytes "0efc877781ed8677ae868577c6e08477effd87772d168677c0fc8377da8f8e7760148877478d8577a8e284776089857700000000ad37e1768b2de176b641e17600000000" to virtual address "0x739A1000" (part of module "WSHIP6.DLL")
"DashlaneInst.exe" wrote bytes "68130000" to virtual address "0x76E11680" (part of module "WS2_32.DLL")
"DashlaneInst.exe" wrote bytes "6012d373" to virtual address "0x76C7E324" (part of module "WININET.DLL")
"DashlaneInst.exe" wrote bytes "b4360200" to virtual address "0x750E4D68" (part of module "SSPICLI.DLL")
"DashlaneInst.exe" wrote bytes "c2000000" to virtual address "0x73F5401C" (part of module "SYSTEM.DLL")
"DashlaneInst.exe" wrote bytes "b4360200" to virtual address "0x750E4EA4" (part of module "SSPICLI.DLL")
"DashlaneInst.exe" wrote bytes "b4360e75" to virtual address "0x750F01E4" (part of module "SSPICLI.DLL")
"DashlaneInst.exe" wrote bytes "d83a0e75" to virtual address "0x750F01E0" (part of module "SSPICLI.DLL")
"DashlaneInst.exe" wrote bytes "7508ff354c403000ff15f0103000c9c2100033c0c21000558bec83ec6c8b45148b00538945e083c00433db381d4840300056578b7d0c8945f48b4518c645fe01895df80f85270100008b4d10" to virtual address "0x00302000" (part of module "UAC.DLL")
"DashlaneInst.exe" wrote bytes "c2000000" to virtual address "0x007E404C"
"DashlaneInst.exe" wrote bytes "d83a0e75" to virtual address "0x750F01FC" (part of module "SSPICLI.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Reads information about supported languages
- details
- "DashlaneInst.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
- source
- Registry Access
- relevance
- 3/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Timestamp in PE header is very old or in the future
- details
-
"api-ms-win-crt-heap-l1-1-0.dll" claims program is from Wed Aug 18 06:30:24 2088
"api-ms-win-core-heap-l1-1-0.dll" claims program is from Sat Dec 12 21:51:16 2076
"api-ms-win-crt-locale-l1-1-0.dll" claims program is from Sun Apr 10 01:28:44 2044
"api-ms-win-core-libraryloader-l1-1-0.dll" claims program is from Tue Feb 7 11:49:14 2051
"api-ms-win-crt-heap-l1-1-0.dll" claims program is from Fri Nov 5 04:33:44 2088
"api-ms-win-core-processthreads-l1-1-0.dll" claims program is from Sat Aug 27 04:11:25 2022
"api-ms-win-core-sysinfo-l1-1-0.dll" claims program is from Sun Aug 1 12:57:38 2100
"api-ms-win-core-memory-l1-1-0.dll" claims program is from Tue Sep 4 20:01:35 2029
"api-ms-win-crt-private-l1-1-0.dll" claims program is from Sat Oct 16 19:25:38 2077
"api-ms-win-crt-multibyte-l1-1-0.dll" claims program is from Wed May 13 04:51:34 1992
"api-ms-win-crt-environment-l1-1-0.dll" claims program is from Sun Jan 29 11:47:34 1989
"api-ms-win-crt-convert-l1-1-0.dll" claims program is from Sun Feb 8 03:46:08 2088
"api-ms-win-core-libraryloader-l1-1-0.dll" claims program is from Tue Apr 11 04:35:18 2084
"api-ms-win-core-profile-l1-1-0.dll" claims program is from Mon Apr 22 23:10:27 2086
"api-ms-win-core-heap-l1-1-0.dll" claims program is from Sun Oct 15 20:07:08 2102
"api-ms-win-crt-utility-l1-1-0.dll" claims program is from Tue Dec 21 20:25:41 2038
"api-ms-win-crt-conio-l1-1-0.dll" claims program is from Mon Nov 21 16:44:33 1988
"api-ms-win-core-file-l2-1-0.dll" claims program is from Tue Jan 28 04:52:53 2031
"api-ms-win-crt-math-l1-1-0.dll" claims program is from Tue Mar 3 15:06:22 2082
"api-ms-win-core-file-l1-1-0.dll" claims program is from Sun Sep 16 17:54:01 2074 - source
- Static Parser
- relevance
- 10/10
-
CRC value set in PE header does not match actual value
-
Hiding 13 Suspicious Indicators
- All indicators are available only in the private webservice or standalone version
-
Informative 33
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
-
SetUnhandledExceptionFilter@KERNEL32.dll (Show Stream)
SetUnhandledExceptionFilter@KERNEL32.dll (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
PE file contains zero-size sections
- details
- Raw size of ".ndata" is zero
- source
- Static Parser
- relevance
- 10/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query the machine version
- details
-
GetVersion@KERNEL32.DLL from DashlaneInst.exe (PID: 3992) (Show Stream)
GetVersion@KERNEL32.DLL from DashlaneInst.exe (PID: 3992) (Show Stream)
GetVersion@KERNEL32.DLL from DashlaneInst.exe (PID: 3992) (Show Stream)
GetVersion@KERNEL32.DLL from DashlaneInst.exe (PID: 3992) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query volume size
- details
-
GetDiskFreeSpaceA@KERNEL32.DLL from DashlaneInst.exe (PID: 3992) (Show Stream)
GetDiskFreeSpaceA@KERNEL32.DLL from DashlaneInst.exe (PID: 3992) (Show Stream)
GetDiskFreeSpaceA@KERNEL32.DLL from DashlaneInst.exe (PID: 3992) (Show Stream)
GetDiskFreeSpaceA@KERNEL32.DLL from DashlaneInst.exe (PID: 3992) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 3/10
- ATT&CK ID
- T1083 (Show technique in the MITRE ATT&CK™ matrix)
-
Makes a code branch decision directly after an API that is environment aware
- details
-
Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, cx" and "je 004034E1h" from DashlaneInst.exe (PID: 3992) (Show Stream)
Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, cx" and "je 004034E1h" from DashlaneInst.exe (PID: 3992) (Show Stream)
Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, cx" and "je 004034E1h" from DashlaneInst.exe (PID: 3992) (Show Stream)
Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, cx" and "je 004034E1h" from DashlaneInst.exe (PID: 3992) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 10/10
-
Reads the registry for installed applications
- details
-
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\DASHLANEINST.EXE")
"DashlaneInst.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\DASHLANEINST.EXE")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME")
"DashlaneInst.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME") - source
- Registry Access
- relevance
- 10/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
-
External Systems
-
Sample was identified as clean by Antivirus engines
- details
- 0/67 Antivirus vendors marked sample as malicious (0% detection rate)
- source
- External System
- relevance
- 10/10
-
Sample was identified as clean by Antivirus engines
-
General
-
Accesses Software Policy Settings
- details
-
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
"DashlaneInst.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
"DashlaneInst.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
"DashlaneInst.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")
"DashlaneInst.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "")
"DashlaneInst.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")
"DashlaneInst.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")
"DashlaneInst.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "")
"DashlaneInst.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "")
"DashlaneInst.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") - source
- Registry Access
- relevance
- 10/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Accesses System Certificates Settings
- details
-
