General Info

File name

Hagopa.exe

Full analysis
https://app.any.run/tasks/f47e0bc1-bfad-4b72-9942-b03eebc0917d
Verdict
Malicious activity
Analysis date
8/13/2019, 20:54:59
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:

installer

trojan

adware

installcore

pup

addrop

Indicators:

MIME:
application/x-dosexec
File info:
PE32 executable (GUI) Intel 80386, for MS Windows
MD5

2ffd8387b6c7999c38642455af7704a1

SHA1

2ef343839886adb9eb52154f0cca41efeb89f9b2

SHA256

dff0d0e5839033bc5e44531a215d83f1289688e900408bbee02a474c3e285d65

SSDEEP

24576:uFcWN4jFlnDPNnPMVT7axEGsHn2xcHQj3qXg40JbosygRs7l:uCWNIFFPia2ZWWHM3SgNJEi4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
60 seconds
Additional time used
none
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (75.0.3770.100)
  • Google Update Helper (1.3.34.7)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.7.2 (4.7.03062)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
  • Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
  • Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
  • Mozilla Firefox 68.0.1 (x86 en-US) (68.0.1)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB4019990
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
INSTALLCORE was detected
  • Hagopa.exe (PID: 3108)
Connects to CnC server
  • Hagopa.exe (PID: 3108)
 Reads Windows Product ID
  • Hagopa.exe (PID: 3108)
Reads Environment values
  • Hagopa.exe (PID: 3108)
Reads the machine GUID from the registry
  • Hagopa.exe (PID: 3108)
Application launched itself
  • Hagopa.exe (PID: 2596)
  • Hagopa.exe (PID: 3108)
Reads CPU info
  • Hagopa.exe (PID: 3108)
Reads internet explorer settings
  • Hagopa.exe (PID: 3108)
Creates files in the program directory
  • Hagopa.exe (PID: 3108)

No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.exe
|   Inno Setup installer (81.5%)
.exe
|   Win32 Executable Delphi generic (10.5%)
.exe
|   Win32 Executable (generic) (3.3%)
.exe
|   Win16/32 Executable Delphi generic (1.5%)
.exe
|   Generic Win/DOS Executable (1.4%)
EXIF
EXE
MachineType:
Intel 386 or later, and compatibles
TimeStamp:
1992:06:20 00:22:17+02:00
PEType:
PE32
LinkerVersion:
2.25
CodeSize:
37888
InitializedDataSize:
42496
UninitializedDataSize:
null
EntryPoint:
0x9c40
OSVersion:
1
ImageVersion:
6
SubsystemVersion:
4
Subsystem:
Windows GUI
FileVersionNumber:
0.0.0.0
ProductVersionNumber:
0.0.0.0
FileFlagsMask:
0x003f
FileFlags:
(none)
FileOS:
Win32
ObjectFileType:
Executable application
FileSubtype:
null
LanguageCode:
Neutral
CharacterSet:
Unicode
Comments:
This installation was built with Inno Setup.
CompanyName:
FileDescription:
Hagopa Setup
FileVersion:
1.4.1.7
LegalCopyright:
ProductName:
Hagopa
ProductVersion:
3.4
Summary
Architecture:
IMAGE_FILE_MACHINE_I386
Subsystem:
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:
19-Jun-1992 22:22:17
Detected languages
English - United States
Comments:
This installation was built with Inno Setup.
CompanyName:
null
FileDescription:
Hagopa Setup
FileVersion:
1.4.1.7
LegalCopyright:
null
ProductName:
Hagopa
ProductVersion:
3.4
DOS Header
Magic number:
MZ
Bytes on last page of file:
0x0050
Pages in file:
0x0002
Relocations:
0x0000
Size of header:
0x0004
Min extra paragraphs:
0x000F
Max extra paragraphs:
0xFFFF
Initial SS value:
0x0000
Initial SP value:
0x00B8
Checksum:
0x0000
Initial IP value:
0x0000
Initial CS value:
0x0000
Overlay number:
0x001A
OEM identifier:
0x0000
OEM information:
0x0000
Address of NE header:
0x00000100
PE Headers
Signature:
PE
Machine:
IMAGE_FILE_MACHINE_I386
Number of sections:
8
Time date stamp:
19-Jun-1992 22:22:17
Pointer to Symbol Table:
0x00000000
Number of symbols:
0
Size of Optional Header:
0x00E0
Characteristics
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
Sections
Name Virtual Address Virtual Size Raw Size Charateristics Entropy
CODE 0x00001000 0x00009364 0x00009400 IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ 6.58387
DATA 0x0000B000 0x0000024C 0x00000400 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 2.7391
BSS 0x0000C000 0x00000E88 0x00000000 IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 0
.idata 0x0000D000 0x00000950 0x00000A00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 4.43073
.tls 0x0000E000 0x00000008 0x00000000 IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 0
.rdata 0x0000F000 0x00000018 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_SHARED 0.204488
.reloc 0x00010000 0x000008B4 0x00000000 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_SHARED 0
.rsrc 0x00011000 0x00009554 0x00009600 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_SHARED 5.65219
Resources
1

