redline | 9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
27-07-2022 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
Size

1.4MB
MD5

48d01d98ec485e09f5f93be69a3bcdab
SHA1

b9c8c101e77e285d1b93a7675d6a8e2e31c4fac2
SHA256

9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10
SHA512

7fdb4382018d8b12f8b296ffeb13c4fe9d789b5abde04fde87243f0b20d9c82019dd042d38834de2e0f757197c8678a82597b667ca031ac7679213d8814d2185

Score

10^/10

redline vidar 1455 4 @tag12312341 nam3 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

nam3

103.89.90.61:18728

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

31.41.244.134:11643

Attributes

auth_value
a516b2d034ecd34338f12b50347fbd92

Extracted

Family

redline

Botnet

@tag12312341

62.204.41.144:14096

Attributes

auth_value
71466795417275fac01979e57016e277

Extracted

Family

vidar

Version

53.3

Botnet

1455

https://t.me/proabudabi

Attributes

profile_id
1455

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 12 IoCs

Processes:

resource	yara_rule
\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
behavioral1/memory/1468-97-0x0000000000E80000-0x0000000000EC4000-memory.dmp	family_redline
behavioral1/memory/888-98-0x0000000000A20000-0x0000000000A64000-memory.dmp	family_redline
behavioral1/memory/948-96-0x0000000000930000-0x0000000000950000-memory.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Executes dropped EXE 10 IoCs

Processes:

real.exenamdoitntn.exeF0geI.exeromb_ro.exesafert44.exetag.exekukurzka9000.exepigmo.exehAphAsh.exeUSA1.exe

pid	process
1620	real.exe
1468	namdoitntn.exe
684	F0geI.exe
1472	romb_ro.exe
888	safert44.exe
948	tag.exe
1060	kukurzka9000.exe
1604	pigmo.exe
2088	hAphAsh.exe
2112	USA1.exe

Loads dropped DLL 16 IoCs

Processes:

9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe

pid	process
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 10 IoCs

Processes:

9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\romb_ro.exe	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\tag.exe	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\pigmo.exe	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\hAphAsh.exe	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\USA1.exe	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
\Program Files (x86)\Company\NewProduct\pigmo.exe	nsis_installer_1
\Program Files (x86)\Company\NewProduct\pigmo.exe	nsis_installer_2
C:\Program Files (x86)\Company\NewProduct\pigmo.exe	nsis_installer_1
C:\Program Files (x86)\Company\NewProduct\pigmo.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

real.exeromb_ro.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	real.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	romb_ro.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	romb_ro.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	real.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3620 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3576 taskkill.exe

pid	process
3620	timeout.exe

pid	process
3576	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4A6E751-0DCE-11ED-A5C8-6670F74F06AE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e528c10875d4b347a30c038b2e32007f00000000020000000000106600000001000020000000991c08d1be2ce24ef44ddf744bae19bea6a747fb9f051ee1062932ecf9dc9270000000000e800000000200002000000068220bfd971f6025018dc486506c3a1ce7e3d6b3f4b29b77880b7f044802c8952000000031296331c8c1218abdf60956f5121c04faf27f9aa74483cc8b6088baf56eb152400000002b54bfb9f603278901ba3c1c43def5bcef7195df0c48f5b404a6b61f55c5993a49c5e938e9df98ff8d666a6f818f09198108355931a969999bc0eedc23a0417a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "365706704"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4C089D1-0DCE-11ED-A5C8-6670F74F06AE} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103fc7afdba1d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

safert44.exetag.exenamdoitntn.exeromb_ro.exereal.exe

pid process

888 safert44.exe
948 tag.exe
1468 namdoitntn.exe
1472 romb_ro.exe
1620 real.exe

pid	process
888	safert44.exe
948	tag.exe
1468	namdoitntn.exe
1472	romb_ro.exe
1620	real.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

safert44.exetag.exenamdoitntn.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	888	safert44.exe
Token: SeDebugPrivilege	948	tag.exe
Token: SeDebugPrivilege	1468	namdoitntn.exe
Token: SeDebugPrivilege	3576	taskkill.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid	process
1344	iexplore.exe
276	iexplore.exe
1728	iexplore.exe
364	iexplore.exe
2028	iexplore.exe
996	iexplore.exe
2016	iexplore.exe
1984	iexplore.exe
620	iexplore.exe