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\EAB040689A0D805B5D6FD654FC168CFF00B78BE3"; Key: "BLOB")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
"DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
"DashlaneInst.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") - source
- Registry Access
- relevance
- 10/10
- ATT&CK ID
- T1112 (Show technique in the MITRE ATT&CK™ matrix)
-
Contacts domains
- details
-
"o.ss2.us"
"ocsp.rootg2.amazontrust.com"
"ocsp.rootca1.amazontrust.com"
"ocsp.sca1b.amazontrust.com"
"d3qm0vl2sdkrc.cloudfront.net"
"logs.dashlane.com"
"ws1.dashlane.com" - source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
-
"54.76.128.186:443"
"99.84.32.150:80"
"99.84.32.96:80"
"99.84.32.149:80"
"99.84.32.49:80"
"34.252.83.153:443"
"99.84.32.31:443"
"34.252.247.18:49376" - source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
-
"C:\repos\Client-Stash\CppLibrairies\installers\NSIS\CustomizedPlugins\Inetc\Plugins\inetc.pdb"
"c:\repos\Binaries\Installers\additionalPlugins\CheckInstalledKB\Release\CheckInstalledKB.pdb"
"D:\bamboo-agent-home\xml-data\build-dir\WIN-REL6-JOB1\CppRepos\CppLibrairies\Installers\builds\current\Dashlane.pdb"
"api-ms-win-core-libraryloader-l1-1-0.pdb"
"api-ms-win-crt-private-l1-1-0.pdb"
"api-ms-win-core-memory-l1-1-0.pdb"
"api-ms-win-core-sysinfo-l1-1-0.pdb"
"api-ms-win-core-heap-l1-1-0.pdb"
"api-ms-win-crt-stdio-l1-1-0.pdb"
"api-ms-win-core-rtlsupport-l1-1-0.pdb"
"api-ms-win-core-processthreads-l1-1-0.pdb"
"api-ms-win-core-file-l1-2-0.pdb"
"api-ms-win-core-handle-l1-1-0.pdb"
"api-ms-win-crt-heap-l1-1-0.pdb"
"api-ms-win-crt-locale-l1-1-0.pdb"
"api-ms-win-core-synch-l1-1-0.pdb" - source
- File/Memory
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
-
"DashlaneInst.exe" created file "%TEMP%\nsrFD47.tmp\System.dll"
"DashlaneInst.exe" created file "%TEMP%\dashlaneInstallLog.txt"
"DashlaneInst.exe" created file "%TEMP%\nsrFD47.tmp\System_2.dll" - source
- API Call
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"
"\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"
"Local\ZonesLockedCacheCounterMutex"
"Local\ZonesCacheCounterMutex" - source
- Created Mutant
- relevance
- 3/10
-
Drops files marked as clean
- details
- Antivirus vendors marked dropped file "api-ms-win-core-synch-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "domain_categories_o.csv" as clean (type is "ASCII text with CRLF line terminators"), Antivirus vendors marked dropped file "aftap0901.cat" as clean (type is "data"), Antivirus vendors marked dropped file "api-ms-win-crt-heap-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-stdio-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-memory-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "domain_categories_l.csv" as clean (type is "ASCII text with CRLF line terminators"), Antivirus vendors marked dropped file "domain_categories_t.csv" as clean (type is "ASCII text with CRLF line terminators"), Antivirus vendors marked dropped file "api-ms-win-crt-private-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "DashlanePlugin_new.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-datetime-l1-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-multibyte-l1-1-0.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-environment-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-convert-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-libraryloader-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-profile-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-core-heap-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "domain_categories_k.csv" as clean (type is "ASCII text with CRLF line terminators")
- source
- Binary File
- relevance
- 10/10
-
GETs files from a webserver
- details
-
"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.ss2.us"
"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.rootg2.amazontrust.com"
"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.rootca1.amazontrust.com"
"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAJcm6XHW1qNzhsgMn%2FhMZk%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.sca1b.amazontrust.com"
"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAaNBGPB88CnF3P8lZXiEOI%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.sca1b.amazontrust.com" - source
- Network Traffic
- relevance
- 5/10
-
Loads rich edit control libraries
- details
- "DashlaneInst.exe" loaded module "%WINDIR%\SysWOW64\riched20.dll" at 734C0000
- source
- Loaded Module
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Overview of unique CLSIDs touched in registry
- details
-
"DashlaneInst.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}")
"DashlaneInst.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}")
"DashlaneInst.exe" touched "NetworkListManager" (Path: "HKCR\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}")
"DashlaneInst.exe" touched "Network List Manager" (Path: "HKCU\WOW6432NODE\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS")
"DashlaneInst.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\TREATAS")
"DashlaneInst.exe" touched "Search Gatherer Notification" (Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS")
"DashlaneInst.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") - source
- Registry Access
- relevance
- 3/10
-
Process launched with changed environment
- details
- Process "explorer.exe" (Show Process) was launched with modified environment variables: "CommonProgramFiles, Path, PROCESSOR_ARCHITECTURE, ProgramFiles"
- source
- Monitored Target
- relevance
- 10/10
-
Reads Windows Trust Settings
- details
- "DashlaneInst.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING"; Key: "STATE")
- source
- Registry Access
- relevance
- 5/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Scanning for window names
- details
- "DashlaneInst.exe" searching for class "#32770"
- source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1010 (Show technique in the MITRE ATT&CK™ matrix)
-
Spawns new processes
- details
- Spawned process "explorer.exe" with commandline ""%APPDATA%\Dashlane\Dashlane.exe"" (Show Process)
- source
- Monitored Target
- relevance
- 3/10
-
Spawns new processes that are not known child processes
- details
- Spawned process "explorer.exe" with commandline ""%APPDATA%\Dashlane\Dashlane.exe"" (Show Process)
- source
- Monitored Target
- relevance
- 3/10
-
The input sample is signed with a certificate
- details
-
The input sample is signed with a certificate issued by "CN=DigiCert EV Code Signing CA SHA2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 62:EA:83:F4:C2:82:84:56:08:43:7B:E0:38:BF:47:C1:4A:36:C0:59; see report for more information)
The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 60:EE:3F:C5:3D:4B:DF:D1:69:7A:E5:BE:AE:1C:AB:1C:0F:3A:D4:E3; see report for more information) - source
- Certificate Data
- relevance
- 10/10
- ATT&CK ID
- T1116 (Show technique in the MITRE ATT&CK™ matrix)
-
The input sample is signed with a valid certificate
- details
- The entire certificate chain of the input sample was validated successfully.
