eternity | aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db

Analysis

max time kernel
147s
max time network
155s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
Size

1.6MB
MD5

1e17d3a48a9af2ec606390be74a223d9
SHA1

71e47b7674ca15bbefa57d94ec8e39155085f571
SHA256

aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db
SHA512

8b72687d93e23071ac62b4a873d351b3b7ce227811a49ae09b29cfeea3c7d987b34e233f30269a29c5fe2106c2f6f4c1c761cc24a8c872d6acc68c53146b8cff

Score

10^/10

eternity redline 4 @tag12312341 nam3 collection discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

nam3

103.89.90.61:18728

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

31.41.244.134:11643

Attributes

auth_value
a516b2d034ecd34338f12b50347fbd92

Extracted

Family

redline

Botnet

@tag12312341

62.204.41.144:14096

Attributes

auth_value
71466795417275fac01979e57016e277

Extracted

Family

eternity

http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion

Wallets

3d124531384b43d082e5cf79f6b2096a

Signatures

Detects Eternity stealer 4 IoCs

stealer

Processes:

resource	yara_rule
\Program Files (x86)\Company\NewProduct\Hassroot.exe	eternity_stealer
C:\Program Files (x86)\Company\NewProduct\Hassroot.exe	eternity_stealer
C:\Program Files (x86)\Company\NewProduct\Hassroot.exe	eternity_stealer
behavioral1/memory/1252-105-0x0000000000DB0000-0x0000000000E62000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 12 IoCs

Processes:

resource	yara_rule
\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
behavioral1/memory/1596-106-0x0000000001120000-0x0000000001140000-memory.dmp	family_redline
behavioral1/memory/240-107-0x0000000000C60000-0x0000000000CA4000-memory.dmp	family_redline
behavioral1/memory/1504-108-0x0000000000F40000-0x0000000000F84000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 11 IoCs

Processes:

real.exeF0geI.exenamdoitntn.exeromb_ro.exesafert44.exetag.exeHassroot.exekukurzka9000.exepigmo.exeEU1.exeTor.exe

pid	process
320	real.exe
1188	F0geI.exe
1504	namdoitntn.exe
1840	romb_ro.exe
240	safert44.exe
1596	tag.exe
1252	Hassroot.exe
1072	kukurzka9000.exe
2068	pigmo.exe
2096	EU1.exe
3908	Tor.exe

Loads dropped DLL 33 IoCs

Processes:

aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exepigmo.exeRundll32.exeRundll32.exeTor.exe

pid	process
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
2068	pigmo.exe
2068	pigmo.exe
2068	pigmo.exe
3512	Rundll32.exe
3512	Rundll32.exe
3512	Rundll32.exe
3512	Rundll32.exe
3524	Rundll32.exe
3524	Rundll32.exe
3524	Rundll32.exe
3524	Rundll32.exe
3908	Tor.exe
3908	Tor.exe
3908	Tor.exe
3908	Tor.exe
3908	Tor.exe
3908	Tor.exe
3908	Tor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Hassroot.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Hassroot.exe
Key opened	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Hassroot.exe
Key opened	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Hassroot.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

45 ip-api.com

flow	ioc
45	ip-api.com

Drops file in Program Files directory 10 IoCs

Processes:

aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\pigmo.exe	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\romb_ro.exe	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Hassroot.exe	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\tag.exe	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\EU1.exe	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
\Program Files (x86)\Company\NewProduct\pigmo.exe	nsis_installer_1
\Program Files (x86)\Company\NewProduct\pigmo.exe	nsis_installer_2
C:\Program Files (x86)\Company\NewProduct\pigmo.exe	nsis_installer_1
C:\Program Files (x86)\Company\NewProduct\pigmo.exe	nsis_installer_2
C:\Program Files (x86)\Company\NewProduct\pigmo.exe	nsis_installer_1
C:\Program Files (x86)\Company\NewProduct\pigmo.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

romb_ro.exereal.exeHassroot.exeEU1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	romb_ro.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	romb_ro.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	real.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	real.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Hassroot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Hassroot.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EU1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EU1.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

3252 timeout.exe
3996 timeout.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

2184 taskkill.exe
2268 taskkill.exe

pid	process
3252	timeout.exe
3996	timeout.exe

pid	process
2184	taskkill.exe
2268	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4D02051-0C79-11ED-9E54-5AF702DB1886} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4CD97E1-0C79-11ED-9E54-5AF702DB1886} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004281fce5e1fefc478c7ba169937a5e5f00000000020000000000106600000001000020000000140d96bb17e0318e89e481852288da01347c8aaa72f439165f5d28cd3e59a13f000000000e80000000020000200000000e9a8d3db7d44c178b6e3698a6cd27ac263b73e0bdd9b06ca9c6c620cf6eda1c200000008d3425361c8c14635a3c8011da01a9590457a5035242b4f32280efa9ae073c1f400000000fc46078badab5ce121f1694e3e25666b72ab6233194539f69472bb86d192affeb3c977583f354681a088f65f4eda1d62819d97e033e4228d20bb7541514b8f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4CB3681-0C79-11ED-9E54-5AF702DB1886} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4E0A2E1-0C79-11ED-9E54-5AF702DB1886} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

pigmo.exeHassroot.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	pigmo.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	pigmo.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	pigmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Hassroot.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Hassroot.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	pigmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	pigmo.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	pigmo.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	pigmo.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	pigmo.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