Suspicious use of SetWindowsHookEx 38 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1984	iexplore.exe
1984	iexplore.exe
276	iexplore.exe
276	iexplore.exe
1344	iexplore.exe
1344	iexplore.exe
996	iexplore.exe
996	iexplore.exe
2028	iexplore.exe
2028	iexplore.exe
1728	iexplore.exe
1728	iexplore.exe
620	iexplore.exe
620	iexplore.exe
364	iexplore.exe
364	iexplore.exe
2016	iexplore.exe
2016	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe

description	pid	process	target process
PID 900 wrote to memory of 1728	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 1728	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 1728	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 1728	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 996	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 996	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 996	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 996	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 1344	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 1344	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 1344	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 1344	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 2016	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 2016	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 2016	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 2016	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 2028	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 2028	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 2028	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 2028	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 1984	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 1984	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 1984	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 1984	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 276	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 276	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 276	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 276	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 620	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 620	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 620	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 620	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 364	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 364	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 364	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 364	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	iexplore.exe
PID 900 wrote to memory of 1620	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	real.exe
PID 900 wrote to memory of 1620	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	real.exe
PID 900 wrote to memory of 1620	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	real.exe
PID 900 wrote to memory of 1620	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	real.exe
PID 900 wrote to memory of 684	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	F0geI.exe
PID 900 wrote to memory of 684	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	F0geI.exe
PID 900 wrote to memory of 684	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	F0geI.exe
PID 900 wrote to memory of 684	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	F0geI.exe
PID 900 wrote to memory of 1468	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	namdoitntn.exe
PID 900 wrote to memory of 1468	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	namdoitntn.exe
PID 900 wrote to memory of 1468	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	namdoitntn.exe
PID 900 wrote to memory of 1468	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	namdoitntn.exe
PID 900 wrote to memory of 1472	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	romb_ro.exe
PID 900 wrote to memory of 1472	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	romb_ro.exe
PID 900 wrote to memory of 1472	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	romb_ro.exe
PID 900 wrote to memory of 1472	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	romb_ro.exe
PID 900 wrote to memory of 888	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	safert44.exe
PID 900 wrote to memory of 888	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	safert44.exe
PID 900 wrote to memory of 888	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	safert44.exe
PID 900 wrote to memory of 888	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	safert44.exe
PID 900 wrote to memory of 948	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	tag.exe
PID 900 wrote to memory of 948	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	tag.exe
PID 900 wrote to memory of 948	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	tag.exe
PID 900 wrote to memory of 948	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	tag.exe
PID 900 wrote to memory of 1060	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	kukurzka9000.exe
PID 900 wrote to memory of 1060	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	kukurzka9000.exe
PID 900 wrote to memory of 1060	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	kukurzka9000.exe
PID 900 wrote to memory of 1060	900	9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe	kukurzka9000.exe

C:\Users\Admin\AppData\Local\Temp\9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe
"C:\Users\Admin\AppData\Local\Temp\9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:900

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1n7LH4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1728

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2300

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1A4aK4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:996

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2284

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RLtX4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1344

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1344 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2264

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RCgX4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2016

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2672

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RCgX4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2028

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2276

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RchC4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1984

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2240

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RyjC4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:276

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:276 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2252

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1nCCJ4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:620

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:620 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2312

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RiLC4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:364

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:364 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2336

C:\Program Files (x86)\Company\NewProduct\real.exe
"C:\Program Files (x86)\Company\NewProduct\real.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1620

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
2⤵
- Executes dropped EXE
PID:684

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468

C:\Program Files (x86)\Company\NewProduct\romb_ro.exe
"C:\Program Files (x86)\Company\NewProduct\romb_ro.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1472

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im romb_ro.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Company\NewProduct\romb_ro.exe" & del C:\ProgramData\*.dll & exit
3⤵
PID:3540

C:\Windows\SysWOW64\taskkill.exe
taskkill /im romb_ro.exe /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:3620

C:\Program Files (x86)\Company\NewProduct\safert44.exe
"C:\Program Files (x86)\Company\NewProduct\safert44.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:888