- source
- Certificate Data
- relevance
- 10/10
-
Accesses Software Policy Settings
-
Installation/Persistance
-
Connects to LPC ports
- details
- "DashlaneInst.exe" connecting to "\ThemeApiPort"
- source
- API Call
- relevance
- 1/10
-
Dropped files
- details
-
"api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-core-synch-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
"api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"domain_categories_o.csv" has type "ASCII text with CRLF line terminators"
"api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"aftap0901.cat" has type "data"
"api-ms-win-crt-heap-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
"domain_categories_w.csv" has type "ASCII text with CRLF line terminators"
"api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
"api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"
"api-ms-win-core-memory-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
"domain_categories_l.csv" has type "ASCII text with CRLF line terminators"
"domain_categories_t.csv" has type "ASCII text with CRLF line terminators"
"api-ms-win-crt-private-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" - source
- Binary File
- relevance
- 3/10
-
Touches files in the Windows directory
- details
-
"DashlaneInst.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu"
"DashlaneInst.exe" touched file "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs"
"DashlaneInst.exe" touched file "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dashlane"
"DashlaneInst.exe" touched file "C:\Windows\SysWOW64\en-US\shell32.dll.mui"
"DashlaneInst.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat"
"DashlaneInst.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files"
"DashlaneInst.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies"
"DashlaneInst.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"
"DashlaneInst.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\VTO935KS\version[1]"
"DashlaneInst.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAC5QEAJ\size[1]"
"DashlaneInst.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu"
"DashlaneInst.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs"
"DashlaneInst.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Dashlane"
"DashlaneInst.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\H3XVNPGD\archive_redist[1].7z"
"DashlaneInst.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\P6QSO9MS\archive_dlls[1].7z"
"DashlaneInst.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2M2KC0IU\archive_full[1].7z"
"DashlaneInst.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\EKCX8E9R\archive_IEPlugin[1].7z"
"DashlaneInst.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\4KBMQIHU\archive_IEPlugin_dlls[1].7z"
"DashlaneInst.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"
"DashlaneInst.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" - source
- API Call
- relevance
- 7/10
-
Connects to LPC ports
-
Network Related
-
Found potential URL in binary/memory
- details
-
Pattern match: "http://nsis.sf.net/NSIS_Error"
Pattern match: "www.digicert.com1+0"
Pattern match: "crl3.digicert.com/EVCodeSigningSHA2-g1.crl07"
Pattern match: "crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K"
Pattern match: "https://www.digicert.com/CPS0"
Pattern match: "http://ocsp.digicert.com0H"
Pattern match: "http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0"
Pattern match: "http://ocsp.digicert.com0I"
Pattern match: "http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0"
Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@"
Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0"
Pattern match: "http://www.digicert.com/ssl-cps-repository.htm0"
Pattern match: "www.digicert.com110/"
Pattern match: "http://crl3.digicert.com/sha2-assured-ts.crl02"
Pattern match: "http://crl4.digicert.com/sha2-assured-ts.crl0"
Pattern match: "http://ocsp.digicert.com0O"
Pattern match: "cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0"
Pattern match: "www.digicert.com1$0"
Pattern match: "http://ocsp.digicert.com0C"
Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0"
Pattern match: "crl4.digicert.com/DigiCertAssuredIDRootCA.crl0"
Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P"
Pattern match: "https://d3qm0vl2sdkrc.cloudfront.net/releases/6.1926.1/6.1926.1.21432/release"
Pattern match: "krc.cloudfront.net/releases/6.1926.1/6.1926.1.21432/release/archive_IEPlugin_dlls.7z"
Heuristic match: "o.ss2.us"
Heuristic match: "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.ss2.us"
Heuristic match: "ocsp.rootg2.amazontrust.com"
Heuristic match: "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.rootg2.amazontrust.com"
Heuristic match: "ocsp.rootca1.amazontrust.com"
Heuristic match: "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.rootca1.amazontrust.com"
Heuristic match: "ocsp.sca1b.amazontrust.com"
Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAJcm6XHW1qNzhsgMn%2FhMZk%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.sca1b.amazontrust.com"
Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAaNBGPB88CnF3P8lZXiEOI%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.sca1b.amazontrust.com"
Pattern match: "dfront.net/releases/6.1926.1/6.1926.1.21432/release/archive_dlls.7z"
Pattern match: "https://d3qm0vl2sdkrc.cloudfront.net/releases/6.1926.1/6.1926.1.21432/release/archive_dlls.7z"
Heuristic match: "d3qm0vl2sdkrc.cloudfront.net"
Heuristic match: "logs.dashlane.com"
Heuristic match: "ws1.dashlane.com"
Pattern match: "https://logs.dashlane.com/1/installerlog/create"
Pattern match: "go.microsoft.com/fwlink/p/?linkid=217865"
Heuristic match: "Dashlane can't be launched, please reboot your computer and try again. If the problem persists, try to re install Dashlane, or contact support@dashlane.com"
Pattern match: "https://logs.dashlane.com/1/installerlog/createLight"
Pattern match: "http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEw"
Pattern match: "https://ws1.dashlane.com/5/binaries/query?logins=&platform=launcher_win&target=archive&format=url&os=WIN_6_1_0&launcher=8.026"
Pattern match: "https://d3qm0vl2sdkrc.cloudfront.net/releases/6.1926.1/6.1926.1.21432/release/version"
Pattern match: "https://d3qm0vl2sdkrc.cloudfront.net/releases/6.1926.1/6.1926.1.21432/release/size"
Pattern match: "https://logs.dashlane.com/1/softwarelog/create"
Pattern match: "https://d3qm0vl2sdkrc.cloudfront.net/releases/6.1926.1/6.1926.1.21432/release/archive_redist.7z"
Pattern match: "https://d3qm0vl2sdkrc.cloudfront.net/releases/6.1926.1/6.1926.1.21432/release/archive_full.7z"
Pattern match: "https://d3qm0vl2sdkrc.cloudfront.net/releases/6.1926.1/6.1926.1.21432/release/archive_IEPlugin.7z"
Pattern match: "https://d3qm0vl2sdkrc.cloudfront.net/releases/6.1926.1/6.1926.1.21432/release/archive_IEPlugin_dlls.7z"
Pattern match: "www.nhs.uk,3"
Pattern match: "www.gov.uk,11"
Pattern match: "www.co.cc,11"
Pattern match: "www.google.com,6"
Pattern match: "www.com.nu,11"
Pattern match: "www.com,11"
Pattern match: "www.facebook,11"
Pattern match: "www.google,11"
Pattern match: "www.gov.qa,11"
Pattern match: "www.paypal,11" - source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"linkedin.com,9" (Indicator: "linkedin.com")
"what.cd,11" (Indicator: "what.cd")
"worldtimebuddy.com,0" (Indicator: "ebuddy.com")
"www.paypal,11" (Indicator: "paypal")
"twitter.com,9" (Indicator: "twitter")
"thepiratebay.org,9" (Indicator: "thepiratebay.org")
"twitterfeed.com,0" (Indicator: "twitter")
"twodollarclick.com,11" (Indicator: "twodollarclick.com")
"twittergadget.com,0" (Indicator: "twitter")
"twitter.fr,11" (Indicator: "twitter")
"twitterenespanol.net,11" (Indicator: "twitter")
"twitter.de,11" (Indicator: "twitter")
"twitterdmer.com,11" (Indicator: "twitter")
"twitter.jp,11" (Indicator: "twitter")
"thefacebook.com,9" (Indicator: "facebook.com")
"theyoutubecommunity.com,9" (Indicator: "youtube")
"tubebuddy.com,0" (Indicator: "ebuddy.com") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
System Security
-
Creates or modifies windows services
- details
- "DashlaneInst.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")
- source
- Registry Access
- relevance
- 10/10
- ATT&CK ID
- T1112 (Show technique in the MITRE ATT&CK™ matrix)
-
Opens the Kernel Security Device Driver (KsecDD) of Windows
- details
- "DashlaneInst.exe" opened "\Device\KsecDD"
- source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
Creates or modifies windows services
-
Unusual Characteristics
-
Matched Compiler/Packer signature
- details
-
"206986190cdab29789bb11fa63d234b00a88d6e05c6917189028f4ac89f7a806.bin" was detected as "Nullsoft PiMP Stub -> SFX"
"api-ms-win-crt-heap-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-core-heap-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-core-file-l1-2-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-core-synch-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-core-handle-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-crt-locale-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-core-rtlsupport-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-core-libraryloader-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-core-processthreads-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-core-sysinfo-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-core-memory-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-crt-private-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"DashlanePlugin_new.exe" was detected as "VC8 -> Microsoft Corporation"
"api-ms-win-core-datetime-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-crt-multibyte-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-crt-environment-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"
"api-ms-win-crt-convert-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" - source
- Static Parser
- relevance
- 10/10
- ATT&CK ID
- T1002 (Show technique in the MITRE ATT&CK™ matrix)
-
Matched Compiler/Packer signature
File Details
DashlaneInst.exe
- Filename
- DashlaneInst.exe
- Size
- 887KiB (908560 bytes)
- Type
- peexe executable
- Description
- PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
- Architecture
- WINDOWS
- SHA256
- 206986190cdab29789bb11fa63d234b00a88d6e05c6917189028f4ac89f7a806
- MD5
- 6c2444cf91594c35d1b3e46cfb41728d
- SHA1
- 26d4e18182204f84f8882bb029bfd524b13edcfa
- ssdeep
-
24576:q5Xw0kgOwA5VaxzV+cUZP5HBIJ8xYYG26dIIQB8y:MkDwA5ywZZP5Hl6dIwy
- imphash
-
10e1538484049e6baa1c5380239250cf
- authentihash
-
77c5eef5de8b1cf43141ee09f30f8f76b7491ecc28b702f8ece96d36d263a2df
- Compiler/Packer
- Nullsoft PiMP Stub -> SFX
Version Info
- LegalCopyright
- Copyright 2009-2019 Dashlane Inc.