Hassroot.exesafert44.exenamdoitntn.exeEU1.exeromb_ro.exetag.exereal.exe

pid	process
1252	Hassroot.exe
240	safert44.exe
1504	namdoitntn.exe
2096	EU1.exe
2096	EU1.exe
2096	EU1.exe
1840	romb_ro.exe
1840	romb_ro.exe
1840	romb_ro.exe
1596	tag.exe
320	real.exe
320	real.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Hassroot.exesafert44.exenamdoitntn.exetaskkill.exetaskkill.exetag.exe

description	pid	process
Token: SeDebugPrivilege	1252	Hassroot.exe
Token: SeDebugPrivilege	240	safert44.exe
Token: SeDebugPrivilege	1504	namdoitntn.exe
Token: SeDebugPrivilege	2184	taskkill.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	1596	tag.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid	process
1732	iexplore.exe
1344	iexplore.exe
1988	iexplore.exe
976	iexplore.exe
1548	iexplore.exe
1568	iexplore.exe
1752	iexplore.exe
1304	iexplore.exe
1588	iexplore.exe

Suspicious use of SetWindowsHookEx 38 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1588	iexplore.exe
1588	iexplore.exe
976	iexplore.exe
976	iexplore.exe
1344	iexplore.exe
1344	iexplore.exe
1568	iexplore.exe
1568	iexplore.exe
1732	iexplore.exe
1732	iexplore.exe
1752	iexplore.exe
1752	iexplore.exe
1988	iexplore.exe
1988	iexplore.exe
1548	iexplore.exe
1548	iexplore.exe
1304	iexplore.exe
1304	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe

description	pid	process	target process
PID 764 wrote to memory of 1988	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1988	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1988	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1988	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1568	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1568	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1568	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1568	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1732	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1732	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1732	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1732	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1344	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1344	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1344	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1344	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1548	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1548	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1548	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1548	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1588	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1588	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1588	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1588	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1752	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1752	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1752	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1752	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 976	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 976	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 976	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 976	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1304	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1304	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1304	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 1304	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	iexplore.exe
PID 764 wrote to memory of 320	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	real.exe
PID 764 wrote to memory of 320	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	real.exe
PID 764 wrote to memory of 320	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	real.exe
PID 764 wrote to memory of 320	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	real.exe
PID 764 wrote to memory of 1188	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	F0geI.exe
PID 764 wrote to memory of 1188	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	F0geI.exe
PID 764 wrote to memory of 1188	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	F0geI.exe
PID 764 wrote to memory of 1188	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	F0geI.exe
PID 764 wrote to memory of 1504	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	namdoitntn.exe
PID 764 wrote to memory of 1504	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	namdoitntn.exe
PID 764 wrote to memory of 1504	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	namdoitntn.exe
PID 764 wrote to memory of 1504	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	namdoitntn.exe
PID 764 wrote to memory of 1840	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	romb_ro.exe
PID 764 wrote to memory of 1840	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	romb_ro.exe
PID 764 wrote to memory of 1840	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	romb_ro.exe
PID 764 wrote to memory of 1840	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	romb_ro.exe
PID 764 wrote to memory of 240	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	safert44.exe
PID 764 wrote to memory of 240	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	safert44.exe
PID 764 wrote to memory of 240	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	safert44.exe
PID 764 wrote to memory of 240	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	safert44.exe
PID 764 wrote to memory of 1596	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	tag.exe
PID 764 wrote to memory of 1596	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	tag.exe
PID 764 wrote to memory of 1596	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	tag.exe
PID 764 wrote to memory of 1596	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	tag.exe
PID 764 wrote to memory of 1252	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	Hassroot.exe
PID 764 wrote to memory of 1252	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	Hassroot.exe
PID 764 wrote to memory of 1252	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	Hassroot.exe
PID 764 wrote to memory of 1252	764	aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe	Hassroot.exe

outlook_office_path 1 IoCs

Processes:

Hassroot.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Hassroot.exe

outlook_win_path 1 IoCs

Processes:

Hassroot.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Hassroot.exe

C:\Users\Admin\AppData\Local\Temp\aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe
"C:\Users\Admin\AppData\Local\Temp\aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:764

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1n7LH4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1988

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2340

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1A4aK4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1568

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1568 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2308

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RLtX4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1732

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2284

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RCgX4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1344

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1344 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2292

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1APMK4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1548

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2332

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RCgX4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1588

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1588 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2300

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RchC4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1752

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2352

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RyjC4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:976

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:976 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2316

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1nCCJ4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1304

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1304 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2360

C:\Program Files (x86)\Company\NewProduct\real.exe
"C:\Program Files (x86)\Company\NewProduct\real.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:320

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
2⤵
- Executes dropped EXE
PID:1188

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Program Files (x86)\Company\NewProduct\romb_ro.exe
"C:\Program Files (x86)\Company\NewProduct\romb_ro.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1840

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im romb_ro.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Company\NewProduct\romb_ro.exe" & del C:\ProgramData\*.dll & exit
3⤵
PID:2608

C:\Windows\SysWOW64\taskkill.exe
taskkill /im romb_ro.exe /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:3252

C:\Program Files (x86)\Company\NewProduct\safert44.exe
"C:\Program Files (x86)\Company\NewProduct\safert44.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:240

C:\Program Files (x86)\Company\NewProduct\tag.exe
"C:\Program Files (x86)\Company\NewProduct\tag.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Program Files (x86)\Company\NewProduct\Hassroot.exe
"C:\Program Files (x86)\Company\NewProduct\Hassroot.exe"
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1252

C:\Windows\system32\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
3⤵
PID:3316

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:3376

C:\Windows\system32\netsh.exe
netsh wlan show profile
4⤵
PID:3392

C:\Windows\system32\findstr.exe
findstr All
4⤵
PID:3404

C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe
"C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3908

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
2⤵
- Executes dropped EXE
PID:1072

C:\Program Files (x86)\Company\NewProduct\pigmo.exe
"C:\Program Files (x86)\Company\NewProduct\pigmo.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:2068

C:\Windows\SysWOW64\Rundll32.exe
Rundll32.exe C:\Users\Admin\AppData\Local\Temp\libnspr4.dll,PR_DestroyRWLock
3⤵
- Loads dropped DLL
PID:3512

C:\Windows\SysWOW64\Rundll32.exe
Rundll32.exe C:\Users\Admin\AppData\Local\Temp\clip.dll,PR_DestroyRWLock
3⤵
- Loads dropped DLL
PID:3524