C:\Program Files (x86)\Company\NewProduct\tag.exe
"C:\Program Files (x86)\Company\NewProduct\tag.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
2⤵
- Executes dropped EXE
PID:1060

C:\Program Files (x86)\Company\NewProduct\pigmo.exe
"C:\Program Files (x86)\Company\NewProduct\pigmo.exe"
2⤵
- Executes dropped EXE
PID:1604

C:\Program Files (x86)\Company\NewProduct\hAphAsh.exe
"C:\Program Files (x86)\Company\NewProduct\hAphAsh.exe"
2⤵
- Executes dropped EXE
PID:2088

C:\Program Files (x86)\Company\NewProduct\USA1.exe
"C:\Program Files (x86)\Company\NewProduct\USA1.exe"
2⤵
- Executes dropped EXE
PID:2112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
290KB

MD5
8ab8fc20b7ab8b18bf0f474cc0156523

SHA1
21b922f6dcd49b67b5b3abc9603ec90835e7a20d

SHA256
b8849a951aadc7c35e1d1b8c57064b49a5eddf54928419b21f18584263162fca

SHA512
ab1ffba707911c50b2ac609c0736560ad2a37dd71f87597af5a87eae3c1811309f3973ecfc0b68cb5d234dd374d771e55637bd84748291758f932dc088def9d2

Download Submit
C:\Program Files (x86)\Company\NewProduct\USA1.exe
Filesize
289KB

MD5
88cd972f3dd0b2e4288276d1be359f23

SHA1
d399895b0193cfb903dd6edc6f15bc8f6afdebec

SHA256
7519f74f46204d75acc6aef962c40885b49d1a4572d4215aec1bce96417c1743

SHA512
3eea0b9d18644740bbf4b541cf051c2bd797ad805118f90ed91fac2e173ed5fc4c5cc26ebd5334d58020e41b6385f693269df8fc637d53e3436b96ec99f3320c

Download Submit
C:\Program Files (x86)\Company\NewProduct\hAphAsh.exe
Filesize
290KB

MD5
3edc9ccbc5593e1b9a28c58e0f62e950

SHA1
169913831e1864ea24800bd74a5175e9caf8cba4

SHA256
8de5ec8cd5e2a45bb17544e9974d87ab140514e3852284d0c07534b7d39d923d

SHA512
8c503af6fd91f6ee3f045c4b5ab2f77d6c492ed563d535af09edc8c80e695fa0c9180ad9e42f149f93f69017115726fbfd0e3b7c2bd2eed93791b8742a7a8ab4

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
1.5MB

MD5
4bb92f1ae6e62f60d99d305929807c49

SHA1
b304564cb3f9a96673d853b5f30c04e7b7898b76

SHA256
61767fbbe32991e95bd9da2309a09795d61e70cfe9bf2762a1d11f58ef524ce2

SHA512
9bb31bf563d7e32885ef41df7652775a4e37b5e4b24e75a862052b5e0a5572f7e90695aa100c93ca485f7fb80214d23f6b5ea2aab33b5877afbaa6bad012d25d

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
245KB

MD5
b16134159e66a72fb36d93bc703b4188

SHA1
e869e91a2b0f77e7ac817e0b30a9a23d537b3001

SHA256
b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c

SHA512
3fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
245KB

MD5
b16134159e66a72fb36d93bc703b4188

SHA1
e869e91a2b0f77e7ac817e0b30a9a23d537b3001

SHA256
b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c

SHA512
3fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c

Download Submit
C:\Program Files (x86)\Company\NewProduct\pigmo.exe
Filesize
59KB

MD5
70730b152cfc9df1fb3884b52d13135f

SHA1
a6b9b07c5897b3d9046d48cfa3e4f5ccbfae5a6b

SHA256
bc575c0ec677d0271d56b6540808bfad5b420222a090837b0519b90c1d8ca6dd

SHA512
78016e57e2eec044fe5fbe07c1d53fd57c31eee0473aa8014c593f344d9059c2948b6a3e41afbadaad2e42006e9a7e0ed6078e0e95823481d0b81b21e7056903