- FileVersion
- 6.1926.1.21432
- LegalTradmarks
- Dashlane is a tradmark of Dashlane Inc.
- CompanyName
- Dashlane Inc.
- ProductName
- Dashlane
- FileDescription
- Dashlane
- Comments
- -
- Translation
- 0x0409 0x04e4
Classification (TrID)
- 41.0% (.EXE) Win32 Executable MS Visual C++ (generic)
- 36.3% (.EXE) Win64 Executable (generic)
- 8.6% (.DLL) Win32 Dynamic Link Library (generic)
- 5.9% (.EXE) Win32 Executable (generic)
- 2.6% (.EXE) OS/2 Executable (generic)
File Metadata
- 1 .OBJ Files (COFF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 26732)
- 11 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 26732)
- 1 .RES Files linked with CVTRES.EXE 5.00 (Visual Studio 5) (build: 25711)
- 2 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 25711)
- File appears to contain raw COFF/OMF content
- File is the product of a small codebase (0 files)
File Sections
Details | ||||||
---|---|---|---|---|---|---|
File Resources
Details | ||||
---|---|---|---|---|
File Imports
File Certificates
Certificate chain was successfully validated.
Download Certificate File (7.6KiB)Owner | Issuer | Validity | Hashes (MD5, SHA1) |
---|---|---|---|
CN="Dashlane USA, Inc.", O="Dashlane USA, Inc.", L=New York City, ST=New York, C=US, OID.2.5.4.17=10010, STREET=156 5th avenue, STREET=Suite 504, SERIALNUMBER=5268403, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization | CN=DigiCert EV Code Signing CA SHA2, OU=www.digicert.com, O=DigiCert Inc, C=US Serial: c9599502ec042a8b54ffc46368705d5 |
10/31/2016 00:00:00 11/05/2019 12:00:00 |
1B:EE:B1:E1:75:5C:2F:39:12:07:ED:2E:A2:CE:70:04 62:EA:83:F4:C2:82:84:56:08:43:7B:E0:38:BF:47:C1:4A:36:C0:59 |
CN=DigiCert EV Code Signing CA SHA2, OU=www.digicert.com, O=DigiCert Inc, C=US | CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US Serial: 3f1b4e15f3a82f1149678b3d7d8475c |
04/18/2012 12:00:00 04/18/2027 12:00:00 |
1D:CB:A7:8C:6C:8A:0D:9B:72:CF:E9:21:10:3F:B2:6D 60:EE:3F:C5:3D:4B:DF:D1:69:7A:E5:BE:AE:1C:AB:1C:0F:3A:D4:E3 |
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 2 processes in total (System Resource Monitor).
-
DashlaneInst.exe (PID: 3992) 1/78
-
explorer.exe "%APPDATA%\Dashlane\Dashlane.exe" (PID: 1216)
-
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
d3qm0vl2sdkrc.cloudfront.net
OSINT |
13.224.12.210
TTL: 59 |
MarkMonitor, Inc. | ![]() |
logs.dashlane.com
OSINT |
52.210.19.6
TTL: 30 |
OVH, SAS | ![]() |
o.ss2.us
OSINT |
99.84.32.150
TTL: 59 |
whois.godaddy.com
Name Server: NS-19.AWSDNS-02.COM Creation Date: Thu, 16 Apr 2015 18:03:31 GMT |
![]() |
ocsp.rootca1.amazontrust.com
OSINT |
99.84.32.149
TTL: 59 |
MarkMonitor, Inc. | ![]() |
ocsp.rootg2.amazontrust.com
OSINT |
99.84.32.96
TTL: 59 |
MarkMonitor, Inc. | ![]() |
ocsp.sca1b.amazontrust.com
OSINT |
99.84.32.49
TTL: 59 |
MarkMonitor, Inc. | ![]() |
ws1.dashlane.com
OSINT |
34.252.247.18
TTL: 52 |
OVH, SAS | ![]() |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
54.76.128.186 |
443
TCP |
dashlaneinst.exe PID: 3992 dashlane.exe PID: 2920 |
![]() |
99.84.32.150 |
80
TCP |
dashlaneinst.exe PID: 3992 |
![]() |
99.84.32.96 |
80
TCP |
dashlaneinst.exe PID: 3992 |
![]() |
99.84.32.149 |
80
TCP |
dashlaneinst.exe PID: 3992 |
![]() |
99.84.32.49 |
80
TCP |
dashlaneinst.exe PID: 3992 |
![]() |
34.252.83.153 |
443
TCP |
dashlaneinst.exe PID: 3992 |
![]() |
99.84.32.31 |
443
TCP |
dashlaneinst.exe PID: 3992 |
![]() |
34.252.247.18 |
49376
TCP |
dashlane.exe PID: 2920 |
![]() |
Contacted Countries
HTTP Traffic
Endpoint | Request | URL | |
---|---|---|---|
99.84.32.150:80 (o.ss2.us) | GET | o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D | GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.ss2.us More Details |
99.84.32.96:80 (ocsp.rootg2.amazontrust.com) | GET | ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKw... | GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.rootg2.amazontrust.com More Details |
99.84.32.149:80 (ocsp.rootca1.amazontrust.com) | GET | ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd... | GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.rootca1.amazontrust.com More Details |
99.84.32.49:80 (ocsp.sca1b.amazontrust.com) | GET | ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAJcm6XHW1qNzhsgMn%2FhM... | GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAJcm6XHW1qNzhsgMn%2FhMZk%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.sca1b.amazontrust.com More Details |
99.84.32.49:80 (ocsp.sca1b.amazontrust.com) | GET | ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAaNBGPB88CnF3P8lZXiEOI... | GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAaNBGPB88CnF3P8lZXiEOI%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.sca1b.amazontrust.com More Details |
Memory Forensics
String | Context | Stream UID |
---|---|---|
http://nsis.sf.net/nsis_error | Domain/IP reference | 00092034-00003992-53491-72-0040311A |
Extracted Strings
Extracted Files
Displaying 75 extracted file(s). The remaining 1925 file(s) are available in the full version and XML/JSON reports.