2

3

4

4089

4090

4091

4093

4094

4095

11111

MAINICON

Imports
    kernel32.dll

    user32.dll

    oleaut32.dll

    advapi32.dll

    comctl32.dll

Exports

    No exports.

Screenshots

Screenshot of dff0d0e5839033bc5e44531a215d83f1289688e900408bbee02a474c3e285d65 taken from 18002 ms from task started Screenshot of dff0d0e5839033bc5e44531a215d83f1289688e900408bbee02a474c3e285d65 taken from 22037 ms from task started Screenshot of dff0d0e5839033bc5e44531a215d83f1289688e900408bbee02a474c3e285d65 taken from 31135 ms from task started Screenshot of dff0d0e5839033bc5e44531a215d83f1289688e900408bbee02a474c3e285d65 taken from 57331 ms from task started Screenshot of dff0d0e5839033bc5e44531a215d83f1289688e900408bbee02a474c3e285d65 taken from 66363 ms from task started Screenshot of dff0d0e5839033bc5e44531a215d83f1289688e900408bbee02a474c3e285d65 taken from 72476 ms from task started

Processes

Total processes
39
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

–
+
start hagopa.exe no specs #INSTALLCORE hagopa.exe hagopa.exe no specs
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
2596
CMD
"C:\Users\admin\AppData\Local\Temp\Hagopa.exe"
Path
C:\Users\admin\AppData\Local\Temp\Hagopa.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Hagopa Setup
Version
1.4.1.7
Modules
Image
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\version.dll
c:\windows\system32\olepro32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\devobj.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\propsys.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\wininet.dll
c:\windows\system32\mpr.dll
c:\windows\system32\msctf.dll
c:\windows\system32\imm32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\users\admin\appdata\local\temp\hagopa.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll

PID
3108
CMD
"C:\Users\admin\AppData\Local\Temp\Hagopa.exe" /RSF /ppn:YyhwYgxaFRAiP211FM5W /mnl
Path
C:\Users\admin\AppData\Local\Temp\Hagopa.exe
Indicators
Parent process
Hagopa.exe
User
admin
Integrity Level
HIGH
Version:
Company
Description
Hagopa Setup
Version
1.4.1.7
Modules
Image
c:\users\admin\appdata\local\temp\hagopa.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\advapi32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\version.dll
c:\windows\system32\olepro32.dll
c:\windows\system32\cryptbase.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\sxs.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\winsta.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\rasman.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\propsys.dll
c:\windows\system32\mlang.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\jscript.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\imgutil.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\pngfilt.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shell32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\msls31.dll
c:\windows\system32\msimtf.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\dui70.dll
c:\windows\system32\duser.dll

PID
3240
CMD
"C:\Users\admin\AppData\Local\Temp\Hagopa.exe" /_ShowProgress /PrTxt:TG9hZGluZy4uLg==
Path
C:\Users\admin\AppData\Local\Temp\Hagopa.exe
Indicators
No indicators
Parent process
Hagopa.exe
User
admin
Integrity Level
HIGH
Exit code
259
Version:
Company
Description
Hagopa Setup
Version
1.4.1.7
Modules
Image
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\users\admin\appdata\local\temp\hagopa.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
c:\windows\system32\oleaut32.dll