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
289KB

MD5
cf25b95144c2766ff8d6af9439b77596

SHA1
467cfb3e63b9da2b1c03bc712ab08cdb8fa71034

SHA256
df0b62403f7a1e666b759a3c174141defe61e275263637729f56749f524a514c

SHA512
bee60a1439e7ed944aca13424a2b4a835608ba05035e6594e711e036427b4243687eebffa1318c5412408919fd21e23179447bc190d5e9efb222f3a41649975d

Download Submit
C:\Program Files (x86)\Company\NewProduct\romb_ro.exe
Filesize
289KB

MD5
6adc24e326546ccd86472a3d4ccf03db

SHA1
5094a1723aa4cfdc03cedc7ed64236969b82d588

SHA256
c4a34d485a31f3b38a7107f53f37586e0e4845a13f02c579ca3fe695d38447d4

SHA512
aacaecd6d1cbac8ac18bdf8313bb06c124e44c720219a5b1b8d2d0178b9be3222faf2375b4445ed0cc455431642fc94d466fd65cc9460712bb87c922f26896ce

Download Submit
C:\Program Files (x86)\Company\NewProduct\romb_ro.exe
Filesize
289KB

MD5
6adc24e326546ccd86472a3d4ccf03db

SHA1
5094a1723aa4cfdc03cedc7ed64236969b82d588

SHA256
c4a34d485a31f3b38a7107f53f37586e0e4845a13f02c579ca3fe695d38447d4

SHA512
aacaecd6d1cbac8ac18bdf8313bb06c124e44c720219a5b1b8d2d0178b9be3222faf2375b4445ed0cc455431642fc94d466fd65cc9460712bb87c922f26896ce

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
244KB

MD5
dbe947674ea388b565ae135a09cc6638

SHA1
ae8e1c69bd1035a92b7e06baad5e387de3a70572

SHA256
86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

SHA512
67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
244KB

MD5
dbe947674ea388b565ae135a09cc6638

SHA1
ae8e1c69bd1035a92b7e06baad5e387de3a70572

SHA256
86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

SHA512
67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C4A846E1-0DCE-11ED-A5C8-6670F74F06AE}.dat
Filesize
5KB

MD5
0edd617dd91b2a92bf7b19d55b680c51

SHA1
66322e55c705e036b5f233e45854f18855d727ec

SHA256
7ac8d45d96957ac519f6acbbf2ac6770462055a778dbdf32bdb7c4b2f3d4098f

SHA512
126e99a4b35da06540f761c9f0beb4188bff020a876f22ccefbb8952de3a7d0ab0c28dbdea50a3a410130ffc123d969a8c795fa1b1a4e77f3da411802ccd7dc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C4AB2D11-0DCE-11ED-A5C8-6670F74F06AE}.dat
Filesize
5KB

MD5
f9cc12e4dc648c59d05aa4d07f537c96

SHA1
c5589eba53480804ac2f30586e52ffd95ad20d83

SHA256
f65bf47e7eb9c05a2e42781f776da205c347ca7a917e35e9c20166a9d1a1cc22

SHA512
9f3d9c32e9e3596129c92ec62c4fc6b775c3204640b91c28dba56a03d5ee47beaeb83fd3aac425bcc6427bd0346c78002359ab0c6cfe262b487d79c25d3f5d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C4AC8CA1-0DCE-11ED-A5C8-6670F74F06AE}.dat
Filesize
4KB

MD5
4abd0b02d9f4e7b3a1c34bc9f2757b8c

SHA1
5d3148adcf245a0e9725b5c103c03811eb7198a0

SHA256
c75ce48b71850b4e6f967b085c830bef22e8a8d6d1447bb27e8463f0f488c854

SHA512
99df9d9d37b1ff1076a2ec6803a3ed014560edbd515ec26bd085675178f9465f29c68a59ad9fbc56d4d4d9466a9f8d3655039beb34b630161fa315310f34c93d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C4AC8CA1-0DCE-11ED-A5C8-6670F74F06AE}.dat
Filesize
3KB