-
Clean 4
-
-
aftap0901.cat
- Size
- 8.2KiB (8403 bytes)
- Type
- data
- AV Scan Result
- 0/70
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
0150c78656aa96a46ab773f541032e8d
- SHA1
-
264da3cd07733182ff1bbfdb0c8c9c6f151c90fb
- SHA256
-
4a8e700d404cf1480f9f335719f5bdd54bee440116bae79907a237e4ea843251
-
DashlanePlugin_new.exe
- Size
- 404KiB (413264 bytes)
- Type
- peexe executable
- Description
- PE32 executable (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/72
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
2bdf8afde29dc9028e454d01e650202e
- SHA1
-
e9d50e62bbd240f836dc1c233513eaddc7cb4a74
- SHA256
-
c4dd19f9eeddb8587a2fb512b6ca9c89c0eec48dc988b4d6cea8761e2fbca471
-
Dashlanei.dll
- Size
- 914KiB (936016 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/70
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
1ad147dd2df070b970760fa3b0b4464f
- SHA1
-
cb3b95a8ddde1aa372bab2c06f1eddde552948b7
- SHA256
-
30353839132da790e70165ee73d32fd53dfadeceb7a06c406a9b7cb9ddb01810
-
CakeTubeSdk.Windows.dll
- Size
- 3MiB (3137104 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- AV Scan Result
- 0/68
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
ae47dc3a57bef9c998b64fb6827993cb
- SHA1
-
9792c93f935a2931daaa829a6827a1e0255366e5
- SHA256
-
8b4a73d9254962cc9bc691a245bdfee5fdba63d5a98e66a41890e6621e5da4b2
-
-
Informative Selection 1
-
-
Dashlane.exe
- Size
- 382KiB (390736 bytes)
- Type
- peexe executable
- Description
- PE32 executable (GUI) Intel 80386, for MS Windows
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
dde87b493fc09b1174860ddd8e9d6519
- SHA1
-
4589ed836a8dbfd2fb82d3b930b07c776d0d5000
- SHA256
-
7309145b0c3d357da1ab389a10c80a80fcbfbfc8473318c9acf1b82499bc7149
-
-
Informative 70
-
-
archive_IEPlugin.7z
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\archive_IEPlugin.7z
- Size
- 332KiB (339964 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
0744a0cbc86743f4193e1738019cdbaa
- SHA1
-
8304a884f3ceafe950fa6ff77bb2a2838e14bcc9
- SHA256
-
eb659cdd7ac8c20799efd50156dad18fdfec10f64a42a126d91e49aee67bba74
-
archive_IEPlugin_dlls.7z
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\archive_IEPlugin_dlls.7z
- Size
- 5MiB (5234688 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
69de4561832017e828b7c953cc1cad75
- SHA1
-
c0e7d3771c23a916096140839d2203e52642fb65
- SHA256
-
b629bb1b4ca65b72d9b5137146865466341d73f7fc8aff981c6d9d60c3bd0639
-
archive_dlls.7z
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\archive_dlls.7z
- Size
- 5MiB (5234688 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
027e54a80d52ae9a258d2a760c0f8328
- SHA1
-
19c2cd613232bc59ffbe615938ed2ebf537ded2c
- SHA256
-
98875a428a98b91d3bda6c8c96029c18f0c8c6154a8403a7474279f6860ecca2
-
archive_full.7z
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\archive_full.7z
- Size
- 5MiB (5234688 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
c7062a82aa9caa88b507222016eb9508
- SHA1
-
440d40639fbbf5ed541610db75db7d8118c415fd
- SHA256
-
31cb2648c8d60194f5ba46f7b9c5134f4e703f6833bd430f83b7fb1abbdb9d4d
-
archive_redist.7z
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\archive_redist.7z
- Size
- 5MiB (5234688 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
14f544720f2c491e511c9b90d2591fae
- SHA1
-
52990f4281e82fedc79498c4ac1a51852f4a8e47
- SHA256
-
52bf8d5503188d8148a9d48afa792727dd4a295698aa2abdae79f6d62ee70ebf
-
DashlaneUninstall.exe
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\bin\DashlaneUninstall.exe
- Size
- 319KiB (326376 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
8620ea63c93719859acfb3cae214e8d7
- SHA1
-
44b0d3293c65bb582b9a191474ecdeea721fd7b1
- SHA256
-
65db6a731fffd6c6ee55058a47da5bff538461aa0513262e34e73359136f701c
-
CheckAndInstallSGX.exe
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\bin\IntelPSW\CheckAndInstallSGX.exe
- Size
- 105KiB (107088 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
a253621893d7116c3248b295b93cad1e
- SHA1
-
b35634a3841b425ab375854ed9ca9bd94977d545
- SHA256
-
eccb67fbeafefef5a168e0513cf0deaabd35a698dac1cf686b17bcee48e92eaa
-
CryptoProvider.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\bin\IntelPSW\CryptoProvider.dll
- Size
- 121KiB (123752 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
ef1a5f4825794b8499ae8bc0b47e80c4
- SHA1
-
7c17dc2f630f32ae8c33ee67415d75a6f4a333b6
- SHA256
-
ab55e66b4f53c8cbb7bee06392f5ed6a2f121ccd593ffa15c665467d2cb5b0b8
-
CryptoProviderDllInstaller.msi
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\bin\IntelPSW\CryptoProviderDllInstaller.msi
- Size
- 832KiB (851968 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
56da3cfb084dbaaebc320a24a1e115e6
- SHA1
-
48b9bcfd1bafe3dfc363cc883bd537927cb4d46d
- SHA256
-
f151fc7141e26dd114fe24cfb3faadfe9523a04d596f8dec2eff7c503cd8f842
-
CryptoProviderEnclave.signed.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\bin\IntelPSW\CryptoProviderEnclave.signed.dll
- Size
- 995KiB (1018728 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
8e3178ddd4960dfb400a30f1f2e871dd
- SHA1
-
0ca11f473a9adaa75ef31ec0dc9ca7957d69fb97
- SHA256
-
4b556b8e4657d4e28297788be0d9b794ac95d371eeb561b922eb1f367b0ee2ca
-
CryptoProviderInstaller.exe
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\bin\IntelPSW\CryptoProviderInstaller.exe
- Size
- 4.9MiB (5149552 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
66d1fe26981d49628139928b8ceb9755
- SHA1
-
a17a5a8574c23e0d7c22df22b2d1e2005ff8a070
- SHA256
-
343ac33afda4ff6315b86b0d2c7f1e0c457d9ad3e79a419b406347fdd5fb4d65
-
API-MS-Win-core-xstate-l2-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\API-MS-Win-core-xstate-l2-1-0.dll
- Size
- 10KiB (10320 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
3b4b87ffbd11cca7ae7ef6a3fbf9f113
- SHA1
-
7926970da4faf826a73118b149ada14acbbe8fb7
- SHA256
-
d0f64f78bc5dc3719c669360d7497bd6ff7224406b43247b839732ab929b2a72
-
api-ms-win-crt-time-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\api-ms-win-crt-time-l1-1-0.dll
- Size
- 20KiB (20744 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
9b79fda359a269c63dcac69b2c81caa4
- SHA1
-
a38c81b7a2ec158dfcfeb72cb7c04b3eb3ccc0fb
- SHA256
-
4d0f0ea6e8478132892f9e674e27e2bc346622fc8989c704e5b2299a18c1d138
-
api-ms-win-crt-utility-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\api-ms-win-crt-utility-l1-1-0.dll
- Size
- 18KiB (18696 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
70e9104e743069b573ca12a3cd87ec33
- SHA1
-
4290755b6a49212b2e969200e7a088d1713b84a2
- SHA256
-
7e6b33a4c0c84f18f2be294ec63212245af4fd8354636804ffe5ee9a0d526d95
-
api-ms-win-core-console-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-console-l1-1-0.dll