C:\Program Files (x86)\Company\NewProduct\EU1.exe
"C:\Program Files (x86)\Company\NewProduct\EU1.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2096

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im EU1.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Company\NewProduct\EU1.exe" & del C:\ProgramData\*.dll & exit
3⤵
PID:4016

C:\Windows\SysWOW64\taskkill.exe
taskkill /im EU1.exe /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:3996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\EU1.exe
Filesize
289KB

MD5
d2dea6e0a56875cdc586accb454cff71

SHA1
0563016b8f98516dc637ea66a4d588528dbb029f

SHA256
a3dcb2cdc7def8e8d843b7630be027af4c43926d8f5c41d91c61729ef35b3134

SHA512
f8c81401111ed6380d0c3e8fb40149c1d739be43bd5e784c4c32808a0a2a5517de99bbe34439f15b0aedab353e3c07398c310330f8a2070c0dae9b2cfd7ddac7

Download Submit
C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
290KB

MD5
8ab8fc20b7ab8b18bf0f474cc0156523

SHA1
21b922f6dcd49b67b5b3abc9603ec90835e7a20d

SHA256
b8849a951aadc7c35e1d1b8c57064b49a5eddf54928419b21f18584263162fca

SHA512
ab1ffba707911c50b2ac609c0736560ad2a37dd71f87597af5a87eae3c1811309f3973ecfc0b68cb5d234dd374d771e55637bd84748291758f932dc088def9d2

Download Submit
C:\Program Files (x86)\Company\NewProduct\Hassroot.exe
Filesize
687KB

MD5
df461340be6619279294dc510ccab782

SHA1
bfc1c233dde70b21498704b21171fc9dad5d77a1

SHA256
9c30234f4b8761151f8912e0dc38ca6e67a1297434beb8ffb816e3af90af5c44

SHA512
dc56be893fcc0a645df5e8a36e2106e4442e32f78f396fdf9f25fcddba33ac6cd4ce81245f4d5744f30d25cdd9f059175d9ec092d369ac06ae6cd874a17eb35f

Download Submit
C:\Program Files (x86)\Company\NewProduct\Hassroot.exe
Filesize
687KB

MD5
df461340be6619279294dc510ccab782

SHA1
bfc1c233dde70b21498704b21171fc9dad5d77a1

SHA256
9c30234f4b8761151f8912e0dc38ca6e67a1297434beb8ffb816e3af90af5c44

SHA512
dc56be893fcc0a645df5e8a36e2106e4442e32f78f396fdf9f25fcddba33ac6cd4ce81245f4d5744f30d25cdd9f059175d9ec092d369ac06ae6cd874a17eb35f

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
1.5MB

MD5
4bb92f1ae6e62f60d99d305929807c49

SHA1
b304564cb3f9a96673d853b5f30c04e7b7898b76

SHA256
61767fbbe32991e95bd9da2309a09795d61e70cfe9bf2762a1d11f58ef524ce2

SHA512
9bb31bf563d7e32885ef41df7652775a4e37b5e4b24e75a862052b5e0a5572f7e90695aa100c93ca485f7fb80214d23f6b5ea2aab33b5877afbaa6bad012d25d

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
245KB

MD5
b16134159e66a72fb36d93bc703b4188

SHA1
e869e91a2b0f77e7ac817e0b30a9a23d537b3001

SHA256
b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c

SHA512
3fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
245KB

MD5
b16134159e66a72fb36d93bc703b4188

SHA1
e869e91a2b0f77e7ac817e0b30a9a23d537b3001

SHA256
b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c

SHA512
3fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c

Download Submit
C:\Program Files (x86)\Company\NewProduct\pigmo.exe
Filesize
59KB

MD5
70730b152cfc9df1fb3884b52d13135f

SHA1
a6b9b07c5897b3d9046d48cfa3e4f5ccbfae5a6b

SHA256
bc575c0ec677d0271d56b6540808bfad5b420222a090837b0519b90c1d8ca6dd

SHA512
78016e57e2eec044fe5fbe07c1d53fd57c31eee0473aa8014c593f344d9059c2948b6a3e41afbadaad2e42006e9a7e0ed6078e0e95823481d0b81b21e7056903

Download Submit
C:\Program Files (x86)\Company\NewProduct\pigmo.exe
Filesize
59KB

MD5
70730b152cfc9df1fb3884b52d13135f

SHA1
a6b9b07c5897b3d9046d48cfa3e4f5ccbfae5a6b

SHA256
bc575c0ec677d0271d56b6540808bfad5b420222a090837b0519b90c1d8ca6dd

SHA512
78016e57e2eec044fe5fbe07c1d53fd57c31eee0473aa8014c593f344d9059c2948b6a3e41afbadaad2e42006e9a7e0ed6078e0e95823481d0b81b21e7056903

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
289KB

MD5
cf25b95144c2766ff8d6af9439b77596

SHA1
467cfb3e63b9da2b1c03bc712ab08cdb8fa71034

SHA256
df0b62403f7a1e666b759a3c174141defe61e275263637729f56749f524a514c

SHA512
bee60a1439e7ed944aca13424a2b4a835608ba05035e6594e711e036427b4243687eebffa1318c5412408919fd21e23179447bc190d5e9efb222f3a41649975d

Download Submit
C:\Program Files (x86)\Company\NewProduct\romb_ro.exe
Filesize
289KB

MD5
6adc24e326546ccd86472a3d4ccf03db

SHA1
5094a1723aa4cfdc03cedc7ed64236969b82d588

SHA256
c4a34d485a31f3b38a7107f53f37586e0e4845a13f02c579ca3fe695d38447d4

SHA512
aacaecd6d1cbac8ac18bdf8313bb06c124e44c720219a5b1b8d2d0178b9be3222faf2375b4445ed0cc455431642fc94d466fd65cc9460712bb87c922f26896ce

