Malware Analysis Report

2024-10-23 21:19

Sample ID 220625-dghrsadha3
Target ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b
SHA256 ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b
Tags
hawkeye_reborn keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b

Threat Level: Known bad

The file ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b was found to be: Known bad.

Malicious Activity Summary

hawkeye_reborn keylogger persistence spyware stealer trojan

HawkEye Reborn

Sets file execution options in registry

Drops startup file

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-06-25 02:58

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-06-25 02:58

Reported

2022-06-25 03:14

Platform

win7-20220414-en

Max time kernel

152s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe"

Signatures

HawkEye Reborn

keylogger trojan stealer spyware hawkeye_reborn

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbampt.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbampt.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbampt.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instup.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ThumbnailExtractionHost.url C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A bot.whatismyipaddress.com N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1260 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe

"C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 bot.whatismyipaddress.com udp

Files

memory/1260-54-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

memory/1892-55-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1892-57-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1892-62-0x000000000048B2BE-mapping.dmp

memory/1892-63-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1892-64-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1260-66-0x0000000000370000-0x00000000003FB000-memory.dmp

memory/1892-67-0x0000000074090000-0x000000007463B000-memory.dmp

memory/1892-68-0x0000000074090000-0x000000007463B000-memory.dmp

memory/1892-69-0x0000000074090000-0x000000007463B000-memory.dmp

memory/1244-72-0x0000000000090000-0x0000000000120000-memory.dmp

memory/1244-77-0x000000000011B2BE-mapping.dmp

memory/1244-78-0x0000000000090000-0x0000000000120000-memory.dmp

memory/1244-79-0x0000000000090000-0x0000000000120000-memory.dmp

memory/1244-81-0x0000000074080000-0x000000007462B000-memory.dmp

memory/1244-82-0x0000000074080000-0x000000007462B000-memory.dmp

memory/1560-90-0x000000000048B2BE-mapping.dmp

memory/1560-94-0x0000000074090000-0x000000007463B000-memory.dmp

memory/1560-95-0x0000000074090000-0x000000007463B000-memory.dmp

memory/1560-96-0x0000000074090000-0x000000007463B000-memory.dmp

memory/1456-104-0x000000000048B2BE-mapping.dmp

memory/1456-105-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1456-106-0x0000000000400000-0x0000000000490000-memory.dmp

memory/1456-108-0x0000000074080000-0x000000007462B000-memory.dmp

memory/1456-109-0x0000000074080000-0x000000007462B000-memory.dmp

memory/1400-117-0x000000000048B2BE-mapping.dmp

memory/1400-121-0x0000000074090000-0x000000007463B000-memory.dmp

memory/1400-122-0x0000000074090000-0x000000007463B000-memory.dmp

memory/1696-130-0x000000000011B2BE-mapping.dmp

memory/1696-134-0x0000000074080000-0x000000007462B000-memory.dmp

memory/1696-135-0x0000000074080000-0x000000007462B000-memory.dmp

memory/1020-143-0x000000000048B2BE-mapping.dmp

memory/1020-147-0x0000000074090000-0x000000007463B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-06-25 02:58

Reported

2022-06-25 03:16

Platform

win10v2004-20220414-en

Max time kernel

160s

Max time network

170s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe"

Signatures

HawkEye Reborn

keylogger trojan stealer spyware hawkeye_reborn

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbampt.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instup.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbampt.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instup.exe\Debugger = "rundll32.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ThumbnailExtractionHost.url C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A bot.whatismyipaddress.com N/A N/A
N/A bot.whatismyipaddress.com N/A N/A
N/A bot.whatismyipaddress.com N/A N/A
N/A bot.whatismyipaddress.com N/A N/A
N/A bot.whatismyipaddress.com N/A N/A
N/A bot.whatismyipaddress.com N/A N/A
N/A bot.whatismyipaddress.com N/A N/A
N/A bot.whatismyipaddress.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2140 set thread context of 2644 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 set thread context of 4088 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 set thread context of 3008 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 set thread context of 4856 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 set thread context of 2728 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 set thread context of 1420 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 set thread context of 3620 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 set thread context of 4348 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2140 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2140 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe

"C:\Users\Admin\AppData\Local\Temp\ee9a1d78f2e0d7d33d7ca9cdffcdc8bc55cff875ec1d3a969803b373c502824b.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

Network

Country Destination Domain Proto
DE 193.122.6.168:80 tcp
NL 104.110.191.140:80 tcp
NL 104.110.191.140:80 tcp
NL 87.248.202.1:80 tcp
NL 87.248.202.1:80 tcp
US 8.8.8.8:53 bot.whatismyipaddress.com udp
US 8.8.8.8:53 bot.whatismyipaddress.com udp
US 8.8.8.8:53 bot.whatismyipaddress.com udp
US 8.8.8.8:53 bot.whatismyipaddress.com udp
US 8.8.8.8:53 bot.whatismyipaddress.com udp
US 8.8.8.8:53 bot.whatismyipaddress.com udp
US 8.8.8.8:53 bot.whatismyipaddress.com udp
US 8.8.8.8:53 bot.whatismyipaddress.com udp

Files

memory/2644-130-0x0000000000000000-mapping.dmp

memory/2644-131-0x00000000007C0000-0x0000000000850000-memory.dmp

memory/2140-136-0x0000000003AD0000-0x0000000003B5B000-memory.dmp

memory/2644-137-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/2644-138-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/2644-139-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/4088-140-0x0000000000000000-mapping.dmp

memory/4088-141-0x0000000000170000-0x0000000000200000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegAsm.exe.log

MD5 8faf48455ffc017246b08e89f6ba1956
SHA1 2f6c39d9828b3f95dc050f52a38cd7d3f543baf8
SHA256 9a643ce75fdfe840ea158010f28f8520bea2a60220494b44a25039a2a318fc35
SHA512 dafd4f1bf894ef1c61ff65dbcb8d5a151b33d8e39f3e354e6e433c8c7c0e8c2105615bffde8d796e361b77ccbe917a70ca4d03cc8cb6396f0495ff9e5b7010a9

memory/4088-147-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/4088-148-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/4088-149-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/3008-151-0x0000000000400000-0x0000000000490000-memory.dmp

memory/3008-150-0x0000000000000000-mapping.dmp

memory/3008-156-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/3008-157-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/3008-158-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/4856-159-0x0000000000000000-mapping.dmp

memory/4856-165-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/4856-166-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/2728-167-0x0000000000000000-mapping.dmp

memory/2728-173-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/2728-174-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/2728-175-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/1420-176-0x0000000000000000-mapping.dmp

memory/1420-182-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/1420-183-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/1420-184-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/3620-185-0x0000000000000000-mapping.dmp

memory/3620-191-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/3620-192-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/3620-193-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/4348-194-0x0000000000000000-mapping.dmp

memory/4348-195-0x0000000000150000-0x00000000001E0000-memory.dmp

memory/4348-200-0x00000000743C0000-0x0000000074971000-memory.dmp

memory/4348-201-0x00000000743C0000-0x0000000074971000-memory.dmp