- Size
- 19KiB (19208 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
e5912b05988259dad0d6d04c8a17d19b
- SHA1
-
724f4f91041ad595e365b724a0348c83acf12bbb
- SHA256
-
9f3608c15c5de2f577a2220ce124b530825717d778f1e3941e536a3ab691f733
-
api-ms-win-core-datetime-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-datetime-l1-1-0.dll
- Size
- 18KiB (18184 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
8894176af3ea65a09ae5cf4c0e6ff50f
- SHA1
-
46858ea9029d7fc57318d27ca14e011327502910
- SHA256
-
c64b7c6400e9bacc1a4f1baed6374bfbce9a3f8cf20c2d03f81ef18262f89c60
-
api-ms-win-core-debug-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-debug-l1-1-0.dll
- Size
- 18KiB (18184 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
879920c7fa905036856bcb10875121d9
- SHA1
-
a82787ea553eefa0e7c3bb3aedb2f2c60e39459a
- SHA256
-
7e4cba620b87189278b5631536cdad9bfda6e12abd8e4eb647cb85369a204fe8
-
api-ms-win-core-errorhandling-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-errorhandling-l1-1-0.dll
- Size
- 18KiB (18184 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
d91bf81cf5178d47d1a588b0df98eb24
- SHA1
-
75f9f2da06aa2735906b1c572dd556a3c30e7717
- SHA256
-
f8e3b45fd3e22866006f16a9e73e28b5e357f31f3c275b517692a5f16918b492
-
api-ms-win-core-file-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-file-l1-1-0.dll
- Size
- 21KiB (21768 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
eefe86b5a3ab256beed8621a05210df2
- SHA1
-
90c1623a85c519adbc5ef67b63354f881507b8a7
- SHA256
-
1d1c11fc1ad1febf9308225c4ccf0431606a4ab08680ba04494d276cb310bf15
-
api-ms-win-core-file-l1-2-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-file-l1-2-0.dll
- Size
- 18KiB (18184 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
79ee4a2fcbe24e9a65106de834ccda4a
- SHA1
-
fd1ba674371af7116ea06ad42886185f98ba137b
- SHA256
-
9f7bda59faafc8a455f98397a63a7f7d114efc4e8a41808c791256ebf33c7613
-
api-ms-win-core-file-l2-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-file-l2-1-0.dll
- Size
- 18KiB (18184 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
3f224766fe9b090333fdb43d5a22f9ea
- SHA1
-
548d1bb707ae7a3dfccc0c2d99908561a305f57b
- SHA256
-
ae5e73416eb64bc18249ace99f6847024eceea7ce9c343696c84196460f3a357
-
api-ms-win-core-handle-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-handle-l1-1-0.dll
- Size
- 18KiB (18696 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
cce27ff9b1e78b61955682788452f785
- SHA1
-
a2e2a40cea25ea4fd64b8deaf4fbe4a2db94107a
- SHA256
-
8ee2de377a045c52bbb05087ae3c2f95576edfb0c2767f40b13454f2d9f779de
-
api-ms-win-core-heap-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-heap-l1-1-0.dll
- Size
- 19KiB (19208 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
cdc266896e0dbe6c73542f6dec19de23
- SHA1
-
b4310929ccb82dd3c3a779cab68f1f9f368076f2
- SHA256
-
87a5c5475e9c26fabfead6802dac8a62e2807e50e0d18c4bfadcb15ebf5bcbc0
-
api-ms-win-core-interlocked-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-interlocked-l1-1-0.dll
- Size
- 18KiB (18696 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
cfe87d58f973daeda4ee7d2cf4ae521d
- SHA1
-
fd0aa97b7cb6e50c6d5d2bf2d21d757040b5204a
- SHA256
-
4997fda5d0e90b8a0ab7da314cb56f25d1450b366701c45c294d8dd3254de483
-
api-ms-win-core-libraryloader-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-libraryloader-l1-1-0.dll
- Size
- 19KiB (19720 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
5d5fae1a17961d6ee37637f04fe99b8a
- SHA1
-
47143a66b4a2e2ba019bf1fd07bcca9cfb8bb117
- SHA256
-
8e01eb923fc453f927a7eca1c8aa5643e43b360c76b648088f51b31488970aa0
-
api-ms-win-core-localization-l1-2-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-localization-l1-2-0.dll
- Size
- 21KiB (21256 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
588bd2a8e0152e0918742c1a69038f1d
- SHA1
-
9874398548891f6a08fc06437996f84eb7495783
- SHA256
-
a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094
-
api-ms-win-core-memory-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-memory-l1-1-0.dll
- Size
- 19KiB (19208 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
6def20ed13972f3c3f08dba8ecf3d6cc
- SHA1
-
9c03356cf48112563bb845479f40bf27b293e95e
- SHA256
-
c2e887a17875d39099d662a42f58c120b9cc8a799afd87a9e49adf3faddd2b68
-
api-ms-win-core-namedpipe-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-namedpipe-l1-1-0.dll
- Size
- 18KiB (18696 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
a056d4eeaae37deab8333dcc4c910a93
- SHA1
-
cb59f1fe73c17446eb196fc0dd7d944a0cd9d81f
- SHA256
-
593fa2aa2474508ad942bbaa0fdc9a1badd81c85b0dff1c43b90a47c23ad5fb7
-
api-ms-win-core-processenvironment-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-processenvironment-l1-1-0.dll
- Size
- 19KiB (19720 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
f3b4ab35a65a8d938c6b60ad59ba6e7f
- SHA1
-
2745259f4dbbefbf6b570ee36d224abdb18719bc
- SHA256
-
ea2972fec12305825162ae3e1ae2b6c140e840be0e7ebb51a7a77b7feeda133a
-
api-ms-win-core-processthreads-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-processthreads-l1-1-0.dll
- Size
- 20KiB (20232 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
1dda9cb13449ce2c6bb670598fc09dc8
- SHA1
-
0a91fe11b9a8321ca369f665a623270e5ac23176
- SHA256
-
4f187f1b4b14763360c325df6b04d3ec3cc6d2cecc9b796bc52a6c7196b0b2cc
-
api-ms-win-core-processthreads-l1-1-1.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-processthreads-l1-1-1.dll
- Size
- 19KiB (19208 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
d699333637db92d319661286df7cc39e
- SHA1
-
0bffb9ed366853e7019452644d26e8e8f236241b
- SHA256
-
fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504
-
api-ms-win-core-profile-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-profile-l1-1-0.dll
- Size
- 18KiB (18184 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
7028cf6b6b609cb0e31abd1f618e42d0
- SHA1
-
e7e0b18a40a35bd8b0766ac72253de827432e148
- SHA256
-
9e98b03a3ca1ebabdceb7ed9c0ceb4912bb68eb68f3e0df17f39c7a55fada31d
-
api-ms-win-core-rtlsupport-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-rtlsupport-l1-1-0.dll
- Size
- 19KiB (19208 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
2166fb99debbb1b0649c4685cf630a4a
- SHA1
-
24f37d46dfc0ef303ef04abf9956241af55d25c9
- SHA256
-
cdc4cfebf9cba85b0d3979befdb258c1f2cfcb79edd00da2dfbf389d080e4379
-
api-ms-win-core-string-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-string-l1-1-0.dll
- Size
- 18KiB (18184 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
e7a266dd3a2a1e03d8716f92bede582d
- SHA1
-
d4b97ce87c96de1f39fea97cca3992d292b2c14e
- SHA256
-
339966ae75675a03f628c4ddd5d3218abb36cbcf6ddce83b88c07336d732b8ae