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
244KB

MD5
dbe947674ea388b565ae135a09cc6638

SHA1
ae8e1c69bd1035a92b7e06baad5e387de3a70572

SHA256
86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

SHA512
67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
244KB

MD5
dbe947674ea388b565ae135a09cc6638

SHA1
ae8e1c69bd1035a92b7e06baad5e387de3a70572

SHA256
86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

SHA512
67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
7ca0e2e760dd76d928eba9502a211cc5

SHA1
5c9c1c6c1f910ab2159dbe1a0b234face86b8694

SHA256
a7c9711e5919f44e985be4ece58b8c89588db15bb6a4a07587a5870c9f3ee05c

SHA512
5c561f57fe42bc002d7f4033db1c0c237a0ddda31715ca2b49e281285a0ded7589239ef41c65df1f97c2abdfcaedfd2f553cedf2f18ff8a45e5ae2a4bd9959ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F4CB3681-0C79-11ED-9E54-5AF702DB1886}.dat
Filesize
5KB

MD5
9b145fa2eb6ac6bac651b0577cb5c00f

SHA1
e32f29bda94cf814c9a39687b63c7f45c91e6b59

SHA256
26216a9ad10557c7dd527a535848fe4427084759c5f5e9c25e49d1ddc745cd0f

SHA512
060285ab172c94e2f25ab9898c224df1c19107f0edb88ff8ea5ad06d5f4d673138edea47b3003d6f2f8e025bf6273cad447f5a340e453238f599c8faa726177f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F4CD97E1-0C79-11ED-9E54-5AF702DB1886}.dat
Filesize
3KB

MD5
5048876e36e9bfd0a4a8cc046e6ab9ce

SHA1
5f33deae5a4321092a4b7bc9e4ee80f3b2982ae7

SHA256
ea3ebe6c36125a3ee7c3920202fd654a923e6e3f8658914f6d9c881af1da20c6

SHA512
7ae662ee8b1a8a375c51d0b497d3252f746a3affbadbd87c8d0b653dca4d6d7732331b3f31d6c7050c0936ab22ca9b37634682b016b068de7c6664995649a03b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F4CFF941-0C79-11ED-9E54-5AF702DB1886}.dat
Filesize
5KB

MD5
d71b7a183dafd483bb8babfd90303a6b

SHA1
a388197a0cc4d0835414815014e490c9d063e265

SHA256
ee3f9b01b9087bc87f0f6cc6a5bce93fe9b51ef427721063723902dc7bdb488d

SHA512
05ae34c857dc0d742e2ca5ac3162a533a3a7c7b9b343b0ef26c28f25e5a02abab1664e281645dce225309a7a0bb2b08765f7fc2177d76b6d66c558554553928e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F4D02051-0C79-11ED-9E54-5AF702DB1886}.dat
Filesize
5KB

MD5
b1f30c4f9aa1c1bfc18e960218e54674

SHA1
24d64cfdb43d92765f81263cb1d7d22615a57396

SHA256
334d3817c6cd090ee842b4f31f9520975fed11d73c91f8b0bbe5ccdec85e9971

SHA512
8531a55e10576b2a6a9186e5efa1abb4cc59992345323f47cb40c4270c26fa84bf22de1ad9d606a315df056a2b5024fa96564a293590bda6294752bab69e42eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F4DBE021-0C79-11ED-9E54-5AF702DB1886}.dat
Filesize
5KB

MD5
01fca24c3a27e15c8757639bf6017dd6

SHA1
336f0e4d8ee5ca48a91f4ac88a7cb858c94bcd2e

SHA256
e332e8b0d21b96972c0ef7b201d82f7912f01ad2ef876632db63ecb277678d63

SHA512
c9bae145fe3e7917ed71496e124802864181e8d440302d6154744f150ecd10ec0d290c40c66567e558afd31677b8cb1c0da70a759701128119b18ffd938100f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F4E0A2E1-0C79-11ED-9E54-5AF702DB1886}.dat
Filesize
3KB

MD5
f088e54a6ac26a7c1881185010fbf6c8

SHA1
0a3c55420c97910c1e0ca6bb72cf591b73b07d39

SHA256
9238e22edc8fec40058e2a69634d352396cca4406a5a800ef3b54cfb37c8c6fa

SHA512
e0e93cd698749c91a13337803445dc57433e0c1c7b81db25560865add074596f93d4ce88e43a06b051d1c5f4b9259d1a5e0b144d60097bf137a93356df70486d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tor\libcrypto-1_1.dll
Filesize
3.5MB

MD5
3406f79392c47a72bed2f0067b3ce466

SHA1
a8e2940d61fc840441c4e2a835959d197929ffdf

SHA256
e4b6b2ca32b1e2ba26959ec7380c4f117418d3a724f60494ff3cb81505fbf43d

SHA512
930d794aa8715dcd23fafbead7fe2ec95d2863783b4c52279870cad93d5b6cf02ba8a13e2653d2bf731e9882bf63f43a7e44788ce47505346be3fe8e8b872fa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tor\libevent-2-1-7.dll
Filesize
1.1MB

MD5
a3bf8e33948d94d490d4613441685eee

SHA1
75ed7f6e2855a497f45b15270c3ad4aed6ad02e2

SHA256
91c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585

SHA512
c20ef2efcacb5f8c7e2464de7fde68bf610ab2e0608ff4daed9bf676996375db99bee7e3f26c5bd6cca63f9b2d889ed5460ec25004130887cd1a90b892be2b28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tor\libgcc_s_sjlj-1.dll
Filesize
1.0MB

MD5
bd40ff3d0ce8d338a1fe4501cd8e9a09

SHA1
3aae8c33bf0ec9adf5fbf8a361445969de409b49

SHA256
ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c

SHA512
404fb3c107006b832b8e900f6e27873324cd0a7946cdccf4ffeea365a725892d929e8b160379af9782bcd6cfeb4c3c805740e21280b42bb2ce8f39f26792e5a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tor\libssl-1_1.dll
Filesize
1.1MB