Registry activity

Total events
487
Read events
465
Write events
22
Delete events
0

Modification events

PID
Process
Operation
Key
Name
Value
2596
Hagopa.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2596
Hagopa.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3108
Hagopa.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hagopa_RASAPI32
EnableFileTracing
0
3108
Hagopa.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hagopa_RASAPI32
ConsoleTracingMask
4294901760
3108
Hagopa.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hagopa_RASMANCS
EnableFileTracing
0
3108
Hagopa.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hagopa_RASMANCS
FileTracingMask
4294901760
3108
Hagopa.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hagopa_RASMANCS
MaxFileSize
1048576
3108
Hagopa.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3108
Hagopa.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hagopa_RASAPI32
FileTracingMask
4294901760
3108
Hagopa.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hagopa_RASAPI32
FileDirectory
%windir%\tracing
3108
Hagopa.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hagopa_RASMANCS
ConsoleTracingMask
4294901760
3108
Hagopa.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hagopa_RASMANCS
FileDirectory
%windir%\tracing
3108
Hagopa.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
3108
Hagopa.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3108
Hagopa.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hagopa_RASAPI32
EnableConsoleTracing
0
3108
Hagopa.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hagopa_RASAPI32
MaxFileSize
1048576
3108
Hagopa.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hagopa_RASMANCS
EnableConsoleTracing
0
3108
Hagopa.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0