MD5
25b36baa7fbafa442f9eef99c48cf6a7

SHA1
f9fd5fa233096aa02a3de4b8063b0f0a6b8e7105

SHA256
8690270398517c14f7e3c67af73409a37004e4288a8a9647741a864e46104b7a

SHA512
954d34ad54bcbde8d9fb0845fe93042292f641ec5e783c1751d212d38a50e8fed85dd2005ffb1e128085bf95cd2f4a45c7fe00579f16a161cc29f85a5e98c927

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C4B14791-0DCE-11ED-A5C8-6670F74F06AE}.dat
Filesize
3KB

MD5
c68e50d1553a1ac5b64a8b3dda0ff7a1

SHA1
04cc8c7cec2d7058f7a9457ffb4cec9235a14018

SHA256
10875ad2088288294a569ee6f12c634e7a9a9da24bc629d6169c2aae71231808

SHA512
fdf540b3da401c62e7ce598c1c8b719409f8347ef4f026ad11675ef4a12b4faf1bb8fee64de702181cbc62e6164cfc93e8a78d4fcfdd349e2582b90ab17f8b60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C4B2F541-0DCE-11ED-A5C8-6670F74F06AE}.dat
Filesize
3KB

MD5
30faeb1282636adfcf9d15361f570ac4

SHA1
a1cfe2ac8a123102e8a611594b68453a492b8119

SHA256
d5f858a7a1bb4d64e829244de355f27617c270961460822b0ca08824890f68c1

SHA512
e4fc053693b9ae0b7b06a549eb966bf4f6a6c99dd4f3d64c55478ef661c26f062709d4b60b583ff081c4c35bf232df0084461223ae517f3ffc98b7810020ba02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C4C089D1-0DCE-11ED-A5C8-6670F74F06AE}.dat
Filesize
3KB

MD5
5addd85a3ad0142b31c90ab3d2396137

SHA1
0e8a197bb4700be5aafc403fc9366706be3e8010

SHA256
f3ee16483c90e260c9578ed556b4a04fc0354918e067c2632cd7854882e9d42f

SHA512
1fbd198b6d20bf1c373d62a8a5decc94dd0624d4aeb5b0c5d5e4c8f6daaacbb5399c57abfce3aa0e2bc3f2b413f5fe175bdf701c4bc490d080c607a5450ff7ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CJIF2UCZ.txt
Filesize
606B

MD5
26b0ab8a38afe3c70c37e3499af20ec4

SHA1
d76314694afb9c10b43d99ef7ef2f27a2b82cb94

SHA256
68e9cd5206287d46482d69420d359fbf459afe0a8694773001ed2a663d69ec53

SHA512
0dd4886eb8feb45b8b38c171f2a253934e6b1878f06fbde8601b886e3d5a8020e95691b5904f9e14aa40996d722707cf088604fd6f9f515ff53ae6dda9a861ee

Download Submit
\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
290KB

MD5
8ab8fc20b7ab8b18bf0f474cc0156523

SHA1
21b922f6dcd49b67b5b3abc9603ec90835e7a20d

SHA256
b8849a951aadc7c35e1d1b8c57064b49a5eddf54928419b21f18584263162fca

SHA512
ab1ffba707911c50b2ac609c0736560ad2a37dd71f87597af5a87eae3c1811309f3973ecfc0b68cb5d234dd374d771e55637bd84748291758f932dc088def9d2

Download Submit
\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
290KB

MD5
8ab8fc20b7ab8b18bf0f474cc0156523

SHA1
21b922f6dcd49b67b5b3abc9603ec90835e7a20d

SHA256
b8849a951aadc7c35e1d1b8c57064b49a5eddf54928419b21f18584263162fca

SHA512
ab1ffba707911c50b2ac609c0736560ad2a37dd71f87597af5a87eae3c1811309f3973ecfc0b68cb5d234dd374d771e55637bd84748291758f932dc088def9d2

Download Submit
\Program Files (x86)\Company\NewProduct\USA1.exe
Filesize
289KB

MD5
88cd972f3dd0b2e4288276d1be359f23

SHA1
d399895b0193cfb903dd6edc6f15bc8f6afdebec

SHA256
7519f74f46204d75acc6aef962c40885b49d1a4572d4215aec1bce96417c1743

SHA512
3eea0b9d18644740bbf4b541cf051c2bd797ad805118f90ed91fac2e173ed5fc4c5cc26ebd5334d58020e41b6385f693269df8fc637d53e3436b96ec99f3320c