MD5
9e3d55fbf890c6cbffd836f2aef4ba31

SHA1
715890ba3bda3431470cca4f4bc492c0f63fa138

SHA256
e6f4cf41373e8770c670cf5e85461f25385314ed9d8a2b37381bc84f5c0dd5c0

SHA512
9848f28fd96c21dd054cbf3e722e56373696c1f7803c137afc7c7203325d9738fa6b984d95cd49ff78a6d95c8f9406f869af3c3783901da3cc003e2b09497d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tor\libssp-0.dll
Filesize
246KB

MD5
b77328da7cead5f4623748a70727860d

SHA1
13b33722c55cca14025b90060e3227db57bf5327

SHA256
46541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7

SHA512
2f1bd13357078454203092ed5ddc23a8baa5e64202fba1e4f98eacf1c3c184616e527468a96ff36d98b9324426dddfa20b62b38cf95c6f5c0dc32513ebace9e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tor\libwinpthread-1.dll
Filesize
512KB

MD5
19d7cc4377f3c09d97c6da06fbabc7dc

SHA1
3a3ba8f397fb95ed5df22896b2c53a326662fcc9

SHA256
228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d

SHA512
23711285352cdec6815b5dd6e295ec50568fab7614706bc8d5328a4a0b62991c54b16126ed9e522471d2367b6f32fa35feb41bfa77b3402680d9a69f53962a4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tor\tor.exe
Filesize
4.0MB

MD5
67ab12cf6cabc14588e4f51b21c2134a

SHA1
32a4ff564f38bf4b62007e419f19c991e60d6e14

SHA256
f0aaae0364306bb7a4681d01935c96c2ac76b3576b7982990f86bcaf811a45ba

SHA512
2a1c67e9d23d6b050e35c5a8e159309cf598095239406c60a9f721fddc912e21afab7036cbd9f77197cc4241df5f8fa6aa9d7294762659178c6edeb4699d5bec

Download Submit
C:\Users\Admin\AppData\Local\Temp\clip.dll
Filesize
319KB

MD5
74779254de3128d746451e0fdb3d9fbe

SHA1
57dd3cea01de9fda0eb1930116e0ef3a18504c87

SHA256
918e7e08df9d5cdb654e6eab315cd69c81a862f8a7305c445602d06ea0398e9c

SHA512
437b2aeb945c0b2234722cca83d00f09de04b0592245304924484327de62c7b8d3e8a64f956e02db39a142b516e60d5dfbddf45a0d036c3fcc17cc52d7344b4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\libnspr4.dll
Filesize
584KB

MD5
45008317b0182ced811ee53cdfb39776

SHA1
7c4a797840e3aa7a9d6b540d2cf0395dbe87b717

SHA256
fa82d0695fabd1b97be3875306cde441ab7acad915be85386e4e5ce05223dab4

SHA512
62100595d9af5942e7c87bdbcdc68c34591a8e569a640bcd7416eb7b94ff8d0fd9902bf3a7888415f90b93a29870d844c367128e1f345acfb2a87fc28390489e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MKTISPSP.txt
Filesize
608B

MD5
dc769ced6d8b11fb195c0cee0a588198

SHA1
2397b216b55938b492ca7f621712a095f7fee09c

SHA256
a29ed3e8c694dd4f30655c74d51e926e0a5ad40803ab421d2d40d050357b2bb8

SHA512
adcfb4986aec8e72893aaf5d576aef6cb4da676c856c98747911b1fac3fe1f114ccfdf6106d741ab1afc2d1559a3b20c4f0ef97c37e47251b9334e22d689893a

Download Submit
\Program Files (x86)\Company\NewProduct\EU1.exe
Filesize
289KB

MD5
d2dea6e0a56875cdc586accb454cff71

SHA1
0563016b8f98516dc637ea66a4d588528dbb029f

SHA256
a3dcb2cdc7def8e8d843b7630be027af4c43926d8f5c41d91c61729ef35b3134

SHA512
f8c81401111ed6380d0c3e8fb40149c1d739be43bd5e784c4c32808a0a2a5517de99bbe34439f15b0aedab353e3c07398c310330f8a2070c0dae9b2cfd7ddac7

Download Submit
\Program Files (x86)\Company\NewProduct\EU1.exe
Filesize
289KB

MD5
d2dea6e0a56875cdc586accb454cff71

SHA1
0563016b8f98516dc637ea66a4d588528dbb029f

SHA256
a3dcb2cdc7def8e8d843b7630be027af4c43926d8f5c41d91c61729ef35b3134

SHA512
f8c81401111ed6380d0c3e8fb40149c1d739be43bd5e784c4c32808a0a2a5517de99bbe34439f15b0aedab353e3c07398c310330f8a2070c0dae9b2cfd7ddac7

Download Submit
\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
290KB

MD5
8ab8fc20b7ab8b18bf0f474cc0156523

SHA1
21b922f6dcd49b67b5b3abc9603ec90835e7a20d

SHA256
b8849a951aadc7c35e1d1b8c57064b49a5eddf54928419b21f18584263162fca

SHA512
ab1ffba707911c50b2ac609c0736560ad2a37dd71f87597af5a87eae3c1811309f3973ecfc0b68cb5d234dd374d771e55637bd84748291758f932dc088def9d2

Download Submit
\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
290KB

MD5
8ab8fc20b7ab8b18bf0f474cc0156523

SHA1
21b922f6dcd49b67b5b3abc9603ec90835e7a20d

SHA256
b8849a951aadc7c35e1d1b8c57064b49a5eddf54928419b21f18584263162fca

SHA512
ab1ffba707911c50b2ac609c0736560ad2a37dd71f87597af5a87eae3c1811309f3973ecfc0b68cb5d234dd374d771e55637bd84748291758f932dc088def9d2

Download Submit
\Program Files (x86)\Company\NewProduct\Hassroot.exe
Filesize
687KB