Files activity

Executable files
0
Suspicious files
2
Text files
49
Unknown types
0

Dropped files

PID
Process
Filename
Type
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\bootstrap_26106.html
html
MD5: 1ea9e5b417811379e874ad4870d5c51a
SHA256: f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\0036D53B.log
––
MD5:  ––
SHA256:  ––
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\0036D5C7.log
––
MD5:  ––
SHA256:  ––
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\images\Loader.gif
image
MD5: afc685139a108e33bd945d5a3ff64122
SHA256: 4d70f45a9c69d8ce2e630214c1b2871454d631ccf9d88976470170d0e106acbc
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\images\Progress.png
image
MD5: 5995603e376b72b3f2f02d400b44584a
SHA256: 392d2b22da905e8f2092d96116b6aa3326dbede98fc6f0c45e5b9146f9fc2f48
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\images\Quick_Specs.png
image
MD5: 07cd59b954e8495ad6cd6a7c11d2de86
SHA256: 6e6b964fd79b4a3461f128e2ed145b9b641d108b8616695f36387661cae995bb
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\locale\EN.locale
html
MD5: 573ac95a983db1ff1ee73184ce60c3ab
SHA256: b6dcb441ee62309e9fc75e44a24f246dc154254bef17cf88b2d3c7a7933e37c8
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\images\sponsored.png
image
MD5: e3758d529f93fee4807f5ea95fbc1a6c
SHA256: 8d46eb0c60043dcb7d79ab3d0525148fc901764620c02e4b9c5dd8b0e9026303
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\images\ProgressBar.png
image
MD5: 41e2db8679de78b2a15a5ada20c0228f
SHA256: cbd36783ed6c4a4bae2414f76102032fcd0905b911c5596014ed0d14c5685b7a
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\images\Color_Button.png
image
MD5: 7a33a579e822edcff0bc4f97b4a28256
SHA256: 76880881ea91146ce14b0a37c33874b46717c0039b6285fbd7b7c0c11bc0ecea
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\images\Grey_Button.png
image
MD5: 8adcc5fc7fa8b96ad1d47e096eb30097
SHA256: 0e07a293681ec629b694d089c24d3187fc9b272f65b939bbd8cae7e65fa17707
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\images\Close.png
image
MD5: 4dd03ce66c803356d63f2659876d7c35
SHA256: 0137cfc6c187c9f0382ff3d52e5d062fa06e494a33e7502082bae674e61f4b2d
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\images\Grey_Button_Hover.png
image
MD5: 8ecb67ffd24d70576de3b55f0e44f304
SHA256: 1d68cd02db994f783e45aede86ee36be50b3d17eef4e6f8f7c734feb9a35f7b1
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\images\BG.png
image
MD5: a34a4eb05b009f3ecfa7d19d55e45a68
SHA256: 6b461f6d8c3473003c85383203da48fce6ee6d4eff643a62405a84f75cd97396
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\images\Close_Hover.png
image
MD5: 7b2a8ba78bbea8ce7decb3dcbda4850c
SHA256: e3c84dfd41c2898ac60f87bdb8b5771105fc0b9d625aea960b4bce48674b8e64
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\images\Color_Button_Hover.png
image
MD5: bcaa0de85d3445ddec6ee8448256408d
SHA256: f74bff653a4f290c98e5846ead475a803169f7b3db68ff0e6d1913fbb901f86d
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\form.bmp.Mask
binary
MD5: d2fc989f9c2043cd32332ec0fad69c70
SHA256: 27dd029405cbfb0c3bf8bac517be5db9aa83e981b1dc2bd5c5d6c549fa514101
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\css\sdk-ui\images\progress-bg-corner.png
image
MD5: 608f1f20cd6ca9936eaa7e8c14f366be
SHA256: 86b6e6826bcde2955d64d4600a4e01693522c1fddf156ce31c4ba45b3653a7bd
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\css\sdk-ui\images\progress-bg.png
image
MD5: e9f12f92a9eeb8ebe911080721446687
SHA256: c1cf449536bc2778e27348e45f0f53d04c284109199fb7a9af7a61016b91f8bc
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\csshover3.htc
html
MD5: 52fa0da50bf4b27ee625c80d36c67941
SHA256: e37e99ddfc73ac7ba774e23736b2ef429d9a0cb8c906453c75b14c029bdd5493
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\css\sdk-ui\progress-bar.css
text
MD5: 5335f1c12201b5f7cf5f8b4f5692e3d1
SHA256: 974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\css\sdk-ui\images\progress-bg2.png
image
MD5: b582d9a67bfe77d523ba825fd0b9dae3
SHA256: ab4eeb3ea1eef4e84cb61eccb0ba0998b32108d70b3902df3619f4d9393f74c3
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\css\sdk-ui\button.css
text
MD5: 37e1ff96e084ec201f0d95feef4d5e94
SHA256: 8e806f5b94fc294e918503c8053ef1284e4f4b1e02c7da4f4635e33ec33e0534
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\css\sdk-ui\images\button-bg.png
image
MD5: 98b1de48dfa64dc2aa1e52facfbee3b0
SHA256: 2693930c474fe640e2fe8d6ef98abe2ecd303d2392c3d8b2e006e8942ba8f534
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\css\sdk-ui\checkbox.css
text
MD5: 64773c6b0e3413c81aebc46cce8c9318
SHA256: b09504c1bf0486d3ec46500592b178a3a6c39284672af8815c3687cc3d29560d
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\css\sdk-ui\browse.css
text
MD5: 6009d6e864f60aea980a9df94c1f7e1c
SHA256: 5ef48a8c8c3771b4f233314d50dd3b5afdcd99dd4b74a9745c8fe7b22207056d
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\css\ie6_main.css
text
MD5: ac0dd292dc6f9850414806089ef4a2af
SHA256: 6588cee3a697df8cb575cd97a7a4a6d57c30cb8f0a9a428a4d1e09cecc55933c
3108
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359353147330\css\main.css
text