-
api-ms-win-core-synch-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-synch-l1-1-0.dll
- Size
- 20KiB (20232 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
c1dcdb0fabc8ae671a7c7a94f42fb79a
- SHA1
-
99355912d7a7d622753b2a855cae4f5a4e50146f
- SHA256
-
cc76a4e82e0e0cd08df3bb8f5ad57142305e0f666cc32599d76e363d0b43efcb
-
api-ms-win-core-synch-l1-2-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-synch-l1-2-0.dll
- Size
- 18KiB (18696 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
6e704280d632c2f8f2cadefcae25ad85
- SHA1
-
699c5a1c553d64d7ff3cf4fe57da72bb151caede
- SHA256
-
758a2f9ef6908b51745db50d89610fe1de921d93b2dbea919bfdba813d5d8893
-
api-ms-win-core-sysinfo-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-sysinfo-l1-1-0.dll
- Size
- 19KiB (19208 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
887995a73bc7dde7b764afabce57efe7
- SHA1
-
363fd4e7ad4a57224e8410154697df5e8629f526
- SHA256
-
f94210b39cdc812beb7342a47e68673ea2116d0ad9266fcf8d7cedaa9561fc38
-
api-ms-win-core-timezone-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-timezone-l1-1-0.dll
- Size
- 18KiB (18696 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
c9a55de62e53d747c5a7fddedef874f9
- SHA1
-
c5c5a7a873a4d686bfe8e3da6dc70f724ce41bad
- SHA256
-
b5c725bbb475b5c06cc6cb2a2c3c70008f229659f88fba25ccd5d5c698d06a4b
-
api-ms-win-core-util-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-core-util-l1-1-0.dll
- Size
- 18KiB (18184 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
29e1922b32e5312a948e6d8b1b34e2d9
- SHA1
-
912f54be8438f45e1562a47294091d522cd89356
- SHA256
-
34c5dee6d566252c0ceb7d9a21e24d5f297af2b26c32e0c7808bbd088aa9a6a9
-
api-ms-win-crt-conio-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-crt-conio-l1-1-0.dll
- Size
- 19KiB (19208 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
a668c5ee307457729203ae00edebb6b3
- SHA1
-
2114d84cf3ec576785ebbe6b2184b0d634b86d71
- SHA256
-
a95b1af74623d6d5d892760166b9bfac8926929571301921f1e62458e6d1a503
-
api-ms-win-crt-convert-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-crt-convert-l1-1-0.dll
- Size
- 22KiB (22280 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
9ddea3cc96e0fdd3443cc60d649931b3
- SHA1
-
af3cb7036318a8427f20b8561079e279119dca0e
- SHA256
-
b7c3ebc36c84630a52d23d1c0e79d61012dfa44cdebdf039af31ec9e322845a5
-
api-ms-win-crt-environment-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-crt-environment-l1-1-0.dll
- Size
- 18KiB (18696 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
39325e5f023eb564c87d30f7e06dff23
- SHA1
-
03dd79a7fbe3de1a29359b94ba2d554776bdd3fe
- SHA256
-
56d8b7ee7619579a3c648eb130c9354ba1ba5b33a07a4f350370ee7b3653749a
-
api-ms-win-crt-filesystem-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-crt-filesystem-l1-1-0.dll
- Size
- 20KiB (20232 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
228c6bbe1bce84315e4927392a3baee5
- SHA1
-
ba274aa567ad1ec663a2f9284af2e3cb232698fb
- SHA256
-
ac0cec8644340125507dd0bc9a90b1853a2d194eb60a049237fb5e752d349065
-
api-ms-win-crt-heap-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-crt-heap-l1-1-0.dll
- Size
- 19KiB (19720 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
f9e20dd3b07766307fccf463ab26e3ca
- SHA1
-
60b4cf246c5f414fc1cd12f506c41a1043d473ee
- SHA256
-
af47aebe065af2f045a19f20ec7e54a6e73c0c3e9a5108a63095a7232b75381a
-
api-ms-win-crt-locale-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-crt-locale-l1-1-0.dll
- Size
- 18KiB (18696 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
034379bcea45eb99db8cdfeacbc5e281
- SHA1
-
bbf93d82e7e306e827efeb9612e8eab2b760e2b7
- SHA256
-
8b543b1bb241f5b773eb76f652dad7b12e3e4a09230f2e804cd6b0622e8baf65
-
api-ms-win-crt-math-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-crt-math-l1-1-0.dll
- Size
- 28KiB (28936 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
8da414c3524a869e5679c0678d1640c1
- SHA1
-
60cf28792c68e9894878c31b323e68feb4676865
- SHA256
-
39723e61c98703034b264b97ee0fe12e696c6560483d799020f9847d8a952672
-
api-ms-win-crt-multibyte-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-crt-multibyte-l1-1-0.dll
- Size
- 26KiB (26888 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
4e033cfee32edf6be7847e80a5114894
- SHA1
-
91eef52c557aefd0fde27e8df4e3c3b7f99862f2
- SHA256
-
dff24441df89a02dde1cd984e4d3820845bafdff105458ed10d510126117115b
-
api-ms-win-crt-private-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-crt-private-l1-1-0.dll
- Size
- 71KiB (72968 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
3d139f57ed79d2c788e422ca26950446
- SHA1
-
788e4fb5d1f46b0f1802761d0ae3addb8611c238
- SHA256
-
dc25a882ac454a0071e4815b0e939dc161ba73b5c207b84afd96203c343b99c7
-
api-ms-win-crt-process-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-crt-process-l1-1-0.dll
- Size
- 19KiB (19720 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
595d79870970565be93db076afbe73b5
- SHA1
-
ec96f7beeaec14d3b6c437b97b4a18a365534b9b
- SHA256
-
fc50a37acc35345c99344042d7212a4ae88aa52a894cda3dcb9f6db46d852558
-
api-ms-win-crt-runtime-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-crt-runtime-l1-1-0.dll
- Size
- 22KiB (22792 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
fb0ca6cbfff46be87ad729a1c4fde138
- SHA1
-
2c302d1c535d5c40f31c3a75393118b40e1b2af9
- SHA256
-
1ee8e99190cc31b104fb75e66928b8c73138902fefedbcfb54c409df50a364df
-
api-ms-win-crt-stdio-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-crt-stdio-l1-1-0.dll
- Size
- 24KiB (24840 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
76e0a89c91a28cf7657779d998e679e5
- SHA1
-
982b5da1c1f5b9d74af6243885bcba605d54df8c
- SHA256
-
0189cbd84dea035763a7e52225e0f1a7dcec402734885413add324bffe688577
-
api-ms-win-crt-string-l1-1-0.dll
- Filepath
- %APPDATA%\Dashlane\6.1926.1.21432\ucrt\x64\api-ms-win-crt-string-l1-1-0.dll
- Size
- 24KiB (24840 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
96da689947c6e215a009b9c1eca5aec2
- SHA1
-
7f389e6f2d6e5beb2a3baf622a0c0ea24bc4de60
- SHA256
-
885309eb86dccd8e234ba05e13fe0bf59ab3db388ebfbf6b4fd6162d8e287e82
-
AccessControl_2.dll
- Filepath
- %TEMP%\nsrFD47.tmp\AccessControl_2.dll
- Size
- 13KiB (13312 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
9e7d36edcc188e166dee9552017ac94f
- SHA1
-
0378843fe1e7fb2ad97b8432fbdcb44faa6fc48a
- SHA256
-
d52a83c2a8551cebf48ff7a8d5930be1873bce990f855ccab4d7479cfeb22e3d
-
CheckInstalledKB_15-02-17_3_1.dll
- Filepath
- %TEMP%\nsrFD47.tmp\CheckInstalledKB_15-02-17_3_1.dll
- Size
- 78KiB (79872 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
d2098d2c2d7d35c0d3c396ef6206b867
- SHA1
-
10d7bcdf07c9b3fb784dc0d6a6983d6846422e9d
- SHA256
-