MD5
df461340be6619279294dc510ccab782

SHA1
bfc1c233dde70b21498704b21171fc9dad5d77a1

SHA256
9c30234f4b8761151f8912e0dc38ca6e67a1297434beb8ffb816e3af90af5c44

SHA512
dc56be893fcc0a645df5e8a36e2106e4442e32f78f396fdf9f25fcddba33ac6cd4ce81245f4d5744f30d25cdd9f059175d9ec092d369ac06ae6cd874a17eb35f

Download Submit
\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
1.5MB

MD5
4bb92f1ae6e62f60d99d305929807c49

SHA1
b304564cb3f9a96673d853b5f30c04e7b7898b76

SHA256
61767fbbe32991e95bd9da2309a09795d61e70cfe9bf2762a1d11f58ef524ce2

SHA512
9bb31bf563d7e32885ef41df7652775a4e37b5e4b24e75a862052b5e0a5572f7e90695aa100c93ca485f7fb80214d23f6b5ea2aab33b5877afbaa6bad012d25d

Download Submit
\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
1.5MB

MD5
4bb92f1ae6e62f60d99d305929807c49

SHA1
b304564cb3f9a96673d853b5f30c04e7b7898b76

SHA256
61767fbbe32991e95bd9da2309a09795d61e70cfe9bf2762a1d11f58ef524ce2

SHA512
9bb31bf563d7e32885ef41df7652775a4e37b5e4b24e75a862052b5e0a5572f7e90695aa100c93ca485f7fb80214d23f6b5ea2aab33b5877afbaa6bad012d25d

Download Submit
\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
245KB

MD5
b16134159e66a72fb36d93bc703b4188

SHA1
e869e91a2b0f77e7ac817e0b30a9a23d537b3001

SHA256
b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c

SHA512
3fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c

Download Submit
\Program Files (x86)\Company\NewProduct\pigmo.exe
Filesize
59KB

MD5
70730b152cfc9df1fb3884b52d13135f

SHA1
a6b9b07c5897b3d9046d48cfa3e4f5ccbfae5a6b

SHA256
bc575c0ec677d0271d56b6540808bfad5b420222a090837b0519b90c1d8ca6dd

SHA512
78016e57e2eec044fe5fbe07c1d53fd57c31eee0473aa8014c593f344d9059c2948b6a3e41afbadaad2e42006e9a7e0ed6078e0e95823481d0b81b21e7056903

Download Submit
\Program Files (x86)\Company\NewProduct\real.exe
Filesize
289KB

MD5
cf25b95144c2766ff8d6af9439b77596

SHA1
467cfb3e63b9da2b1c03bc712ab08cdb8fa71034

SHA256
df0b62403f7a1e666b759a3c174141defe61e275263637729f56749f524a514c

SHA512
bee60a1439e7ed944aca13424a2b4a835608ba05035e6594e711e036427b4243687eebffa1318c5412408919fd21e23179447bc190d5e9efb222f3a41649975d

Download Submit
\Program Files (x86)\Company\NewProduct\real.exe
Filesize
289KB

MD5
cf25b95144c2766ff8d6af9439b77596

SHA1
467cfb3e63b9da2b1c03bc712ab08cdb8fa71034

SHA256
df0b62403f7a1e666b759a3c174141defe61e275263637729f56749f524a514c

SHA512
bee60a1439e7ed944aca13424a2b4a835608ba05035e6594e711e036427b4243687eebffa1318c5412408919fd21e23179447bc190d5e9efb222f3a41649975d

Download Submit
\Program Files (x86)\Company\NewProduct\romb_ro.exe
Filesize
289KB

MD5
6adc24e326546ccd86472a3d4ccf03db

SHA1
5094a1723aa4cfdc03cedc7ed64236969b82d588

SHA256
c4a34d485a31f3b38a7107f53f37586e0e4845a13f02c579ca3fe695d38447d4

SHA512
aacaecd6d1cbac8ac18bdf8313bb06c124e44c720219a5b1b8d2d0178b9be3222faf2375b4445ed0cc455431642fc94d466fd65cc9460712bb87c922f26896ce

Download Submit
\Program Files (x86)\Company\NewProduct\romb_ro.exe
Filesize
289KB

MD5
6adc24e326546ccd86472a3d4ccf03db

SHA1
5094a1723aa4cfdc03cedc7ed64236969b82d588

SHA256
c4a34d485a31f3b38a7107f53f37586e0e4845a13f02c579ca3fe695d38447d4

SHA512
aacaecd6d1cbac8ac18bdf8313bb06c124e44c720219a5b1b8d2d0178b9be3222faf2375b4445ed0cc455431642fc94d466fd65cc9460712bb87c922f26896ce

Download Submit
\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
244KB

MD5
dbe947674ea388b565ae135a09cc6638

SHA1
ae8e1c69bd1035a92b7e06baad5e387de3a70572

SHA256
86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

SHA512
67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

Download Submit
\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
\Users\Admin\AppData\Local\Temp\Tor\libcrypto-1_1.dll
Filesize
3.5MB

MD5
3406f79392c47a72bed2f0067b3ce466

SHA1
a8e2940d61fc840441c4e2a835959d197929ffdf

SHA256
e4b6b2ca32b1e2ba26959ec7380c4f117418d3a724f60494ff3cb81505fbf43d

SHA512
930d794aa8715dcd23fafbead7fe2ec95d2863783b4c52279870cad93d5b6cf02ba8a13e2653d2bf731e9882bf63f43a7e44788ce47505346be3fe8e8b872fa4

Download Submit
\Users\Admin\AppData\Local\Temp\Tor\libevent-2-1-7.dll
Filesize
1.1MB

MD5
a3bf8e33948d94d490d4613441685eee

SHA1
75ed7f6e2855a497f45b15270c3ad4aed6ad02e2

SHA256
91c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585

SHA512
c20ef2efcacb5f8c7e2464de7fde68bf610ab2e0608ff4daed9bf676996375db99bee7e3f26c5bd6cca63f9b2d889ed5460ec25004130887cd1a90b892be2b28