MD5: d0604060b5d7f63c6175cbbdb1eb27ae
SHA256: f64dc2830e4b7e108a0acf55c592789a4f5d497f239db4d7f9e75faf2c7f824a
3108
Hagopa.exe
C:\Program Files\0036D77D.log
––
MD5:  ––
SHA256:  ––
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\0036D385.log
––
MD5:  ––
SHA256:  ––
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\images\sponsored.png
image
MD5: e3758d529f93fee4807f5ea95fbc1a6c
SHA256: 8d46eb0c60043dcb7d79ab3d0525148fc901764620c02e4b9c5dd8b0e9026303
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\locale\EN.locale
html
MD5: 573ac95a983db1ff1ee73184ce60c3ab
SHA256: b6dcb441ee62309e9fc75e44a24f246dc154254bef17cf88b2d3c7a7933e37c8
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\images\Quick_Specs.png
image
MD5: 07cd59b954e8495ad6cd6a7c11d2de86
SHA256: 6e6b964fd79b4a3461f128e2ed145b9b641d108b8616695f36387661cae995bb
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\images\Color_Button_Hover.png
image
MD5: bcaa0de85d3445ddec6ee8448256408d
SHA256: f74bff653a4f290c98e5846ead475a803169f7b3db68ff0e6d1913fbb901f86d
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\images\Color_Button.png
image
MD5: 7a33a579e822edcff0bc4f97b4a28256
SHA256: 76880881ea91146ce14b0a37c33874b46717c0039b6285fbd7b7c0c11bc0ecea
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\images\Loader.gif
image
MD5: afc685139a108e33bd945d5a3ff64122
SHA256: 4d70f45a9c69d8ce2e630214c1b2871454d631ccf9d88976470170d0e106acbc
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\images\ProgressBar.png
image
MD5: 41e2db8679de78b2a15a5ada20c0228f
SHA256: cbd36783ed6c4a4bae2414f76102032fcd0905b911c5596014ed0d14c5685b7a
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\images\Progress.png
image
MD5: 5995603e376b72b3f2f02d400b44584a
SHA256: 392d2b22da905e8f2092d96116b6aa3326dbede98fc6f0c45e5b9146f9fc2f48
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\images\Grey_Button.png
image
MD5: 8adcc5fc7fa8b96ad1d47e096eb30097
SHA256: 0e07a293681ec629b694d089c24d3187fc9b272f65b939bbd8cae7e65fa17707
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\images\Grey_Button_Hover.png
image
MD5: 8ecb67ffd24d70576de3b55f0e44f304
SHA256: 1d68cd02db994f783e45aede86ee36be50b3d17eef4e6f8f7c734feb9a35f7b1
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\css\sdk-ui\images\progress-bg.png
image
MD5: e9f12f92a9eeb8ebe911080721446687
SHA256: c1cf449536bc2778e27348e45f0f53d04c284109199fb7a9af7a61016b91f8bc
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\images\Close_Hover.png
image
MD5: 7b2a8ba78bbea8ce7decb3dcbda4850c
SHA256: e3c84dfd41c2898ac60f87bdb8b5771105fc0b9d625aea960b4bce48674b8e64
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\images\BG.png
image
MD5: a34a4eb05b009f3ecfa7d19d55e45a68
SHA256: 6b461f6d8c3473003c85383203da48fce6ee6d4eff643a62405a84f75cd97396
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\csshover3.htc
html
MD5: 52fa0da50bf4b27ee625c80d36c67941
SHA256: e37e99ddfc73ac7ba774e23736b2ef429d9a0cb8c906453c75b14c029bdd5493
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\css\sdk-ui\progress-bar.css
text
MD5: 5335f1c12201b5f7cf5f8b4f5692e3d1
SHA256: 974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\form.bmp.Mask
binary
MD5: d2fc989f9c2043cd32332ec0fad69c70
SHA256: 27dd029405cbfb0c3bf8bac517be5db9aa83e981b1dc2bd5c5d6c549fa514101
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\css\sdk-ui\images\progress-bg2.png
image
MD5: b582d9a67bfe77d523ba825fd0b9dae3
SHA256: ab4eeb3ea1eef4e84cb61eccb0ba0998b32108d70b3902df3619f4d9393f74c3
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\images\Close.png
image
MD5: 4dd03ce66c803356d63f2659876d7c35
SHA256: 0137cfc6c187c9f0382ff3d52e5d062fa06e494a33e7502082bae674e61f4b2d
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\css\sdk-ui\browse.css
text
MD5: 6009d6e864f60aea980a9df94c1f7e1c
SHA256: 5ef48a8c8c3771b4f233314d50dd3b5afdcd99dd4b74a9745c8fe7b22207056d
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\css\sdk-ui\button.css
text
MD5: 37e1ff96e084ec201f0d95feef4d5e94
SHA256: 8e806f5b94fc294e918503c8053ef1284e4f4b1e02c7da4f4635e33ec33e0534
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\css\sdk-ui\images\progress-bg-corner.png
image
MD5: 608f1f20cd6ca9936eaa7e8c14f366be
SHA256: 86b6e6826bcde2955d64d4600a4e01693522c1fddf156ce31c4ba45b3653a7bd
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\css\sdk-ui\images\button-bg.png
image
MD5: 98b1de48dfa64dc2aa1e52facfbee3b0
SHA256: 2693930c474fe640e2fe8d6ef98abe2ecd303d2392c3d8b2e006e8942ba8f534
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\css\sdk-ui\checkbox.css
text
MD5: 64773c6b0e3413c81aebc46cce8c9318
SHA256: b09504c1bf0486d3ec46500592b178a3a6c39284672af8815c3687cc3d29560d
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\css\ie6_main.css
text
MD5: ac0dd292dc6f9850414806089ef4a2af
SHA256: 6588cee3a697df8cb575cd97a7a4a6d57c30cb8f0a9a428a4d1e09cecc55933c
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\inH359223416255\css\main.css
text
MD5: d0604060b5d7f63c6175cbbdb1eb27ae
SHA256: f64dc2830e4b7e108a0acf55c592789a4f5d497f239db4d7f9e75faf2c7f824a
2596
Hagopa.exe
C:\Users\admin\AppData\Local\Temp\0036D02A.log
––
MD5:  ––
SHA256:  ––