92d2e4031540c2db9938f257e4c25fd61f3d8fce9397a6a7a83a6604a40c0c8c
-
CakeTubeSdk.Core.dll
- Size
- 54KiB (55376 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
8d9faace25578255853e4321d9ccbb86
- SHA1
-
d33a11a18c024dc893ce97562381d1e1919d5e6c
- SHA256
-
d09235f91b003b2bff099596c41b13b83cd0af2a8a8a231a1223c71185f80213
-
Dashlanei.dll
- Size
- 914KiB (936016 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
1ad147dd2df070b970760fa3b0b4464f
- SHA1
-
cb3b95a8ddde1aa372bab2c06f1eddde552948b7
- SHA256
-
30353839132da790e70165ee73d32fd53dfadeceb7a06c406a9b7cb9ddb01810
-
aftap0901.cat
- Size
- 8.2KiB (8379 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
b5ddc1859f240b61ccf9a196a863a3ba
- SHA1
-
84baa474b18625dfd2744aa0ae418d25d6985134
- SHA256
-
5b87a3161dfb16864f31a7348fb78bacb0cafd7ff5dd5a0239cfff15ef64f881
-
Dashlane.lnk
- Size
- 1.7KiB (1739 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
3ddc708f248ad6c5882d6d07ad7ef701
- SHA1
-
8894d53fbe86efd07d662bca61fc7f6ac7bf252d
- SHA256
-
a05f5dec88f0d609dfe752476c93516f20ee2a197e7e77e8d5ed12475e0078c3
-
DashlaneDiagnosticTool.exe
- Size
- 3.8MiB (3960912 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
8a9da087c50e4fea1321a99b5c3dfa92
- SHA1
-
4ec36c92f32b01030979f53e84364e36e52d1f8a
- SHA256
-
71a972f7de05ecaaacbc671d420a92cd64d325ecea78850a240b3b47cae2090b
-
DashlanePlugin.exe
- Size
- 404KiB (413264 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
2bdf8afde29dc9028e454d01e650202e
- SHA1
-
e9d50e62bbd240f836dc1c233513eaddc7cb4a74
- SHA256
-
c4dd19f9eeddb8587a2fb512b6ca9c89c0eec48dc988b4d6cea8761e2fbca471
-
ChakraCore.dll
- Size
- 4.6MiB (4853328 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
7673ce745c032642a2a9fb14c34bf9ec
- SHA1
-
fc4c292833b5805de46a230a246afc65bb15483a
- SHA256
-
13a2d056499533233855422bba3d26f6156a9e4902415cbf5f7b82628de41e89
-
CheckInstalledKB_15-02-17_3_2.dll
- Size
- 78KiB (79872 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
d2098d2c2d7d35c0d3c396ef6206b867
- SHA1
-
10d7bcdf07c9b3fb784dc0d6a6983d6846422e9d
- SHA256
-
92d2e4031540c2db9938f257e4c25fd61f3d8fce9397a6a7a83a6604a40c0c8c
-
DashlaneBiometry.exe
- Size
- 378KiB (387152 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
681ca2e54cac470c482cddaa7be523d3
- SHA1
-
adab1c438ac5a99b88bb14c330d8aadbf7a10f37
- SHA256
-
c90b94abc8d7ae2a644c9eae1a4ea03854267fee9849db8c6ce28fe6575c4808
-
AFTap.inf
- Size
- 7.5KiB (7656 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
6c3ca981c4bf85c881dbfe05d3154b29
- SHA1
-
5eb4653a89f6a2231a7d02a0ce601f7398d28044
- SHA256
-
e4896bf9acd028277bc18422210eacf0e6fa88467ed2887a941a1397363bb65d
-
Dashlane_new.exe
- Size
- 382KiB (390736 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
dde87b493fc09b1174860ddd8e9d6519
- SHA1
-
4589ed836a8dbfd2fb82d3b930b07c776d0d5000
- SHA256
-
7309145b0c3d357da1ab389a10c80a80fcbfbfc8473318c9acf1b82499bc7149
-
freebl3.dll
- Size
- 481KiB (493008 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
bcf953a4c88f8e897c0f3c50425ce4e5
- SHA1
-
ea39a0ddd0a17107574d8bab173f2268b00bd8b1
- SHA256
-
e63a539508475fc34573c06648d4f40aa5d03f42bd043ae64ade159566b75967
-
Dashlane_launcher.exe
- Size
- 29KiB (29264 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
8d08e1c23b9a2c9bf2f63cc620207cea
- SHA1
-
0422ee3066363ba7659a6107c4d9d0a4e6e25545
- SHA256
-
87dcf1727131034cd32da9cf815274f154978bafc5b3b5a1c955f1958c5112c0
-
DashlaneUpdateService.exe
- Size
- 366KiB (374864 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
86c9770dc8e335c3428e91c719b4b297
- SHA1
-
fd54fe34ee9304468d73a7121a2f4ca36eeaf5e4
- SHA256
-
4c260e048b087bf3281bf52c95fc9f815bec481a702a2f841351f329334a4034
-
DashlanePlugin_new.exe
- Size
- 404KiB (413264 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
2bdf8afde29dc9028e454d01e650202e
- SHA1
-
e9d50e62bbd240f836dc1c233513eaddc7cb4a74
- SHA256
-
c4dd19f9eeddb8587a2fb512b6ca9c89c0eec48dc988b4d6cea8761e2fbca471
-
CakeTubeSdk.Windows.dll
- Size
- 3MiB (3137104 bytes)
- Runtime Process
- DashlaneInst.exe (PID: 3992)
- MD5
-
ae47dc3a57bef9c998b64fb6827993cb
- SHA1
-
9792c93f935a2931daaa829a6827a1e0255366e5
- SHA256
-
8b4a73d9254962cc9bc691a245bdfee5fdba63d5a98e66a41890e6621e5da4b2
-
Notifications
-
Runtime
- Extracted file "domain_categories_e.csv" was unknown to VirusTotal, submitted file for scanning (Permalink: "https://www.virustotal.com/file/ea5f0ab612799095c55bb8f54897482c26870139ef0508f4e7ac317af2350be1/analysis/1562599266/")
- Extracted file "domain_categories_w.csv" was unknown to VirusTotal, submitted file for scanning (Permalink: "https://www.virustotal.com/file/f91a687975fe0d7ca13be9eeb6b316c895fef87e9908d449c63ba3fa3fd08d37/analysis/1562599264/")
- Extracted file "domain_categories_y.csv" was unknown to VirusTotal, submitted file for scanning (Permalink: "https://www.virustotal.com/file/6684b9e188c9789543a853ae0fe9d2ab705b7ee6088faa08439e51c3f57bb332/analysis/1562599267/")
- Not all IP/URL string resources were checked online
- Not all file accesses are visible for explorer.exe (PID: 1216)
- Not all sources for indicator ID "api-12" are available in the report
- Not all sources for indicator ID "api-4" are available in the report
- Not all sources for indicator ID "api-55" are available in the report
- Not all sources for indicator ID "api-70" are available in the report
- Not all sources for indicator ID "binary-0" are available in the report
- Not all sources for indicator ID "binary-1" are available in the report
- Not all sources for indicator ID "binary-10" are available in the report
- Not all sources for indicator ID "binary-16" are available in the report
- Not all sources for indicator ID "hooks-8" are available in the report
- Not all sources for indicator ID "registry-17" are available in the report
- Not all sources for indicator ID "registry-18" are available in the report
- Not all sources for indicator ID "registry-19" are available in the report
- Not all sources for indicator ID "static-0" are available in the report
- Not all sources for indicator ID "static-18" are available in the report
- Not all sources for indicator ID "static-3" are available in the report
- Not all sources for indicator ID "static-6" are available in the report
- Not all sources for indicator ID "string-23" are available in the report
- Not all sources for indicator ID "string-61" are available in the report
- Not all strings are visible in the report, because the maximum number of strings was reached (5000)
- Some low-level data is hidden, as this is only a slim report
- Touched the maximum number of extracted files (2000), report might not contain information about some extracted files