Download Submit
\Users\Admin\AppData\Local\Temp\Tor\libgcc_s_sjlj-1.dll
Filesize
1.0MB

MD5
bd40ff3d0ce8d338a1fe4501cd8e9a09

SHA1
3aae8c33bf0ec9adf5fbf8a361445969de409b49

SHA256
ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c

SHA512
404fb3c107006b832b8e900f6e27873324cd0a7946cdccf4ffeea365a725892d929e8b160379af9782bcd6cfeb4c3c805740e21280b42bb2ce8f39f26792e5a1

Download Submit
\Users\Admin\AppData\Local\Temp\Tor\libssl-1_1.dll
Filesize
1.1MB

MD5
9e3d55fbf890c6cbffd836f2aef4ba31

SHA1
715890ba3bda3431470cca4f4bc492c0f63fa138

SHA256
e6f4cf41373e8770c670cf5e85461f25385314ed9d8a2b37381bc84f5c0dd5c0

SHA512
9848f28fd96c21dd054cbf3e722e56373696c1f7803c137afc7c7203325d9738fa6b984d95cd49ff78a6d95c8f9406f869af3c3783901da3cc003e2b09497d65

Download Submit
\Users\Admin\AppData\Local\Temp\Tor\libssp-0.dll
Filesize
246KB

MD5
b77328da7cead5f4623748a70727860d

SHA1
13b33722c55cca14025b90060e3227db57bf5327

SHA256
46541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7

SHA512
2f1bd13357078454203092ed5ddc23a8baa5e64202fba1e4f98eacf1c3c184616e527468a96ff36d98b9324426dddfa20b62b38cf95c6f5c0dc32513ebace9e2

Download Submit
\Users\Admin\AppData\Local\Temp\Tor\libwinpthread-1.dll
Filesize
512KB

MD5
19d7cc4377f3c09d97c6da06fbabc7dc

SHA1
3a3ba8f397fb95ed5df22896b2c53a326662fcc9

SHA256
228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d

SHA512
23711285352cdec6815b5dd6e295ec50568fab7614706bc8d5328a4a0b62991c54b16126ed9e522471d2367b6f32fa35feb41bfa77b3402680d9a69f53962a4a

Download Submit
\Users\Admin\AppData\Local\Temp\clip.dll
Filesize
319KB

MD5
74779254de3128d746451e0fdb3d9fbe

SHA1
57dd3cea01de9fda0eb1930116e0ef3a18504c87

SHA256
918e7e08df9d5cdb654e6eab315cd69c81a862f8a7305c445602d06ea0398e9c

SHA512
437b2aeb945c0b2234722cca83d00f09de04b0592245304924484327de62c7b8d3e8a64f956e02db39a142b516e60d5dfbddf45a0d036c3fcc17cc52d7344b4b

Download Submit
\Users\Admin\AppData\Local\Temp\clip.dll
Filesize
319KB

MD5
74779254de3128d746451e0fdb3d9fbe

SHA1
57dd3cea01de9fda0eb1930116e0ef3a18504c87

SHA256
918e7e08df9d5cdb654e6eab315cd69c81a862f8a7305c445602d06ea0398e9c

SHA512
437b2aeb945c0b2234722cca83d00f09de04b0592245304924484327de62c7b8d3e8a64f956e02db39a142b516e60d5dfbddf45a0d036c3fcc17cc52d7344b4b

Download Submit
\Users\Admin\AppData\Local\Temp\clip.dll
Filesize
319KB

MD5
74779254de3128d746451e0fdb3d9fbe

SHA1
57dd3cea01de9fda0eb1930116e0ef3a18504c87

SHA256
918e7e08df9d5cdb654e6eab315cd69c81a862f8a7305c445602d06ea0398e9c

SHA512
437b2aeb945c0b2234722cca83d00f09de04b0592245304924484327de62c7b8d3e8a64f956e02db39a142b516e60d5dfbddf45a0d036c3fcc17cc52d7344b4b

Download Submit
\Users\Admin\AppData\Local\Temp\clip.dll
Filesize
319KB

MD5
74779254de3128d746451e0fdb3d9fbe

SHA1
57dd3cea01de9fda0eb1930116e0ef3a18504c87

SHA256
918e7e08df9d5cdb654e6eab315cd69c81a862f8a7305c445602d06ea0398e9c

SHA512
437b2aeb945c0b2234722cca83d00f09de04b0592245304924484327de62c7b8d3e8a64f956e02db39a142b516e60d5dfbddf45a0d036c3fcc17cc52d7344b4b

Download Submit
\Users\Admin\AppData\Local\Temp\libnspr4.dll
Filesize
584KB

MD5
45008317b0182ced811ee53cdfb39776

SHA1
7c4a797840e3aa7a9d6b540d2cf0395dbe87b717

SHA256
fa82d0695fabd1b97be3875306cde441ab7acad915be85386e4e5ce05223dab4

SHA512
62100595d9af5942e7c87bdbcdc68c34591a8e569a640bcd7416eb7b94ff8d0fd9902bf3a7888415f90b93a29870d844c367128e1f345acfb2a87fc28390489e

Download Submit
\Users\Admin\AppData\Local\Temp\libnspr4.dll
Filesize
584KB

MD5
45008317b0182ced811ee53cdfb39776

SHA1
7c4a797840e3aa7a9d6b540d2cf0395dbe87b717

SHA256
fa82d0695fabd1b97be3875306cde441ab7acad915be85386e4e5ce05223dab4

SHA512
62100595d9af5942e7c87bdbcdc68c34591a8e569a640bcd7416eb7b94ff8d0fd9902bf3a7888415f90b93a29870d844c367128e1f345acfb2a87fc28390489e