Find more information of the staic content and download it at the full report

Network activity

HTTP(S) requests
8
TCP/UDP connections
5
DNS requests
9
Threats
8

HTTP requests

PID Process Method HTTP Code IP URL CN Type Size Reputation
3108 Hagopa.exe POST 200 52.214.73.247:80 http://rp.dipapina.com/ IE
binary
––
––
malicious
3108 Hagopa.exe POST 200 54.246.196.116:80 http://info.dipapina.com/?ttixevosh=0 IE
binary
text
malicious
3108 Hagopa.exe POST 404 52.50.98.206:80 http://os.dipapina.com/iPadian/ IE
binary
––
––
malicious
3108 Hagopa.exe POST 200 52.214.73.247:80 http://rp.dipapina.com/ IE
binary
––
––
malicious
3108 Hagopa.exe POST 404 52.51.129.59:80 http://os2.dipapina.com/iPadian/ IE
binary
––
––
malicious
3108 Hagopa.exe POST 404 52.50.98.206:80 http://os.dipapina.com/iPadian/ IE
binary
––
––
malicious
3108 Hagopa.exe POST 404 52.51.129.59:80 http://os2.dipapina.com/iPadian/ IE
binary
––
––
malicious
3108 Hagopa.exe HEAD 302 78.41.204.30:80 http://xpadian.com/ipadian10.exe NL
––
––
malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID Process IP ASN CN Reputation
3108 Hagopa.exe 52.214.73.247:80 Amazon.com, Inc. IE malicious
3108 Hagopa.exe 54.246.196.116:80 Amazon.com, Inc. IE malicious
3108 Hagopa.exe 52.50.98.206:80 Amazon.com, Inc. IE malicious
3108 Hagopa.exe 52.51.129.59:80 Amazon.com, Inc. IE malicious
3108 Hagopa.exe 78.41.204.30:80 Snel.com B.V. NL unknown

DNS requests

Domain IP Reputation
rp.dipapina.com 52.214.73.247
52.30.49.225
malicious
info.dipapina.com 54.246.196.116
18.203.190.76
34.254.168.23
malicious
os.dipapina.com 52.50.98.206
52.51.129.59
52.212.215.62
malicious
os2.dipapina.com 52.51.129.59
52.50.98.206
52.212.215.62
malicious
xpadian.com 78.41.204.30
unknown
survey-smiles.com 127.0.0.1
whitelisted

Threats

PID Process Class Message
3108 Hagopa.exe Misc activity ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M2
3108 Hagopa.exe Misc activity ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M1
3108 Hagopa.exe Misc activity ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M3
3108 Hagopa.exe Misc activity ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M4

4 ETPRO signatures available at the full report

Debug output strings

No debug info.