Download Submit
\Program Files (x86)\Company\NewProduct\USA1.exe
Filesize
289KB

MD5
88cd972f3dd0b2e4288276d1be359f23

SHA1
d399895b0193cfb903dd6edc6f15bc8f6afdebec

SHA256
7519f74f46204d75acc6aef962c40885b49d1a4572d4215aec1bce96417c1743

SHA512
3eea0b9d18644740bbf4b541cf051c2bd797ad805118f90ed91fac2e173ed5fc4c5cc26ebd5334d58020e41b6385f693269df8fc637d53e3436b96ec99f3320c

Download Submit
\Program Files (x86)\Company\NewProduct\hAphAsh.exe
Filesize
290KB

MD5
3edc9ccbc5593e1b9a28c58e0f62e950

SHA1
169913831e1864ea24800bd74a5175e9caf8cba4

SHA256
8de5ec8cd5e2a45bb17544e9974d87ab140514e3852284d0c07534b7d39d923d

SHA512
8c503af6fd91f6ee3f045c4b5ab2f77d6c492ed563d535af09edc8c80e695fa0c9180ad9e42f149f93f69017115726fbfd0e3b7c2bd2eed93791b8742a7a8ab4

Download Submit
\Program Files (x86)\Company\NewProduct\hAphAsh.exe
Filesize
290KB

MD5
3edc9ccbc5593e1b9a28c58e0f62e950

SHA1
169913831e1864ea24800bd74a5175e9caf8cba4

SHA256
8de5ec8cd5e2a45bb17544e9974d87ab140514e3852284d0c07534b7d39d923d

SHA512
8c503af6fd91f6ee3f045c4b5ab2f77d6c492ed563d535af09edc8c80e695fa0c9180ad9e42f149f93f69017115726fbfd0e3b7c2bd2eed93791b8742a7a8ab4

Download Submit
\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
1.5MB

MD5
4bb92f1ae6e62f60d99d305929807c49

SHA1
b304564cb3f9a96673d853b5f30c04e7b7898b76

SHA256
61767fbbe32991e95bd9da2309a09795d61e70cfe9bf2762a1d11f58ef524ce2

SHA512
9bb31bf563d7e32885ef41df7652775a4e37b5e4b24e75a862052b5e0a5572f7e90695aa100c93ca485f7fb80214d23f6b5ea2aab33b5877afbaa6bad012d25d

Download Submit
\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
1.5MB

MD5
4bb92f1ae6e62f60d99d305929807c49

SHA1
b304564cb3f9a96673d853b5f30c04e7b7898b76

SHA256
61767fbbe32991e95bd9da2309a09795d61e70cfe9bf2762a1d11f58ef524ce2

SHA512
9bb31bf563d7e32885ef41df7652775a4e37b5e4b24e75a862052b5e0a5572f7e90695aa100c93ca485f7fb80214d23f6b5ea2aab33b5877afbaa6bad012d25d

Download Submit
\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
245KB

MD5
b16134159e66a72fb36d93bc703b4188

SHA1
e869e91a2b0f77e7ac817e0b30a9a23d537b3001

SHA256
b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c

SHA512
3fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c

Download Submit
\Program Files (x86)\Company\NewProduct\pigmo.exe
Filesize
59KB

MD5
70730b152cfc9df1fb3884b52d13135f

SHA1
a6b9b07c5897b3d9046d48cfa3e4f5ccbfae5a6b

SHA256
bc575c0ec677d0271d56b6540808bfad5b420222a090837b0519b90c1d8ca6dd

SHA512
78016e57e2eec044fe5fbe07c1d53fd57c31eee0473aa8014c593f344d9059c2948b6a3e41afbadaad2e42006e9a7e0ed6078e0e95823481d0b81b21e7056903