Download Submit
\Users\Admin\AppData\Local\Temp\libnspr4.dll
Filesize
584KB

MD5
45008317b0182ced811ee53cdfb39776

SHA1
7c4a797840e3aa7a9d6b540d2cf0395dbe87b717

SHA256
fa82d0695fabd1b97be3875306cde441ab7acad915be85386e4e5ce05223dab4

SHA512
62100595d9af5942e7c87bdbcdc68c34591a8e569a640bcd7416eb7b94ff8d0fd9902bf3a7888415f90b93a29870d844c367128e1f345acfb2a87fc28390489e

Download Submit
\Users\Admin\AppData\Local\Temp\libnspr4.dll
Filesize
584KB

MD5
45008317b0182ced811ee53cdfb39776

SHA1
7c4a797840e3aa7a9d6b540d2cf0395dbe87b717

SHA256
fa82d0695fabd1b97be3875306cde441ab7acad915be85386e4e5ce05223dab4

SHA512
62100595d9af5942e7c87bdbcdc68c34591a8e569a640bcd7416eb7b94ff8d0fd9902bf3a7888415f90b93a29870d844c367128e1f345acfb2a87fc28390489e

Download Submit
\Users\Admin\AppData\Local\Temp\nsyFC4C.tmp\INetC.dll
Filesize
21KB

MD5
2b342079303895c50af8040a91f30f71

SHA1
b11335e1cb8356d9c337cb89fe81d669a69de17e

SHA256
2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

SHA512
550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

Download Submit
\Users\Admin\AppData\Local\Temp\nsyFC4C.tmp\INetC.dll
Filesize
21KB

MD5
2b342079303895c50af8040a91f30f71

SHA1
b11335e1cb8356d9c337cb89fe81d669a69de17e

SHA256
2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

SHA512
550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

Download Submit
\Users\Admin\AppData\Local\Temp\nsyFC4C.tmp\System.dll
Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
memory/240-71-0x0000000000000000-mapping.dmp

Download
memory/240-109-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/240-107-0x0000000000C60000-0x0000000000CA4000-memory.dmp

Filesize
272KB

Download
memory/320-57-0x0000000000000000-mapping.dmp

Download
memory/764-54-0x00000000754B1000-0x00000000754B3000-memory.dmp

Filesize
8KB

Download
memory/1072-100-0x0000000000350000-0x0000000000365000-memory.dmp

Filesize
84KB

Download
memory/1072-85-0x0000000000000000-mapping.dmp

Download
memory/1072-101-0x0000000000400000-0x000000000058B000-memory.dmp

Filesize
1.5MB

Download
memory/1188-125-0x000000000052C000-0x000000000053C000-memory.dmp

Filesize
64KB

Download
memory/1188-61-0x0000000000000000-mapping.dmp

Download
memory/1188-103-0x0000000000220000-0x000000000022E000-memory.dmp

Filesize
56KB

Download
memory/1188-104-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1188-102-0x000000000052C000-0x000000000053C000-memory.dmp

Filesize
64KB

Download
memory/1252-80-0x0000000000000000-mapping.dmp

Download
memory/1252-105-0x0000000000DB0000-0x0000000000E62000-memory.dmp

Filesize
712KB

Download
memory/1504-110-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1504-64-0x0000000000000000-mapping.dmp

Download
memory/1504-108-0x0000000000F40000-0x0000000000F84000-memory.dmp

Filesize
272KB

Download
memory/1596-76-0x0000000000000000-mapping.dmp

Download
memory/1596-106-0x0000000001120000-0x0000000001140000-memory.dmp

Filesize
128KB

Download
memory/1840-68-0x0000000000000000-mapping.dmp

Download
memory/2068-87-0x0000000000000000-mapping.dmp

Download
memory/2096-93-0x0000000000000000-mapping.dmp

Download
memory/2096-144-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/2184-189-0x0000000000000000-mapping.dmp

Download
memory/2268-186-0x0000000000000000-mapping.dmp

Download
memory/2608-185-0x0000000000000000-mapping.dmp

Download
memory/3252-190-0x0000000000000000-mapping.dmp

Download
memory/3316-120-0x0000000000000000-mapping.dmp

Download
memory/3376-121-0x0000000000000000-mapping.dmp

Download
memory/3392-130-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp

Filesize
8KB

Download
memory/3392-122-0x0000000000000000-mapping.dmp

Download
memory/3404-123-0x0000000000000000-mapping.dmp

Download
memory/3512-128-0x0000000000000000-mapping.dmp

Download
memory/3512-163-0x0000000010000000-0x0000000010098000-memory.dmp

Filesize
608KB

Download
memory/3524-164-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/3524-129-0x0000000000000000-mapping.dmp

Download
memory/3908-213-0x0000000073B10000-0x0000000073B36000-memory.dmp

Filesize
152KB

Download
memory/3908-191-0x0000000000000000-mapping.dmp

Download
memory/3908-207-0x0000000067680000-0x000000006777B000-memory.dmp

Filesize
1004KB

Download
memory/3908-208-0x0000000073B10000-0x0000000073B36000-memory.dmp

Filesize
152KB

Download
memory/3908-209-0x0000000000010000-0x0000000000423000-memory.dmp

Filesize
4.1MB

Download
memory/3908-210-0x0000000067680000-0x000000006777B000-memory.dmp

Filesize
1004KB

Download
memory/3908-211-0x00000000671E0000-0x00000000674D5000-memory.dmp

Filesize
3.0MB

Download
memory/3908-212-0x00000000670F0000-0x00000000671D6000-memory.dmp

Filesize
920KB

Download
memory/3908-214-0x0000000000010000-0x0000000000423000-memory.dmp

Filesize
4.1MB

Download
memory/3908-215-0x0000000000010000-0x0000000000423000-memory.dmp

Filesize
4.1MB

Download
memory/3996-194-0x0000000000000000-mapping.dmp

Download
memory/4016-165-0x0000000000000000-mapping.dmp

Download