Download Submit
\Program Files (x86)\Company\NewProduct\real.exe
Filesize
289KB

MD5
cf25b95144c2766ff8d6af9439b77596

SHA1
467cfb3e63b9da2b1c03bc712ab08cdb8fa71034

SHA256
df0b62403f7a1e666b759a3c174141defe61e275263637729f56749f524a514c

SHA512
bee60a1439e7ed944aca13424a2b4a835608ba05035e6594e711e036427b4243687eebffa1318c5412408919fd21e23179447bc190d5e9efb222f3a41649975d

Download Submit
\Program Files (x86)\Company\NewProduct\real.exe
Filesize
289KB

MD5
cf25b95144c2766ff8d6af9439b77596

SHA1
467cfb3e63b9da2b1c03bc712ab08cdb8fa71034

SHA256
df0b62403f7a1e666b759a3c174141defe61e275263637729f56749f524a514c

SHA512
bee60a1439e7ed944aca13424a2b4a835608ba05035e6594e711e036427b4243687eebffa1318c5412408919fd21e23179447bc190d5e9efb222f3a41649975d

Download Submit
\Program Files (x86)\Company\NewProduct\romb_ro.exe
Filesize
289KB

MD5
6adc24e326546ccd86472a3d4ccf03db

SHA1
5094a1723aa4cfdc03cedc7ed64236969b82d588

SHA256
c4a34d485a31f3b38a7107f53f37586e0e4845a13f02c579ca3fe695d38447d4

SHA512
aacaecd6d1cbac8ac18bdf8313bb06c124e44c720219a5b1b8d2d0178b9be3222faf2375b4445ed0cc455431642fc94d466fd65cc9460712bb87c922f26896ce

Download Submit
\Program Files (x86)\Company\NewProduct\romb_ro.exe
Filesize
289KB

MD5
6adc24e326546ccd86472a3d4ccf03db

SHA1
5094a1723aa4cfdc03cedc7ed64236969b82d588

SHA256
c4a34d485a31f3b38a7107f53f37586e0e4845a13f02c579ca3fe695d38447d4

SHA512
aacaecd6d1cbac8ac18bdf8313bb06c124e44c720219a5b1b8d2d0178b9be3222faf2375b4445ed0cc455431642fc94d466fd65cc9460712bb87c922f26896ce

Download Submit
\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
244KB

MD5
dbe947674ea388b565ae135a09cc6638

SHA1
ae8e1c69bd1035a92b7e06baad5e387de3a70572

SHA256
86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

SHA512
67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

Download Submit
\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
memory/684-104-0x000000000050C000-0x000000000051C000-memory.dmp

Filesize
64KB

Download
memory/684-61-0x0000000000000000-mapping.dmp

Download
memory/684-110-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/684-106-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/684-105-0x0000000000220000-0x000000000022E000-memory.dmp

Filesize
56KB

Download
memory/888-72-0x0000000000000000-mapping.dmp

Download
memory/888-98-0x0000000000A20000-0x0000000000A64000-memory.dmp

Filesize
272KB

Download
memory/888-99-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/900-54-0x00000000754C1000-0x00000000754C3000-memory.dmp

Filesize
8KB

Download
memory/948-96-0x0000000000930000-0x0000000000950000-memory.dmp

Filesize
128KB

Download
memory/948-75-0x0000000000000000-mapping.dmp

Download
memory/1060-102-0x0000000000740000-0x0000000000755000-memory.dmp

Filesize
84KB

Download
memory/1060-103-0x0000000000400000-0x000000000058B000-memory.dmp

Filesize
1.5MB

Download
memory/1060-81-0x0000000000000000-mapping.dmp

Download
memory/1468-100-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/1468-97-0x0000000000E80000-0x0000000000EC4000-memory.dmp

Filesize
272KB

Download
memory/1468-63-0x0000000000000000-mapping.dmp

Download
memory/1472-69-0x0000000000000000-mapping.dmp

Download
memory/1472-122-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/1604-83-0x0000000000000000-mapping.dmp

Download
memory/1620-57-0x0000000000000000-mapping.dmp

Download
memory/2088-90-0x0000000000000000-mapping.dmp

Download
memory/2112-94-0x0000000000000000-mapping.dmp

Download
memory/3540-141-0x0000000000000000-mapping.dmp

Download
memory/3576-142-0x0000000000000000-mapping.dmp

Download
memory/3620-143-0x0000000000000000-mapping.dmp

Download